About:
This is the 6th challenge from FireEye's 2015 "FLARE On" challenge (http://flare-on.com/)
Solution:
This one was the first one I got legitimately stuck on.
Off the bat, it's clear that this one is an Android application that takes a string as input and returns "No" or possibly "Yes" when the correct string is entered.
Digging into this one was tricky for a couple reasons, but I was pretty quickly able to extract/decompile the Android code and see that the app was quite simple and seemed to use a native library to perform the main "checking" functionality.
Based on the function that triggers the call into the library being named "validateEmail", it seems pretty likely that we just need to find what string will cause an "OK" output and that'll be our email address.
The full path of the library where our function is implemented is lib/armeabi/libvalidate.so, so let's open this up in IDA. Here we can see the part where it chooses between "No" and "That's it!":
From here, it looks like we just need to work backwards to find out what will make us go to the green code block.
Looking to the left a bit, we can see a particular section of memory referenced that seems to contain a list of prime numbers...
Strange.... Although when we look at how the string we pass in is validated, it looks like an integer value (coming from two bytes of the string) are decomposed into its prime factors, and these factors are compared against static lists of values. For example, here is one that says we should have two of the fifth prime (11), one of the seventh (17), etc.:
If we go through the list of all expected prime numbers, generate the composite numbers from them, and convert these integer values into two-byte strings, we get the following email address:
Should_have_g0ne_to_tashi_$tation@flare-on.com
No comments:
Post a Comment