BreizhCTF 2024 - New World

May 23, 2024

This year, BreizhCTF had a nice MISC challenge that asked us to emulate various shellcodes from multiple architectures. Altough the author hinted us to use Unicorn to do so, I choosed to use miasm. This challenge was really straightforward, and minimal code is required to get the flag.

Poking around with the server reveals that 4 different architectures are used in given shellcodes :

  • x86_64
  • x86
  • arm32
  • AArch64

All we need to do is to create an emulator using miasm’s jitter, and give it the proper Machine. The jitter will be abstracting the architecture for us:

archs = {
    b'x64': 'x86_64',
    b'x86': 'x86_32',
    b'ARM32': 'arml',
    b'AArch64': 'aarch64l'

Machine(archs.get(arch, None))
jit = machine.jitter(LocationDB())

Two memory areas are required when using the jitter:

  • an executable page that will be holding our shellcode ;
  • a valid page that our stack based registers can point to.

This can be achieved thanks to the vm.add_memory_page call, which as far as I know is the only part of miasm written in pure C, with python bindings on top of it.

Now execute the shellcode, rinse and repeat !

Here is the full code.

from miasm.analysis.machine import Machine
from miasm.core.locationdb import LocationDB
from miasm.jitter.csts import PAGE_EXEC, PAGE_READ, PAGE_WRITE
from pwn import *
context.log_level = 'debug' 

archs = {
    b'x64': 'x86_64',
    b'x86': 'x86_32',
    b'ARM32': 'arml',
    b'AArch64': 'aarch64l'

conn = remote('',31129)

def round(conn):
    conn.recvuntil('registres ')
    regs = conn.recvuntil('apr\xc3\xa8s ex\xc3\xa9cution du code assembleur ').split(b'apr')[0].replace(b' ',b'').split(b',')
    arch = conn.recvuntil(' ')[:-1]
    conn.recvuntil(': ')
    payload = conn.recvline(keepends=False)
    b = b''.join([bytes([ord(b)]) for b in payload.decode('unicode_escape')])
    payload = b

    Machine(archs.get(arch, None))
    jit = machine.jitter(LocationDB())
    jit.stack_size = 0x1000
    jit.set_trace_log(trace_instr=False, trace_new_blocks=False, trace_regs=False)
    jit.vm.add_memory_page(0x1000, PAGE_READ | PAGE_WRITE | PAGE_EXEC, b'\x00' * 0x1000)
    jit.vm.add_memory_page(0x2000, PAGE_READ | PAGE_WRITE | PAGE_EXEC, payload + b'\x00' * (0x1000 - len(payload)))
    jit.vm.add_memory_page(0x3000, PAGE_READ | PAGE_WRITE | PAGE_EXEC, b'\x00' * 0x10000)
    jit.run_until(0x2000 + len(payload), trace=True)
    v = ''
    for i, reg in enumerate(regs):
        v += f'0x{(getattr(jit.cpu, reg.decode().upper())):02x}'
        if i+1 != len(regs):
            v += ','
    return True