[23:05.410 --> 23:35.720]  A little pause... and we are back.
[23:35.720 --> 23:35.800]  A little pause... and we are back.
[30:33.640 --> 30:34.040]  A little pause... and we are back.
[30:34.040 --> 30:37.640]  Everybody, we are here again, the last run of the day.
[30:38.080 --> 30:40.480]  Apologies for the ten minute delay on this one.
[30:40.680 --> 30:42.500]  We're trying to hunt down a bad cable.
[30:42.500 --> 30:46.580]  Somewhere in our infrastructure is a bad cable, and it's causing one of our streams to have issues.
[30:46.840 --> 30:49.900]  So we might have some intermittent connectivity for one of our players.
[30:50.220 --> 30:51.700]  Apologies for that.
[30:51.760 --> 30:53.320]  We're going to go ahead and get a kick off right away.
[30:53.320 --> 30:56.420]  We want to get these team members back to their teams as soon as we can.
[30:56.420 --> 31:03.180]  So let's go ahead and get a countdown of 5, 4, 3, 2, 1.
[31:03.180 --> 31:04.200]  Go!
[31:04.720 --> 31:06.780]  And now they're off.
[31:07.320 --> 31:07.880]  Okay.
[31:07.880 --> 31:11.280]  So we've already got the first one downloaded.
[31:11.280 --> 31:12.300]  And this particular one...
[31:12.300 --> 31:15.140]  Actually, can you grab me my notebook over there with our teams and whatnot?
[31:15.940 --> 31:19.100]  This one, we've got the new organizers.
[31:19.800 --> 31:24.060]  And I believe we've got Team Taiwan was the name that they requested.
[31:24.060 --> 31:31.920]  Because it's, again, another one of these mega teams that has a conglomeration of many different teams.
[31:31.960 --> 31:37.480]  So we've got Team Balsan, Team 217, Team TSJ.TW.
[31:37.860 --> 31:42.400]  So there's another team that has TW in the name that's Tokyo Westerns, a Japanese team.
[31:42.400 --> 31:44.980]  But this is the Taiwanese team because it's .TW.
[31:45.400 --> 31:50.520]  So let's go ahead and take a look at Team Balsan.
[31:50.520 --> 31:52.840]  It should be the one that I've got over here on my monitor.
[31:52.840 --> 31:56.740]  And they are already off, and they're in IDA looking at our challenge.
[31:56.740 --> 32:01.140]  Now, again, you'll notice all of our challenges are named Challenge, just the way that our Docker deployment kind of works.
[32:01.140 --> 32:05.680]  The official name of this challenge is called Nerd Sniped.
[32:05.760 --> 32:06.380]  Right.
[32:07.000 --> 32:09.700]  So what are things you can get Nerd Sniped by?
[32:09.700 --> 32:11.420]  A lot of things, but yeah.
[32:11.880 --> 32:12.600]  We'll see how that plays out.
[32:12.600 --> 32:14.700]  I get Nerd Sniped by, like, a Rubik's Cube?
[32:14.700 --> 32:14.860]  Yeah.
[32:14.860 --> 32:16.180]  A good puzzle, maybe?
[32:16.180 --> 32:17.280]  Yeah, a good puzzle.
[32:17.280 --> 32:18.780]  Maybe something like that.
[32:18.800 --> 32:19.740]  That'll do it.
[32:19.740 --> 32:22.940]  So we got you 1080p back and going.
[32:22.940 --> 32:32.620]  Hopefully, we'll figure out our issue with our HDMI cable, and we'll have a much better consistent capture across both team members tomorrow.
[32:32.780 --> 32:35.040]  Something about this cable is like it's heating up or something.
[32:35.040 --> 32:40.020]  We had several hours of testing last night with no problem, and something's going on now.
[32:40.020 --> 32:42.040]  So we'll give that a run.
[32:42.360 --> 32:45.240]  And sure enough, I literally just saw a rename solve puzzle.
[32:45.260 --> 32:48.300]  So we've renamed this function Solve the Puzzle.
[32:48.300 --> 32:51.960]  So what they're looking for, they know it's a puzzle of some sort.
[32:52.060 --> 32:58.480]  I'm curious if we get someone just kind of running it and interacting with the binary, or if we're going to do more static analysis.
[32:59.920 --> 33:03.420]  But actually, yeah, this should be much higher quality with the full 1080.
[33:03.860 --> 33:06.540]  Unfortunately, we don't have even the local recordings.
[33:06.560 --> 33:08.360]  We're also not 1080.
[33:08.360 --> 33:09.800]  They were only in 720 as well.
[33:09.800 --> 33:11.700]  So I apologize for those first couple matches.
[33:12.140 --> 33:19.060]  We're not going to have the higher quality video for those either.
[33:19.060 --> 33:26.000]  But all 12 other matches from here on out are going to be in high def because we have a lot of these to go.
[33:26.000 --> 33:28.760]  So you'll see your favorite players that won in the first couple rounds.
[33:28.860 --> 33:29.840]  They're going to come back.
[33:29.840 --> 33:31.400]  We're going to see them again.
[33:32.980 --> 33:33.900]  Oh, no, that was cool.
[33:33.980 --> 33:35.500]  I didn't notice that website.
[33:35.500 --> 33:36.700]  Have you seen that one before?
[33:37.820 --> 33:38.780]  I'm curious what that was.
[33:38.780 --> 33:40.400]  So now they're on the Ubuntu repo.
[33:40.400 --> 33:44.040]  They're getting a particular glibc version, which makes sense.
[33:44.180 --> 33:45.560]  That's often common.
[33:45.560 --> 33:49.440]  Now, I think for most of these, we included a libc if we thought it was necessary.
[33:49.620 --> 33:49.920]  Yes.
[33:50.080 --> 33:51.900]  So it's kind of a hint to the teams.
[33:52.660 --> 33:57.280]  We're trying to give out everything that we could, make it as self-contained as possible.
[33:57.620 --> 34:02.260]  And so we'll see if that one ends up being useful.
[34:02.260 --> 34:04.180]  But we've got our binary challenge.
[34:04.180 --> 34:09.720]  This one is starting to be a little bit more difficult, though, I would say.
[34:09.720 --> 34:13.180]  Our challenge difficulty is cranking up a tiny bit.
[34:13.660 --> 34:17.000]  And we're going to see that kind of trend throughout the whole rest of the weekend.
