Basic Windows Reversing and Attacking Weak Crypto - FLARE-On 2018

[@love-hammer]

Pretty sure my coworkers wrote those function names.

[@samuel7998]

This video is an exact representation of a programmer's life. Comitting mistakes, realizing where was the mistake 2 days later...

[@Wilker_uwu]

committing and commiting lots of mistakes

[@TremereTT]

@@Wilker_uwu it's marketing. Commit a lot of mistakes and create a after sales market for support plans and update plans and off course extended warranty plans...

[@Wilker_uwu]

@@TremereTT this is why FOSS is important

[@110110010]

And this, children, is why you always write unit tests.

[@lukasriemer8038]

This is so true. Save my life every day.

[@dantenotavailable]

And why you really should run those unit tests to make sure they fail.

[@NicolaiSyvertsen]

The important thing about doing unit testing is that it forces you to break down your code into small units that can run standalone. How would you apply this to all the nested for loops that depend on each other?

[@papagunit]

And go functional to avoid nested if statements

[@thomapple]

I used a simpler approach (in my opinion); I patched the function that prints the cells and inverted the behavior. I modified the "if" conditions so that all cells were revealed by default instead of hidden. Your solution is more elegant though!

[@LiveOverflow]

Thought about that too! What did you use to modify the code?

[@dirtbikersteve]

@@LiveOverflow dnSpy probably

[@thomapple]

I used dnSpy. By the way, a colleague of mine was in your team at DEFCON and I asked him to bring me back some LiveOverflow goodies, and you gave him like dozens of stickers, thanks a lot :) maybe next time I can see you in person.

[@craftyle]

Wait, wait, wait... thete are liveoverflow stickers???

[@dafzu]

@LiveOverflow you can also use Reflexil plugin for ILSpy to manipulate IL code

[@dm4uz3]

I think it'd pretty funny how flare-on's website has no working https

[@Zihad]

Same here xD

[@coler154]

LetsEncrypt.org

[@GalaxyCatz]

It’s probably intentional so that a future flag can be extracted from their website or something

[@dm4uz3]

@@GalaxyCatz hmm didn't think about that

[@DanielSimon1995]

@@GalaxyCatz in that case they could have added a challange.flare-on.com domain without ssl.

[@NtQueryInformationProcess]

He uses 7-Zip instead of WinRAR. Best KZbinr ever.

[@chaosmagican]

WinRAR can open 7z nowadays?

[@NtQueryInformationProcess]

Yep.

[@ac130kz]

WinRAR should be used only to compress RAR. In all other use cases it sucks a big one

[@papagunit]

Izarc

[@PflanzenChirurg]

@@ac130kz i use winrar all my life, no problems so far and its fast

[@VLS-Why]

Oof, I hate when I make a silly mistake and end up with a convoluted work around. At least you learned more about the challenge

[@AmauryOrtega]

yeah, keep trying was the key here. this bug could've been found by someone else working as a team, that's why team work is so important

[@ckennedy0323]

I don't know why but I decided to do this in python. I had gotten the result similar to how you did, but no matter the combinations (where I started the count for rows and columns), I couldn't get it to work. I imported ctypes, attempted to run my found cells into a generate key function I converted from C# to python, and even fruitlessly trying to rewrite all of the logic of the game into python. Turns out, I am better at programming than I am counting. I saw your video, saw that I got the same coordinates as you, and tried again, this time counting carefully. CTFs are really hard man.

[@iliyass]

Awesome job man, keep these videos coming.

[@Romannumerals_]

"I'm so dumb" hey man, dont be so hard on yourself. You're doing amazing :)

[@nug203]

Lol, I burst out laughing at the end. Atleast you caught it in the end before a youtube comment could ruin your day. Thanks for the video liveoverflow. I loved this one!

[@kimbol496]

Great vid as always!

[@jaredmeit6127]

The first challenge had obfuscated function names?! I would have been stuck on that. You rock!

[@fireboltofdeath]

@@xorxpert I don't think you know what obfuscation is.

[@xorxpert]

Fireboltofdeath apparently you don’t know what obfuscation is. -_-. There was no obfuscation in this video period. It’s decompilations, reverse engineering. There was no obfuscated function names. Everything was plain visible as day. If it was obfuscated, it’ll be hard and challenging to read it.

[@xorxpert]

Fireboltofdeath that just shows you both don’t know nothing. That’s sad. Go continue with your daily life and don’t bother mines. I am a software engineer.

[@fireboltofdeath]

@@xorxpert Obscure: not clearly expressed or easily understood. The function names were obfuscated, because they had names to mislead the user that doesn't do what the name implies. And, I'm a programmer also, so I really don't care. Obfuscation isn't only making your code hard to read,.

