# Sudo_root-----------------------# Reversing400 realism:
Did you know that x86 is really old? I found a really old Master Boot Record that I thought was quite interesting! At least, I think it's really old...
qemu-system-i386 -drive format=raw,file=main.bin------------------------
We were provided with a [main.bin](https://github.com/youben11/CSAW_2017_quals_rev400/blob/master/main.bin) which seems to be a DOS/MBR boot sector, so we have to disassamble it as 16-bit assembly.
I first started it in qemu to have an idea of what going on, It prints some byte to the screen and wait for the user to type a flag of 20char length and check if the flag is correct (it prints wrong :p).
Then I started IDA to do some static analysis, the code was small since the MBR is limited to the size of 512bytes, the execution also start at the begining of the file wich is loaded at adr 0x7c00 (MBR stuff). After few readings, I realised that the important part of the code is in the range adr [0x066-0x0d3] the rest is some code for reading from the keyboard and printing the result and stuff like that, we will only focus on the important part (the entire assembly code is [there](https://github.com/youben11/CSAW_2017_quals_rev400/blob/master/main.ida) )
0066 cmp     byte ptr ds:7DC8h, 13h ; check if the flag_length is < 19 and read more if yes, otherwise start checking the flag
006B jle     loc_10D
006F cmp     dword ptr ds:1234h, 67616C66h ; compare the first char of the flag with "flag"
0078 jnz     loc_14D
008B mov     si, 8 ; prepare si for a loop
007C movaps  xmm0, xmmword ptr ds:1238h ; this load the 16 byte that follows "flag" into xmm0
0081 movaps  xmm5, xmmword ptr ds:7C00h ; this load the 16 first byte of the binary ( remember that MBR is loaded at adr 0x7c00 )
0086 pshufd  xmm0, xmm0, 1Eh ; this just change the position of the in xmm0
I didn't focused on how pshufd really work because I know that I can reorder the flag using my eyes and because I was very tired x)
after that is a loop of 8 iteration, if a check is not correct it will break and display wrong, if it can finish the 8 iteration, it will print correct, so what was this check ?
this is the begining of the loop:
008E movaps  xmm2, xmm0 ; move the changed flag to xmm2
0091 andps   xmm2, xmmword ptr [si+7D90h] ; this just switch two byte of xmm2 to 0x00 depending on the si
0096 psadbw  xmm5, xmm2 ; It will take me a lot to explain this intruction, please read the doc
from psadbw the computation of the 16byte flag will be devided (go read the doc), the result of each part must be equal to some bytes stored at 0x7da8-0x7dc8 at each iteration, this lead us to some equation : 
b8 + b7 + b6 + b5 + b4 + b3  +      abs(b1-cst1) = res1
b8 + b7 + b6 + b5 + b4 +      b2  + abs(b1-cst2) = res2
b8 + b7 + b6 + b5 +      b3 + b2  + abs(b1-cst3) = res3
b8 + b7 + b6 +      b4 + b3 + b2  + abs(b1-cst4) = res4
b8 + b7 +      b5 + b4 + b3 + b2  + abs(b1-cst5) = res5
b8 +      b6 + b5 + b4 + b3 + b2  + abs(b1-cst6) = res6
   b7 + b6 + b5 + b4 + b3 + b2  + abs(b1-cst7) = res7
with some linear algebra and some brute_force we can solve it, I used numpy to get this done [keygen.py](https://github.com/youben11/CSAW_2017_quals_rev400/blob/master/keygen.py)there is two value for cst and dec, each one of them give 8byte independently, so just comment one of them
the first value of cst and dec give 10 possibilites but the first one seems to be the good one, after reorder of them it gives "{4r3alz_"
the second then give 9 possibilites, reading carefully, the 8th seems to be the good one, after reoredr of them it gives "m0d3_y0}"
the flag was "flag{4r3alz_m0d3_y0}"