[34:17.000 --> 34:21.400]  I'm sure we'll have some easier ones, some that somebody finds an amazing solution to, solves it quickly.
[34:21.400 --> 34:28.800]  But on the topic of difficulty, we have an idea of what's more difficult and what's easier and so on.
[34:28.800 --> 34:31.120]  But, of course, we can be wrong.
[34:31.120 --> 34:36.460]  People can have different specializations in their skill sets and so on.
[34:36.460 --> 34:38.680]  So something that we might think is...
[34:38.680 --> 34:39.760]  In both directions, right?
[34:39.940 --> 34:41.100]  Exactly, yes.
[34:41.100 --> 34:46.760]  So something that we might think is easy might be actually kind of tricky, and then the other way around.
[34:46.760 --> 34:49.400]  So it's going to be interesting to see what's going on.
[34:49.400 --> 34:53.600]  There's still some reverse, like the initial reverse engineering going on of the program.
[34:53.600 --> 34:57.840]  For example, this kind of step was not really needed in the previous challenge,
[34:57.840 --> 35:01.520]  where we just gave them the full source code with names and everything.
[35:02.820 --> 35:04.100]  And it is...
[35:04.560 --> 35:07.340]  Yeah, as an organizer, you have a lot of levers to pull.
[35:07.960 --> 35:10.560]  It's ironic because we have the organizers here up playing,
[35:10.560 --> 35:13.440]  although, unfortunately, they're on our non-capture screen, unfortunately.
[35:14.860 --> 35:16.920]  I just had to make sure that we had them lined up right.
[35:16.920 --> 35:18.320]  I freaked out for a second, not realizing.
[35:18.320 --> 35:19.920]  Yes, they are on the right halves.
[35:21.260 --> 35:24.180]  But the team organizers, we're not seeing them.
[35:24.180 --> 35:27.020]  But as a challenge organizer, as somebody making challenges,
[35:27.020 --> 35:29.240]  you can strip a binary. You can not strip a binary.
[35:29.240 --> 35:30.540]  You can include debug symbols.
[35:30.540 --> 35:34.140]  Yeah, different levels of optimizations.
[35:34.140 --> 35:38.760]  Because a lot of optimization also kind of acts as a slight obfuscation as well.
[35:38.760 --> 35:40.240]  Mild obfuscation, yeah.
[35:40.660 --> 35:45.420]  We have all seen these optimized mem copies and everything,
[35:45.420 --> 35:48.280]  but you have all these bits of magic stuff going on.
[35:48.760 --> 35:52.500]  Yeah, you get vector operations in your mem copies.
[35:53.320 --> 35:59.500]  And that's where, to some degree, you can make an easy challenge hard with just tedious things.
[35:59.500 --> 36:03.900]  So it is interesting that you see a lot of, I would say, cheap challenge design,
[36:03.900 --> 36:06.000]  where it's like, yeah, we just made it harder by doing X.
[36:06.040 --> 36:07.600]  And it didn't make it more interesting.
[36:07.600 --> 36:11.540]  It just made it slightly more annoying to do the thing that you want.
[36:11.540 --> 36:14.720]  So sometimes a really good, easy challenge is actually,
[36:14.720 --> 36:18.220]  you're just really focusing on that one core thing that you want to do,
[36:18.220 --> 36:20.980]  which makes it a lot of fun for what we're doing here.
[36:22.320 --> 36:25.880]  So still, that's reversing and trying to name different things.
[36:25.880 --> 36:28.260]  You've seen they named the functions, like solvePuzzle,
[36:28.260 --> 36:30.640]  and you see some variables getting named, like the input.
[36:31.920 --> 36:37.200]  It's all trying to get an understanding of, what is this program doing?
[36:37.560 --> 36:39.220]  And there are two parts to it.
[36:39.420 --> 36:43.580]  First of all, what's the intended functionality of the program?
[36:43.580 --> 36:45.980]  And then from there, you can start to understand,
[36:45.980 --> 36:49.640]  in what way is it acting not as intended?
[36:49.640 --> 36:50.580]  Like, where's the bug?
[36:50.580 --> 36:55.120]  In this case, where the author intended a bug,
[36:55.120 --> 36:57.720]  but in the normal case where it's unintended vulnerabilities,
[36:57.720 --> 37:00.700]  or in this case, what's the surface level intended?
[37:00.800 --> 37:02.800]  What's it claimed to be able to do?
[37:02.960 --> 37:06.300]  And then what does it actually do that may be different?
[37:07.500 --> 37:10.000]  So let's see what we're doing.
[37:10.000 --> 37:12.180]  And this is nice, too, because this is the first time
[37:12.180 --> 37:14.120]  we've seen a little reverse engineering workflow.
[37:14.120 --> 37:15.900]  Yes. A lot of the other ones have been,
[37:15.900 --> 37:19.100]  basically, a quick glance at the code or disassembly
[37:19.100 --> 37:21.820]  has kind of revealed what's going on.
[37:21.820 --> 37:24.960]  Here, they actually need to kind of understand what is going on.
[37:25.620 --> 37:28.220]  Okay, so we're still sort of starting our framework
[37:28.220 --> 37:31.040]  for our exploit here, but I think it's just
[37:31.600 --> 37:33.560]  getting the menus and interacting with it, right?
[37:33.560 --> 37:36.340]  And so we're looking. Oh, okay, so there's a current puzzle state.
[37:36.720 --> 37:39.520]  All right, so, that puzzle looked interesting.
[37:39.520 --> 37:42.520]  That looked like maybe a 9x9 grid of numbers.
[37:42.520 --> 37:44.780]  Yes, numbers. It could be maybe like a Sudoku.
[37:44.820 --> 37:47.200]  I think that's a great guess, and of course,
[37:47.200 --> 37:49.400]  we're a little spoiled here, a little tainted knowledge,
[37:49.400 --> 37:51.180]  but this is indeed a Sudoku.
[37:51.600 --> 37:54.360]  In fact, when somebody was, like,
[37:54.360 --> 37:56.580]  play testing and validating this challenge,
[37:56.580 --> 37:57.620]  we sort of were like, wait a minute.
[37:57.620 --> 38:00.220]  You just solve a Sudoku, and that's it?
[38:00.220 --> 38:02.040]  And the author was like, no, no, no, no, no.
[38:02.720 --> 38:05.000]  That's not actually possible.
