rev

[true finch]

I do believe Harry stayed up many nights to write this

[round terrace]

#first-bloods message

[novel lynx]

nice, thanks harry for cool chall

[round terrace]

i should learn to use the quote thing

[true finch]

very oars

[quartz sapphire]

rCTF

Congratulations to IrisSec for first :drop_of_blood: on dice-is-you!

​

[Jump to message](#first-bloods message)

Sent in #first-bloods | Quote requested by asphyxia#6640 | 807456060398108745 · Feb 6, 2021, 3:42 AM

[mild birch]

R u winning son?

[languid shore]

No papa

[austere plaza]

you know

i think the DRS should learn how to standardize their instructions

imma sue them on that too

[tender bay]

:(

[round terrace]

sovereign immunity

[chrome viper]

i gave up on taxes

😢

[wraith cedar]

health ctf

[dire roost]

mfw all but one part of flagle and cant get that last part

[molten cargo]

Exactly

[soft oar]

dicecraft is pain

[latent ore]

This feeling when you find out your final mistake in Form B and it finally spits out the first char

[round terrace]

👀

[unreal relic]

same

[latent ore]

Finally Form B done

[worthy kelp]

What the HECK is taxes? 🙃 it’s annoying and addicting at the same time, i can’t seem to stop working on it

[latent ore]

Same

[fickle fractal]

It's also unsolvable

[latent ore]

Iterating a trillion times seems to much for a tax form, yeah

[ionic shore]

flag format for dicecraft?

[deep ginkgo]

dice{}

[stark atlas]

see faq in #rules

What is the flag format?

dice{...} (regex: dice\{[!-z|~]+\})

[ionic shore]

thx

[deep ginkgo]

i got the flag of flagle but its not showing correct

any admin for help

please

the challange is also saying that the flag is correct but

[wraith cedar]

fantastic taxes

[upbeat python]

anyone available for hyperlink? I opened a ticket but no answers

[true finch]

patience please

[oblique zephyr]

awake now, looking at complaints for taxes...

I hope the frustration you feel embodies the way you feel doing real taxes

[true finch]

no worries, people complain about taxes all the time

[north jungle]

I just want you to know I glanced at that chal at 3am because I got curious and it was absolutely hilarious. It's still kinda funny at 11am 🙂 Grade A theme meme lol
Now, I haven't actually started yet, I need to text my family the emoji for my flagle solution before I can start there and I haven't found it yet 😉

[forest coral]

I agree, this challenge is hilarious, until you dig a bit deeper 🤣 Our write-up will be legendary

[latent ore]

The first two parts were fun...

[forest coral]

exactly, then the reality striked back

[worthy kelp]

can confirm

[oblique zephyr]

lmao

[chrome viper]

thats meme is speed

[echo garden]

If you think DG6 is bad, wait until you see DG7

[latent ore]

Would have been great if the chal would have been split into 2 seperated challs (A and B as one and C and D as one xD)

[oblique zephyr]

in retrospect this might have been a good idea

[worthy kelp]

DG6 and DG7 are madness

[chrome viper]

well DG6 is already unsolvable, DG7 straight up takes you to another dimension

[stoic nimbus]

🤡

[frigid shell]

no one will be on fishing 😄

[latent ore]

Also, after solving B and implementing C (which takes years to solve so the solution is of course wrong) you are so burnt out that you wont be able to do D xD

[worthy kelp]

I’m burnt out after solving A and B already xD

[chrome viper]

wondering if anyone coded A and B manually

[latent ore]

I wasnt able to fall asleep yesterday as I was thinking about solutions for B (which helped of course) but I dont think I can replicate that tonight with C and D

[glass gate]

Taxes is absolutely doing me over. Got the first half but the 3rd quarter is just not happening

[round terrace]

Much like real taxes

[latent ore]

Maybe change the chal so that we only need to first two parts? 😄

[glass gate]

C always gives back the same value in the end for me which is not what is expected. I have each and every line as the challenge has asked but still no go

[fickle fractal]

C and D are believed to be broken at the moment

[glass gate]

That would make sense ha - can an admin/mod confirm?

[oblique zephyr]

C has known error, pushing fix really soon... standby

[oblique zephyr]

it's hard to justify effectively doubling the point value for this problem mid-competition

[latent ore]

Yeah true

Maybe add another challenge that gives half the points for half the flag?

[molten cargo]

haha

[oblique zephyr]

same effect though

see announcement re DG4-C/DG6

[latent ore]

Damn the update doesnt help at all

[twilit palm]

"DG6 is correct" => ok, see you in 2 hours for the 1000 billion iteration to finish 😂

[oblique zephyr]

anyone working on taxes: if you've solved or made significant progress on DG4-D/DG7, can you dm me?

[round terrace]

[latent ore]

2 hours?

I calculated that it takes 950 Days to complete

[round terrace]

Skill issue

Get TurboTax

[true finch]

TurboDice

[chrome viper]

imagine the typo was missing a 0

[twilit palm]

20h, still ok, there is room for that by the end of the challenge XD

I still have ideas about dg6, but none is working 😦

kinda like taxes, when you want to evade stuff, it doesn't work like you want

[fickle fractal]

I think the updated number is still incorrect

[tulip jasper]

Still unsure how I ended up solving typed

Fucking turing complete type systems man

[serene bramble]

🔥 nice job

[broken onyx]

🔥

[sly quartz]

:^)

rust or bust

[earnest crow]

welp, i give up on quantum xd

[maiden quartz]

noooooo

[slow reef]

Havent looked at the quantum is it fun (definition: Painful)?

[earnest crow]

im sure ireland had loads of fun during creation

[maiden quartz]

it's the easiest of all the quantum revs
you only need to analyze 3 different gates

[earnest crow]

2M lines of qasm 🙃

[maiden quartz]

p sure last year's challenges had like 30 gigs of qasm

[sly quartz]

btw fun fact, while making typed, I segfaulted rustc about 30 times

there's irony somewhere here

[nimble creek]

are you actually from ireland

[maiden quartz]

how did you guess

[nimble creek]

wasnt sure if it was a joke 🤣

[round terrace]

😮

[nimble creek]

you're not rbx nah?

[sly quartz]

actually ireland is every person from ireland

[maiden quartz]

exactly

its in the name

[nimble creek]

i didnt know there was someone from ireland in dicegang

[sly quartz]

I think ireland lives in the us now though so

[oblique zephyr]

we are a multinational organization

[maiden quartz]

[slow reef]

lmao im just dying in the hadmard gates followed by cx
like wat so its a 50% percent chance that the cx is triggered no definite reverse

[sly quartz]

[round terrace]

or international organization

[slow reef]

ahhhhhh ireland 1000iq

[nimble creek]

im from ireland too btw hence the interest

[maiden quartz]

🙂

[sly quartz]

I feel like the active members in dice all either live in the us or uk

[slow reef]

lmao after this I am opening a ticket just to talk quantum with ireland 👀

[round terrace]

larry?

[sly quartz]

oh right

a single canadian

:pepega:

[true finch]

I live in pandaland

[round terrace]

i thought we all live in diceland

[slow reef]

There was a short while I converted all the t's into s's then tried canceling out but sad no effect

since ireland over 1000iq

D:

the entire chat just died

[earnest crow]

i do wonder how to get such decompositions into t-gate, H, Cnot tbf

[slow reef]

thats the fun things

[maiden quartz]

well done to Zer0Tolerance!

Can the solver please DM me their solution?

[slow reef]

see imo people are overreacting its the same procedure repeated (minus the cx gates ofc ireland had to use those ): )

[maiden quartz]

theoretically, there's the solovay kitaev theorem.
but while that provides a poly time algo, it's v slow in practice

[slow reef]

like several months slow I tried doing smthng like that ages ago D:

[earnest crow]

ooof

[slow reef]

maybe im not efficient tho

lmao I built a theoretical solve script but its to slow I think D:

And prob doesnt even work D:

[round terrace]

me for every programming assignment

[woven cargo]

🤪

[slow reef]

hehehe you say that but its still running

im assuming its not that easy D:

[earnest crow]

isnt the limit with some qiskit backends (simulator) like 32 ?

[slow reef]

2048793 gates/spaces yep this is gonna get my ibmq account banned

[slow reef]

for some

[earnest crow]

👀

[slow reef]

Me over here trying to copy a few (hundred) lines to see quantum stuff
My computer just crashing

Ireland with pschyological fear, ik how to optimize the code but then ireland prob made it so you cant

[chrome viper]

damn i wanted the 🩸 for the taxes

(insert I was here first meme)

[quick star]

btw @oblique zephyr what does CA stand for in taxes? Certificate Authority?

[molten cargo]

Chartered Accountants ig

[oblique zephyr]

can't be too obvious with hints ;p

[unreal relic]

any hints on flagle?

got all the parts except 4

[round terrace]

Please do not ask for hints from competing teams.

If you wish to speak to an org or the challenge author, open a ticket.

[fringe portal]

jyu give every answer

[round terrace]

However, we are not providing any hints for flagle (or most anything else that has already been solved) and would encourage you to try your best and learn independently.

