[💎 Platinum 3] 암호화된 RISC-V 멀티-VM을 복호해 flag를 역산하다 — DreamHack BumpyMM 풀이

cat run.sh; file drive0 drive1 drive2 drive3

#!/usr/bin/env bash
cd "$(dirname "$0")/extracted"
timeout 8 qemu-system-i386 -enable-kvm -cpu host,+rdrand -m 512M \
  -drive format=raw,file=drive0 \
  -drive format=raw,file=drive1,if=ide,index=1 \
  -drive format=raw,file=drive2,if=ide,index=2 \
  -drive format=raw,file=drive3,if=ide,index=3 \
  -nographic -monitor none 2>&1 | stdbuf -o0 sed $'s/\x1b\\[[0-9;?]*[JH]//g'

dd if=extracted/drive0 bs=512 skip=1 of=emu_main.bin status=none
objdump -D -b binary -mi386 -Maddr32,data32 --adjust-vma=0x10000 emu_main.bin \
  | sed -n '/10bed:/,/10c2c:/p'

# scan_floppies.py — 워드 하위 2비트가 11인 비율로 평문/암호화를 가른다
import struct, re, os
HERE = os.path.dirname(os.path.abspath(__file__))
def dens(d, a, b):
    c = t = 0
    for o in range(a, b - 4, 4):
        w = struct.unpack('<I', d[o:o + 4])[0]
        if w == 0: continue
        t += 1
        if (w & 3) == 3: c += 1
    return c / t if t else 0.0
for name in ('drive1', 'drive2', 'drive3'):
    d = open(os.path.join(HERE, 'extracted', name), 'rb').read()
    row = [f'{dens(d, b, b + 0x400):.2f}' for b in range(0, 0x1800, 0x400)]
    strs = sorted({m.group().decode('latin1') for m in re.finditer(rb'[ -~]{5,}', d)})[:4]
    print(f'{name}: op-bits=11 density/1KB {row}  strings~{strs}')

python3 scan_floppies.py

# disasm.py — capstone RV32 + auipc/addi 상대주소·rodata 문자열 주석
import sys, re, struct, capstone
code = open(sys.argv[1], 'rb').read()
full = open(sys.argv[2], 'rb').read()
start = int(sys.argv[3], 0); end = int(sys.argv[4], 0)
img = bytearray(full); img[0:len(code)] = code; img = bytes(img)
md = capstone.Cs(capstone.CS_ARCH_RISCV, capstone.CS_MODE_RISCV32)
strs = {0x3000 + m.start(): m.group().decode('latin1')
        for m in re.finditer(rb'[ -~]{3,}', img[0x3000:0x3200])}
prev = {}
a = start
while a < end:
    w = struct.unpack('<I', img[a:a + 4])[0]
    ins = list(md.disasm(img[a:a + 4], a))
    mn, op = (ins[0].mnemonic, ins[0].op_str) if ins else ('.word', '%#010x' % w)
    note = ''
    if (w & 0x7f) == 0x17:
        imm = w & 0xfffff000; imm -= 0x100000000 if imm & 0x80000000 else 0
        prev[(w >> 7) & 0x1f] = a + imm
    elif (w & 0x7f) == 0x13 and ((w >> 12) & 7) == 0:
        rs1 = (w >> 15) & 0x1f; rd = (w >> 7) & 0x1f
        if rs1 in prev and rs1 == rd:
            imm = w >> 20; imm -= 0x1000 if imm & 0x800 else 0
            t = prev[rs1] + imm; note = '; =%#x' % t
            if t in strs: note += ' "%s"' % strs[t]
    print('%06x: %-7s %-22s %s' % (a, mn, op, note))
    a += 4

python3 disasm.py extracted/drive3 extracted/drive3 0x148c 0x1530

# cipher.py 핵심 — 재구현한 블록암호와 CTR 키스트림 (sbox/키스케줄/라운드는 본문 설명과 동일)
def block_encrypt(key, inp):
    rks = key_schedule(key)
    st = bytearray(inp)
    for r in range(10):
        for i in range(16): st[i] = sbox(st[i])              # SubBytes
        w = rotl128(b2i(bytes(st)), (3 * r + 7) % 128)       # ShiftRows 류
        st = bytearray(i2b(w ^ rks[r]))                      # AddRoundKey
    return bytes(st)
 
KEY, NONCE = b'YOUHAVESECUREKEY', bytes.fromhex('deadbeefcafebabe')
def keystream_block(counter):            # 입력 블록 = nonce || ctr_hi(BE) || ctr_lo(BE)
    hi, lo = (counter >> 32) & 0xffffffff, counter & 0xffffffff
    return block_encrypt(KEY, NONCE + struct.pack('>I', hi) + struct.pack('>I', lo))

python3 kat.py

python3 disasm.py drive2_plain.bin extracted/drive2 0x774 0x814

python3 disasm.py drive2_plain.bin extracted/drive2 0x3c4 0x468

# solve.py (발췌) — CBC+XTEA 역산으로 64바이트 입력 복원
M = 0xffffffff; DELTA = 0x9e3779b9
def xtea_dec(v0, v1, key):                         # 0x500, 4 라운드
    s = (DELTA * 4) & M
    for _ in range(4):
        v1 = (v1 - ((((v0 << 4) & M ^ (v0 >> 5)) + v0) ^ (s + key[(s >> 11) & 3]))) & M
        s  = (s - DELTA) & M
        v0 = (v0 - ((((v1 << 4) & M ^ (v1 >> 5)) + v1) ^ (s + key[s & 3]))) & M
    return v0, v1
 
