RaRCTF Infinite Free Trial Write Up

Details:

Jeopardy style CTF

Category: Reverse Engineering

Points: 300

Comments:

We've decided to make an app specially for flag hoarding, can you make sure no one can crack it?

NOTE: The flag is a valid registration key

Write up:

This was a bigger program so I started by finding where the string "Invalid Serial Key 1" was referenced. Doing this I found the following function:

unsigned __int64 __fastcall func(__int64 a1, int a2, __int64 a3)
{
  __int64 v3;
...
  unsigned __int64 v29; 

  v29 = __readfsqword(0x28u);
  v3 = gtk_entry_get_type(a1);
  v15 = g_type_check_instance_cast(a3, v3);
  v16 = 0LL;
  v17 = 0LL;
  v18 = 0LL;
  v19 = 0LL;
  v20 = 0LL;
  v21 = 0LL;
  v22 = 0LL;
  v23 = 0LL;
  v24 = 0LL;
  v25 = 0LL;
  v26 = 0LL;
  v27 = 0LL;
  v28 = 0;
  if ( a2 == -2 )
    goto LABEL_10;
  if ( a2 <= -2 && a2 != -4 && a2 == -3 )
  {
    v4 = gtk_entry_get_text(v15);
    v5 = *(_QWORD *)(v4 + 8);
    v16 = *(_QWORD *)v4;
    v17 = v5;
    v6 = *(_QWORD *)(v4 + 24);
    v18 = *(_QWORD *)(v4 + 16);
    v19 = v6;
    v7 = *(_QWORD *)(v4 + 40);
    v20 = *(_QWORD *)(v4 + 32);
    v21 = v7;
    v8 = *(_QWORD *)(v4 + 56);
    v22 = *(_QWORD *)(v4 + 48);
    v23 = v8;
    v9 = *(_QWORD *)(v4 + 72);
    v24 = *(_QWORD *)(v4 + 64);
    v25 = v9;
    v10 = *(_QWORD *)(v4 + 88);
    v26 = *(_QWORD *)(v4 + 80);
    v27 = v10;
    v28 = *(_DWORD *)(v4 + 96);
    if ( (unsigned int)do_crc_check(&v16) )
    {
      if ( (unsigned int)do_xor_check(&v16) )
        registered = 1;
      else
        puts("Invalid Serial Key 2");
    }
    else
    {
      puts("Invalid Serial Key 1");
    }
LABEL_10:
    v11 = gtk_widget_get_type();
    v12 = g_type_check_instance_cast(a1, v11);
    gtk_widget_destroy(v12);
  }
  return v29 - __readfsqword(0x28u);
}

I then decided to check out do_crc_check and do_xor_check:

_BOOL8 __fastcall do_crc_check(__int64 a1)
{
  int i; 

  for ( i = 0; i <= 6; ++i )
    crcout[i] = crccheck[(unsigned __int8)crc8(6 * i + a1, 6LL)];
  return memcmp(crcout, "w1nR4rs", 7uLL) == 0;
}

__int64 __fastcall crc8(unsigned __int8 *a1, int a2)
{
  unsigned int v3; 
  int i;

  v3 = 0;
  while ( a2 )
  {
    v3 ^= *a1 << 8;
    for ( i = 8; i; --i )
    {
      if ( (v3 & 0x8000) != 0 )
        v3 ^= 0x8380u;
      v3 *= 2;
    }
    --a2;
    ++a1;
  }
  return v3 >> 8;
}

For do_crc_check we take the input string, pass the string 6 bytes at a time to crc8, and use the output from that as an index for the crccheck array and add it to a string. That string then needs to equal w1nR4rs.

