Rating:
# sign
This was a misc challenge (might as well been re) from RCTF 2018. This one I seriously overthought. We are given a file, let's see what it is:
```
$ file sign
sign: ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=94302ea5814315714a6d91c85d25a5b0eaa43d4d, stripped
$ ./sign
Segmentation fault (core dumped)
```
So we are given a 64 bit elf that crashes when we run it. When we look at in IDA, we see that it has several issues with the binary. However we see that there is a `WinMain` function. Let's try jumping to it in gdb:
```
gdb-peda$ b *main
Breakpoint 1 at 0x11cf0
gdb-peda$ r
Starting program: /Hackery/RCTF/sign/sign
[----------------------------------registers-----------------------------------]
RAX: 0x0
RBX: 0x0
RCX: 0x0
RDX: 0x0
RSI: 0x0
RDI: 0x0
RBP: 0x0
RSP: 0x7fffffffe050 --> 0x1
RIP: 0x555555565cf0 (<main>: push rbp)
R8 : 0x0
R9 : 0x0
R10: 0x0
R11: 0x0
R12: 0x0
R13: 0x0
R14: 0x0
R15: 0x0
EFLAGS: 0x202 (carry parity adjust zero sign trap INTERRUPT direction overflow)
[-------------------------------------code-------------------------------------]
0x555555565ce0 <__stack_chk_fail@plt>:
jmp QWORD PTR [rip+0xa33a] # 0x555555570020
0x555555565ce6 <__stack_chk_fail@plt+6>: push 0x1
0x555555565ceb <__stack_chk_fail@plt+11>: jmp 0x555555565cc0
=> 0x555555565cf0 <main>: push rbp
0x555555565cf1 <main+1>: push rbx
0x555555565cf2 <main+2>: sub rsp,0x98
0x555555565cf9 <main+9>: mov rax,QWORD PTR fs:0x28
0x555555565d02 <main+18>: mov QWORD PTR [rsp+0x88],rax
[------------------------------------stack-------------------------------------]
0000| 0x7fffffffe050 --> 0x1
0008| 0x7fffffffe058 --> 0x7fffffffe38a ("/Hackery/RCTF/sign/sign")
0016| 0x7fffffffe060 --> 0x0
0024| 0x7fffffffe068 --> 0x7fffffffe3a2 ("CLUTTER_IM_MODULE=xim")
0032| 0x7fffffffe070 --> 0x7fffffffe3b8 ("LS_COLORS=rs=0:di=01;34:ln=01;36:mh=00:pi=40;33:so=01;35:do=01;35:bd=40;33;01:cd=40;33;01:or=40;31;01:mi=00:su=37;41:sg=30;43:ca=30;41:tw=30;42:ow=34;42:st=37;44:ex=01;32:*.tar=01;31:*.tgz=01;31:*.arc"...)
0040| 0x7fffffffe078 --> 0x7fffffffe974 ("LESSCLOSE=/usr/bin/lesspipe %s %s")
0048| 0x7fffffffe080 --> 0x7fffffffe996 ("_=/usr/bin/gdb")
0056| 0x7fffffffe088 --> 0x7fffffffe9a5 ("LANG=en_US.UTF-8")
[------------------------------------------------------------------------------]
Legend: code, data, rodata, value
Breakpoint 1, 0x0000555555565cf0 in main ()
gdb-peda$ j *WinMain
Continuing at 0x55555556ce46.
Program received signal SIGSEGV, Segmentation fault.
[----------------------------------registers-----------------------------------]
RAX: 0x0
RBX: 0x0
RCX: 0x0
RDX: 0x0
RSI: 0x0
RDI: 0x0
RBP: 0x7fffffffe048 --> 0x0
RSP: 0x7fffffffde08 --> 0x0
RIP: 0x55555556ce54 (<WinMain+14>: movaps XMMWORD PTR [rbp-0xc0],xmm6)
R8 : 0x0
R9 : 0x0
R10: 0x0
R11: 0x0
R12: 0x0
R13: 0x0
R14: 0x0
R15: 0x0
EFLAGS: 0x10212 (carry parity ADJUST zero sign trap INTERRUPT direction overflow)
[-------------------------------------code-------------------------------------]
0x55555556ce4b <WinMain+5>: push rsi
0x55555556ce4c <WinMain+6>: push rbx
0x55555556ce4d <WinMain+7>: sub rsp,0x228
=> 0x55555556ce54 <WinMain+14>: movaps XMMWORD PTR [rbp-0xc0],xmm6
0x55555556ce5b <WinMain+21>: movaps XMMWORD PTR [rbp-0xb0],xmm7
0x55555556ce62 <WinMain+28>: movaps XMMWORD PTR [rbp-0xa0],xmm8
0x55555556ce6a <WinMain+36>: movaps XMMWORD PTR [rbp-0x90],xmm9
0x55555556ce72 <WinMain+44>: movaps XMMWORD PTR [rbp-0x80],xmm10
[------------------------------------stack-------------------------------------]
0000| 0x7fffffffde08 --> 0x0
0008| 0x7fffffffde10 --> 0x0
0016| 0x7fffffffde18 --> 0x0
0024| 0x7fffffffde20 --> 0x0
0032| 0x7fffffffde28 --> 0x0
0040| 0x7fffffffde30 --> 0x0
0048| 0x7fffffffde38 --> 0x0
0056| 0x7fffffffde40 --> 0x0
[------------------------------------------------------------------------------]
Legend: code, data, rodata, value
Stopped reason: SIGSEGV
0x000055555556ce54 in WinMain ()
gdb-peda$
```
So that didn't work. However when we decompile the function, we see something that is quite interesting:
```
sub_12090(
a1,
a2,
L"RCTF{WelCOme_To_RCTF}\n\n\u5700\u6168\u3f74\u5920\u756f\u6420\u6365\u6d6f\u6970\u656c\u2064\u656d\u3f3f",
Globals[3]);
```
So that looks like a flag. Those hex characters after it look like ASCII, so let's use python to see what that string says:
```
>>> print "RCTF{WelCOme_To_RCTF}\n\n\x57\x68\x61\x74\x3f\x20\x59\x6f\x75\x20\x64\x65\x63\x6f\x6d\x70\x69\x6c\x65\x64\x20\x6d\x65\x3f\x3f"
RCTF{WelCOme_To_RCTF}
What? You decompiled me??
```
Yes we did decompile you. So it is clear that we have a flag. When we try it, we see that it is the correct flag. Just like that, we captured the flag.