[round terrace]

mm...no

[fringe portal]

yes

this is a threat

[broken onyx]

ono

[round terrace]

!bean @fringe portal threatening admin

[quartz sapphire]

✅ hyper#4353 (313105201311645710) was beaned. Reason: threatening admin

[fringe portal]

!bean @round terrace not giving every flag answers

[quartz sapphire]

✅ jyu#7186 (476169212717563912) was beaned. Reason: not giving every flag answers

[carmine rover]

man got beaned

[fringe portal]

!bean @carmine rover

[quartz sapphire]

✅ Platinum#3042 (317418749273833473) was beaned. Reason: No reason given.

[slow reef]

!bean @fringe portal

[quartz sapphire]

✅ hyper#4353 (313105201311645710) was beaned. Reason: No reason given.

[fringe portal]

!bean @slow reef eating bagels without convent

[quartz sapphire]

✅ Quasar#0147 (767776595099385876) was beaned. Reason: eating bagels without convent

[slow reef]

convent?

nice

[fringe portal]

consent

[round terrace]

convent vs covenant

[broken onyx]

[fringe portal]

how do I become org

[slow reef]

#team-search message

Waiting patiently for code results

is actually nice

[round terrace]

are you still working on quantum?

[slow reef]

yes

[round terrace]

🙂

[fringe portal]

@round terrace how do I become org

[slow reef]

I modded it slightly to irelands suggestions ¯_(ツ)_/¯

maybe it work

maybenot

prob not

[round terrace]

#team-search message

[fringe portal]

I already sent mine

pls accept me

[slow reef]

See the plan is hyper

Get job at PB

sell jyu pb secrets

ez win

Oh wait I just realized I was running the not optimized version 👀

lmaoooooo

[round terrace]

🤡

[slow reef]

hmm so jyu if a PB developer wanted you join dice would you let them
(this is a sarcastic joke obv not its PB no one likes it (the no one likes it part is also a joke))

[fringe portal]

defensive countermeasures and forensics can be found on Google

yes

[slow reef]

Hmm is it worth further optimizing in life

I estimate 4 minutes of run time is that too much

oh well

[chrome viper]

taxes solved (guessed), i think DG7 is still wrong

[true finch]

:notlikeduck:

[round terrace]

😮

pls make a ticket so harry can review

[fickle fractal]

solvable wrong > unsolvable wrong

[iron summit]

Could the latest set of changes to taxes be published? Extracting the questions from the pdfs took quite some time...

[tender flint]

did you do it manually

[iron summit]

No

But my OCR was not very accurate

So I ended up having to go through a lot of it myself as well

[tender flint]

there are better solutions

[north jungle]

I really wanna see writeups for that monstrosity, I ... don't think I have the willpower to stare at any more tax forms 😛

Did y'all have issues registering DiceGang with the IRS and this was your payback? 😄

(Neat chal concept, it's fantastic)

[tender flint]

maybe harry was inspired by the llc formation

[oblique zephyr]

[north jungle]

The best CTF challenges start with "wait what if we do X, that'd be insane". "oh wait, maybe we actually can do it" ... <does it>

[round terrace]

dicecraft was the same way

i think

[broken onyx]

This was me coming up with sober-bishop

[oblique zephyr]

[slow reef]

wait

this was

[true finch]

ignore the date

[slow reef]

on 1/28

he speedran

[true finch]

it isn't there

[slow reef]

LMAO

[sly quartz]

you think 1 week is a speedrun?

amateur

[true finch]

well he didn't start right away obviously

[sly quartz]

harry wrote the whole thing on the last day

[slow reef]

Dicecraft 1 week is speedrun

[sly quartz]

:pepega:

[true finch]

anyway now you know why he was asleep so long

[slow reef]

Wat

[broken onyx]

It's not a real challenge if it wasn't started 8 hours before

[slow reef]

lmaooooooo

[sly quartz]

he went on a 30 hour no sleep grind before ctf start

[true finch]

too bad he was foiled by windows

a tale as old as time

[slow reef]

lmaooo

[slow reef]

pls do tell

my code is still loading D:

[true finch]

what

he wrote the code

compiling and running on windows was pepega

[slow reef]

oh

windows moment

[true finch]

what else is there to tell

[slow reef]

see

windows is garbage

¯_(ツ)_/¯

March to Jan - Chill
Jan and Early Feb - WAIT DICE CTF IS COMING CHALLENGES NOWW

[sturdy crane]

Hello can I talk to an admin for flagle please ?

[true finch]

#create-ticket

[sturdy crane]

thx I haven't seen it

[digital zephyr]

😎

rookjie

[round terrace]

did you write yours in an hour?