I also went ahead and extracted crccheck from the binary:

[0xD6, 0xD4, 0x4D, 0x46, 0x53, 0xCD, 0x3E, 0xC7, 0x41, 0x6D, 0x50, 0x8A, 0x22, 0xBF, 0x2C, 0x8E, 0x09, 0x9C, 0x01, 0x55, 0x10, 0x35, 0xF4, 0xC5, 0x6B, 0x68, 0xD8, 0x4F, 0xD5, 0x15, 0x13, 0xA8, 0x08, 0xD3, 0x42, 0x32, 0x54, 0x06, 0x94, 0xA1, 0xE0, 0xFB, 0xAD, 0xFF, 0x5F, 0x9E, 0x31, 0x82, 0x02, 0xCA, 0x1E, 0xF2, 0x4A, 0xD7, 0xE2, 0x47, 0x48, 0x66, 0x80, 0x14, 0x67, 0xDA, 0x27, 0x2D, 0x62, 0xE8, 0x40, 0x11, 0x23, 0x21, 0x84, 0x81, 0x74, 0x17, 0xBE, 0xCE, 0x9B, 0x92, 0xB5, 0x0E, 0xC6, 0xF0, 0x99, 0xF7, 0xA6, 0xDF, 0x3A, 0x76, 0xDD, 0x7C, 0xD1, 0xF6, 0xA9, 0xE9, 0xB7, 0x07, 0x97, 0x7A, 0xC2, 0x7E, 0x90, 0xB3, 0x4C, 0x30, 0x5D, 0xFD, 0x45, 0x85, 0xA3, 0x75, 0xE3, 0xF3, 0x49, 0xBD, 0x0D, 0x38, 0xB4, 0x8B, 0xB9, 0xFA, 0xAA, 0x59, 0xB2, 0x2B, 0x6A, 0xCF, 0x0B, 0xE6, 0x05, 0x63, 0x3C, 0xBC, 0xE5, 0x87, 0x79, 0x88, 0xA5, 0x03, 0x34, 0x43, 0xEF, 0x1D, 0x7D, 0x89, 0xF1, 0x58, 0x33, 0xB1, 0x78, 0x83, 0x95, 0x7F, 0xDB, 0x7B, 0xB6, 0xF5, 0x1B, 0x2F, 0xBA, 0x37, 0x8D, 0x18, 0x12, 0xD0, 0x73, 0xE7, 0x3F, 0x70, 0xA7, 0x0C, 0x0A, 0x64, 0x9F, 0x71, 0x6C, 0xAE, 0x28, 0xEB, 0x96, 0xB8, 0xA2, 0x19, 0x8F, 0x86, 0xD9, 0x0F, 0xDC, 0xC9, 0xF9, 0x39, 0x5E, 0xAB, 0x51, 0xCB, 0xC1, 0x25, 0x20, 0x65, 0x44, 0xEE, 0x5C, 0x3B, 0xA4, 0x1F, 0xCC, 0xAF, 0x29, 0xC8, 0x2A, 0x60, 0xAC, 0x61, 0x5A, 0xF8, 0x5B, 0x4B, 0x93, 0xEC, 0x8C, 0x9D, 0xA0, 0xC3, 0xDE, 0x98, 0xBB, 0x36, 0xE4, 0xEA, 0x72, 0x00, 0x3D, 0xB0, 0x24, 0x4E, 0x77, 0x6F, 0x52, 0xFE, 0xC0, 0x1A, 0x91, 0x69, 0x56, 0x2E, 0x9A, 0x16, 0xFC, 0x04, 0xE1, 0x26, 0x1C, 0x57, 0xED, 0xD2, 0x6E, 0xC4]

_BOOL8 __fastcall do_xor_check(__int64 a1)
{
  int i;

  for ( i = 0; i <= 5; ++i )
    xor_block(6 * i + a1, 6 * (i + 1) + a1, (char *)&xorout + 6 * i, 6LL);
  return memcmp(&xorout, &xorcheck, 0x24uLL) == 0;
}

__int64 __fastcall xor_block(__int64 a1, __int64 a2, __int64 a3, int a4)
{
  __int64 result;
  unsigned int i;

  for ( i = 0; ; ++i )
  {
    result = i;
    if ( (int)i >= a4 )
      break;
    *(_BYTE *)((int)i + a3) = *(_BYTE *)((int)i + a1) ^ *(_BYTE *)((int)i + a2);
  }
  return result;
}

The xor check takes the input string 12 bytes at a time, it then splits those 12 in half and xor's the two bytes from each half, saving them into xorout. It then checks this against xorcheck.

