[null, {"document_url": "http://vulnerablespace.blogspot.com/2015/10/ctf-writeup-tum-ctf-teaser-whitebox.html", "unformatted_src": "http://2.bp.blogspot.com/-yzIqF41uK5o/Vi1uaAHAvBI/AAAAAAAAAU8/ej6yNshN0WY/s550/whitebox%2Bcrypto%2B-%2B1a.png", "src": "http://2.bp.blogspot.com/-yzIqF41uK5o/Vi1uaAHAvBI/AAAAAAAAAU8/ej6yNshN0WY/s550/whitebox%2Bcrypto%2B-%2B1a.png", "formatted_filename": "whitebox Bcrypto B B a"}, null, {"document_url": "http://vulnerablespace.blogspot.com/2015/10/ctf-writeup-tum-ctf-teaser-whitebox.html", "unformatted_src": "http://4.bp.blogspot.com/-lyoiN0hRkVc/Vi56XFJAOEI/AAAAAAAAAVU/JyJ9dGthEzI/s640/whitebox%2Bcrypto-2.png", "src": "http://4.bp.blogspot.com/-lyoiN0hRkVc/Vi56XFJAOEI/AAAAAAAAAVU/JyJ9dGthEzI/s640/whitebox%2Bcrypto-2.png", "formatted_filename": "whitebox Bcrypto"}, null, null, null]

CTF Writeup - TUM CTF Teaser - whitebox crypto (Rev 20)

According to the description we're required to find the key used by the 64-bit ELF binary to encrypt the input. We're also given the algorithm used: XTEA, eXtended Tiny Encryption Algorithm. The following is a C implementation of the encrypting part of the XTEA algorithm: One cycle of the XTEA algorithm consists of 2 Feistel rounds: A few things to notice are 1) the key is used as is, i.e. it's not used to derive a longer key and 2) the key is split into 4 equal parts. Let's look at the enciphering function in the binary: The function has been redacted as it contains 32 cycles. From the above C implementation and the Feistel-rounds image, we know that some constant delta is being added to the key at each cycle. Like the key, the delta is also constant. The fact that there are no instructions in the binary that add 2 constants together means that, the addition of delta and the key has been pre-computed and hard coded in the program. This leaves us with the following 4 potentially-interesting instructions:

The 1st time a part of the key is used, it is used as is since the sum is 0 at this point. The 2nd and 3rd time a part of the key is used, it is incremented by delta, the 4th and 5th by (delta * 2), and so on. With this in hand let's compute the original key.

Combining we get: hxp{w4rming_up!}
Posted by Francesco Mifsud at 12:59