[chrome viper]

im being brainwashed by the names in typed

[tiny ridge]

Same bro 0-0

[glass gate]

I don't get C /DG6 at all - I think I'm done here 🙂 for taxes

[wild swift]

why no music on dicecraft 😦

also props for making a macos version!

[chrome viper]

i spend 12 hours writing a rust template compiler

and it doesn't work

[glass gate]

For taxes I put each line in a script for each form. A and B worked through apparently sheer luck as the same doesn't for for C And D

[grand crater]

hyperlink is making my head spin, heh

[dire roost]

!bean @grand crater GLHF, its not that hard just very easier to overthink and get confused

[quartz sapphire]

✅ FireFly#9973 (134368240016031744) was beaned. Reason: GLHF, its not that hard just very easier to overthink and get confused

[grand crater]

...I simplified and I think I can get the flag now, but I still don't understand how this actually works, lol.. will have to read writeups afterwards I guess

oh that's silly, figured out what I missed in my analysis and of course it's always the dumbest mistakes that get you

[dire roost]

!bean @grand crater congrats on getting through that, CTF's aren't won by the teams that get the most correct, but the teams who make the fewest dumb errors

[quartz sapphire]

✅ FireFly#9973 (134368240016031744) was beaned. Reason: congrats on getting through that, CTF's aren't won by the teams that get the most correct, but the teams who make the fewest dumb errors

[slow reef]

Can I ask for challenge description clarification in here or is that :ban:

[round terrace]

Uh...

I would say ticket, but I just woke up to see that nobody else is dealing with tickets and there's a bunch

[slow reef]

One sec ill dm you it since its just me being dumb and not understanding smthng simple

[lilac python]

Trying to solve the hyperlink chall makes me think I'm fool

[iron summit]

😕 taxes 4-C and -D suck 😦

[slow reef]

taxes suck, DRS or IRS

[grand crater]

I'm probably in the minority here but I really liked taxes lol, esp C & D

but my brain works in weird ways

[worthy kelp]

same :/

[glass gate]

not here - just didn't click for me at all despite doing (A) and (B) pretty quickly

[fickle fractal]

I liked C and D, it's just a shame they were initially broken (I chose to spend 4 hours formally verifying that it's unsolvable before deciding to open a ticket, quite worthwhile though)

[grand crater]

oh.. yeah, understandable. I was lucky to get the announcement before I reached the point where it would've affected me

[glass gate]

Hi, I am MrJ and I still have no clue. The sooner these writeups happen the better.

[grand crater]

hmm, I could work on that after dinner, could do a writeup for taxes.. I've given up on getting anything more done on the challenges at this point anyhow

[fickle fractal]

What better writeup than the actual filled in tax forms (all trillion of them)

[true finch]

I mean if you have the correct flag then filling it out should be a breeze

[slow reef]

Look its a noodles person from cypat discord (/j)

[fringe portal]

cypat epic

[true finch]

I should just leave cypat server

[fringe portal]

no

[slow reef]

nooooo rainbow will most likely ban half the server responsible

[round terrace]

I think Matt will ban y'all for low score anyway

[fringe portal]

Matt will ban the server owner?

[slow reef]

see im not in that team so HAHAHAHAHAA

jyu if you can find my team DO NOT leek

[fringe portal]

you are now

[slow reef]

wat

Thats illegal

im alr in a team

[fringe portal]

yes

we kicked you off that other team

you will go down with us now

have a good day

[slow reef]

👀one hour left until I realize that the answer has been infront of me all along and rage

@ jyu cypat based sys hardening chall?

[fringe portal]

q ua sar

[true finch]

no

[slow reef]

oof

ok then

[true finch]

we do not touch this territory

it is forbidden

[slow reef]

wat why

[fringe portal]

q
qu
qua
quas
quasa
quasar
quasa
quas
qua
qu
q

[slow reef]

what

[round terrace]

^

We do not enter sys hardening ctf

[slow reef]

whhy

[true finch]

cyberpatriot not based

[slow reef]

lmaooooo

ok then

[round terrace]

Too guessy

[true finch]

oh

you should put heap pwn in nats

[azure musk]

never ever ever

sorry

[slow reef]

Lmaooooo okok

actually more than fine dice sys hardening would be harder than nats

[azure musk]

cypat kinda on its way out doe

as famous cypat kingpin christo has said, people do cyberpatriot and 95% don’t know what a docker is

[round terrace]

So sad

[slow reef]