def recover_flag(vm2_rodata):
    key = list(struct.unpack('<4I', vm2_rodata[0x3000:0x3010]))   # key: LE 워드
    iv0, iv1 = struct.unpack('<2I', vm2_rodata[0x3010:0x3018])    # IV
    ref = vm2_rodata[0x3018:0x3058]                               # 64바이트 레퍼런스
    prev0, prev1 = iv0, iv1
    out = bytearray()
    for i in range(0, 64, 8):                                     # CBC 역산, 워드는 BE
        c0, c1 = struct.unpack('>2I', ref[i:i + 8])
        d0, d1 = xtea_dec(c0, c1, key)
        out += struct.pack('>2I', d0 ^ prev0, d1 ^ prev1)
        prev0, prev1 = c0, c1
    return bytes(out)

python3 solve.py

python3 verify.py

python3 dreamhack.py wg 2906 --flag 'DH{flat_memory_model_is_better_than_segmented_2hf8eg23}'

#!/usr/bin/env python3
# BumpyMM — self-contained solver (문제 VM 불필요, 평문 플로피만으로 복원)
import struct, os
 
HERE = os.path.dirname(os.path.abspath(__file__))
def rd(p): return open(os.path.join(HERE, p), 'rb').read()
 
# 1) VM3 블록암호 (CTR 키스트림 생성기) — RISC-V 에서 그대로 전사
MASK = (1 << 128) - 1
def rotl8(b, n):  return ((b << n) | (b >> (8 - n))) & 0xff
def sbox(x):      return rotl8((29 * x + 0x25) & 0xff, 3)
def rotl128(x, n):
    n &= 0x7f
    return ((x << n) | (x >> (128 - n))) & MASK if n else x
def shl128(x, n): return (x << n) & MASK
def shr128(x, n): return x >> n
def b2i(b):
    w = struct.unpack('<4I', b);  return w[0] | (w[1] << 32) | (w[2] << 64) | (w[3] << 96)
def i2b(x):
    return struct.pack('<4I', *[(x >> (32 * i)) & 0xffffffff for i in range(4)])
 
def key_schedule(key):
    k = b2i(key); rks = []
    for r in range(1, 11):
        k ^= shl128(k, 13); k &= MASK
        k ^= shr128(k, 7)
        k ^= shl128(k, 17); k &= MASK
        rks.append(rotl128(k, (11 * r) % 128))
    return rks
 
def block_encrypt(key, inp):
    rks = key_schedule(key)
    st = bytearray(inp)
    for r in range(10):
        for i in range(16): st[i] = sbox(st[i])              # SubBytes
        w = rotl128(b2i(bytes(st)), (3 * r + 7) % 128)       # ShiftRows 류
        st = bytearray(i2b(w ^ rks[r]))                      # AddRoundKey
    return bytes(st)
 
KEY   = b'YOUHAVESECUREKEY'
NONCE = bytes.fromhex('deadbeefcafebabe')
def keystream_block(counter):            # nonce || ctr_hi(BE) || ctr_lo(BE)
    hi, lo = (counter >> 32) & 0xffffffff, counter & 0xffffffff
    return block_encrypt(KEY, NONCE + struct.pack('>I', hi) + struct.pack('>I', lo))
 
def decrypt_code(cipher, end=0x2000):    # CTR, counter = off/16
    d = bytearray(cipher)
    for off in range(0, end, 16):
        ks = keystream_block(off // 16)
        for k in range(16): d[off + k] ^= ks[k]
    return bytes(d)
 
# 2) VM2 검증기의 변환 역산 (CBC + XTEA) — 키·IV·레퍼런스는 VM2 rodata
M = 0xffffffff; DELTA = 0x9e3779b9
def xtea_dec(v0, v1, key):
    s = (DELTA * 4) & M
    for _ in range(4):
        v1 = (v1 - ((((v0 << 4) & M ^ (v0 >> 5)) + v0) ^ (s + key[(s >> 11) & 3]))) & M
        s  = (s - DELTA) & M
        v0 = (v0 - ((((v1 << 4) & M ^ (v1 >> 5)) + v1) ^ (s + key[s & 3]))) & M
    return v0, v1
 
def recover_flag(vm2_rodata):
    key = list(struct.unpack('<4I', vm2_rodata[0x3000:0x3010]))
    iv0, iv1 = struct.unpack('<2I', vm2_rodata[0x3010:0x3018])
    ref = vm2_rodata[0x3018:0x3058]
    prev0, prev1 = iv0, iv1
    out = bytearray()
    for i in range(0, 64, 8):
        c0, c1 = struct.unpack('>2I', ref[i:i + 8])
        d0, d1 = xtea_dec(c0, c1, key)
        out += struct.pack('>2I', d0 ^ prev0, d1 ^ prev1)
        prev0, prev1 = c0, c1
    return bytes(out)
 
if __name__ == '__main__':
    drive2 = rd('extracted/drive2')
    plain2 = decrypt_code(drive2)
    assert plain2[:4] == b'\x13\x01\x01\xee', '복호 실패 — prologue 불일치'
    vm2_rodata = bytearray(drive2); vm2_rodata[:0x2000] = plain2[:0x2000]
    flag = recover_flag(bytes(vm2_rodata))
    print('[*] recovered 64-byte input:', flag)
    print('[+] FLAG:', flag.rstrip(b'\x00').decode())