[38:05.460 --> 38:07.200]  So it is a little bit trickier than that.
[38:07.200 --> 38:08.620]  So we'll see as our teams discover
[38:10.120 --> 38:12.640]  it's not just a straight put it into a Sudoku solver,
[38:12.640 --> 38:14.320]  get a correct answer, and win.
[38:14.740 --> 38:16.280]  It is going to be a little bit more tricky.
[38:16.280 --> 38:19.300]  And this is one I am almost positive
[38:19.300 --> 38:20.520]  we're going to need a hint on.
[38:20.620 --> 38:24.460]  So I'm going to propose at, like, 15 minutes in,
[38:24.820 --> 38:26.300]  if we don't see...
[38:27.200 --> 38:28.200]  Like, progress.
[38:28.200 --> 38:30.060]  Progress. In fact, why don't you go ahead
[38:30.060 --> 38:31.460]  and take a look at the organizers, maybe, too.
[38:31.460 --> 38:32.580]  Yes, I will do that.
[38:32.580 --> 38:36.320]  And if we're looking for them to kind of have a hint
[38:36.320 --> 38:37.720]  as to what they're doing, like, indicate that they know
[38:37.720 --> 38:38.420]  what they're doing.
[38:39.260 --> 38:40.360]  Yeah, yeah.
[38:41.020 --> 38:42.500]  Oh, does it come on occasionally? Okay.
[38:42.840 --> 38:44.300]  So it's apparently flickering in and out.
[38:44.340 --> 38:46.720]  Occasionally we're getting our video.
[38:46.720 --> 38:48.820]  We swapped out the capture card.
[38:48.820 --> 38:51.060]  That worked for a while until it didn't.
[38:51.060 --> 38:52.960]  And then we swapped out the USB-C cable.
[38:52.960 --> 38:54.500]  And that worked for a while until it didn't.
[38:54.620 --> 38:57.480]  And so now we're convinced that it's just the HDMI cable itself
[38:58.120 --> 38:59.500]  that is causing trouble.
[38:59.500 --> 39:01.780]  And I think this has been true even if we were direct wired
[39:01.780 --> 39:02.900]  into the laptop.
[39:03.000 --> 39:05.780]  So it's not the capture on the other side.
[39:06.240 --> 39:07.580]  Yes, because we also did swap out
[39:07.580 --> 39:09.920]  the USB-C adapter once, too.
[39:09.920 --> 39:11.400]  So we've swapped every component
[39:11.400 --> 39:13.440]  except the HDMI cable.
[39:14.860 --> 39:15.700]  Partly because
[39:15.700 --> 39:17.040]  they're like taped to the floor
[39:17.040 --> 39:18.140]  and they're a 30-foot long cable.
[39:18.560 --> 39:19.660]  Oh, there we go.
[39:20.260 --> 39:22.620]  I did see a solver pop up briefly.
[39:22.620 --> 39:24.280]  Yeah, I was just going to say.
[39:24.280 --> 39:25.820]  The player from the organizers
[39:25.820 --> 39:28.900]  copy-pasted the current state of the puzzle
[39:28.900 --> 39:32.100]  and they googled for a Sudoku solver.
[39:32.940 --> 39:34.440]  So we'll see to what extent
[39:34.440 --> 39:35.720]  that will help them.
[39:37.700 --> 39:40.200]  Again, I'm not completely familiar
[39:40.200 --> 39:42.460]  with the intended solution here.
[39:42.460 --> 39:44.400]  But I would assume
[39:44.400 --> 39:46.180]  that it still involves
[39:47.460 --> 39:48.540]  solving the Sudoku
[39:48.540 --> 39:50.460]  but not only doing that.
[39:50.460 --> 39:52.320]  It is trickier than that.
[39:52.320 --> 39:53.400]  Yeah, that's right.
[39:54.060 --> 39:56.340]  I have a little bit more info.
[39:56.520 --> 39:58.200]  We're still seeing that kind of solver
[39:58.200 --> 39:59.900]  flashing in and out occasionally
[40:01.100 --> 40:03.140]  on the display.
[40:03.500 --> 40:03.520]  So
[40:05.280 --> 40:06.460]  there's going to be some memory
[40:06.460 --> 40:07.620]  corruption here.
[40:08.800 --> 40:10.060]  Although I will say,
[40:10.060 --> 40:12.600]  it is actually a perfectly valid
[40:12.600 --> 40:14.760]  category of challenge in a lot of CTFs.
[40:14.760 --> 40:16.180]  Where you would actually do have
[40:17.020 --> 40:18.820]  a more programming challenge or puzzle.
[40:18.820 --> 40:19.920]  That happens.
[40:20.660 --> 40:22.560]  Honestly, even in moderation, I think those can be
[40:22.560 --> 40:24.460]  fun and enjoyable mixed in amongst
[40:24.460 --> 40:26.040]  the traditional happy competition.
[40:26.040 --> 40:27.980]  Typically they are branded as
[40:28.600 --> 40:30.320]  PPC is the category in
[40:30.320 --> 40:32.520]  normal CTFs, which I think is like
[40:32.520 --> 40:34.100]  professional programming challenge
[40:34.100 --> 40:35.840]  or something like this.
[40:36.140 --> 40:37.420]  People familiar with
[40:38.960 --> 40:40.120]  ICPC style
[40:40.120 --> 40:41.780]  algorithms competitions
[40:41.780 --> 40:44.140]  might find, although usually they're kind of
[40:44.140 --> 40:46.060]  framed slightly
[40:46.060 --> 40:48.040]  differently, but it's
[40:48.040 --> 40:50.340]  kind of like the same general idea there.
[40:50.340 --> 40:52.160]  Yeah, and there's no security
[40:52.160 --> 40:54.220]  flaw. There's really just rather
[40:54.220 --> 40:56.160]  solving some hard mathematical
[40:56.160 --> 40:58.180]  problem with the right algorithm or with the right
[40:58.180 --> 40:59.820]  approach to
[40:59.820 --> 41:01.440]  kind of get it working.
[41:01.440 --> 41:03.380]  But that's not the case here.
[41:03.380 --> 41:06.400]  There's an aspect of that, but that's not enough.
[41:06.400 --> 41:08.020]  This is truly a
[41:08.020 --> 41:10.280]  component where there is memory corruption involved.