LMAooo that cant be accurate

oh well

how about perfect blue supportive challenge

[true finch]

pepsipu do you know what a docker is

[azure musk]

docker?? Is that like a ship thing

[slow reef]

do you know what a docker is

[true finch]

yes actually

[obsidian sundial]

yes

[true finch]

^

[slow reef]

Omg they know

impossible

AZ how are you doing

[obsidian sundial]

Docker is no longer a hidden secret

[slow reef]

I am confident I will fail quantum

[obsidian sundial]

giving up after waiting for coppersmith

[slow reef]

same D:

[cloud willow]

I'm interested to find out how they generated the pdf for taxes 👀

[oblique zephyr]

I’ll release the tooling after the ctf

[wraith cedar]

that's great challenge

i like it

[chrome viper]

not if you are the first to start realizing it's unsolvable😢

[round terrace]

😔

[wraith cedar]

dicecraft kill me

[slow reef]

universal kill me

[chrome viper]

typed kill me

ahh i just need a few more minutes

[wraith cedar]

3min

[worthy kelp]

can't wait to see the solution for taxes

[earnest crow]

I let Ireland defeat me this year for universal, but I’ll be back next year :3

[slow reef]

sameee

[chrome viper]

it's not very hard, basically extraction to z3 and solve

[true finch]

oh ctf is over now

pogu

[chrome viper]

GG

[wraith cedar]

GG

[ionic owl]

Breach was evil and fun, rop inside the VM trying to work it out, I feel I came close but needed sleep

GG

[worthy kelp]

GG

[worthy kelp]

I've heard of z3, not really sure how it works tho....

[chrome viper]

imaging a CAS calculator but on bytes

[earnest crow]

You are kidding right ?

JUST RUNNING IT WOULD HAVE WORKED ?

[true finch]

unintended, but yes

[earnest crow]

(For universal)

AAAAAAAAAA

But yea, intended solution was roughly what I tried, but seems like I got tricked by the QFT a bit

[maiden quartz]

from qiskit import QuantumCircuit, Aer, execute
simulator = Aer.get_backend('aer_simulator')
qc = QuantumCircuit.from_qasm_file("converted_circuit.qasm")
qubits = list(range(256))
qc.measure(qubits, qubits)
job = execute(qc, simulator)
result = job.result()
print(result.get_counts())

num_chars = 256 // 8
x = list(result.get_counts().keys())[0]
f = int(x, 2).to_bytes(num_chars, "little")
print(f)

i have no clue how it works

i thought it would take 2^256 memory

but qiskit has some fancy simulator that makes it work with like 3 gigs

(this was 100% unintended btw -- my solution is entirely static analysis)

[hoary meteor]

yeah breach was fun

[earnest crow]

😢

Qiskit is just magic

But yea, fun challenge. I tried to isolate the adding component and then ran it though qiskit in the hope of getting the phase

But I was unsuccessful with that

[novel lynx]

breach was a terrible experience for me, gdb sucks

[heavy zinc]

What was the intended solution for the cellular automaton part oft taxes? We implelemted it on a zynq7000 FPGA and got 1Ghz executions, so the whole thing just took a few minutes to run :D but I feel this was a bit overkill and we likely could have thought about the automaton some more and fast forward it or something?

[twilit palm]

regarding taxes dg6, I ended up computing the whole 1000 billion iterations by simplifying things + code in c++ (40 minutes computation), which I doubt was the intended way (well, it might actually be 😅 )
I was unable to find a repeating pattern to avoid computing the whole stuff. What did you guys do?

[oblique zephyr]

the cellular automata was rule 30 (https://en.wikipedia.org/wiki/Rule_30) but on a circle

[heavy drum]

lmao that's sick

[heavy zinc]

We had it as rule86

[oblique zephyr]

yeah that's the same one just flipped I think

[grand crater]

oh that's part C?

I just implemented it in C once I'd reversed enough to follow the logic; running it took ~30 min on my laptop

[quick star]

also implemented it in c

as val = (val | ror(val, 1)) ^ rol(val, 1)

but split into two 64 bit integers

[chrome viper]

using xmm simd im able to get to 20 min

but i did it three times because i thought i was wrong

[grand crater]

my x86-fu isn't so strong, but I just used __uint128_t

[twilit palm]

unsigned __int128 _dg6 (unsigned __int128 number)
{
    return ~(~(rightRotate(number) | number) ^ leftRotate(number));
}

unsigned __int128 dg6 (unsigned __int128 number, long int cnt)
{
    for (long int i = 0; i < cnt; ++i)
    {
        number = _dg6(number);
    }

    return number;
}

[finite galleon]

what was the final value that you got from dg6? i ran everything the same way but couldn't seem go get the right output

[chrome viper]

here's the interm results

[twilit palm]

Final value: 0b01010110000001010100001001110011000011001110000111101001111111110000001010100010011010101101000110111100000010100001010111011100

[grand crater]

I printed out the last 5 loop iterations since I was worried I'd have an off-by-one and loop too far, heh

[chrome viper]

can anyone send typed flag? i wanna check if my typechecker is correct

[oblique zephyr]

source for dicecraft https://github.com/hgarrereyn/dicecraft

[ionic owl]

This is how far I got on breach dumping it, also got other output with a bunch of the ROPs dumped but didn't solve it

[oblique zephyr]

this is super cool! is this graphviz?

