The function takes user input then loops through 74 characters, which is the length of the flag, and XORs each character with ‘m1’. The result is then compared with ’t’ if it’s correct we will get the flag.
So it’s simply and XOR challenge

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26

from pwn import xor

t = [
    0x2C, 0x4A, 0xB7, 0x99, 0xA3, 0xE5, 0x70, 0x78, 0x93, 0x6E, 
  0x97, 0xD9, 0x47, 0x6D, 0x38, 0xBD, 0xFF, 0xBB, 0x85, 0x99, 
  0x6F, 0xE1, 0x4A, 0xAB, 0x74, 0xC3, 0x7B, 0xA8, 0xB2, 0x9F, 
  0xD7, 0xEC, 0xEB, 0xCD, 0x63, 0xB2, 0x39, 0x23, 0xE1, 0x84, 
  0x92, 0x96, 0x09, 0xC6, 0x99, 0xF2, 0x58, 0xFA, 0xCB, 0x6F, 
  0x6F, 0x5E, 0x1F, 0xBE, 0x2B, 0x13, 0x8E, 0xA5, 0xA9, 0x99, 
  0x93, 0xAB, 0x8F, 0x70, 0x1C, 0xC0, 0xC4, 0x3E, 0xA6, 0xFE, 
  0x93, 0x35, 0x90, 0xC3, 0xC9, 0x10, 0xE9
]
m1 = [
    0x6E, 0x3F, 0xC3, 0xB9, 0xD7, 0x8D, 0x15, 0x58, 0xE5, 0x0F, 
  0xFB, 0xAC, 0x22, 0x4D, 0x57, 0xDB, 0xDF, 0xCF, 0xED, 0xFC, 
  0x1C, 0x84, 0x6A, 0xD8, 0x1C, 0xA6, 0x17, 0xC4, 0xC1, 0xBF, 
  0xA0, 0x85, 0x87, 0xA1, 0x43, 0xD4, 0x58, 0x4F, 0x8D, 0xA8, 
  0xB2, 0xF2, 0x7C, 0xA3, 0xB9, 0x86, 0x37, 0xDA, 0xBF, 0x07, 
  0x0A, 0x7E, 0x73, 0xDF, 0x5C, 0x60, 0xAE, 0xCA, 0xCF, 0xB9, 
  0xE0, 0xDE, 0xFF, 0x00, 0x70, 0xB9, 0xE4, 0x5F, 0xC8, 0x9A, 
  0xB3, 0x51, 0xF5, 0xAE, 0xA8, 0x7E, 0x8D
]
password = xor(t, m1)
print(password)
# output: 
b'But the value of these shells will fall, due to the laws of supply and demand'

Now let’s move on to the serious stuff. The VM obfuscation challenge. We have two files, vm and bin, and we can execute them by typing

1

$ ./vm bin

The vm_create() function takes two parameters: “bin_ptr” and “bin_size”. The function first allocates 168 bytes of memory for a variable called “v3”, which is used to store the state of the virtual machine.

The function then initializes various fields of the “v3” variable. It also allocates memory for two additional variables: a 64KB block of memory and a 800-byte block of memory, which are maybe used for the virtual machine’s memory and stack, respectively.

The function then copies the contents of the “bin” file, starting from the fourth byte (i.e., skipping the first three bytes, which are 55 77 55), into the 64KB block of memory allocated.

The vm_run() function is responsible for executing the bytecode contained in the virtual machine’s memory. The function takes a single parameter, “a1”, which is a pointer to the virtual machine state.

The function works by repeatedly calling the vm_step() function.

648: mov reg[30], 119
654: muli reg[30], reg[30], 6
660: mov reg[28], 0
666: mov reg[29], 1500
672: mov reg[27], 69

678: load reg[25], mem[reg[30]]

684: xor reg[25], reg[25], reg[27]

690: store mem[reg[30]], reg[25]
696: addi reg[30], reg[30], 1
702: addi reg[28], reg[28], 1

708: jle reg[28], reg[29] ? 678 : 714

dead ?????????????????
dead ?????????????????
dead ?????????????????

