# bubbly
Author: [roerohan](https://github.com/roerohan)
A possible way to solve this challenge is decompiling the binary and trying to understand what's happening in the code.
# Requirements
- ghidra- gdb
# Source
- [bubbly](./bubbly).
# Exploitation
First, we checkout the decompiled version of this binary with the help of `ghidra`.

As you see in the code, there is a `while(true)` loop which reads a number `%d` from `stdin` and stores it in `i`. There's also an array of numbers `nums`. The code snippet containing `nums` is basically swapping `nums[i]` with `nums[i+1]`. The `check` function basically checks if the list is sorted. 
```c_Bool check(void)
{  uint32_t i;  _Bool pass;   i = 0;  while( true ) {    if (8 < i) {      return true;    }    if (nums[i + 1] < nums[i]) break;    i = i + 1;  }  return false;}```
The target is to keep swapping indices in `nums` to finally sort it as a list. So, we open gdb and find out what nums is.
```bashgdb-peda$ print nums$1 = {0x1, 0xa, 0x3, 0x2, 0x5, 0x9, 0x8, 0x7, 0x4, 0x6}```
When you execute this line in `gdb`, you see that `nums` is a global array, consisting of numbers from 1 to 10. It is also important to notice in the `ghidra` decompiled code that the value of `i` entered by the user must be `<=8`, otherwise it will just break out of the `while(true)` loop.
Now, we have to device a strategy to sort these numbers by swapping indices `i` and `i+1` in `nums`. So, first we try to bring `0x2` or `2` to it's real place by passing `2` followed by `1`. That swaps the indices `2 with 3` and then `1 with 2`, bringing 2 back to it's original place. We can perform these swaps in `gdb` and keep checking the outputs of the swaps as we move on. Here's a list of swaps that could sort the array.
```21276543487658768789```
At the end of every iteration, the `check` function runs to check if the list is sorted. Once it's sorted, we can break out of the loop, since `pass` is now equal to `true`.
The list ends with a `9` so that we can break out of the `while` loop. Once it breaks out, it checks if the value of `pass` is `true`, which it is, and then it runs the `print_flag` function. Passing the numbers in the above list fetches us the flag.
```bash$ nc 2020.redpwnc.tf 31039I hate my data structures class! Why can't I just sort by hand?21276543487658768789Well done!flag{4ft3r_y0u_put_u54c0_0n_y0ur_c011ege_4pp5_y0u_5t1ll_h4ve_t0_d0_th15_57uff}```
The flag is:
```flag{4ft3r_y0u_put_u54c0_0n_y0ur_c011ege_4pp5_y0u_5t1ll_h4ve_t0_d0_th15_57uff}```