[@fireboltofdeath]

obfuscate verb ob·​fus·​cate | \ˈäb-fə-ˌskāt; äb-ˈfə-ˌskāt, əb-\ obfuscated; obfuscating Definition of obfuscate 2 : CONFUSE: obfuscate the reader.

[@JordiGerrie]

Quality content as always and this one is hilarious!

[@nooneneedstoknowthis4141]

Thumbs up for leaving the bug in there! Greatly underlines the constant try and error of hacking!

[@Bar3ttGameplay]

My god, im so glad that i found your channel.

[@DSAhmed]

You're not dumb. You're a human being. And the fact that you saw it at all means you're smart.

[@hoxorious]

Like always another great video

[@jean-baptistelasselle4562]

ILSpy : The "IL" stands for "Intermediate Language", cf. "Intermediate Representation" (just love ur videos btw, hevin so much fun hackin on ur hax)

[@forgotthisone]

This. Is. High quality!

[@hosamalfishawy1635]

i don't even understand what you say , but i love to watch this videos xD

[@shans2408]

I used dnSpy which acts kind of like IDE so you can patch, run, etc dotnet. I looked up the data structure that contained the minefield matrix. Looked up the positions of the no-bomb cells. But counting the tiny row colmns was tough. Also not knowing if the colms are 0-based or 1-based index added to the trouble, so I patched the exe to not exit the game on bomb reveal. Then clicked open all the cells in the vicinity of the empty cells untill I found the right one. Then in another window I open the non-patched exe. Aligned the two fields to see where the empty-cells are. :P I was happy with my approach untill I saw yours. I loved that you could do it statically and still make it look so easy. Waiting for more videos

[@corruptbytes]

actually met some of the lead fire-eye people, and they are so cool and get to do amazing stuff in terms of RE

[@trapOrdoom]

Jesus Christ you’re good as fuck, and these vids are so needed. Why no patreon or BTC donations? Whatever I can do to make sure you keep this up.

[@lacno29]

3:38 The InitializeComponent initializes those ughh..... components! Hahahahaha

[@YezzyHD]

Man i strive to be as smart as you one day. Keep up the amazing videos!

[@pacsmile]

Holy fuck, that went from 0 to 100000 real quick, i can't even imagine what the third challenge will be like.

[@mitikox]

I've had a harder time reading c++ and binary. I usually write C#. Thank you for this video!

[@ARMADA7KSA]

What kind of reason that may make some one press dislike for such great video ?

[@alaeddine5387]

very good ! For me as a beginner this was really helpfull and I understood all of it , thanks!

[@mads7401]

In the allocate memory class, you could create a string containing the flags and then just Messagebox.Show all the flags :) I did it like this in dnspy, displays all the flags: private void AllocateMemory(MineField mf) { // Initialize our string containing the flags information string flags = ""; for (uint num = 0u; num < MainForm.VALLOC_NODE_LIMIT; num += 1u) { for (uint num2 = 0u; num2 < MainForm.VALLOC_NODE_LIMIT; num2 += 1u) { bool flag = true; uint r = num + 1u; uint c = num2 + 1u; if (this.VALLOC_TYPES.Contains(this.DeriveVallocType(r, c))) { flag = false; // Save the flag x,y coordinate in the string flags += string.Format("({0}, {1}) ", c, r); } mf.GarbageCollect[(int)num2, (int)num] = flag; } } // Display our flags string MessageBox.Show(flags); }

[@aurorans_solis]

That ending is one reason why I prefer langs where things are immutable by default :^)

[@T3sl4]

When you showed the brute force code, I immediately said to myself, "but wait, where is the copy from constants back to array2?... uh, if you say so?" D'OH! :D

[@Mir4cleMan]

Nice solution for the second challenge, I just inverted the condition that decides what image is displayed on the field so i could see all bombs.

[@jasonrobertcheney]

These are boss, slow learner these help so much.

[@tobiumevolume9890]

I dont like Fridays cause its gonna be weekend, i like them cause i get high quality content to watch!

[@xetop]

Great video, thanks !

[@trungthanhbp]

holy shit, 1st time I understand and saw your mistake init array outside the loop. That a big step, lol

[@hermanheinz33]

Very good video!

[@AlboCoder]

I didn't figure the RNG thing. Thanks for the video. I solved it the same way haha :) I just inserted the row and col I found from debugging to the input. (Click randomly and change the index calculation). I also tried to find the real safe slots but was too lazy :)

[@z1mt0n1x2]

Love listening to stuff I know absolutely nothing about xD

[@wakandaforever1254]

degga du bist so toll

[@nahidux]

the 1st channel to which i pressed bell icon

[@270jonp]

Great videos, I really enjoyed flare-on challenges and am happy to see you covering them. I do think, however, that you should revisit this problem with one of the simpler approaches for people still learning. anything that can edit a .net binary could be used to easily solve this problem. I actually ended up using Cheat engine for this as i was familiar with the tool. that said i loved seeing a more static approach to this problem, though i cant say i would want to do it myself.

