# polictf: John the Packer

----------
## Challenge details
| Contest | Challenge | Category | Points |
|:---------------|:--------------|:----------|-------:|
| polictf | John the Packer | Reversing | 350 |

>*John's greatest skill is to pack everything and everywhere with everyone. He doesn't want that someone reverse his super secret program. So he wrote a magic packing system. Can you show to John that his packing system is not a good anti->reversing solution? N.B. Unfortunately John The Packer has multiple solution, so if you have a solution that is not accepted by the scoreboard (but is accepted by the binary) please contact an OP on IRC*

----------

## Write-up
### Reversing

Fire up IDA, close to the entry point we see

>```asm
>.text:08048633 push eax
>.text:08048634 mov edx, [edx]
>.text:08048636
>.text:08048636 loc_8048636: ; CODE XREF: .text:0804863C?j
>.text:08048636 xor [eax], edx
>.text:08048638 add eax, 4
>.text:0804863B dec ecx
>.text:0804863C jnz short loc_8048636
>.text:0804863E pop eax
>.text:0804863F call eax
>.text:08048641 sub esp, 8
>.text:08048644 push dword ptr [ebp+0Ch]
>.text:08048647 push dword ptr [ebp+8]
>.text:0804864A call sub_804859B
>```

So, this unpacks the function pointed at by EAX, and then calls it, after it returns we go to sub_804859B, lets see what we have there.

So there we find the repacking loop:

>```asm
>.text:080485D3 loc_80485D3: ; CODE XREF: sub_804859B+3E?j
>.text:080485D3 xor [ebx], edx
>.text:080485D5 add ebx, 4
>.text:080485D8 dec ecx
>.text:080485D9 jnz short loc_80485D3
>```

So to get the unpacked binary we just NOP out the repack instruction at 080485D3, place a breakpoint at 0804863F and run it until all the functions are unpacked. Then we can use GDB-PEDA to get a memory dump of the unpacked binary. (dumpmem out all). Then to get a runnable binary we also have to NOP out the unpacking loop, because else it will try to unpack something that is not packed and crash at 0804863F.

Now that we have an unpacked readable binary we can see that the flag is checked in 3 parts. At sub_8048A42, sub_80489A9 and sub_804890B.

### sub_8048A42

Here we have:

>```asm
>.text:08048A84 cmp ebx, eax
>.text:08048A86 jz short loc_8048A8F
>.text:08048A88 mov eax, 0
>.text:08048A8D jmp short loc_8048AA0
>```

To get the first part of the flag we can place a breakpoint at 08048A84 and see our input (in EBX) being compared to flagletters (in EAX), this gives us the first part of the flag: flag{packer...}

### sub_80489A9

The second part of the flag is checked here:

>```asm
>.text:08048A06 test eax, eax ; comes from sub_08048813
>.text:08048A08 jnz short loc_8048A11
>.text:08048A0A mov eax, 0
>.text:08048A0F jmp short loc_8048A3A
>```

Now here we can see the same pattern, we need EAX to be 1 to pass the check. Now here the value in EAX comes from sub_08048813, which takes the next input character and does some strange floating-point magic on it. I solved this part by placing a breakpoint on 08048A06 and just try different characters until EAX == 1, this worked untill: flag{packer-15-4-?41=-}

### sub_804890B

The last part of the check looks like this:

>```asm
>.text:0804896F cmp al, [ebp+var_E]
>.text:08048972 jz short loc_804897B
>.text:08048974 mov eax, 0
>.text:08048979 jmp short loc_80489A4
>```

So by now we know the drill, place a breakpoint at 0804896F, and copy the flag char-by-char from the register.

The flag is flag{packer-15-4-?41=-in-th3-4ss}

Original writeup (https://github.com/dqi/ctf_writeup/tree/master/2015/polictf/reversing/john%20the%20packer).