DOCSEARCHbyAlgolia
Submit Docs

huanghunr's Blog

website·Indexed 31 days ago

https://blog.huanghunr.top

A technical blog featuring CTF write-ups and reverse engineering guides. Content covers challenges from CTFNewStar2024, TRXctf, VNCTF, N1CTF, GHCTF, and TPCTF, with a focus on IDA Pro, assembly language, Python bytecode, Cython, and encryption algorithms like TEA, AES, and Blowfish.

Tokens
102.7K
Snippets
304
Records
415
Agent score
52%

What's inside huanghunr

  1. Understand x86/x64 General Purpose and Special Registers

    x86 architecture utilizes several types of registers for data manipulation and memory addressing:

    General Purpose Registers:

    • EAX: Accumulator (used for operands and result data).
    • EBX: Base Register (data pointer for the DS segment).
    • ECX: Count Register (used for strings and loop operations).
    • EDX: Data Register (I/O pointer).

    Memory Pointer Registers:

    • ESI: Source Index (source pointer for string operations).
    • EDI: Destination Index (destination pointer for string operations).
    • EBP: Base Pointer (points to the bottom of the stack frame in the SS segment).
    • ESP: Stack Pointer (points to the top of the stack).

    Segment Registers:

    • CS: Code Segment
    • SS: Stack Segment
    • DS: Data Segment
    • FS, GS: Additional Data Segments
    • ES: Extra Segment

    Status and Control Registers:

    • EFLAGS: Flag register containing status bits:
      • ZF (Zero Flag): Set to 1 if the operation result is 0.
      • CF (Carry Flag): Set to 1 if there is a carry out of the highest bit.
      • OF (Overflow Flag): Set to 1 if an arithmetic overflow occurs.
      • AF (Auxiliary Carry Flag): Set to 1 if there is a carry at the 3rd bit.
      • SF (Sign Flag): Set to 1 for negative results, 0 for positive.

    Instruction Pointer:

    • EIP / RIP: Stores the address of the next instruction to be executed.

  2. Differentiate between 32-bit (E) and 64-bit (R) registers

    In x86-64 architecture, registers starting with 'r' are 64-bit (8 bytes), while those starting with 'e' are the lower 32-bit (4 bytes) portion of the same register.

    • rax is the full 64-bit register; eax is its lower 32 bits.
    • rbp is the full 64-bit register; ebp is its lower 32 bits.

    Behavioral Note: Executing mov eax, 1 sets the lower 32 bits of rax to 1 and clears the upper 32 bits to 0. However, when assigning a value to eax, the high bits of rax may be preserved depending on the specific operation context (e.g., if only the low bits are targeted without a zero-extension rule).

  3. Analyze Android dynamic loading via BroadcastReceivers

    Some Android applications implement a multi-stage encryption and loading process:

    1. The app encrypts user input via a local method (e.g., encrypt()).
    2. It downloads a remote .dex file (e.g., hook_fish.dex).
    3. It registers a BroadcastReceiver for android.intent.action.DOWNLOAD_COMPLETE to trigger the loading process once the file is available.
    4. The onReceive() method of the receiver loads the .dex file, uses reflection to call an encoding method (e.g., encode()) for secondary encryption, and finally calls a check() method to validate the result.

  4. Zhejiang Normal University Disciplinary Action Framework

    Overview of disciplinary durations, procedures, and the appeals process for students at Zhejiang Normal University.

    Disciplinary Durations:

    • Warning (警告): 3 months
    • Serious Warning (严重警告): 6 months
    • Demerit (记过): 9 months
    • Maximum Duration: No disciplinary period shall exceed 12 months.

    Key Rules:

    • Concurrent Punishments: If multiple violations occur, the heaviest applicable category is chosen.
    • Cumulative Punishments: If a new punishment is received during an existing period, the new period is added to the remaining time of the original punishment.
    • Vacation Violations: Generally processed by the beginning of the next semester.
    • Automatic Removal: Disciplinary actions are removed simultaneously if the student's registration (学籍) is cancelled.
    • Post-Removal: After a punishment is lifted, the student is no longer affected by the original punishment when seeking awards or rights.

    Appeals Process:

    • Timeline: Students may file a written appeal to the Student Appeal Handling Committee within 10 days of receiving the decision.
    • Resolution: The committee must provide a review conclusion within 15 days of receiving the appeal.
    • Notification: If the decision did not inform the student of their right to appeal, the window is 6 months from the date the student became aware of the decision.
    • Service of Notice: Documents are considered served 60 days after the public announcement.

