Being smart this year, not write write-up for each challenge, only the script for challenge 9, genius.
OK, this year I’m the first person who finish all flare-on challenges out of 7 from Taiwan (there’s actually an anonymous guy right behind me) and 96th (or 89th) in global ranking.
9 - evil
You should read the official write-up for details, I’m only to explain my python script for deobfuscating the binary here.
First, use python to implement the equivalent of the hash function in binary for searching specific API:
hash.py
import ctypes import sys
a = sys.argv[1].encode()
v18 = 64 for i in range(len(a)): v18 = ctypes.c_uint32(a[i] - 0x45523F21 * v18).value
print(hex(v18))
Use the script above to generate the corresponding hash of Windows APIs, known_hash.py is available on github:
Finally, because IDA Pro can determine the prototype of a function by matching the function’s name. By creating a dummy section which used to place name of API . Then, replace all operations those causing the binary trap to vectored exception handler with call operation which points to the real API names in dummy section to make the decompile result easy to read. But due to the nature of IDA Pro, one have to run the again function and explicitly mark some data as code in IDA Pro multiple times:
