# nobus-101
After reverse-engineering the binary, we learned that it uses the Dual_EC_DRBG backdooredkeys. The curve generatoin itself is deterministic, but we needed to reverse it. It looks likethis:
```pythonMAGIC = 0x132867e88e82431dc40ba24e11bf3ec7ffb18764a3b4df1f5957fd5f37d8be40
def gen_backdoor():    P = P256.G    e = MAGIC    d = mod_inv(e, P256.q)    Q = e * P    return P, Q, d```
This makes it possible to recover the seed using only two random numbers, using the well-studiedattack technique on Dual_EC_DRBG keys.
We modified the https://github.com/AntonKueltz/dual-ec-poc attack to get a deterministicseed recovery.
The interesting piece of our code is:
```pythondef recover_s(bits0, bits1, Q, d):    for high_bits in range(2**16):        guess = (high_bits << (8 * 30)) | bits0        on_curve, y = find_point_on_p256(guess)
        if on_curve:            # use the backdoor to guess the next 30 bytes            point = Point(guess, y, curve=P256)            s = (d * point).x            r = (s * Q).x & (2**(8 * 30) - 1)
            if r == bits1:                return s
def main():    P, Q, d = gen_backdoor()    data = requests.get("http://nobus101.insomnihack.ch:13337/prng").text    bits0, bits1, *rest = data.split()    bits0 = int(bits0, 16)    bits1 = int(bits1, 16)
    s = recover_s(bits0, bits1, Q, d)    curve = DualEC(s, P, Q)    prediction = hex(curve.genbits())[2:].rjust(60, '0')    text = requests.post("http://nobus101.insomnihack.ch:13337/flag", data=prediction.encode())
    print(text.text)```
This allowed us to recover the flag.
```INS{7ru57_7h3_5c13nc3}```