Jump Oriented Programming: Ethereum Smart Contract #2 - Real World CTF 2018

[@xiaohangyu6343]

Glad you enjoy it and great explanation! This was a great birthday&christmas gift, especially the drawings lol(wait where's my glasses). BTW Monica wants to say "You beat me! :D"

[@soneomeelse]

前排膜首席。。tql

[@dzolti]

Sir, you are indeed an evil genius 😈

[@45640uberfreak]

As someone who knows a bit of assembly, and a bit about Ethereum smart contracts: wtf did I just watch. This challenge is insane, nice work figuring it out!

[@thomas.n.jordan5093]

Thanks for the Christmas Gift. The only way to be festive this time of year is to watch some good ol’ LiveOverflow.

[@RisingMooon]

i barely understood a thing but still watched it, oh well

[@billigerfusel]

As a full time programmer, don't worry, I didn't understand anything either.

[@dennisbarzanoff9025]

lol, so did I xd

[@invigale]

I can't believe people actually do this casually.

[@HACKINGWITHLINUX]

same lmao

[@parpid]

Amazing explanation. I didnt know much about smart contracts before, but I feel you've improved the internet's collective knowledge by a huge amount! Kudos for Christmas :)

[@humanflybzzz4568]

Hiya Live, I admire the honest and clean approach your channel is still maintaining. Love you man, keep on the good work learning and teaching at the same time is the best, especially for the noobs like me :)

[@chi221]

This may be the best Christmas present I've gotten today. Merry Christmas and a Happy New Year to everyone!

[@Troxilitis]

Sweet video, I too fell out with the detail. But you know, this was probably the most enjoyable video I've seen from you. Mainly because you sounded so determined to nail it and got excited nearing the end. Congratulations

[@TheOamaok]

I'm not sure if you've included those reaction drawings before, but they were a nice touch. interesting video once again.

[@yinge101]

LiveOverflow face reveal?!! :P

[@leo0o0o0]

What a satisfying journey for me, watching your struggling process and the bingo process. So damn good. Would you consider making another video which you recreates the challenge as if you were the challenge author?

[@tolosthesecond]

Man, those drawings just keep getting better and better. I love it!

[@小张同学-v6i]

wow...so incredible.. normally i dont watch youtube...but this video makes me glued...thanks and merry christmas!!!

[@SonicD007]

Wow that was a great explanation! Thank you for the video, it always helps fill in knowledge gaps during the struggle to learning application analysis. Happy Holidays!

[@L0j1k]

Merry Chrimbus and thanks for the Chrimbus GIF. Excellent CTF!

[@honkatatonka]

Wow. Just mad respect to you for digging into this in such depth in such short time. I'm now scared for live, writing evm code just when thinking about function signature collision O_O

[@zCri]

i dont even know eth but i still enjoy watching your videos

[@mbebeli]

What editor/viewer is he using to display the assembly code at 13:08 ?

[@alphafundava5819]

Don't study solidity, just watch these two videos on repeat.

[@d3line]

Delightful task, congratulations for solving it!

[@tobiumevolume9890]

Hey LiveOverflow, are you gonna be at the 35C3?

[@X3eRo0]

I am fucken playing 35c3 CTF junior

[@tobiumevolume9890]

Im gonna try too, even tho i know im not gonna solve shit 😂

[@KanalMcLP]

If you'd read his twitter, you'd know :D

[@mindtropy]

look at the team list, ALLES!

[@AquilaSornoAranion]

Great work! Love this kind of videos. Merry Christmas!

[@adokce]

could you record your audits of a popular (or other interesting open source) smart contracts. this was so cool and I enjoyed both of the videos

[@ruudcools2866]

whoooow what a great explanation. To be honest, i'm not there yet. However, I do got one question already. At the end you mention you gained professional insights and knowledge. My question is, given your efforts, who would have the same experience and insights you have. To rephrase, why not hire you on the spot given your gained knowledge. To rephrase again, how many would resolve this ctf and can tell me how they did it in such clear insights.

