nuclear_codes — UMDCTF

Description

No separate organizer description was present in the provided workspace files.

English summary: the challenge provides a stripped ELF service reachable at nc challs.umdctf.io 30301. It asks for three positive integers a, b, and c with a > b > c, performs a large amount of high-precision interval-style arithmetic, and prints the flag only if the final comparison result is negative.

Challenge summary

This solve ended up being a reverse-engineering problem that turned into a math problem.

The binary did not hide the success path: main eventually opens flag.txt. The hard part was understanding what the huge wall of helper calls was actually computing. After dynamic reversing, the repeated wrapper at 0xfd60 and the final compare helper at 0xfe70 were enough to model the computation, collapse the first decisive scalar component into a rational function, and turn the acceptance condition into finding a rational point on a cubic. A birational map to an elliptic curve produced a point in the valid region x > 1, 0 < y < 1, which converted back into the exact winning integer triple.

Recon

Basic triage showed the expected hardened Linux target:

• ELF64 PIE
• NX enabled
• stack canary present
• Full RELRO

Runtime behavior was simple on the surface:

1. print enter positive integers a,b,c; one per line:
2. read three decimal strings
3. require all three to be positive integers
4. require a > b > c
5. run a very long arithmetic pipeline
6. on success, open flag.txt

From the disassembly, the important control points were:

• repeated arithmetic helper around 0xfd60
• final comparison helper around 0xfe70
• call site in main near 0x491b

...