  5. Understand Base64 encoding and decoding logic

    Base64 is a method used to represent binary data using a set of 64 printable characters.

    Encoding Process:

    1. The original binary data is split into chunks of 3 bytes (24 bits).
    2. Each 3-byte chunk is divided into four 6-bit segments.
    3. Each 6-bit segment is padded with leading zeros to make it 8 bits (1 byte) if necessary. If a segment is shorter than 6 bits, trailing zeros are added.
    4. If the original data does not align perfectly with 3-byte chunks, padding characters (=) are used to fill the remaining space.
    5. The resulting 6-bit values are used as indices to look up the corresponding characters in the Base64 alphabet table.

    Decoding Process:

    1. Characters are looked up in the Base64 table to retrieve their 6-bit indices.
    2. These indices are concatenated and converted back into 3-byte chunks to restore the original binary data.

  7. Understand Salsa20 encryption process

    Salsa20 is a stream cipher that requires the following inputs: an 8-byte random nonce, a 128-bit or 256-bit key, plaintext/ciphertext of arbitrary length, a 16-byte key expansion constant ("expand 32-byte k"), and a set of constants: [0x61707865, 0x3320646e, 0x79622d32, 0x6b206574].

    The encryption workflow is as follows:

    1. Key expansion.
    2. Arrange the expanded key, nonce, counter, and constants into a 4x4 matrix (each element is 4 bytes).
    3. Perform multiple rounds of encryption on rows and columns (processing 3 elements per group).
    4. Deconstruct the matrix into a single-byte stream (box).
    5. XOR the plaintext with this stream to produce ciphertext.

  9. x86 General Purpose and Segment Registers Reference

    Overview of common x86 registers used in assembly language:

    General Purpose Registers:

    • EAX: Accumulator (operands and results)
    • EBX: Base Register (DS segment data pointer)
    • ECX: Count Register (string and loop operations)
    • EDX: Data Register (I/O pointer)

    Pointer Registers:

    • ESI: Source Index (string operation source pointer)
    • EDI: Destination Index (string operation target pointer)
    • EBP: Base Pointer (stack bottom pointer)
    • ESP: Stack Pointer (stack top pointer)

    Segment Registers:

    • CS: Code Segment
    • SS: Stack Segment
    • DS: Data Segment
    • FS/GS: Additional Data Segments
    • ES: Extra Segment

    Memory Addressing: Segment registers store the start of a memory block. The Instruction Pointer (IP) acts as an offset relative to the segment register to locate specific memory addresses.

  10. Extract NES game flags using PPU Tile mapping

    In NES games, graphics are composed of Tiles, each with a specific index. To recover a flag displayed visually in a game, use a PPU viewer to identify the index values of the characters forming the flag. By searching for these specific Tile indices (e.g., 26, 2C, 21, 27) within the game's memory or data (such as in a hex editor like 010 Editor), you can locate the sequence of tiles used to render the flag on screen. Once the sequence is extracted, use a character mapping table to translate the Tile indices back into alphanumeric characters.

  11. Decrypt data encrypted with time-derived MD5 and AES

    In the ASM?Signin! challenge, the encryption process involves generating an MD5 hash from a specific date in 2024. The resulting MD5 value is XORed with 0x11 and 0x14. This modified MD5 is then used as a key for AES encryption. To decrypt the data, you must brute-force the possible dates in 2024 to find the correct MD5 value. Note that the encryption includes custom XOR operations (xor1 and xor2); during decryption, these XOR operations must be swapped/reversed.

  12. Analyze and decrypt oooooore challenge

    The 'oooooore' challenge employs heavy junk code (specifically jz/jnz and call/ret patterns) to obscure the main logic. The encryption process consists of two stages: an RC4 encryption followed by a Salsa20 or ChaCha20 encryption (identified by the string "expand 32-byte k").

    To solve this via dynamic analysis:

    1. Set hardware breakpoints on the input data.
    2. Trace the data changes to identify the XOR operations and the RC4 S-box usage.
    3. Write the ciphertext into memory as the input and run the program to the final encryption step to reveal the flag.
    Ciphertext: 81 ED 7E 2F 93 B6 6F 8D 43 E5 C9 11 A9 F4 2B DB AD CB 45 66 FA DF A9 61 28 65 31 D7 80 D5 18 FE 25 6E 94 05 83 51 B5 42 D2 9D