I then extracted xorcheck from the binary as well:

[0x09, 0x16, 0x17, 0x0F, 0x17, 0x56, 0x16, 0x44, 0x3A, 0x18, 0x53, 0x6F, 0x14, 0x03, 0x2A, 0x06, 0x6F, 0x31, 0x1C, 0x47, 0x2A, 0x06, 0x2D, 0x5F, 0x51, 0x1B, 0x00, 0x46, 0x4A, 0x00, 0x04, 0x55, 0x66, 0x50, 0x01, 0x4C]

Knowing all of these contraints I built the following Z3 script:

# import z3
from z3 import *

# crccheck bytes
crccheck = [0xD6, 0xD4, 0x4D, 0x46, 0x53, 0xCD, 0x3E, 0xC7, 0x41, 0x6D, 0x50, 0x8A, 0x22, 0xBF, 0x2C, 0x8E, 0x09, 0x9C, 0x01, 0x55, 0x10, 0x35, 0xF4, 0xC5, 0x6B, 0x68, 0xD8, 0x4F, 0xD5, 0x15, 0x13, 0xA8, 0x08, 0xD3, 0x42, 0x32, 0x54, 0x06, 0x94, 0xA1, 0xE0, 0xFB, 0xAD, 0xFF, 0x5F, 0x9E, 0x31, 0x82, 0x02, 0xCA, 0x1E, 0xF2, 0x4A, 0xD7, 0xE2, 0x47, 0x48, 0x66, 0x80, 0x14, 0x67, 0xDA, 0x27, 0x2D, 0x62, 0xE8, 0x40, 0x11, 0x23, 0x21, 0x84, 0x81, 0x74, 0x17, 0xBE, 0xCE, 0x9B, 0x92, 0xB5, 0x0E, 0xC6, 0xF0, 0x99, 0xF7, 0xA6, 0xDF, 0x3A, 0x76, 0xDD, 0x7C, 0xD1, 0xF6, 0xA9, 0xE9, 0xB7, 0x07, 0x97, 0x7A, 0xC2, 0x7E, 0x90, 0xB3, 0x4C, 0x30, 0x5D, 0xFD, 0x45, 0x85, 0xA3, 0x75, 0xE3, 0xF3, 0x49, 0xBD, 0x0D, 0x38, 0xB4, 0x8B, 0xB9, 0xFA, 0xAA, 0x59, 0xB2, 0x2B, 0x6A, 0xCF, 0x0B, 0xE6, 0x05, 0x63, 0x3C, 0xBC, 0xE5, 0x87, 0x79, 0x88, 0xA5, 0x03, 0x34, 0x43, 0xEF, 0x1D, 0x7D, 0x89, 0xF1, 0x58, 0x33, 0xB1, 0x78, 0x83, 0x95, 0x7F, 0xDB, 0x7B, 0xB6, 0xF5, 0x1B, 0x2F, 0xBA, 0x37, 0x8D, 0x18, 0x12, 0xD0, 0x73, 0xE7, 0x3F, 0x70, 0xA7, 0x0C, 0x0A, 0x64, 0x9F, 0x71, 0x6C, 0xAE, 0x28, 0xEB, 0x96, 0xB8, 0xA2, 0x19, 0x8F, 0x86, 0xD9, 0x0F, 0xDC, 0xC9, 0xF9, 0x39, 0x5E, 0xAB, 0x51, 0xCB, 0xC1, 0x25, 0x20, 0x65, 0x44, 0xEE, 0x5C, 0x3B, 0xA4, 0x1F, 0xCC, 0xAF, 0x29, 0xC8, 0x2A, 0x60, 0xAC, 0x61, 0x5A, 0xF8, 0x5B, 0x4B, 0x93, 0xEC, 0x8C, 0x9D, 0xA0, 0xC3, 0xDE, 0x98, 0xBB, 0x36, 0xE4, 0xEA, 0x72, 0x00, 0x3D, 0xB0, 0x24, 0x4E, 0x77, 0x6F, 0x52, 0xFE, 0xC0, 0x1A, 0x91, 0x69, 0x56, 0x2E, 0x9A, 0x16, 0xFC, 0x04, 0xE1, 0x26, 0x1C, 0x57, 0xED, 0xD2, 0x6E, 0xC4]

