# ./Reverse Engineering
The challenge give a file called "bond". For RE challenge i'm using Windows Flare VM to reverse the file.
1. Initial step
Identify file type. In windows flare vm, there is a tool called Detect it Easy (DIE). This tools can help to detect file type.
Figure 1.0
Figure 1.0 above shows information for file "bond." The language used for that file is C/C++, and it uses the clang tool to compile the file. Another important information is that this file is from MacOS. So, to decompile it, you need to use suitable tools that support the MacOS file type.
2. Decompile the binanry
Ghidra supports decompiling macOS file types when compiling files. However, there is an online compiler called "decompiler explorer."
Link:
Figure 1.1
Based on Figure 2.0, this is what will happend if using decompiler explore. it gives many types of readable C code from various decompiler tools.
```c
uint64_t _xor_string(char* arg1, char* arg2, char arg3)
{
uint64_t result = _strlen(arg1);
for (int64_t i = 0; i < result; i += 1)
arg2[i] = (arg1[i] ^ arg3);
arg2[result] = 0;
return result;
}
int64_t _main()
{
int64_t x8 = *___stack_chk_guard;
int32_t var_22c = 0;
_printf("Enter A Key To Bond : ");
void var_128;
void* __s = &var_128;
_fgets(&var_128, 0x100, *___stdinp);
*(__s + _strcspn(__s, &data_100003f6f)) = 0;
char var_239 = 0x4b;
void __s1;
_xor_string(__s, &__s1, 0x4b);
if (_strcmp(&__s1, "gu\{yn\zont\v3j0f0j\n3g") != 0)
_printf("NO NO! BEGONE!!!!\n");
else
_printf("Looks like a match to me!\n");
if (*___stack_chk_guard == x8)
return 0;
___stack_chk_fail();
/* no return */
}
void ___stack_chk_fail() __noreturn
{
/* tailcall */
return ___stack_chk_fail();
}
char* _fgets(char* arg1, int32_t arg2, FILE* arg3)
{
/* tailcall */
return _fgets(arg1, arg2, arg3);
}
int32_t _printf(char const* arg1)
{
/* tailcall */
return _printf(arg1);
}
int32_t _strcmp(char const* __s1, char const* __s2)
{
/* tailcall */
return _strcmp(__s1, __s2);
}
uint64_t _strcspn(char const* __s, char const* __charset)
{
/* tailcall */
return _strcspn(__s, __charset);
}
uint64_t _strlen(char const* __s)
{
/* tailcall */
return _strlen(__s);
}
```
3. Analyzing the code.
if analyze the code, the interesting part is main() and there is "xor\_string" function. Based on the code snippet above, it is initializing the string and decrypt it with some key. These parameter are pass to the xor\_string function. to decrypt the encrypted string, we can try to brute force the xor key.
```
gu\{yn\zont\v3j0f0j\n3g
```
4. Decrypt the string
For decrypt the string, we can use cyberchef and xor brute force as a recipe.
Figure 1.2
Based on Figure 3.0, this is what it look, when brute force the xor key using cyberchef. Look on "key 03" that string look more readable then the other string. It looks like we need to decyper it again.
```
dv_xzm_ylmw_u0i3e3i_m0d
```
Since, we have no clue about the encryption use to decyper that string, we can find cipher identifier.
Link:
Figure 1.3
Based on figure 4.0, this is what it looks like when using cipher identifier. It will give a few suggestion to decyper it.
Figure 1.4
After trying a few suggestions suggested by the tools, the encrypted string was using "Atbash Cipher" to encrypt the strings. After decrypt it, we get the flag.
```
urchinsec{we_can_bond_f0r3v3r_n0w}
```
Figure 2.0
Given a file name called "vibe".
1. initial step.
Use DIE to gather information about the file.
Figure 2.1
Based on Figure 3.0, this is the only information that we have on vibe file. "binary"
This information doesnt give us so much insight about the file. After trying a few tools and researching another tool. Found an online tools to identify the file.
Link:
Figure 2.2
Based on Figure 2.2, the file description is VBscript encoded. After a few research to find tools to decode the encoded vb file, there is a python script that can decode the vb script.
Link:
Figure 2.3
Based on Figure 2.3 above, the flag obtain right away after decode the vb script using the python script. And the funny things is the challenge author for this challenge is the one who develop the vbe decoder script. Nice one !!! Learn a new thing during do this challenge.
```
urchinsec{v1bing_w1th_VBS_d8e3ca}
```
Figure 3.0
For the drift challenge, it gives a .pcap file to analyse the network. Figure 3.0 shows that, there is http packet and there is GET method that get drift file.
Figure 3.1
In the wireshark go to File > Export Object > HTTP. Then click save. Let's analyze drift file.
When clicking on hash\_password(), the MD5 function returns. This means the password will be passed to the MD5 function and encrypted in an MD5 hash.
Figure 3.4
When look around inside the main function, there is predefined\_hash.
Figure 3.5
when we click on predefined\_hash, it redirects us to the MD5 hash that could contain our flag.
Figure 3.6
Copy the hash and paste it to crackstation and we have the result.
```
urchinsec{admin_vanessa}
```
---
# Agent Instructions: Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter:
```
GET https://abdulazim.gitbook.io/write-up/urchinsec-ctf-2024/.-reverse-engineering.md?ask=
```
The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.