[@rj_2190]

Incredible job, this was very informative and enjoyable

[@ptr6000]

I was really exited for part 2 of this series! I only had some basic knowledge of ethereum smart contracts but you explained everything pretty good. It's quite bizarre that smart contracts allow inline assembly. A bit too 'low level' in my opinion. Hope you keep up your good work! Would you say that your experience with CTFs help you generally in your career? I personally love to look into 'implementations' of copy protections, licence validations or 'trial-periods' but I don't really know how to make money of it. (At the moment I do regular software development work) Viele Grüße aus 🇦🇹

[@TheClubPlazma]

Very advanced ,You're genius love your channel thank you

[@alkeryn1700]

A question i have though, when doing CTFs you know there is a vuln to be found But when working for someone you don't know if there even is one and that's why you are here, so do you get paid if you didn't found any and at what point do you stop searching for a vuln in a particular software ?

[@LR-qt7fx]

Will you be on the 35C3?

[@TheDelneg]

Kinda proud of myself for kinda understanding it

[@quantumbracket6995]

0:43 I want to see a liveoverflow anime!!!!

[@NoNameAtAll2]

This is cartoon, not anime

[@1e1001]

@@NoNameAtAll2 anime-styled cartoon maybe

[@aa301875]

I wanna ask: Is metasploit using pwn to remote exploit? I'm new to pwn in ctf.

[@lacno29]

What a Christmas Present! Thanks for the video

[@ncflg7667]

Great video and definitely not a waste of time! At the end of the video you mentioned that you also do smart contract audits, how do you get your audit work? Do you use a specific platform or do people contact you because they know you?

[@froozynoobfan]

I understood .001%, i learned alot.

[@jojo-fp1zv]

Are you present on the amazing CCC Kongress in Leipzig?

[@davenezrapappas4589]

Congrats on CTF and figuring this out! Love ya man..... Ya.... No....... Anyway guten Christmas!

[@c1berspace469]

hauptsache guten xD

[@subzero3499]

SO is Ethereum still a good buy ?

[@user-lz2oh9zz4y]

best Christmas gift!

[@board9919]

Great Video Merry X-mas

[@gwnbw]

Nice bro, you dont give up that easily :)

[@john80944]

Love your video. This is really amazing.

[@Underjobbed]

Yes!! Part 2! You made my day

[@MinhazTaher]

i dont understate most of you said ..(yes i am a super noob) but i like your cool animation ..so funny :)

[@andreab5185]

Always the best!

[@ADILKHAN-er9tp]

Please make a video on satellite tv smartcard cloing. It's possible????

[@MarKac9090]

please more simple video about smart contract reversing and reviewing

[@AlexVasiluta]

Merry Christmas!

[@PATTHECATMCD]

Conditional jumps... nightmare to debug without the right tools. Things haven't changed much I guess, just more people "frown" on learning the techniques to make code more transparent in general.

[@SamyKalem]

Very well explained!

[@DingleFlop]

You're so cute. Thank you for the Christmas upload. Happy holidays!

[@cntrix2047]

This was really interesting!

[@BfhChaosXX]

Why did you pad with 4848? I was so sure I found a cute little easteregg in the video, but G is 0x47, so no GG... Meine Trauer lässt sich nicht in Worte fassen :p

[@ichimurayoshie3603]

Nice, thanks for Christmas presents

[@amyshaw893]

i have no idea whats going on, but its LO so im happy

[@gladdos833]

i keep watching your videos eventho i understand like 5% of it lmao

[@rahulbansode1537]

That's more than what I understand

[@HA7DN]

So, they released a fake source code to confuse you?

[@MatthijsvanDuin]

Saying _as part of the contest description_ that you should obtain the source code of the contracts via the provided web service, and then having it serve different code than the actual contracts seems like real bullshit to me.