# xorcheck bytes
xorcheck = [0x09, 0x16, 0x17, 0x0F, 0x17, 0x56, 0x16, 0x44, 0x3A, 0x18, 0x53, 0x6F, 0x14, 0x03, 0x2A, 0x06, 0x6F, 0x31, 0x1C, 0x47, 0x2A, 0x06, 0x2D, 0x5F, 0x51, 0x1B, 0x00, 0x46, 0x4A, 0x00, 0x04, 0x55, 0x66, 0x50, 0x01, 0x4C]

# string that we check against
crcstr = "w1nR4rs"

# turn string into array of indices that get the string we want
s = []
for i in crcstr:
	for j in crccheck:
		if i == chr(j):
			s.append(crccheck.index(j))
crcstr = s

# crc8 function
def crc8(a1, a2):
	v3 = 0
	c = 0
	while a2 != 0:
		v3 ^= (a1[c] << 8)
		for i in range(8, 0, -1):
			v3 = If((v3 & 0x8000) != 0, v3 ^ 0x8380, v3)
			v3 *= 2
		a2 -= 1
		c += 1
	return v3 >> 8

# xorblock function
def xor_block(s, a1, a2, flag):
	xorout = [0] * 6
	for i in range(0, 6):
		xorout[i] = flag[a1 + i] ^ flag[a2 + i]
	s.add(xorout[0] == xorcheck[a1])
	s.add(xorout[1] == xorcheck[a1+1])
	s.add(xorout[2] == xorcheck[a1+2])
	s.add(xorout[3] == xorcheck[a1+3])
	s.add(xorout[4] == xorcheck[a1+4])
	s.add(xorout[5] == xorcheck[a1+5])

# initialize the flag
flag = [BitVec(f'flag[{i}]', 32) for i in range(0,42)]

# create solver
s = Solver()

# add contraint for characters
for i in range(0, len(flag)):
	s.add(flag[i] >= 32)
	s.add(flag[i] <= 127)

# add do_crc_check function constraints
for i in range(0, 7):
	s.add(crcstr[i] == (0xFF & crc8([flag[(i * 6)], flag[(i * 6) + 1], flag[(i * 6) + 2], flag[(i * 6) + 3], flag[(i * 6) + 4], flag[(i * 6) + 5]], 6)))

# add do_xor_check constraints
for i in range(0, 6):
	xor_block(s, i * 6, (i + 1) * 6, flag)

# Add rarctf{ as a constraint so we get the flag since there are multiple solutions
s.add(flag[0] == ord("r"))
s.add(flag[1] == ord("a"))
s.add(flag[2] == ord("r"))
s.add(flag[3] == ord("c"))
s.add(flag[4] == ord("t"))
s.add(flag[5] == ord("f"))
s.add(flag[6] == ord("{"))

# run the model
print(s.check())
m = s.model()

s = ""

# convert model to flag and print
for i in range(0, len(flag)):
	s += chr(int(str(m[flag[i]])))

print(s)

When run I got:

sat
rarctf{welc0m3_t0_y0ur_new_tr14l_281099b9}