[41:11.160 --> 41:12.160]  Although, I will
[41:12.160 --> 41:14.120]  say, and I'm looking to see if somebody finds
[41:15.560 --> 41:16.560]  the sort of
[41:16.560 --> 41:18.120]  win function. When you have
[41:18.240 --> 41:18.820]  a correct solve
[41:21.820 --> 41:22.860]  Sudoku,
[41:22.860 --> 41:23.760]  I think we're going to see.
[41:23.760 --> 41:26.100]  This function here, they've
[41:26.100 --> 41:27.760]  named it check, returns
[41:27.760 --> 41:29.340]  whether or not we've successfully
[41:29.980 --> 41:31.880]  calculated a value,
[41:32.900 --> 41:33.420]  a valid
[41:34.800 --> 41:35.840]  solve.
[41:37.380 --> 41:38.140]  The result
[41:38.140 --> 41:39.520]  of that is going to determine
[41:39.520 --> 41:41.740]  basically what you call a win function. So it is going to
[41:41.740 --> 41:43.240]  do the win for you.
[41:43.480 --> 41:46.460]  You know that you have to solve it.
[41:46.460 --> 41:47.820]  You're just questioning, okay, what
[41:47.820 --> 41:49.800]  mechanic will actually get me to solve it?
[41:49.800 --> 41:51.740]  And can I cheat it? Do I have to have a combination
[41:51.740 --> 41:53.580]  of a solver plus a cheat? What
[41:53.580 --> 41:55.480]  is that ratio going to entail?
[41:55.480 --> 41:57.720]  Because at face value, it kind of
[41:57.720 --> 42:00.040]  looks like you just solve the Sudoku and you win.
[42:00.640 --> 42:01.620]  Yeah, but you know,
[42:01.620 --> 42:03.520]  Defcon finals, even being
[42:03.800 --> 42:05.420]  a sort of easy live CTF,
[42:05.420 --> 42:07.480]  I would think people would be like, no, wait a minute.
[42:07.480 --> 42:09.160]  There's something here.
[42:09.160 --> 42:11.320]  I think if you can also,
[42:11.320 --> 42:12.780]  there's not a lot of
[42:13.880 --> 42:15.100]  values here.
[42:15.140 --> 42:17.100]  I don't know,
[42:17.100 --> 42:19.280]  I think the idea is that these are just not
[42:20.100 --> 42:21.300]  solvable because there's not enough
[42:21.300 --> 42:23.340]  information. Some Sudoku balls are very
[42:23.340 --> 42:24.940]  minimal, but they're designed to be solved,
[42:25.460 --> 42:27.280]  made to be solvable. I think I remember that
[42:27.280 --> 42:29.760]  if you have 13 digits,
[42:29.760 --> 42:31.360]  you're guaranteed to have
[42:32.020 --> 42:33.160]  a unique solution.
[42:37.220 --> 42:38.100]  Okay, so this one
[42:38.100 --> 42:39.920]  definitely has more than that, but there's going to be
[42:39.920 --> 42:42.120]  some other issues with it still.
[42:42.120 --> 42:43.760]  I'm not sure if my trivia is
[42:43.760 --> 42:45.740]  correct, but I vaguely remember
[42:45.740 --> 42:48.140]  if you have 13 digits, you have a unique solution.
[42:48.140 --> 42:50.440]  You can have a unique solution with fewer digits,
[42:50.440 --> 42:51.940]  but it's not guaranteed. I don't know that
[42:51.940 --> 42:53.920]  that's true, because I can just give you all
[42:53.920 --> 42:55.380]  of the ones, for example.
[42:56.020 --> 42:57.340]  But that's just nine.
[42:57.780 --> 42:59.900]  And all the twos, and that doesn't
[42:59.900 --> 43:01.700]  give you enough information to know where all the other
[43:01.700 --> 43:02.820]  numbers are.
[43:05.840 --> 43:06.520]  Maybe.
[43:06.520 --> 43:09.460]  Maybe it's 21
[43:09.460 --> 43:10.520]  or something.
[43:10.980 --> 43:12.660]  There is a number.
[43:13.880 --> 43:15.720]  Where's our cracking the cryptic
[43:15.720 --> 43:16.980]  phone a friend
[43:16.980 --> 43:20.020]  and go to the YouTube stream?
[43:20.100 --> 43:21.900]  Yeah, great channel.
[43:21.900 --> 43:23.160]  So here we go. We're seeing
[43:23.960 --> 43:25.360]  a Sudoku solver Python.
[43:25.360 --> 43:27.680]  We're seeing people investigate that. All right.
[43:27.680 --> 43:29.540]  We are now 15 minutes in.
[43:29.540 --> 43:31.540]  I think we should be preparing our hands,
[43:31.540 --> 43:33.480]  because I actually think this one is a little too
[43:33.480 --> 43:35.440]  subtle, and we're going to have to point them
[43:35.440 --> 43:37.020]  in the right direction
[43:37.840 --> 43:39.600]  without actually giving them the thing.
[43:39.600 --> 43:41.420]  We should notice now that even
[43:41.420 --> 43:43.120]  though the time is
[43:43.120 --> 43:45.460]  24, we started
[43:45.460 --> 43:47.700]  10 minutes late because of technical difficulties,
[43:47.700 --> 43:49.500]  so they are only 15 minutes into
[43:49.500 --> 43:51.600]  the challenge. Correct. So we have
[43:51.600 --> 43:53.520]  more time than the clock looks
[43:53.520 --> 43:55.580]  like compared to the other ones where we started much closer
[43:55.580 --> 43:57.640]  to on time.
[43:57.640 --> 43:59.720]  So we're
[43:59.720 --> 44:01.280]  trying a solver again. So
[44:01.280 --> 44:03.040]  trying a solver on here, which is
[44:03.520 --> 44:05.680]  not going to be sufficient. So I think
[44:05.680 --> 44:07.740]  we need to figure out if there is an official hint
[44:07.740 --> 44:09.680]  from the challenge author.
[44:09.960 --> 44:11.260]  So we've got
[44:11.260 --> 44:13.980]  Glen over in the production booth,
[44:13.980 --> 44:15.660]  as it were, which is otherwise
[44:15.660 --> 44:17.580]  known as the other side of the table
[44:17.580 --> 44:18.920]  that we're sitting on here.
[44:20.460 --> 44:21.800]  It's going to reach
[44:21.800 --> 44:23.780]  out and see if we have an official...
[44:23.780 --> 44:25.760]  We have like three times the number
[44:25.760 --> 44:27.660]  of computers compared to the number of crew members
[44:27.660 --> 44:29.800]  for this setup. We have a lot
[44:29.800 --> 44:31.380]  of displays and
[44:32.480 --> 44:33.560]  an order of magnitude
[44:33.560 --> 44:35.760]  more cables, I think, than...
[44:36.940 --> 44:37.620]  Yeah.
[44:37.620 --> 44:39.520]  But it's... And once
[44:39.520 --> 44:41.760]  we find out what is breaking our
[44:41.760 --> 44:43.960]  secondary capture...
[44:43.960 --> 44:45.900]  Actually, speaking of which, I'm going to go ahead and take a look
[44:45.900 --> 44:48.040]  at the organizers. I want to see if they're making progress
[44:48.640 --> 44:49.780]  while we figure out
[44:49.780 --> 44:51.760]  what we're doing with that
[44:52.660 --> 44:54.580]  hint, if we're going to give it.
[44:54.580 --> 44:56.300]  And if you guys have any questions
[44:56.300 --> 44:58.880]  about where we're going, let us know.
[44:59.700 --> 45:00.440]  And I'll be back
[45:00.440 --> 45:01.340]  with an update.
[45:01.340 --> 45:04.460]  Great. So while Jordan
[45:04.460 --> 45:06.660]  does that, we can try
[45:06.660 --> 45:07.260]  to
[45:08.340 --> 45:08.980]  see
[45:10.780 --> 45:12.060]  that we...
[45:12.580 --> 45:13.980]  I've just been informed that
[45:14.580 --> 45:16.320]  the puzzle that
[45:16.320 --> 45:17.900]  you were given
[45:18.540 --> 45:20.500]  is impossible to solve.
[45:20.500 --> 45:21.900]  That's kind of the trick here.
[45:21.900 --> 45:23.440]  At face value,
[45:23.440 --> 45:26.100]  everything looks fine, you just need to solve the Sudoku,
[45:26.100 --> 45:27.480]  but actually there is no solution.
[45:27.480 --> 45:29.180]  This is an invalid state
[45:29.720 --> 45:30.740]  for the Sudoku.
[45:32.200 --> 45:33.760]  So once they...
[45:33.760 --> 45:35.660]  And this is something that can really throw you off,
[45:35.660 --> 45:37.260]  because if you
[45:37.720 --> 45:39.540]  take this and put it into a solver
[45:39.540 --> 45:42.380]  and the solver says, no, there's no solution,
[45:42.380 --> 45:43.500]  you might be starting to think
[45:43.500 --> 45:45.700]  maybe the solver has a bug,
[45:45.700 --> 45:47.640]  or maybe the format of
[45:47.640 --> 45:49.660]  my input is wrong, or something like this.
[45:50.660 --> 45:51.300]  And
[45:51.300 --> 45:53.520]  only later you might
[45:53.520 --> 45:55.580]  question the impossibility
[45:55.580 --> 45:57.060]  of the puzzle.
[45:57.520 --> 45:59.560]  So this is where they have to then
[45:59.560 --> 46:01.720]  cheat to solve the impossible
[46:01.720 --> 46:02.700]  Sudoku
[46:03.980 --> 46:05.260]  to then
[46:05.260 --> 46:07.280]  get this win function.
[46:08.360 --> 46:09.620]  We can see here
[46:09.620 --> 46:11.000]  on the battle screen that
[46:12.080 --> 46:13.260]  they are
[46:14.200 --> 46:15.760]  looking still at the
[46:15.760 --> 46:17.720]  kind of decompilation
[46:17.720 --> 46:19.760]  here, thinking hard
[46:19.760 --> 46:21.020]  about this.
[46:22.360 --> 46:23.580]  Trying to
[46:23.580 --> 46:25.980]  figure out what is going on here?
[46:25.980 --> 46:27.740]  Why is this not working?
[46:30.100 --> 46:32.560]  It's this check function, right?
[46:32.980 --> 46:33.780]  So they're
[46:33.780 --> 46:34.900]  trying to think about
[46:34.900 --> 46:37.940]  in what way does this function not behave
[46:38.640 --> 46:39.820]  correctly, maybe?
[46:39.820 --> 46:41.540]  Maybe they have realized that
[46:41.540 --> 46:42.960]  you're given an impossible
[46:43.620 --> 46:44.900]  puzzle.
[46:45.760 --> 46:46.880]  So let's see.
[46:46.880 --> 46:48.500]  They're going to try to...
[46:48.500 --> 46:50.660]  It seems like they're writing a small formatting
[46:51.320 --> 46:52.780]  function. They're looping through
[46:52.780 --> 46:54.380]  the X and Y axes
[46:54.380 --> 46:56.100]  and printing
[46:56.680 --> 46:57.640]  something.
[46:58.780 --> 46:59.980]  So yeah.
[47:02.680 --> 47:04.720]  Still unsure exactly where they're
[47:04.720 --> 47:06.020]  going with that, but let's see.
[47:06.020 --> 47:08.840]  So quick update is
[47:08.840 --> 47:10.540]  both teams are taking the
[47:10.540 --> 47:12.960]  wrong approach now, and they're still looking for solves.
[47:12.960 --> 47:14.780]  So the hint they're both going to get is
[47:14.780 --> 47:16.440]  you can't win, you need to cheat.
[47:17.240 --> 47:17.820]  Right.
[47:19.180 --> 47:19.980]  Which is...
[47:19.980 --> 47:22.220]  I almost feel like there's some kind of deeper
[47:23.620 --> 47:24.680]  philosophical thing here.
[47:24.680 --> 47:26.220]  I mean, it's a true life statement.
[47:26.220 --> 47:27.020]  Yeah.
[47:34.080 --> 47:36.100]  I had a lot of thoughts about that, but let's not
[47:36.100 --> 47:38.340]  go too off topic.
[47:38.340 --> 47:38.980]  Yeah.
[47:40.060 --> 47:42.380]  So here's the other question. Do we want to give them a little
[47:42.380 --> 47:43.500]  bit more of a hint?
[47:44.020 --> 47:46.220]  Do we want to tell them exactly how...
[47:46.220 --> 47:48.420]  I think we have time, right?
[47:48.420 --> 47:50.560]  No, no. We have time. Let's do that.
[47:51.160 --> 47:51.560]  And...
