4 ms·

Also by Matasano, and tons of fun: https://microcorruption.com https://microcorruption.com In-browser reverse engineering game.

by csdrane 12y ago

a473152 12y ago
I find using a browser to do this type of tasks intensely frustrating.
- tptacek 12y ago
  You don't need to use a browser; there's a simple JSON RPC interface.
  - showdead 12y ago
    That doesn't really do much for those of us with backgrounds that do not include Javascript / web development. Such as embedded processors, just to use an example that might be exactly the type of people who would find this challenge extra interesting. Full disclosure: I did several of these, but the browser issue is probably what kept me from doing more. It did not run in my (admittedly outdated) browser of choice, so I had to do some Chrome wrangling, which was the opposite of fun.
    - tptacek 12y ago
      What Javascript are you talking about? Anything the browser interface can do, you can do directly with raw HTTP calls. The Rails front-end is actually just a thin proxy around a JSON RPC interface exposed by the Golang emulator itself. If your point is "that's not helpful for people who don't know how to use HTTP and JSON", I'm at a loss, because the problems Microcorruption wants you to solve are much, much harder than HTTP.
      - a473152 12y ago
        Harder, but simpler (less complex). Wargames like SmashTheStack give you a Linux shell - it's much more fun this way. Just so you know, I ragequit microcorruption after three levels. Like the poster above, I know nothing about web development and have no intention of learning. The crypto challenge was really great though, thank you for that!
    - deleted 12y ago
      [deleted]
    - PeterisP 12y ago
      JSON RPC calls would be trivial to use from any scripting environment - python, perl, or ruby; even shell scripts would be an option with curl and such. Okay, if someone is hardware oriented and has never stepped outside the assembly and C world, then doing it from C isn't particularly convenient - but even with such background I would assume that most embedded processor people would know one of those scripting languages just to automate stuff in their development/testing workflow.
tptacek 12y ago
Thank you! That was Hans, me, Daniel, Andy, and (especially) Nicholas the intern. The followup we're planning to it is going to be pretty intense.
- aparadja 12y ago
  Oh dear. I already wrote an emulator for the MSP430 from scratch just to try out an approach for the current challenge's final level. And now you tell me the next one is going to be pretty intense.
- watwut 12y ago
  Can I backup my solutions on github now?
- andrewjkerr 12y ago
  I've spent the past three hours working on some of these challenges and I probably will spend a lot more time working on them too. They're a fun and friendly reminder that I should brush up on my RE skills every now and then.

Also by Matasano, and tons of fun: https://microcorruption.com https://microcorruption.com In-browser reverse engineering game.

by csdrane 12y ago

Also by Matasano, and tons of fun: https://microcorruption.com https://microcorruption.com In-browser reverse engineering game.

a473152 12y ago

I find using a browser to do this type of tasks intensely frustrating.

tptacek 12y ago
You don't need to use a browser; there's a simple JSON RPC interface.
- showdead 12y ago
  That doesn't really do much for those of us with backgrounds that do not include Javascript / web development. Such as embedded processors, just to use an example that might be exactly the type of people who would find this challenge extra interesting. Full disclosure: I did several of these, but the browser issue is probably what kept me from doing more. It did not run in my (admittedly outdated) browser of choice, so I had to do some Chrome wrangling, which was the opposite of fun.
  - tptacek 12y ago
    What Javascript are you talking about? Anything the browser interface can do, you can do directly with raw HTTP calls. The Rails front-end is actually just a thin proxy around a JSON RPC interface exposed by the Golang emulator itself. If your point is "that's not helpful for people who don't know how to use HTTP and JSON", I'm at a loss, because the problems Microcorruption wants you to solve are much, much harder than HTTP.
    - a473152 12y ago
      Harder, but simpler (less complex). Wargames like SmashTheStack give you a Linux shell - it's much more fun this way. Just so you know, I ragequit microcorruption after three levels. Like the poster above, I know nothing about web development and have no intention of learning. The crypto challenge was really great though, thank you for that!
  - deleted 12y ago
    [deleted]
  - PeterisP 12y ago
    JSON RPC calls would be trivial to use from any scripting environment - python, perl, or ruby; even shell scripts would be an option with curl and such. Okay, if someone is hardware oriented and has never stepped outside the assembly and C world, then doing it from C isn't particularly convenient - but even with such background I would assume that most embedded processor people would know one of those scripting languages just to automate stuff in their development/testing workflow.

tptacek 12y ago

Thank you! That was Hans, me, Daniel, Andy, and (especially) Nicholas the intern. The followup we're planning to it is going to be pretty intense.

aparadja 12y ago
Oh dear. I already wrote an emulator for the MSP430 from scratch just to try out an approach for the current challenge's final level. And now you tell me the next one is going to be pretty intense.
watwut 12y ago
Can I backup my solutions on github now?
andrewjkerr 12y ago
I've spent the past three hours working on some of these challenges and I probably will spend a lot more time working on them too. They're a fun and friendly reminder that I should brush up on my RE skills every now and then.