https://b17fr13nds.github.io/tags/vm/Recent content in Vm on bitfriends' blogHugoenSun, 24 Nov 2024 14:53:47 +0100https://b17fr13nds.github.io/posts/seccon_toy2/Sun, 24 Nov 2024 14:53:47 +0100https://b17fr13nds.github.io/posts/seccon_toy2/<h2 id="toy2"> <strong>TOY/2:</strong> <a class="heading-link" href="#toy2"> <i class="fa-solid fa-link" aria-hidden="true" title="Link to heading"></i> <span class="sr-only">Link to heading</span> </a> </h2> <p>This weekend we played as P1G SEKAI and managed to qualify to the finals. TOY/2 was a challenge I solved.</p> <p>In this challenge we&rsquo;re given a C++ binary that emulates some 16-bit architecture.</p> <p>It had several instructions, one of them included an OOB bug:</p> <div class="highlight"><pre tabindex="0" style="color:#e6edf3;background-color:#0d1117;-moz-tab-size:4;-o-tab-size:4;tab-size:4;-webkit-text-size-adjust:none;"><code class="language-cpp" data-lang="cpp"><span style="display:flex;"><span><span style="color:#ff7b72">case</span> <span style="color:#a5d6ff">13</span><span style="color:#ff7b72;font-weight:bold">:</span> <span style="color:#8b949e;font-style:italic">/* STT */</span> </span></span><span style="display:flex;"><span> mem_write(_regs.a <span style="color:#ff7b72;font-weight:bold">&amp;</span> (size() <span style="color:#ff7b72;font-weight:bold">-</span> <span style="color:#a5d6ff">1</span>), _regs.t); </span></span><span style="display:flex;"><span> <span style="color:#ff7b72">break</span>; </span></span></code></pre></div><p>This is bad code, since we write two bytes but the <code>AND</code> let&rsquo;s us place those one byte before the emulator memory ends → one-byte OOB write.</p>