itewqq

Keybase proof

I hereby claim:

I am itewqq on github.
I am itewqq (https://keybase.io/itewqq) on keybase.
I have a public key whose fingerprint is 2BF3 4A5C 75B8 E3A9 8F41 9C5D 5834 A675 CBC9 EA1B

To claim this, I am signing this object:

Brief writeup for two rev challs (macroscopic, not-baby-parallelism) from DiceCTF 2023

macroscopic

Observation: Compile some naive demo and run you can find each character in the input of dice_macro::dice!{}; macro was 1-to-1 mapped to some integer arrays. So just enumerate all printable characters and figure out the flag byte by byte.

EXP:

Disable or uninstall the official C/C++ plugin.
Install the clangd plugin.
Build the kernel with clang:

/path/to/kernel_source$ make CC=clang defconfig
/path/to/kernel_source$ make CC=clang -j16

Generate the compile_commands.json:

/path/to/kernel_source$ python ./scripts/clang-tools/gen_compile_commands.py

Append the following text to linux/installer/deb/local_repo_tool/conf/distributions:

Origin: Intel Corporation
Label: Intel Corporation
Codename: bullseye
Architectures: amd64
Components: main
Description: debian/bullseye repository for SGX PSW
DebIndices: Packages .

Features

Make sure you build the binary with debug symbols. For example: RUSTFLAGS=-g cargo build --release
Use rust-gdb to start the binary and load the script: rust-gdb rust_binary -x memlayout-rust.py
Break anywhere you like, and use the command mem-layout VARIABLE_NAME to print the layout of that variable:

Custom structures are also supported:

	$("#run").click(() => tryCatch(run));

	async function run() {
	await Excel.run(async (context) => {
	const sheet = context.workbook.worksheets.getActiveWorksheet();
	var selectedRange = context.workbook.getSelectedRange();
	selectedRange.load(['address', 'values', 'rowCount','columnCount'])
	return context.sync()
	.then(function () {
	var arr = selectedRange.values;