dc2019q-vitor-public

KO | EN

gitlite — search

#javascript #hacktoberfest #ai #typescript #golang #go #machine-learning #rust #java #nodejs #windows #cli #kubernetes #ios

dc2019q-vitor-public

(★ 10)

No description available.

dc2019q-vitor-public Latest Version Download

Download Latest Version (.zip)

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# Vitor

Matryoshka-style Android reversing chall.

The app had several (encrypted) stages. Each stage would decrypt the next stage and execute it. The stages had all different nature:
- P0: main app
- P1: DEX code
- P2: .so code
- P3: shellcode
- P4: ROP
- P5: JavaScript

More info:
- The JavaScript payload would then modify a static variable in P0, marking the flag as valid.
- It was possible to determine the decryption key of each stage because 1) the key space was 31 bits, 2) it was clear what the next stage would look like. P1 and P2 required bruteforcing (and checking for magic bytes of DEX and ELF). The remaining ones didn't (e.g., a comment in the app made clear that the shellcode started with a nop sled, P5 needed to start with "<html>", etc.)
- All the encryption keys are derived from the input flag. The right encryption keys would give enough constraints to recover the flag.

# Build

- Check `build.sh` for building the various stages and assemble the final Vitor app.
- You need to run this script within a python virtual environment (`pip install -r requirements.txt`).
- You need to have installed Android Studio / SDK / NDK / etc.

dc2019q-vitor-public

dc2019q-vitor-public Latest Version Download

Today's picks

Was this content helpful?

Recent Feedback

dc2019q-vitor-public

dc2019q-vitor-public Latest Version Download

Today's picks

Was this content helpful?

Recent Feedback

Download README