Rating:
# Internetwache CTF 2016 : File Checker
**Category:** Reversing
**Points:** 60
**Solves:** 190
**Description:**
> Description: My friend sent me this file. He told that if I manage to reverse it, I'll have access to all his devices. My misfortune that I don't know anything about reversing :/
>
>
> Attachment: [rev60.zip](./rev60.zip)
## Write-up
For first, we checked what file is it
> filechecker: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 2.6.32, BuildID[sha1]=564c7e61a18251b57f8c2c3dc205ed3a5b35cca6, stripped
So we have 64-bit linux binary, that after launch prints
```
./filechecker
Fatal error: File does not exist
````
So app want file, we checked filename
```
400666: 55 push rbp
400667: 48 89 e5 mov rbp,rsp
40066a: 48 83 ec 30 sub rsp,0x30
40066e: 89 7d dc mov DWORD PTR [rbp-0x24],edi
400671: 48 89 75 d0 mov QWORD PTR [rbp-0x30],rsi
400675: b8 00 00 00 00 mov eax,0x0
40067a: e8 e1 00 00 00 call 400760 <fopen@plt+0x200>
40067f: 85 c0 test eax,eax
400681: 75 19 jne 40069c <fopen@plt+0x13c>
400683: bf d8 08 40 00 mov edi,0x4008d8
400688: b8 00 00 00 00 mov eax,0x0
40068d: e8 7e fe ff ff call 400510 <printf@plt>
400692: b8 01 00 00 00 mov eax,0x1
400697: e9 c2 00 00 00 jmp 40075e <fopen@plt+0x1fe>
40069c: be f9 08 40 00 mov esi,0x4008f9
4006a1: bf fb 08 40 00 mov edi,0x4008fb // password string addr
4006a6: e8 b5 fe ff ff call 400560 <fopen@plt>
```
At `0x4008fb` was placed `.password` string, so we have filename.
Without analyzing whole file, we have seen that if variable from `[rbp-0x4]` will be equal or lower than 0, `Congrats` will be printed to stdout.
```
40072c: 83 7d fc 00 cmp DWORD PTR [rbp-0x4],0x0
400730: 7e 11 jle 400743 <fopen@plt+0x1e3>
400732: bf 20 09 40 00 mov edi,0x400920 // Error Wrong Characters string
400737: e8 b4 fd ff ff call 4004f0 <puts@plt>
```
```
400743: 48 8b 45 f0 mov rax,QWORD PTR [rbp-0x10]
400747: 48 89 c7 mov rdi,rax
40074a: e8 b1 fd ff ff call 400500 <fclose@plt>
40074f: bf 38 09 40 00 mov edi,0x400938 // Congrats string
400754: e8 97 fd ff ff call 4004f0 <puts@plt>
```
Value at `[rbp-x04]` depends on function at `0x40079c` so we reversed this function...
```
40079c: 55 push rbp
40079d: 48 89 e5 mov rbp,rsp
4007a0: 89 7d bc mov DWORD PTR [rbp-0x44],edi
4007a3: 48 89 75 b0 mov QWORD PTR [rbp-0x50],rsi
4007a7: c7 45 c0 ee 12 00 00 mov DWORD PTR [rbp-0x40],0x12ee
4007ae: c7 45 c4 e0 12 00 00 mov DWORD PTR [rbp-0x3c],0x12e0
4007b5: c7 45 c8 bc 12 00 00 mov DWORD PTR [rbp-0x38],0x12bc
4007bc: c7 45 cc f1 12 00 00 mov DWORD PTR [rbp-0x34],0x12f1
4007c3: c7 45 d0 ee 12 00 00 mov DWORD PTR [rbp-0x30],0x12ee
4007ca: c7 45 d4 eb 12 00 00 mov DWORD PTR [rbp-0x2c],0x12eb
4007d1: c7 45 d8 f2 12 00 00 mov DWORD PTR [rbp-0x28],0x12f2
4007d8: c7 45 dc d8 12 00 00 mov DWORD PTR [rbp-0x24],0x12d8
4007df: c7 45 e0 f4 12 00 00 mov DWORD PTR [rbp-0x20],0x12f4
4007e6: c7 45 e4 ef 12 00 00 mov DWORD PTR [rbp-0x1c],0x12ef
4007ed: c7 45 e8 d2 12 00 00 mov DWORD PTR [rbp-0x18],0x12d2
4007f4: c7 45 ec f4 12 00 00 mov DWORD PTR [rbp-0x14],0x12f4
4007fb: c7 45 f0 ec 12 00 00 mov DWORD PTR [rbp-0x10],0x12ec
400802: c7 45 f4 d6 12 00 00 mov DWORD PTR [rbp-0xc],0x12d6
400809: c7 45 f8 ba 12 00 00 mov DWORD PTR [rbp-0x8],0x12ba
400810: 8b 45 bc mov eax,DWORD PTR [rbp-0x44]
400813: 48 98 cdqe
400815: 8b 54 85 c0 mov edx,DWORD PTR [rbp+rax*4-0x40]
400819: 48 8b 45 b0 mov rax,QWORD PTR [rbp-0x50]
40081d: 8b 00 mov eax,DWORD PTR [rax]
40081f: 8d 0c 02 lea ecx,[rdx+rax*1]
400822: ba 33 c9 4a 35 mov edx,0x354ac933
400827: 89 c8 mov eax,ecx
400829: f7 ea imul edx
40082b: c1 fa 0a sar edx,0xa
40082e: 89 c8 mov eax,ecx
400830: c1 f8 1f sar eax,0x1f
400833: 29 c2 sub edx,eax
400835: 89 d0 mov eax,edx
400837: 69 c0 37 13 00 00 imul eax,eax,0x1337
40083d: 29 c1 sub ecx,eax
40083f: 89 c8 mov eax,ecx
400841: 48 8b 55 b0 mov rdx,QWORD PTR [rbp-0x50]
400845: 89 02 mov DWORD PTR [rdx],eax
400847: 90 nop
400848: 5d pop rbp
400849: c3 ret
```
...and write a keygen
```
#include <stdio.h>
#include <stdint.h>
int16_t tab[] = {
0x12ee, 0x12e0,
0x12bc, 0x12f1,
0x12ee, 0x12eb,
0x12f2, 0x12d8,
0x12f4, 0x12ef,
0x12d2, 0x12f4,
0x12ec, 0x12d6,
0x12ba,
};
int get_dig_for_char(int i, char cc) {
int64_t sum = cc + tab[i];
return sum-(sum*0x354ac933>>32>>0xa-(sum>>0x1f))*0x1337;
}
int main() {
char flag[30] = {0};
int f=0;
for(int i=0;i<30;++i)
for(int a = ' '; a<'~';++a)
if(get_dig_for_char(i, a) == 0)
flag[f++] = a;
printf("Flag:%s\n", flag);
}
./*
./keygen
$ Flag:IW{FILE_CHeCKa}
*/
```
Thats all, folks.
