Skip to content
/ permute Public

Source code for the permute challenge from 35c3 CTF.

Notifications You must be signed in to change notification settings

kokjo/permute

Repository files navigation

Tl;DR
1. Replace FLAG (note: size limitations)
2. Duild using ./build.sh
3. If modifying the 'inner crackme' see LIMITATIONS.

This is a program which be disassemble itself into basicblocks and reassemble itself using a new order of the basicblocks.
The order of the basicblocks can hold state. The number of bits which we can encode is propotional to the number of basicblocks.
This is used in the functions 'setup' and 'crackme' to encode the flag into the permutation of basicblocks.

Note: 'setup_func' is a function pointer to 'setup', but setup will set it to NULL on first execution.

Please replace the FLAG variable in Makefile.

Dockerfile is the build environment. 
build.sh build the challenge inside the build environment and copies it out of the docker.
Dockerfile.run is an environment in which the binary can be executed. It can be handed out as a part of the challenge.
Makefile is executed inside the docker build environment by build.sh. Building using the Makefile outside of docker is not recommended.

The flag validation can be changed by replacing 'setup' and 'crackme', the current flag validation is quite simple compared to the rest of the challenge.

LIMITATION:
    - No function pointers. The disassembler cannot detect them, and the function will be deadcode. Ẃhich makes the function pointer invalid.
    - No jumptables. These are essentially function pointers.
    - No optimisations. I don't know why this breaks stuff, but it does.
    - The code size will be larger after first execution. Please make the variable 'zeroes' in main.c big enough.
    - main must the the first function of the program. Do not change the ordering of the functions or in the SOURCES variable in the Makefile.

About

Source code for the permute challenge from 35c3 CTF.

Topics

Resources

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published

Languages