[47:52.120 --> 47:53.800]  Yeah. In fact...
[47:53.800 --> 47:55.220]  Well, that's too late now.
[47:55.940 --> 47:57.680]  I was thinking in terms of
[47:57.680 --> 48:00.780]  since this is the last match of the day,
[48:00.780 --> 48:01.980]  we could have afforded
[48:02.560 --> 48:03.360]  extending the
[48:04.240 --> 48:06.080]  standard game time, but I don't know
[48:06.080 --> 48:07.720]  if it's fair to do that once...
[48:07.720 --> 48:09.780]  Well, we do it to the same two players.
[48:09.780 --> 48:12.460]  Either way, it's only fair relative to each other.
[48:12.560 --> 48:13.680]  Because every match is different.
[48:13.680 --> 48:16.160]  Different challenges, different conditions, and so to some degree...
[48:16.160 --> 48:18.600]  Right, right. So you could argue that it's fair.
[48:18.600 --> 48:20.540]  But let's see. You can't win. You need to cheat.
[48:20.960 --> 48:22.200]  You need memory corruption.
[48:22.320 --> 48:22.980]  Yes.
[48:27.590 --> 48:29.230]  It's dangerous to go alone.
[48:29.230 --> 48:31.510]  Yeah. It's dangerous to go alone.
[48:31.510 --> 48:33.370]  Take this memory corruption. I love it.
[48:36.470 --> 48:37.270]  Alright.
[48:37.270 --> 48:39.610]  Here goes the first tense.
[48:39.610 --> 48:40.210]  Yes.
[48:40.430 --> 48:42.850]  We'll see if this gets them on the right track again
[48:42.850 --> 48:44.530]  or if we need to...
[48:45.210 --> 48:47.030]  In the meantime, I'm trying to decipher
[48:47.030 --> 48:49.710]  what this script is doing.
[48:49.710 --> 48:51.210]  They have a solve function there
[48:51.210 --> 48:52.950]  which then will not really help them
[48:52.950 --> 48:54.630]  since you can't solve this.
[48:57.310 --> 48:57.790]  It's...
[48:59.730 --> 49:01.410]  Yeah, it's still like,
[49:01.410 --> 49:02.790]  you know, a little bit unclear
[49:02.790 --> 49:04.430]  where the players are in this.
[49:04.430 --> 49:06.850]  Unfortunately, we can't read the minds of the players.
[49:06.850 --> 49:08.470]  That would be immensely helpful
[49:08.470 --> 49:09.850]  when doing this type of commentary.
[49:09.850 --> 49:12.670]  We can just try to guess based on what we're seeing on the screen.
[49:14.190 --> 49:16.270]  Again, if you have any questions
[49:16.270 --> 49:18.770]  or comments from all of you
[49:18.770 --> 49:19.810]  watching this...
[49:19.810 --> 49:21.710]  I got some smiles. I wish you all could have seen it.
[49:21.710 --> 49:24.210]  But there was like, oh yeah, of course.
[49:24.210 --> 49:24.990]  Okay, okay.
[49:24.990 --> 49:28.670]  They were both going down the solver approach.
[49:29.090 --> 49:31.010]  So I think we're going to see a lot more Ida now.
[49:31.010 --> 49:31.470]  Right.
[49:31.470 --> 49:33.550]  We're going to see them actually dig into the binary.
[49:33.930 --> 49:34.490]  Right.
[49:34.730 --> 49:36.030]  And follow it that way.
[49:37.510 --> 49:39.550]  So that's nice to hear
[49:39.550 --> 49:41.030]  that the hint was
[49:42.930 --> 49:43.650]  appropriately leveled
[49:43.650 --> 49:46.130]  and that it was useful to the players.
[49:46.150 --> 49:47.590]  Yeah, I think they both were
[49:47.590 --> 49:49.810]  at a spot where it's going to help both of them.
[49:50.090 --> 49:51.470]  We'll see if either one starts to
[49:52.470 --> 49:53.930]  take advantage of that or not.
[49:53.930 --> 49:55.270]  Okay, yeah, so we're looking at checksec.
[49:55.270 --> 49:56.870]  We're looking at the binary properties.
[49:57.050 --> 49:59.810]  And that's actually a great habit to be into.
[49:59.810 --> 50:01.530]  I really think that a lot of people overlook that.
[50:01.530 --> 50:03.690]  Again, we saw that last one with
[50:03.690 --> 50:05.290]  Mallard with the ducks where
[50:06.670 --> 50:08.030]  it not being randomized
[50:08.670 --> 50:09.750]  I think added a little bit of
[50:09.750 --> 50:10.610]  extra slowdown there.
[50:10.610 --> 50:11.990]  Right, yes, definitely.
[50:12.090 --> 50:14.070]  Because you could have gone straight into...
[50:15.070 --> 50:18.430]  I think I have this as a pretty good habit.
[50:18.590 --> 50:19.970]  Always run file.
[50:20.090 --> 50:21.490]  Always run checksec.
[50:23.210 --> 50:23.970]  It's kind of like
[50:23.970 --> 50:24.990]  when you're doing reversing
[50:26.350 --> 50:27.510]  engineering challenges.
[50:27.510 --> 50:29.950]  Always run strings. Always binwalk.
[50:30.050 --> 50:31.990]  Just out of habit.
[50:31.990 --> 50:34.090]  It's just the things that you do.
[50:34.770 --> 50:35.830]  Alright, so let's
[50:35.830 --> 50:37.270]  watch this. Okay, so now
[50:37.270 --> 50:39.550]  we're seeing them actually where we want them.
[50:39.550 --> 50:41.310]  Now they're back to reverse engineering.
[50:41.490 --> 50:43.250]  They're looking for vulnerabilities.
[50:44.170 --> 50:45.810]  And what they're going to do
[50:46.290 --> 50:47.690]  is they're going to use the vulnerability
[50:47.690 --> 50:49.650]  to win. They're going to use the memory
[50:49.650 --> 50:51.470]  corruption to
[50:52.650 --> 50:53.110]  not
[50:54.030 --> 50:55.670]  code execution directly
[50:55.670 --> 50:57.590]  but to the win state. So what they're going to do
[50:57.590 --> 50:59.610]  is they're going to need to corrupt in such a way that
[50:59.610 --> 51:01.430]  they can create a solved board.
