5 ms·

Running it with pypy sped it up quite a bit and got it far enough to figure out the remaining portion of the URL.

ehsankia 7y ago
Haha, I was gonna try exactly that, but I got too lazy trying to install pypy3 on my shitty centos box. My other option was to translate it into real assembly, but that also seemed like more work that I wanted to put into it.
- aereal 7y ago
  I guessed the URL, but found nothing on it. I'm guessing the flag may be in the rest of the message to be decoded.
  - dvno42 7y ago
    Check the pngs across the domain. There is something special in at least one of them.
    - aereal 7y ago
      Already checked them out, for EXIF data, visually and also inverted colors. What I am missing? I scrapped and downloaded around 55 pngs.
      - ehsankia 7y ago
        Yeah, I found 55 profiles/pngs. Tried ordering the profiles by the image # (from 2 to 56). Noticed the profile names are also a variation of two emojis, so tried looking into binary/morse, but nothing. As the comment above implies, it seems like my approach was wrong and the answer is in one of the images I guess
        aereal 7y ago
        I checked the pictures a lot of times, maybe I'm missing something.
        aereal 7y ago
        If you'd like to whine a bit with me, join me at: ##ctfcompetition @ freenode, I'm currently under the nick caulifl0wer
        dvno42 7y ago
        I might be going the wrong way with that then. Using stegoveritas I noticed that PNG has a bunch of "ISO-8859 text, with very long lines, with no line terminators" files which isn't normal for PNGs.
- tntn 7y ago
  > My other option was to translate it into real assembly I wrote a compiler from emoji-code to amd64 (mostly because I'm more interested in compilers than reversing). It runs quite fast - prints the whole domain in ~1 min. I'd highly recommend it to people who are into assembly, it was a fun exercise.
  - archgoon 7y ago
    How did you implement the JUMP_TOP instruction? You need to jump to the x86_64 instructions that correspond to the given emoji index; did you implement a jump table?
    - tntn 7y ago
      Yeah, I put labels corresponding to the original IP throughout and used a jump table.
      - archgoon 7y ago
        That's pretty cool! I just transliterated the instructions into C macros; but i didn't bother with the jump tables. The nice thing with this approach is that you can mix vm instructions with c code freely; and get gdb support. I needed that because speeding up via C wasnt enough to decode the full URL and I still needed to do additional reversing. Was your method fast enough to get all three parts of the URL?
        tntn 7y ago
        It produces the full domain name (up to .com) in ~ 1 minute. If there is more to the url (a path, ?= parameters, etc) after the domain name, then no.
  - aereal 7y ago
    would you mind sharing this? I'd love to check it out :)
    - 7y ago

Haha, I was gonna try exactly that, but I got too lazy trying to install pypy3 on my shitty centos box. My other option was to translate it into real assembly, but that also seemed like more work that I wanted to put into it.

aereal 7y ago
I guessed the URL, but found nothing on it. I'm guessing the flag may be in the rest of the message to be decoded.
- dvno42 7y ago
  Check the pngs across the domain. There is something special in at least one of them.
  - aereal 7y ago
    Already checked them out, for EXIF data, visually and also inverted colors. What I am missing? I scrapped and downloaded around 55 pngs.
    - ehsankia 7y ago
      Yeah, I found 55 profiles/pngs. Tried ordering the profiles by the image # (from 2 to 56). Noticed the profile names are also a variation of two emojis, so tried looking into binary/morse, but nothing. As the comment above implies, it seems like my approach was wrong and the answer is in one of the images I guess
      - aereal 7y ago
        I checked the pictures a lot of times, maybe I'm missing something.
      - aereal 7y ago
        If you'd like to whine a bit with me, join me at: ##ctfcompetition @ freenode, I'm currently under the nick caulifl0wer
      - dvno42 7y ago
        I might be going the wrong way with that then. Using stegoveritas I noticed that PNG has a bunch of "ISO-8859 text, with very long lines, with no line terminators" files which isn't normal for PNGs.
tntn 7y ago
> My other option was to translate it into real assembly I wrote a compiler from emoji-code to amd64 (mostly because I'm more interested in compilers than reversing). It runs quite fast - prints the whole domain in ~1 min. I'd highly recommend it to people who are into assembly, it was a fun exercise.
- archgoon 7y ago
  How did you implement the JUMP_TOP instruction? You need to jump to the x86_64 instructions that correspond to the given emoji index; did you implement a jump table?
  - tntn 7y ago
    Yeah, I put labels corresponding to the original IP throughout and used a jump table.
    - archgoon 7y ago
      That's pretty cool! I just transliterated the instructions into C macros; but i didn't bother with the jump tables. The nice thing with this approach is that you can mix vm instructions with c code freely; and get gdb support. I needed that because speeding up via C wasnt enough to decode the full URL and I still needed to do additional reversing. Was your method fast enough to get all three parts of the URL?
      - tntn 7y ago
        It produces the full domain name (up to .com) in ~ 1 minute. If there is more to the url (a path, ?= parameters, etc) after the domain name, then no.
- aereal 7y ago
  would you mind sharing this? I'd love to check it out :)
  - 7y ago