Hacker News Reader

Comment by dysoco | Hacker News Reader

I'm on that as well, for me it seems it just decodes some Unicode characters and does arithmetic to print the message, I don't know why it's taking so long or how can I speed it up.

View on HN

It's calculating prime numbers which is why it's slow.

Now if only I was to work out which prime numbers it wants... :)

have you guys figured it out? I got stuck here too.

https://github.com/InverseIntegral/ctf_writeups/tree/master/... - great write up of the solution here

I'm having a hard time even getting it to run.

"python vm.py program" results in "SyntaxError: Non-ASCII character '\xf0' in file vm.py on line 19, but no encoding declared;"

adding the relevant encoding (# -- coding: utf-8 --) then results in "RuntimeError: Unknown instruction ''\xf0\x9f\x96\x8b\xf0\x9f\x92\xa0\xf0\x9f\x94\xb6\xf0\x9f\x8e\x8c\xf0\x9f\x9a\xa9\xf0\x9f\x8f\x81'' at 370"

I assume debugging the program is part of the challenge? Or is it just supposed to work?

Run it with python3, not 2.7X

Hints: Prime numbers, Palindromes, XOR and offset for later :)

There's a pretty simple optimization in the labels you can do, but it doesn't really help that much. The first block of letters is XORing with one set of primes that follow a common pattern, but the second one is stumping me. I let it run overnight and basically made no progress once it hit the second block.

Running it with pypy sped it up quite a bit and got it far enough to figure out the remaining portion of the URL.

Haha, I was gonna try exactly that, but I got too lazy trying to install pypy3 on my shitty centos box. My other option was to translate it into real assembly, but that also seemed like more work that I wanted to put into it.

I guessed the URL, but found nothing on it.

I'm guessing the flag may be in the rest of the message to be decoded.

Check the pngs across the domain. There is something special in at least one of them.

Already checked them out, for EXIF data, visually and also inverted colors. What I am missing?

I scrapped and downloaded around 55 pngs.

Yeah, I found 55 profiles/pngs. Tried ordering the profiles by the image # (from 2 to 56). Noticed the profile names are also a variation of two emojis, so tried looking into binary/morse, but nothing.

As the comment above implies, it seems like my approach was wrong and the answer is in one of the images I guess

I checked the pictures a lot of times, maybe I'm missing something.

If you'd like to whine a bit with me, join me at: ##ctfcompetition @ freenode, I'm currently under the nick caulifl0wer

I might be going the wrong way with that then. Using stegoveritas I noticed that PNG has a bunch of "ISO-8859 text, with very long lines, with no line terminators" files which isn't normal for PNGs.

> My other option was to translate it into real assembly

I wrote a compiler from emoji-code to amd64 (mostly because I'm more interested in compilers than reversing). It runs quite fast - prints the whole domain in ~1 min. I'd highly recommend it to people who are into assembly, it was a fun exercise.

How did you implement the JUMP_TOP instruction? You need to jump to the x86_64 instructions that correspond to the given emoji index; did you implement a jump table?

Yeah, I put labels corresponding to the original IP throughout and used a jump table.

That's pretty cool! I just transliterated the instructions into C macros; but i didn't bother with the jump tables. The nice thing with this approach is that you can mix vm instructions with c code freely; and get gdb support. I needed that because speeding up via C wasnt enough to decode the full URL and I still needed to do additional reversing.

Was your method fast enough to get all three parts of the URL?

It produces the full domain name (up to .com) in ~ 1 minute. If there is more to the url (a path, ?= parameters, etc) after the domain name, then no.

would you mind sharing this? I'd love to check it out :)

https://pastebin.com/eEuJcy18

Reply on news.ycombinator.com