[51:01.430 --> 51:03.330]  And they should hopefully still remember this, right? Because
[51:03.670 --> 51:05.630]  they know that the point was to win. They saw
[51:05.630 --> 51:07.370]  that. They saw the win state.
[51:07.750 --> 51:09.570]  That's why they were trying to solve the puzzle.
[51:10.050 --> 51:11.370]  So I think they know that.
[51:11.550 --> 51:12.730]  The question is
[51:13.530 --> 51:14.950]  are they going to
[51:16.410 --> 51:17.550]  be able to figure out the memory
[51:17.550 --> 51:19.550]  corruption in time? So that's the question
[51:19.550 --> 51:21.590]  that we're looking for. And this is kind of interesting, I think.
[51:21.590 --> 51:23.590]  This type of pwnable where, like a lot of pwnables
[51:23.590 --> 51:25.250]  you have kind of this like standard
[51:25.250 --> 51:26.930]  workflow where you try to
[51:27.410 --> 51:29.890]  gain control of certain aspects of memory.
[51:29.890 --> 51:31.750]  Yeah, it's a pointer overwrite
[51:31.750 --> 51:33.510]  or it's something that gets you a memory write.
[51:33.510 --> 51:35.470]  So you get a pointer overwrite. To a ROP chain
[51:35.470 --> 51:36.750]  to like, you know.
[51:37.410 --> 51:39.270]  But here you're just doing kind of like, maybe
[51:39.270 --> 51:41.570]  we call it like a local memory corruption.
[51:41.610 --> 51:43.530]  Or it's not quite a logic
[51:43.530 --> 51:45.110]  vulnerability in that it is memory corruption
[51:45.110 --> 51:47.610]  but it's not useful. It's not being used
[51:47.610 --> 51:48.770]  for control flow
[51:49.470 --> 51:51.250]  hijacking. You're using it specifically
[51:51.250 --> 51:53.370]  to just change the behavior
[51:53.370 --> 51:54.970]  of the state and change the behavior of the
[51:54.970 --> 51:57.390]  functionality through its normal legitimate means
[51:57.390 --> 51:59.410]  but by entering a memory state
[51:59.410 --> 52:00.930]  that it didn't intend for you to enter.
[52:00.930 --> 52:03.270]  So in a lot of these cases
[52:03.270 --> 52:05.530]  where the program wouldn't crash
[52:05.530 --> 52:07.230]  for example, if the exploit
[52:07.230 --> 52:08.510]  is slightly wrong.
[52:08.570 --> 52:11.670]  You just failed to get a correct puzzle. It's just not solved, right?
[52:11.670 --> 52:13.290]  Yeah. Which is not to say
[52:13.290 --> 52:15.350]  that they couldn't crash with this vulnerability
[52:15.350 --> 52:17.090]  necessarily. It depends on how it's actually
[52:17.090 --> 52:19.450]  constructed. But there are
[52:19.450 --> 52:21.330]  certainly use cases, or there are cases
[52:21.330 --> 52:23.570]  where an exploit isn't
[52:23.570 --> 52:25.330]  actually exploitable in the
[52:26.270 --> 52:27.650]  direct code execution
[52:27.650 --> 52:29.530]  state. It is rather just by
[52:29.530 --> 52:31.470]  exercising some other logical
[52:31.470 --> 52:32.790]  state of the program.
[52:33.210 --> 52:35.450]  In general, everything
[52:35.450 --> 52:36.950]  we say here about the
[52:36.950 --> 52:39.490]  pwnables and general ideas
[52:39.490 --> 52:41.370]  there are a lot of ifs and buts
[52:41.370 --> 52:43.290]  and stuff to all of these exceptions.
[52:43.290 --> 52:44.650]  But we're trying to
[52:45.250 --> 52:46.850]  make some broad strokes here about
[52:47.310 --> 52:48.930]  different types of challenges.
[52:50.290 --> 52:50.850]  I'm a little
[52:50.850 --> 52:52.870]  nervous. This one feels like the first
[52:52.870 --> 52:54.870]  one we might have to unleash a sudden death.
[52:54.870 --> 52:55.950]  I'm hoping we don't.
[52:56.690 --> 52:58.470]  And I like the challenge, because
[52:58.470 --> 53:00.870]  like we're talking about, I think it has
[53:00.870 --> 53:02.190]  that good twist.
[53:02.490 --> 53:04.850]  You're going to not get a pointer
[53:04.850 --> 53:05.750]  overwrite, but you're going to
[53:06.610 --> 53:08.070]  influence the state of the binary.
[53:08.510 --> 53:10.730]  I'm hoping. And we've seen
[53:10.730 --> 53:12.930]  great work from all the teams so far.
[53:12.930 --> 53:14.710]  So we know we have high quality people.
[53:15.450 --> 53:17.250]  We'll see how it's going.
[53:18.450 --> 53:21.090]  This is also, I said, one of the larger binaries.
[53:21.090 --> 53:22.710]  We all get very small binaries.
[53:22.710 --> 53:24.850]  Very, very self-contained. This one's a little
[53:24.850 --> 53:26.790]  bigger. It's still, I think, small on the CTF
[53:26.790 --> 53:29.150]  scale of things, which in CTF is smaller than
[53:29.150 --> 53:30.250]  real-world binaries.
[53:30.290 --> 53:32.830]  But relative to the live CTF binaries,
[53:32.830 --> 53:35.150]  this is larger than some of them.
[53:36.270 --> 53:36.830]  Yeah, luckily
[53:36.830 --> 53:38.670]  they don't have to sift
[53:38.670 --> 53:41.310]  through a 300 megabyte binary.
[53:41.310 --> 53:42.830]  What? Who doesn't love
[53:43.890 --> 53:44.930]  sorting out
[53:44.930 --> 53:47.110]  massive binaries? Yeah, I think I remember
[53:48.230 --> 53:48.750]  opening
[53:48.750 --> 53:50.730]  the Minecraft binary in IDA
[53:50.730 --> 53:52.970]  at some point. Then I
[53:52.970 --> 53:53.890]  went to bed and
[53:54.830 --> 53:56.390]  continued the day after.
[53:56.390 --> 53:58.590]  I think it was just barely finished, but it took
[53:58.590 --> 54:01.310]  eight or nine hours to analyze that.
[54:01.990 --> 54:02.910]  Big binary
[54:02.910 --> 54:04.410]  or even obfuscated binaries
[54:04.410 --> 54:06.870]  can take a long time
[54:06.870 --> 54:08.270]  to analyze for sure.
