Skip to content
Branch: master
Find file History
Fetching latest commit…
Cannot retrieve the latest commit at this time.
Permalink
Type Name Latest commit message Commit time
..
Failed to load latest commit information.
IDA
src
README.md

README.md

Here is Sixology source code and some related ugly scripts on 0CTF/TCTF 2019 Quals

This is a vm reversing challenge, but without simulator.

Build Processor

Tested on 7.0 and 7.2

$ cd sixology/IDA
$ mkdir build
$ cd build
# for debug
$ cmake -DIDA_SDK_DIR="/path/to/your/idasdk" ..
# for release
$ cmake -DIDA_SDK_DIR="/path/to/your/idasdk" -DCMAKE_BUILD_TYPE=Release ..

If you are told that missing some files, find them in IDASDK.

Writeup

  1. Have some basic knowledge on IDA processor development.
  2. Get LPH in processor from export table
  3. find out notify member in LPH object
  4. locate key functions in notify via event_code (ev_ana_insn, ev_emu_insn, etc.)
  5. Figure out instruction encoding and decoding from ana function
  6. Understand vm instructions semantic in all emu analysis handlers, I've try to explain all the instructions in this vm. Follow the emu data flow and other api used at this stage (set_switch_info, add_crefs, get_dword, trace_sp, etc.), you could understand all of them.
  • HINT in source code means that here is the hint of one vm instruction.
  • You could find most of enum value and struct definition through IDA official online documents.
  • Be careful about lexcmp and exchange vm instruction, without lexcmp, it's another problem.
  1. Understand what's the program doing and optimize the algorithm.
  2. Run it and Get flag.

Thanks

  • Thanks for slipper and hen for many useful advice to this challenge.
  • Thanks for nforest and Azure for help on IDA.
You can’t perform that action at this time.