[ionic owl]

yep, graphviz, I'll grab the script and share it

[ionic owl]

The script used to create it can be seen here https://gist.github.com/ReDucTor/43c75d169df909e497865825df2c8221 attempt2.py is the one used to solve it, attempt1.py is one which attempts do simulate the VM and also dump the ROPs

[wild swift]

some gdb scripts for breach. Allows you to have somewhat nice debugging, i.e. step, breakpoints, continue, memdump. Also integrates with gef to give context panes

[dusk schooner]

want me to DM the flag to you, or just post it here?

[chrome viper]

post it here doesn't violate rules right, my dm is open as well, thanks

[oblique zephyr]

this is so cool! I'm totally gonna steal this code for future ctf's ;p

[dusk schooner]

dice{l1sp_insid3_rus7_9afh1n23}

[wild swift]

haha feel free to, not sure it really paid of in the end

also code is really bad

[untold remnant]

So what was cable about? I solved it pretty quickly by bruteforcing the flag bit by bit and looking at how the map thing changed in memory but I have no idea what it represents, I did very little reversing

[chrome viper]

thanks btw, how fast did your calculate the string out, the script runtime, not including the analysis

[dusk schooner]

uh, I was lazy and just solved the system of equations with pen and paper (once I reversed the logic behind the "program")
took me 20...30 minutes I guess

[chrome viper]

oh ok thanks

[dusk schooner]

btw is the author of typed is reading this, I want to say thanks
this is my favorite chall of this CTF

[ionic owl]

very nice, I might try this method the next time I work on a similar challenge

[chrome viper]

you know what i want to say to harry

[oblique zephyr]

😨

[wheat tusk]

I gave up reversing the logic at some point and re-implemented the lisp to a z3 lifter 😂

[stark atlas]

@sly quartz 🙂

[chrome viper]

i implemented a full-fledge rust type checker 🤣

[abstract herald]

lolwut

too cool

[wheat tusk]

I mean, essentially, just putting the z3 on top to satisfy it

though very ad-hoc and ugly 😄

[chrome viper]

couldn't figure out how to convert type relation to logical relation

it feels more like a set theory instead of logic so that's why i didn't use z3

[sly quartz]

:D

[chrome viper]

while doing it i also tried gradient descent, which almost work🤣

[solid iron]

https://en.wikipedia.org/wiki/Wireworld

[sly quartz]

I was originally going to make a much more complicated lisp program

but then I realized that I hate lisp and rustc hates me

so I settled with this

[grand crater]

oh yeah... the thing that messed up by analysis of hyperlink some hours back was I was too focused on going from start to target that I forgot the provided app.py uses target only as a bitmask and ANDs with it, not a direct == comparison... so I was thinking each 4-chunk of state was to go from 8 to 1, and couldn't see how that was possible with the state transitions

[sly quartz]

oh uh

now that dicectf is over

[grand crater]

...oooohhhh

[sly quartz]

I should probably report that segfault I found

compiling this makes rustc segfault

[heavy drum]

oh sorry 😭

i think a tester missed that too

it basically simulates a few nondeterministic finite automatons in parallel so it only requires that some of the states get reached

[untold remnant]

looks nice... too bad it was cheesable 😂

[grand crater]

it was a really fun challenge to analyse though :p

[heavy drum]

lol thanks

did you figure out what the state machines did

[solid iron]

yeah, i was trying to make something bigger but I had a lot of timing issues

the electrons would not meet properly

[sly quartz]

can you send this, sounds kinda cool

[wheat tusk]

Yes, the code is fugly 😄

[sly quartz]

also btw the challenge description is a reference to https://aphyr.com/posts/342-typing-the-technical-interview

[grand crater]

not quite, no, but I noticed they all had the same structure and only pertain different letters. what did they do?

[sly quartz]

“Wait, hang on,” Criss interrupts. “Shouldn’t you… shouldn’t there be type declarations here? At least on our functions?”

You smile kindly. “Haskell is a dynamically-typed, interpreted language.”

