Dragon CTF 2021 Rev - `Run of the Mill` write-up

This is a write-up for Reverse engg chall -> `Run of the Mill` in DragonCTF 2021

[*]-challenges
    [+] (Rev - 202 pts/42 solves) Run of the Mill

Our Team Water Paddler got 7 th position in `DragonCTF 2021`.

Run of the Mill

Given a executable, seems to be constructed directly from the assembly (Only entry0 function).
Takes an input (flag), make operations on that input bytes and finally compare those input bytes with the stored 64 bytes, if equal -> prints "Well Done"

Goal is to recover the flag based on operations (encryption), and final bytes.
But manual analysis on those operations is very difficult (nearly 7.5k+ instructions for those operations)

Analyzing the problem

One of my teammate mentioned that, even though instructions are many, opcodes used are very less
`['ror', 'xor', 'mov', 'add', 'sub', 'movq', 'pxor', 'rol']`

Then got the idea of scripting : Writing a script for decrypting the encrypted flag bytes, automatically based on operations on Assembly
-> Dumped those assembly instructions (of encryption) into a text file, from IDA
-> Dumped the memory (0x000412000 - 0x00041209F) of runofmill into a python script

Part-1 : Script for simulating asm instructions
In order to reverse that encryption automatically, need a script to first (parse , execute) those instructions.

Main Challanges faced in this part :

Instruction parsing, Operand Parsing.

Memory (RAM) management for executing instructions (store, load ops), due to little endian concept.

Instruction Execution, based on opcode and operands

Part-2 : Script for Reversing the encryption
By doing those operations (used for encryption) on the encrypted bytes in the reverse order, we can recover the flag.

Main Challanges faced in this part :

Seprating the instructions into the blocks, to execute those blocks (operations) in reverse order.

Instruction Execution, based on opcode and operands

By Observing the assembly instructions i have noticed three patterns in the assembly instructions, which are used for encryption.

Type - 1 :
ror|xor|add|sub     (byte/word/dword/qword) memory-address, direct-value

Type - 2 :
mov     register, direct-value
add     register, memory-address

Type - 3 : 
mov     register, direct-value
mov     qword_412090, register
movq    mm0, qword_412090
pxor    mm0, (qword) memory-address
movq    (qword) memory-address, mm0

Type - 2 is dummy instructions , just for obfuscation, we need only Type-1, Type-3 instrucions.
Implemented block separation, reverse logic for opcodes, placed the final encrypted bytes at input bytes address.

Finally

The script : I have created for recovering flag, by putting all together. Assembly Instructions, I have dumped from IDA are (input for the script) : link

By running the script :
Flag : DrgnS{SoManyInstructionsYetSoWeak}

---

Thanks for reading !...