[@LiveOverflow]

No its not. Though there is a clever backdoor technique involved

[@MatthijsvanDuin]

​@@LiveOverflow "its not" ? As far as I can tell from your talk, there was a clear mismatch between the source code of the AcoraidaMonicaGame contract, provided to you by the web service specified in the contest description, and the actual bytecode of that contract. Specifically the bytecode contained a backdoor in TheAnswerIs, while the provided source code did not. Am I missing something?

[@soneomeelse]

@@MatthijsvanDuinThe `asm` thing partly overrides the pseudo code, making it a totally different function binary-wise.

[@MatthijsvanDuin]

@@soneomeelse I'm not talking about any runtime behaviour, I was talking about the bytecode as it appeared in the transaction on the blockchain that created the contract. When I compile Logger or LoggerAgent with optimization enabled, the resulting bytecode exactly matches the hexdumps of the actual transactions that created the contracts (as shown in the previous video, around the 15 minutes in). For AcoraidaMonicaGame however the bytecode and source code are totally different.

[@arvindpunk]

13:57 0x0fe6 though.

[@DonatStratos]

Great content, as always! Just a quick off-topic question: I have a SafePal wallet with USDT, and I have the seed phrase. (alarm fetch churn bridge exercise tape speak race clerk couch crater letter). How can I transfer them to Binance?

[@Davi-c4q]

8:45 me every time I try to do something new

[@aliqandil]

Gave up at min 3! I'll be back when I know more! bye :3

[@chrisjones6945]

LiveOverflow: 'But that was wrong because like I said, I'm so dumb' Me (Struggling to even comprehend what's going on): ...

[@ir4640]

I didn't understand a thing , what area of computer science is this

[@kjs628]

reverse engineering

[@LKRaider]

You should call Wozniak to explain it to you.

[@ncflg7667]

You forgot to add the python file debug_trace.py to the source code

[@gr4y_gh0st91]

It's really a hard CTF challenge, I couldn't even continue the video

[@odynnxd]

And here I am writing php :D

[@nion456789]

Smashed the like

[@AfonsodelCB]

PLEASE stop writing the word "answer" as "anwser", you did it pretty much every time on your hand drawn text, but never on typed text xD still a great challenge and videos but god damn I saw that typo too many times to shut up about it :p

[@LiveOverflow]

Oooops

[@casperes0912]

LiveOverflow that wasn’t the anwser I expected

[@noobaroid]

Euhhh why did I subscribe ?? Donno !!... but i guess congrats on solving what i don’t know and don’t understand, and hope for more future videos that will make feel better for not being a programer or whatever you do in life !!

[@danhorus]

That was unnecessarily misguiding on the challenger's part. I feel sorry for you :/

[@minty279]

#first

[@harshant1]

even i have written a python script to find collision in function signature , ran it on public bugbounty smart contract but no luck

[@DaPorkchop_]

notification squad!

[@unknownprofile8909]

Anyone else just still trying to figure out what a smart contract even is?

[@Edwinlopez-rc7pb]

So are you bullish or bearish on eth? Lol

[@mikoajpisula6756]

Todays best gift (accept a JBL) Xd

[@josh.salles]

yaes

[@codechapter6960]

Because...COMPUTER SCIENCE

[@tuanlinhdao3389]

Same, trying to solve Rwext5 help me learn a lot about linux filesystem, before that, i dont even know wtf is linux filesystem. But it's an real obsession, i was spend like a week after that doing nothing but that challenge, even during my exam, fuck it!

[@cl0udbear]

explodierender_kopf.gif

[@nug203]

"anwser". Literally unwatchable. Seriously though that was a deeeeeep dive in Smart contracts. I never realised how in depth a eth ctf challenge could go. If only that ctf was a day longer huh 😁

[@LiveOverflow]

Hhahha

[@slonkazoid]

*9 lunix(meme) haters has disliked the video*

[@tthtlc]

frankly i wanted very much to listen to your talk, but because you have so much vulgarity in your language (which I can understand is part of your longstanding habits) i felt so embarrassed and reluctant to listen eventually, as I am always surrounded by my kids and other people, and would not like to influence them. sorry.