$ cat writeup.md…
$ cat writeup.md…
hackthebox
Task: stripped x86-64 PIE ELF implementing a custom self-decrypting stack VM that validates a password client-side. Solution: reverse the dispatch table and lazily-decrypted opcode handlers via qemu-user/gdb, build a Python emulator, recover the PACK4/ROTL transforms and 8 magic constants, then algebraically invert (rotr + unpack + permutation) to recover the 32-byte flag.
$ cat /etc/rate-limit
Rate limit reached (20 reads/hour per IP). Showing preview only — full content returns at the next hour roll-over.
A new startup claims to have developed an unbreakable client-side password validation system. VCs have invested millions, but I'm a bit skeptical of their claim. Can you prove them wrong?
A password-protected zip (password: hackthebox) contains an ELF named vvm. It
prints a banner vvm v0.0.3, asks What is the password:, and validates the
input. The goal is to recover the accepted password, which is the flag.
rev_vvm/vvm is an ELF 64-bit LSB PIE executable, x86-64, dynamically linked,
stripped. Notable imports:
ptrace — anti-debuggetline — reads the passwordmalloc, memcpy, __printf_chkThe name "vvm" is the hint: it is a custom virtual machine. On Apple Silicon
(macOS/ARM) the x86-64 ELF cannot run natively, so analysis was done inside a
Docker --platform linux/amd64 (ubuntu:22.04) container, with
qemu-x86_64 -g <port> + gdb for dynamic analysis against the qemu gdbstub.
main flow:
mmap pages (lazy-decrypted). The dispatch table in .bss at virtual
address 0x74e0 is populated as opcodes are first used.Dispatch loop (.text 0x2870, call site 0x28d8): reads the current opcode
dword from the bytecode stream, indexes table[opcode], calls the handler. The
VM bytecode/program lives in .data at virtual address 0x5540 (IP starts
at 0x5544). The HALT opcode is 28 (0x1c).
Handler calling convention:
| reg | meaning |
|---|---|
| rdi | bytecode base |
| rsi | &IP |
| rdx | stack array (vaddr 0x6220) |
| rcx | &sp counter (vaddr 0x6200) |
| r8 | handler table |
...
$ grep --similar