Tags: binary hex 

Rating:

Description:

    Well I just loaded,
        and this is crazy,
    but here's my address,
        172.31.0.10/artisinal_assembly_0331fb4526b5ffee34f6ab66899bac0b

Running objdump on the binary showed minimal obfuscation, as well as a `main` function that seemed to do nothing more than call a bunch of functions:

    0000000000400506 <main>:
      400506:   55                      push   %rbp
      400507:   48 89 e5                mov    %rsp,%rbp
      40050a:   b8 00 00 00 00          mov    $0x0,%eax
      40050f:   e8 63 01 00 00          callq  400677 <initialize_dx>
      400514:   b8 00 00 00 00          mov    $0x0,%eax
      400519:   e8 61 01 00 00          callq  40067f <import_input>
      40051e:   b8 00 00 00 00          mov    $0x0,%eax
      400523:   e8 6c 01 00 00          callq  400694 <a_good_start>
      400528:   b8 00 00 00 00          mov    $0x0,%eax
      40052d:   e8 31 01 00 00          callq  400663 <word_realignment>
      400532:   b8 00 00 00 00          mov    $0x0,%eax
      400537:   e8 71 00 00 00          callq  4005ad <source_cx>
      40053c:   b8 00 00 00 00          mov    $0x0,%eax
      400541:   e8 5f 01 00 00          callq  4006a5 <todo_unit_tests>
      400546:   b8 00 00 00 00          mov    $0x0,%eax
      40054b:   e8 4d 01 00 00          callq  40069d <largerify>
      400550:   b8 00 00 00 00          mov    $0x0,%eax
      400555:   e8 33 01 00 00          callq  40068d <timing_offset>
      40055a:   b8 00 00 00 00          mov    $0x0,%eax
      40055f:   e8 5f 00 00 00          callq  4005c3 <finalize_xc>
      400564:   b8 00 00 00 00          mov    $0x0,%eax
      400569:   e8 4d 00 00 00          callq  4005bb <almost_there>
      40056e:   b8 00 00 00 00          mov    $0x0,%eax
      400573:   e8 61 00 00 00          callq  4005d9 <todo_reexamine>
      400578:   b8 00 00 00 00          mov    $0x0,%eax
      40057d:   e8 79 00 00 00          callq  4005fb <reticulate_splines>
      400582:   b8 00 00 00 00          mov    $0x0,%eax
      400587:   e8 42 00 00 00          callq  4005ce <timing_loop>
      40058c:   b8 00 00 00 00          mov    $0x0,%eax
      400591:   e8 65 00 00 00          callq  4005fb <reticulate_splines>
      400596:   b8 00 00 00 00          mov    $0x0,%eax
      40059b:   e8 3f 00 00 00          callq  4005df <export_results>
      4005a0:   5d                      pop    %rbp
      4005a1:   c3                      retq

Ignoring `mov %0x0,%eax`, we notice that function calls appear out of order from the function definitions, as well as `important_initialization`, which wasn't called at all:

    00000000004005a2 <important_initialization>:
    00000000004005ad <source_cx>:
    00000000004005bb <almost_there>:
    00000000004005c3 <finalize_xc>:
    00000000004005ce <timing_loop>:
    00000000004005d9 <todo_reexamine>:
    00000000004005df <export_results>:
    00000000004005fb <reticulate_splines>:
    0000000000400663 <word_realignment>:
    0000000000400677 <initialize_dx>:
    000000000040067f <import_input>:
    000000000040068d <timing_offset>:
    0000000000400694 <a_good_start>:
    000000000040069d <largerify>:
    00000000004006a5 <todo_unit_tests>:



Stepping through the instructions reveals nothing, as the program just builds the string "The answer is 42" and prints it.

Initially we thought that execution order was important, and that maybe we needed to call all the functions in the order defined in the binary, but it didn't seem like there was enough code, nor available static strings, to produce anythinge else. Additionally, the NOPs spread through the program strongly suggested that the function offsets were important.

By taking the least significant byte of each instruction argument in `main` we get:

    89 63 61 6c 31 71 5f 4d 33 5f 4d 61 79 42 65 3f

which can be converted back from hex to get:

    $ echo -n '89 63 61 6c 31 71 5f 4d 33 5f 4d 61 79 42 65 3f' | xxd -r
    cal1q_M3_MayBe?

Answer:

    cal1q_M3_MayBe?