The document describes the reversing of a Tiffany binary that spawns 7 child processes. Each child process handles messages from the parent process using ptrace calls. The parent initializes the children by sending configuration data, then sends each character of a password to be verified. Each child performs a simple computation on its local data and passes the character to the next child. The password is only accepted if all children accept after processing all characters.

1. HacknamStyle
Plaid CTF 2014 Write-ups

2. Reversing: g++

3. Reversing: g++

4. Reversing: g++

5. Reversing: g++

6. Reversing: g++

7. Reversing: g++
Makefile:
echo '${KEY}' | perl -p -e 's/(.)/<DEL>/ge' > key.h
Key.h:
K(0,116) // 't'
K(1,101) // 'e'
K(2,115) // 's'
K(3,116) // 't‘
Solveme.cpp:
template <int i> struct key { static int r = 0; };
#define K(i,v) template<> struct key<i> { S r = v; };

8. Reversing: g++
• Template metaprogramming
• Password verified during compilation
• “key<i>::r” gives i-th char of password
• Result printed at runtime

9. Reversing: g++
int main() {
if (!vv<0>::r)
// print 16 characters
else
std::cout << "Wrongn";
}

10. Reversing: g++
Analyzing templates:
• vv<0>::r zero iff gg<i>::r zero (for 0 <= i < 16)
• gg<i>::r = hiddenkey<a, b> - makefilekey<a, b>
• Parameter `a` and `b` depend on `i`
• Hiddenkey is constant, extract value.
How is makefilekey constructed?

11. Calculation makefilekey<a, b>
Let g++ replace #define’s:
• g++ -E -o solveme2.cpp solveme.cpp
<boring reversing>
makefilekey<a,b> =
( lookup<a*4> * key<b>
+ lookup<a*4+1> * key<b+4>
+ lookup<a*4+2> * key<b+8>
+ lookup<a*4+3> * key<b+12>) % 257;

12. Solution
Method 1:
• Key can be bruteforced in groups of 4 chars
• Extract constants, implement algorithm
Method 2:
• Solve linear equations

13. Reversing: Tiffany
From Child's Play (Chucky)

14. Reversing: Tiffany
Initialization
Computation

15. Reversing: Tiffany
• Spawns 7 children, many ptrace calls
• Hint: “Each instance does a very simple thing”
• ltrace fails during initialization
• strace fails after computation
<DEMO>
strace ./tiffany 2>&1 | less

16. Parent spawns 7 children
getpid() = 15866
clone(...) = 15867
clone(...) = 15868
clone(...) = 15869
clone(...) = 15870
clone(...) = 15871
clone(...) = 15872
clone(...) = 15873 = 0x3e01
 Child knows PID of parent and previous children.

17. Ptrace communication
• Parent sends messages to children using
ptrace
• Similarly, children send each other messages
using ptrace.
One of the reasons why the program is slow…

18. Ptrace communication
ptrace(PTRACE_ATTACH, 15823, 0, 0) = 0
--- SIGCHLD (Child exited) @ 0 (0) ---
wait4(-1, NULL, 0, NULL) = 15823
ptrace(PTRACE_POKEDATA, 15823, 0x618180, 0x1) = 0
ptrace(PTRACE_POKEDATA, 15823, 0x618184, 0) = 0
ptrace(PTRACE_POKEDATA, 15823, 0x618188, 0) = 0
ptrace(PTRACE_POKEDATA, 15823, 0x61818c, 0x3e01) = 0
ptrace(PTRACE_DETACH, 15823, 0, SIG_0) = 0
kill(15823, SIGUSR1) = 0

19. Ptrace communication
ptrace(PTRACE_ATTACH, 15823, 0, 0) = 0
--- SIGCHLD (Child exited) @ 0 (0) ---
wait4(-1, NULL, 0, NULL) = 15823
ptrace(PTRACE_POKEDATA, 15823, 0x618180, 0x1) = 0
ptrace(PTRACE_POKEDATA, 15823, 0x618184, 0) = 0
ptrace(PTRACE_POKEDATA, 15823, 0x618188, 0) = 0
ptrace(PTRACE_POKEDATA, 15823, 0x61818c, 0x3e01) = 0
ptrace(PTRACE_DETACH, 15823, 0, SIG_0) = 0
kill(15823, SIGUSR1) = 0

20. Ptrace communication
ptrace(PTRACE_ATTACH, 15823, 0, 0) = 0
--- SIGCHLD (Child exited) @ 0 (0) ---
wait4(-1, NULL, 0, NULL) = 15823
ptrace(PTRACE_POKEDATA, 15823, POKE1, 0x1) = 0
ptrace(PTRACE_POKEDATA, 15823, POKE2, 0) = 0
ptrace(PTRACE_POKEDATA, 15823, POKE3, 0) = 0
ptrace(PTRACE_POKEDATA, 15823, 0x61818c, 0x3e01) = 0
ptrace(PTRACE_DETACH, 15823, 0, SIG_0) = 0
kill(15823, SIGUSR1) = 0

21. Child Message Handler

22. Command #0
0x618180 = POKE1 = 1 # message available
0x618184 = POKE2 = 0 # destination ID
0x618188 = POKE3 = 0 # command ID
0x61818C = ARGS = 0x3e01
kill(15823, SIGUSR1) # notify child
 Parent sends CMD #0 to first child
 Send PID of last child to the first child.

23. Command #1
• Copies large amount of data
• Child handler makes local copy
 Each child is given unique data

24. Initialization Complete
Password now requested

25. Command #3
• Parent sends every char to first child
Child handler:
• Updates states according to char and local data
• Forwards char to previous child
• Last child informs parent to send next char
 Every child gets char and “performs a step”

26. Parent sends command #2 to first child.

27. Password okay?
• Password OK if final `bitokay` is 1
• All children must “accept” the password
• Every child is a DFA
• Local data is state transition function
Extract DFA, intersect, find witness
Minimize DFA while intersecting!