Criss appears to have swallowed a frog.

[heavy drum]

basically, the first state machine checked that the flag was the right length (you might have seen the binary number get shorter and shorter)
the next ones checked for series of three letters to be in the flag. eg checking that dic, ice, ce{, etc. existed

[grand crater]

oh I see

[cloud willow]

How were you supposed to solve taxes? Using pdfPlumber or smth?

[dusk schooner]

I can't reproduce this now, but I got an ICE when I was trying to rename some variables

[sly quartz]

lmao is this a parser combinator in python

this looks disturbingly like the shitty parser combinator I made in js a year ago

[wheat tusk]

I needed to parse shit, didn't want to get bogged down in flaky string-handling, so I just googled for some library

it worked reasonably okay

[sly quartz]

using generators as discount monads

[grand crater]

I used poppler's pdftotext -raw to get something workable that was easy to hack up a parser for

[cloud willow]

I see

[wheat tusk]

My annoyance with the parser combinator would be optional whitespace/token separators, if I actually had cared about those 😄

[sly quartz]

wow your code is really something

although my original code is also fugly af

so I should shut up

[quick star]

i only used pdftotext to extract opcodes from DG4D, rest i just read/interpreted manually

[wheat tusk]

Yeah, trying to keep it close to the original type stuff just to avoid bugs by faulty interpretation of what it means 😄

and the weird proper vs improper lists were sometimes tricky too 🙂

[raw bane]

any have taxes writeup?

[sly quartz]

I have had so many internal crises

while writing this challenge

I'd impl a thing then rustc would start segfaulting

and I'd be like "oh no please don't make me scrap this chall"

[grand crater]

I have one for A-C currently, I should finish it for D too...

[sly quartz]

luckily I made it all the way to the end without rustc crapping its pants 👍

[grand crater]

it's... kind of verbose though

[sly quartz]

wow this is

super high effort

I just broke in the vm

and ran this every time

to get a traced disassembly

was incredibly slow

took ~10 minutes to get to the input processing

[wild swift]

yeah same the above is also very slow

not entirely sure why though

imo shouldn't be too bad

[sly quartz]

cause there are like

~100k iters to get to input processing

and it has to spawn python interpreter

every single instruction

[wild swift]

oh really? (I didnt to much of the rev)

ah and so gdb spawns a new interpretery everytime?

I would have expected it to reuse it?

[sly quartz]

at least the way I did it gdb spawns a new interpreter

idk about yours

[wild swift]

I mean looking at gdb source code, I would not be surprised lmao

[raw bane]

ohh greats, when you finish you think on share please? hahah i have DG6

[grand crater]

yep, sure

[chrome viper]

D is a stack machine

the first two bit is opcode, following is imm

program text is in Field A and stack is on Field B

but the program actually misses a pop stack after each letter

so it's unsolvable lmao

[oblique zephyr]

breach source: https://github.com/hgarrereyn/dicectf2022-breach

[grand crater]

https://gist.github.com/FireyFly/d0fd7db70c9777e930a7fa2bff9f0a7a -- I didn't proofread it and it's a bit... verbose and longform, but eh, there you go :p

[north jungle]

Thanks, makes me wish I had spent a few more hours on the chal 🙂

Good writeup!

[grand crater]

Thanks!

[solar prism]

what is the intended solution for hyperlink?

it had something to do with matrices?

[stark atlas]

@heavy drum

[heavy drum]

basically, each link is a list of integers

this can be interpreted as a matrix of bits

if you look at these bits, you might notice that the matrix is very sparse

it only has entries on the diagonal

this is because it's actually a bunch of block matrices along the diagonal

the "linking" operation is actually just matrix multiplication where * is & and + is |

the big idea is that it simulates the operation of a nondeterministic state machine on the input

and the current integer is the state

[solar prism]

but did people actually solve it in that way?

[heavy drum]

most people did some sort of "side channel"

[solar prism]

I bruteforced my way back from the end

and guessed the first part of the flag

[heavy drum]

interesting

[solar prism]

got until the word thing_

[heavy drum]

ah

[solar prism]

but actually to go from h to t it took a full day

[heavy drum]

wow

[solar prism]

can you share a solver?

[heavy drum]

there isn't really a """solver"""

the easiest way is to figure out what the state machine is doing

and use that to recover the flag

specifically, it actually simulates a bunch of state machines at the same time

one of them checks for the flag length, and the others check for sequences of 3 chars in the flag

eg "is dic in the flag" and "is ice in the flag" and "is ce{ in the flag"

once you get those sequences of three characters it's really easy to arrange them into the flag

[solar prism]

the characters are supposed to be the states?