1
2

if bc[0] >= 0x19: # DEAD
    bc = [(i ^ 0x45) for i in bc if i != 0]

It XOR with reg[27] which is 69 and store the byte code in address 1500. That’s why we got a dead ?????? code

1020: mov reg[30], 4400
1026: mov reg[31], 4600
1032: mov reg[26], 0
1038: mov reg[27], 35
1044: load reg[20], mem[reg[30]]
1050: push reg[31]
1056: pop reg[15]
1062: add reg[15], reg[15], reg[28]
1068: load reg[16], mem[reg[15]]

1074: xor reg[20], reg[20], reg[16]

1080: store mem[reg[30]], reg[20]
1086: addi reg[26], reg[26], 1
1092: addi reg[30], reg[30], 1

1098: jle reg[26], reg[27] ? 1044 : 1104 **; loop from 0 -> 35**

1104: addi reg[28], reg[28], 1

1110: jle reg[28], reg[29] ? 918 : 1116

1116: mov reg[30], 4400
1122: mov reg[31], 4700
1128: mov reg[26], 0
1134: mov reg[27], 35
1140: load reg[15], mem[reg[30]]
1146: load reg[16], mem[reg[31]]

1152: je reg[15], reg[16] ? 1206 : 1158 **; loop from 0 -> 35**

1158: putc Wrong!\n
1200: exit()

1206: addi reg[26], reg[26], 1
1212: addi reg[30], reg[30], 1
1218: addi reg[31], reg[31], 1
1224: jle reg[26], reg[27] ? 1140 : 1230

1230: putc Acess granted, shutting down!\n
1416: exit()

finish ?????????????????????

1020: mov reg[30], 4400
1026: mov reg[31], 4600
1032: mov reg[26], 0
1038: mov reg[27], 35
1044: load reg[20], mem[reg[30]]
1050: push reg[31]
1056: pop reg[15]
1062: add reg[15], reg[15], reg[28]
1068: load reg[16], mem[reg[15]]

1074: xor reg[20], reg[20], reg[16]

1080: store mem[reg[30]], reg[20]
1086: addi reg[26], reg[26], 1
1092: addi reg[30], reg[30], 1

1098: jle reg[26], reg[27] ? 1044 : 1104 ; loop from 0 -> 35

1104: addi reg[28], reg[28], 1

1110: jle reg[28], reg[29] ? 918 : 1116

1116: mov reg[30], 4400
1122: mov reg[31], 4700
1128: mov reg[26], 0
1134: mov reg[27], 35
1140: load reg[15], mem[reg[30]]
1146: load reg[16], mem[reg[31]]

1152: je reg[15], reg[16] ? 1206 : 1158 ; loop from 0 -> 35

1158: putc Wrong!\n
1200: exit()

1206: addi reg[26], reg[26], 1
1212: addi reg[30], reg[30], 1
1218: addi reg[31], reg[31], 1
1224: jle reg[26], reg[27] ? 1140 : 1230

1230: putc Acess granted, shutting down!\n
1416: exit()

finish ?????????????????????

• Again it check for the user input if it’s greater than or equal 36 it will continue else it will go back for the input [flag length is 36]
• Store these values
  • reg[20] = mem[4400] → load the value in offset 4400 to reg[20] (which is user input address)
  • reg[21] = mem[4500] → load the value in offset 4500 to reg[21] (???)

• It seems that it store the input of the user and then go to the next for loop (nested for loop) and swap the value of the user_input with user_input[???]

1
2
3

for i in user_input:
   for j in range(0, 36):
       swap(user_input[i], user_input[???[j]])

• reg[31] = mem[4600] → load the value in offset 4600 to reg[20] (???)

• It then XOR with the value in the offset 4600 and compare it with the value in offset 4700

1
2
3
4
5

for i in range(0,36):
	for j in range(0,36):
	    swap(user_input[j], user_input[sbox[j]])
	for j in range(0,36):
	    user_input[j] = user_input[j] ^ xor_val[i]