# Flareon5 #6 Challenge : Magic

In this post I’ll try to explain how I bruteforced challenge 6 with frida.

First of all lets try to understand what binary does.

Binary will take 666 input. Follow the flow of the program, it goes to sub_402dcf after taking input from user.

In sub_402dcf, program iterates 0x21 times.

It checks size of input with 0x40. If its less than 0x40 program goes to sub_402cc7 and exits. I should avoid sub_402cc7.

Each iteration program goes to 0x605100 + 0x120*i and take somethings. Lets look at structure for first iteration (0x605100)

0x400c55,0x147,0x02,0x03,0x25,0x61385a …

Firstly it takes 0x400c55 (first region) and 0x61385a (second region) and 0x147(size) . It xors first region with second region. After that it calls first region at 0x402f06 (call rcx).

If you look at size of “A”s in rax ,it says 61 times but I entered 63 times and remember 0x2 from first structure. So 0x2 is index of string. Also see 0x3 at rsi register. After analyzing 0x400c55 it turns out 0x3 is our length.

What I learned so far.

• Key size is 69, (max number at structure 0x42+3)
• Before call rcx, program xors region by getting parameters from structure.
• Call rcx is taking length and index of strings which comes from structure.
• If its correct program goes to next iteration, so probably different function will be executed for checking input.

I tried to understand each function. I reversed 3 functions but stuck at 4th. (turns out it was base64). Then I looked at structure, and saw each function takes only 1-3 length.
So why not bruteforce it ? Since I love frida and never tried instrumentation on linux binaries lets give it a shot.

First lets learn how functions called with frida. If functions exported you can define NativeFunction with

NativeFunction(Module.findExportByName(null,'printf'), 'pointer', []);

But I will use functions that aren’t exported. So I will give pointer to NativeFunction such as:

var xor = new NativeFunction( ptr(0x402CDF), 'void', ['pointer', 'pointer', 'pointer']);

First parameter is pointer to beginning of routine. Second parameter is type of what function will return. Third parameter is types of parameter which function will accept.

Lets try it

I defined 2 functions, first one xor routine other one is where our input checked. Second routine returns int, After that I set a Interceptor to see registers before getting into function.
You can write into memory with Memory.writeS* . First parameter is pointer , second is what you want to write. You read locations as a string with readUtf8String function.
I give 7 parameter to fnc1 to see state of registers. Attach to binary with frida magic -l brute.js

So order of parameters is : rdi,rsi,rdx,rcx,r8,r9..
I used this to understand which register my parameter goes.

Now I can define functions with pointers, write strings to memory and read memory. So I have everything I need.

Before bruteforcing lets parse structure, open all functions with xor.

Define our pools with len 1, 2 and 3 for bruteforcing

Get parameters from s and bruteforce functions.

I defined fnc1 NativeFunction which checks user input.
Lastly wrap all script into

because if I dont it will timeout.

So running this script will give this.

Looks promising. BUT script couldn’t find 2 string. Even now I dont know why it doesnt find it. Maybe some register values doesnt fit idk. Since I was so close to finding first key, I tried to bypass checks and looked program at gdb.

Lets put breakpoint at after call rcx (0x402F0a) and 0x403B6C which is after all input is checked. Give string to program and if doesnt correct bypass next check by setting eax 1.

Annd whoa. After hitting 0x403b6c, you can see “Ah, there is nothi like the hot winds of He blowing in your face.” . Turns out program shuffled our input to create meaningfull string.

Googleing sentence and blanks filled with “ng “ and “ll”. This is good. If my script cant find string with len 2, I can say its “ll” , if len is 3 its “ng “.

After giving correct input to binary, without knowing what program does I attached my frida script again. And whoila again I found string. And pool of letters is same.

So I know now, each key is shuffled, and shuffled parts are same. And I can lower my pool to this :

My plan is set my frida script such that it will find correct key, send to binary, and again again.. for each key. I will use python helper for that.

I will start magic and my frida script same time. Get key from frida and send to binary.

I will wrap my frida script to timeout so it will execute after given time (70ms).

Running sol.py

It was fun to use frida. I learned a lot from this challenge. :)