[@LiveOverflow]

How did you approach this with Cheat Engine?

[@270jonp]

@@LiveOverflow Cheat Engine has a .net dissembler built into it. (or at least can pull the symbols and function names out) from there i searched for the function that triggered when i clicked on one of the tiles and found that they were all set to either 0 or 1, however the function to close the program only ran when it got a click event. So i changed all the values to positive and saw where the correct tiles were. took a picture with the snipping tool and then clicked them and got the flag. Honestly its a kinda weird way to do it and www.reddit.com/r/ReverseEngineering/ posted some much more efficient ways to do it but it was a lot of fun regardless. Also, i post a lot of criticism, but i love your work. Keep it up :) .

[@angryman9333]

@@270jonp you should've shared a video doing that, but that's too late now :) regardless great work

[@bryanjones3058]

I love doing windows reversing, I wish I knew this was happening!

[@hikaroto2791]

Actually the video end up being quite exciting even for a standard user

[@sarunint]

12:07 is priceless!

[@manudeadskinmask3435]

Wish I could do anything of that, but I'm just an electrician knowing the basics

[@TheGrimravager]

hahahahaha that ending man, all too familiar

[@estivanlombard2661]

You know this man has been in the game for a while if he uses ILspy

[@Gary-tp9dk]

Mind blowing..!!

[@danielchin1259]

The "Ohhhhhhhh" was extensively cute.

[@paulbrandt3167]

CTF 1: Open the disclosed program and copy some text CTF 2: literally run your brain around this significantly larger program for 10 hours just to realize that had you not of made one small mistake early on, you would of been done hours ago.

[@RogueWizard-v9r]

I can RE better than anyone you know. I RE so well you cant ever get to me... Its the worst but kinda the best. comforting in a way.

[@regul4rjohn]

If you think you are dumb what's left for the rest of us?! lol. Thanks for sharing!

[@mobsean]

awesome content!

[@VarunKumarB0597]

Great channel.. keep up

[@th3.Revenant]

Brain.exe has stopped working

[@Wilker_uwu]

it is easy to understand how programming works, it's like learning to play the piano or your favorite competitive game: //i say that if you press(aButton), you get... press(Button aButton) { //the note played by this button which is the note of this button. return notePlayed = note[aButton]; } //then you define that the keyword "response" is the response of pressing this button on this position. response = press(thisButton[onThisPosition]); it is really easy to understand stuff by looking at simple mechanics, but the fun is about finding out what you can do with combinations and sequences of those mechanics used here.

[@asandax6]

@@Wilker_uwu You just Made his Entire OS go offline he is not responding. System Error;

[@Wilker_uwu]

@@asandax6 throw new Error(string? message) || throw new RuntimeError(String? msg) ?

[@asandax6]

@@Wilker_uwu Ok I wrote Error String on a piece of paper and I threw it 😁. Now I am Grounded thanks to the message hitting my Mom🙁. So uh thanks.

[@Wilker_uwu]

@@asandax6 what? XD

[@prakashyadav008]

windows "NOT MY WORLD" same here. thats i reverse elf binaries and use rader2 for reversing mostly everything :)

[@TheDimaSomov]

Huh, nice bruteforce approach, I hadn't even thought about that :D Just found all this stuff about cells with no bombs (done that using calculator... I'm too dumb to copypaste the code, yep xD) Looking forward to see you working on next challenges, I'm so excited :)

[@sayyadabbas8687]

Always debug the first few loop cycles ..and watch the state of variables

[@miroslavmajer5155]

12:10 Man, if you are dumb, then I am bubbling mad comparing to you. Awesome vids!

[@IllusionEDM]

Hi! For .NET i recommend DnSpy, it's Open Source of Github.

[@WaffeFIN]

4:04 "...also, the other pictures do not have a flag" *shows a picture of a flag* ;)

[@arcticcat3040]

Vert nice drawing of the Eevee evolution ^.^

[@olivert.7192]

interesting for sure, cool video

[@nion456789]

Smashed the like

[@DrensLP]

Hi, I'd like to Start With ctfs But cant find a easy one to Start With. Do you have an idea? Thank you!

[@AhmadAlghannam]

what an alien!!!

[@Diadras]

You need a rubber duck!

[@EugeneKolo]

You'd also run into a bug in the brute force if the sorted array contained multiples of the same number. You assume the next number is greater, but it can be greater or equal than.

[@Flare03l]

Doesn't that imply the same cell is there twice? I thought it must be greater than, and that there'd be no duplicates.

[@EugeneKolo]

@@Flare03l Yeah that may be true, didn't examine it too closely/attempt the challenge myself. So I may be wrong in there being a bug :).