[heavy drum]

mm not quite

[solar prism]

It sounds very complex that I think if the flag was a little longer with more characters it wouldn't be solved at all

[heavy drum]

the current states are held in the integer (start is initial states and target is accept states)

[grand crater]

the characters are the symbols transitioning between states (regardless of if you treat it as one big automaton or 32x 16-state ones)

[heavy drum]

lol i actually wanted other techniques to work so it was more friendly to intermediate players

[solar prism]

oh my god

that explains some weird behavior in my script

while bruteforcing "some characters" gave more options than others

they were the one repeated more than once

and that basically means they can go to multiple states

[heavy drum]

yes it was nondeterministic

basically, a nondeterministic state machine is one where each state can go to many different states and it will branch

[solar prism]

Yes

[heavy drum]

and whether it accepts just depends on whether a branch accepts

[solar prism]

and it can go back if it was of no success

not "go back"

take another branch

awesome challenge, thanks 😄

[heavy drum]

here's what it might have looked like (i dont remember)

[grand crater]

https://up.firefly.nu/tmp/graph.d.svg I ended up plotting one of the sub-automatons like this, but was focusing on the wrong node as the accepting state, whoops :p

(I think I also might've gotten some states wrong in that graph, I don't remember now)

[heavy drum]

lol

[grand crater]

I kind of stopped with that track when people said I was overthinking it, and after not seeing how to reach 1 from 8 :p

[heavy drum]

oop

[solar prism]

what about dicecraft

[tidal flax]

is anyone who has typed write up??

[crisp charm]

where can i find the flag-checker.wasm file for fragle guys?

[true finch]

https://flagle.mc.ax/flag-checker.wasm

[cloud willow]

There's actually no challenge called fragle so there is no .wasm file

[glad night]

bruh flagle kinda lame, it only has 1 word smh

do the devs plan on adding more words to it

[round terrace]

considering the ctf is over, uh, no...

[glad night]

did the devs intend the game to only be playable once? 🤨

[round terrace]

flagle refreshes the word every ctf day

!quote 805962713133875211-939629636546068501

[quartz sapphire]

gallileo

1 ctf minute = however long it takes 🙂

​

[Jump to message](#pwn message)

Sent in #pwn | Quote requested by jyu#7186 | 939629636546068501 · Feb 5, 2022, 9:12 PM

[round terrace]

@true finch thanks for cleaning up my mess

[sly quartz]

@tidal flax

that's someone else's solve script for typed

there's also some stuff in the official author writeups

[tulip jasper]

haha, we had exactly the same WTF1/WTF2 names for the two sets of constraints

[wheat tusk]

😄

[wild swift]

@oblique zephyr could it be that the constants in dicecraft were wrong in the level? We had the same exact mismatches in our flag from z3 as https://github.com/IrisSec/irissec.github.io/blob/master/_posts/2022-02-07-dicecraft.md

and we double checked our constants from the game

[novel lynx]

yep I double checked too, think there's just a mistake in the terminals in the map

was wondering what minehraft was at first

[oblique zephyr]

hmm that's strange, I generated a "solved" version of the map as well so I know the correct flag should also work

does z3 give multiple solutions?

I thought it would be unique but I could have made a mistake there

[novel lynx]

in my testing it didn't

but I can double check later

[oblique zephyr]

this is an awesome writeup btw!

how did you generate those isometric overhead views?

[novel lynx]

i changed the perspective camera to an orthographic one

and removed the fog from the shader

[oblique zephyr]

oh that's awesome!

I was curious how hard opengl code would be to patch

[novel lynx]

I recompiled the source code from your repo

thankfully you posted it before writeups were due, some ctfs wait until after writeups are due to post source for whatever reason

[wild swift]

maybe I messed up my scripting, but no, z3 does not give multiple solutions:

[wild swift]

Oh I found our error

we transcribed two b's into two 6'

[novel lynx]

ah that makes sense

[jagged robin]

omg is this a markov chain diagram

[round terrace]

looks like a graph to me...

[jagged robin]

nvm im pepega

[grand crater]

it's a finite state automaton

[forest coral]

For those who are interested, we're going live on Twitch to explain how we solved the Taxes reverse challenge. Live is in french. Feel free to join us 🙂 https://www.twitch.tv/dysnome
The VOD will be available later on YouTube

[ionic owl]

https://github.com/ReDucTor/dice-ctf-2022-breach-writeup/
Write-up of solving breach

[sly quartz]

!clean user 821232024064753724

[quartz sapphire]

✅ Deleted 1 message!

[fiery salmon]

damn, ABU getting us all the nitro