[@sadrien]

@@EugeneKolo there is no bug, for exactly the reason flare stated. But in another program it might have been an issue.

[@root317]

1:48 finally something i understand! 2:50 finally some c#/ .net $#!t that i know. this is going to be my episode! :D then this happens: 7:07 like wuuuuuut? XD im still 2 fuckin' young i guess lol.. :D

[@epictech1472]

What is basically happening is that the program is using a random integer as an XOR decryption key to an array of bytes, which contains the flag. Although, a seed is set, determined by cell values which are the same every time the program is started. That's what makes this weak. If you can find the cell values somehow, you can determine the seed, which then allows you to get the XOR key by generating random numbers using the seed and running an XOR decrypt operation on the array bytes.

[@morsiskoPC]

If you are over 12 years old I doubt you are too young

[@michaelepica3564]

WOW I wish I could do that thatlooks like so much fun

[@gamersunite9026]

the second one would have been easier with dnspy. you can edit the code with it

[@arnabmukherjee1580]

Now I believe that even pros can make trivial mistakes.

[@lacinaberthe6085]

My dll file coded in c++, what can i do to get all c++ code ?

[@qwkc]

I’m feeling a bit like a dumb dumb since I really only know BASICS of C++, have only gone more in depth into front end languages. What language were you coding in for your own Bruteforce/your application to print out the results?

[@LiveOverflow]

we copied the recompiled C# code, and we just added some loops for the bruteforce around it. so in this case we used C#, because that was our target ;)

[@qwkc]

LiveOverflow ah, thanks!

[@VonCarlsson]

I took VALLOC_NODE_LIMIT to mean the maximal amount of nodes allocated in the vertical.

[@greasyfingers9250]

Why use ilspy instead of the better dnspy?

[@mohdamrirazlan7879]

How about the rest of the flag...are you gonna do a walkthrough video for that?

[@catorials444]

I find CSharp really similar to java with a hint of c++.

[@fredianriko5648]

hey bro... i tried one of wesite you suggest to open before, its "w3challs.com" i have a problem on registering and login to that website... after i registered it said "registered succesfull", but there's no notification in my email, and also i tried to login to that website but always says "login/pass Error"... and after that, i tried to click "forget password feature, and i input my email address which i used to register, but the website said "your email has not been registered"... i really confused with this problem, i thought maybe i'ts some kind a test, i tried to connect to the irc channel using xchat and hexchat.. but the connection always denied. could you help me with this kind of problem i have? thanks .

[@tacokoneko]

"Many of the challenges are based on Windows, which is not really my world" but LiveOverflow.. in your Google CTF 2019 qualifier video, you used Windows to run minetest! perhaps... having some problems, with hardware-accelerated 3d rendering, on your unspecified non-Windows platform? ;)

[@fahmiirfan6923]

I've searched for malware source code in deeper web and found some. How to know if those code are a malware?

[@CalumBoal]

Read the source code?

[@MiddleboroMovement]

Dn Spy, or .net reflector would have been a much easier tool to use. You did not even have to brute force the key, that's the over complicated way to do it. Nice for content though, good stuff.

[@S1lenc31991]

That just shows me how far im away of being an good dev. Just the slightest obfuscation shreddes me

[@awes0meness123]

is it possible to decompile c++ native code?

[@CoolAppleman]

Hi at 5:25 you messed up the drawing of the rows and columns last row has 21/22/21/22/23 it should be 20/21/22/23/24

[@ari_archer]

"only 4 billion options" *it took me one f-ing year to fix a typo*

[@kice]

I always define variables const if they are not suppose to change. So I have never encountered this kind of things after I switch to python XD.

[@FetchBot]

watched this a couple times, just realized that the cell number grid example he drew i missing 20 5:20

[@P-G-77]

"Give me a second..." any time i ear this message... my brain in automatic mode has the right response... NO RESPONSE AT ALL.

[@tmcowley]

how come it is possible to de-compile the jar executable into java code, I thought it was only possible to find the binary assembly code using something like gdb. Sorry I am a noob, pls don't roast me

[@LiveOverflow]

Java is not compiled to assembly code. Java is compiled to java bytecode (which runs in the Java VM). And that bytecode is a lot easier to decompile

[@ムワ-d7n]

need more flareon ctf :3

[@Veso266]

did you ever finish Flare-on?

[@dirtyactsatdonedirtprice4547]

where i can learn stuff like this

[@cathalpoon6341]

you use a wacom tablet? Cool every thing else not really XD just kidding keep doing what your doing man

[@arsen3783]

could you not have just compared the last four bytes of the encrypted key and undid the xor, as you already know what the key ends with edit: wait never mind, it's not the same byte xored against all of it

[@estivanlombard2661]

Lmao I love that ending

[@creature_of_fur]

That video is missing 20 seconds

[@waqarahmed4200]

yeah 1337 💓