[54:09.550 --> 54:10.990]  Here we go. So let's look.
[54:10.990 --> 54:13.210]  We're seeing an int64 int.
[54:14.830 --> 54:16.850]  So making sure the types
[54:16.850 --> 54:18.310]  are correct.
[54:19.530 --> 54:20.990]  That's good.
[54:20.990 --> 54:21.890]  I think
[54:23.410 --> 54:24.910]  analyzing the types is useful,
[54:24.910 --> 54:26.610]  although what I will say is that
[54:26.610 --> 54:28.390]  just looking at decompiled code
[54:28.990 --> 54:31.190]  is maybe not the best way to analyze
[54:31.190 --> 54:32.790]  any kind of type issues, right?
[54:32.790 --> 54:34.990]  No, I think it's
[54:36.050 --> 54:37.130]  a good start
[54:37.130 --> 54:38.470]  to give you the big picture.
[54:38.470 --> 54:39.470]  And
[54:40.650 --> 54:42.450]  but then at some point you might have to
[54:42.450 --> 54:44.430]  drill down on things. And I think this is
[54:44.430 --> 54:46.410]  also kind of interesting again with different types
[54:46.410 --> 54:48.450]  of pwnable challenges.
[54:48.710 --> 54:49.950]  Some pwnable challenges
[54:50.450 --> 54:52.190]  the bug is obvious
[54:52.190 --> 54:54.130]  and the exploitation is difficult.
[54:54.230 --> 54:56.290]  And then you have these more reversing heavy
[54:56.290 --> 54:58.610]  pwnables where you have to figure out
[54:58.610 --> 55:00.430]  very complex data structure.
[55:00.430 --> 55:02.290]  But once you have sorted everything out
[55:02.290 --> 55:04.730]  the bug just appears.
[55:04.930 --> 55:06.410]  And then from there it's
[55:06.410 --> 55:07.830]  typically not that hard.
[55:08.250 --> 55:10.290]  And I think our previous examples
[55:10.290 --> 55:12.610]  several of our previous challenges were more on the side
[55:12.610 --> 55:14.110]  of like, it's obvious
[55:14.110 --> 55:16.430]  where the bug was, but actually landing
[55:16.430 --> 55:17.910]  it was sort of the tricky part.
[55:17.910 --> 55:20.790]  We just let you run syscalls, but which ones?
[55:20.790 --> 55:21.650]  That's the tricky part.
[55:21.650 --> 55:24.430]  Your payload, the execution. Same thing with
[55:24.430 --> 55:26.490]  not coding. We just ran your bytes, sort of
[55:26.490 --> 55:27.870]  you had to do that.
[55:27.950 --> 55:29.810]  I think those shell coding heavy
[55:29.810 --> 55:32.870]  and constrained environments are some of my favorite challenges.
[55:33.210 --> 55:34.610]  Probably because I'm just bad
[55:34.610 --> 55:36.690]  at the more, I don't want to say tedious,
[55:36.690 --> 55:37.570]  but the more in-depth
[55:38.570 --> 55:40.250]  long-term reverse engineering.
[55:41.910 --> 55:42.870]  I'm more of a
[55:42.870 --> 55:45.130]  reverse engineer myself, so I like those
[55:45.130 --> 55:46.750]  things. But then, for example, when you
[55:46.750 --> 55:49.170]  get to these complex heap exploitation
[55:49.170 --> 55:50.610]  things, then I'm completely
[55:51.490 --> 55:52.270]  out of luck there.
[55:52.270 --> 55:55.110]  There's always just familiarity and
[55:55.110 --> 55:57.390]  experience with it. One of the things I was going to mention
[55:57.390 --> 55:58.810]  and I say this, I don't do the
[55:59.310 --> 56:01.210]  reversing heavy ones as an author
[56:01.210 --> 56:02.230]  of a reverse engineering tool.
[56:02.230 --> 56:03.810]  Maybe that's why you built the tool, right?
[56:03.930 --> 56:06.570]  That's also why I have coworkers who are much better than I am.
[56:06.830 --> 56:08.790]  I highly recommend that approach.
[56:10.390 --> 56:12.110]  But one of the things that I was
[56:12.110 --> 56:14.270]  going to comment on is that I like
[56:14.270 --> 56:16.310]  one of the things that Ghidor, I think, really does well
[56:16.310 --> 56:17.850]  that a lot of
[56:21.190 --> 56:22.170]  both Ida and
[56:22.170 --> 56:24.010]  Binja have actually changed as a result
[56:24.010 --> 56:26.270]  is their side-by-side view. Having the
[56:26.270 --> 56:28.270]  synchronized side-by-side decouplation
[56:28.270 --> 56:30.250]  with this assembly, I think was a really
[56:30.250 --> 56:32.370]  important improvement in the standard
[56:32.370 --> 56:34.210]  workflow. And so now you'll see
[56:34.210 --> 56:35.870]  Ida and Binja both have much better
[56:36.250 --> 56:38.250]  split-pane synchronization, those kind of
[56:38.250 --> 56:40.550]  workflows. I mean,
[56:40.550 --> 56:42.490]  I assume Ilfac also was
[56:42.490 --> 56:43.650]  inspired and was like, oh yeah,
[56:43.650 --> 56:45.690]  I like the way that Ghidor does that too.
[56:46.370 --> 56:48.350]  Certainly from Binja's perspective,
[56:48.350 --> 56:49.850]  we definitely did that as well.
[56:50.650 --> 56:52.510]  So I do think it's good seeing difference.
[56:52.510 --> 56:53.430]  Oh, here we go, we've got
[56:54.450 --> 56:56.230]  I don't know, is that the same? That's just the same
[56:56.230 --> 56:56.850]  screen.
[56:56.850 --> 56:58.890]  But we are...
[56:58.890 --> 57:00.430]  They're looking at libc
[57:02.470 --> 57:04.850]  trying to download the appropriate
[57:04.850 --> 57:06.610]  libc version, right?
[57:06.610 --> 57:07.850]  They're using this
[57:08.650 --> 57:11.130]  webpage where you can put in
[57:11.130 --> 57:13.070]  offsets for
[57:13.070 --> 57:14.170]  different
[57:14.990 --> 57:15.930]  functions to
[57:16.670 --> 57:18.590]  match up with. Yeah, like fingerprint
[57:18.590 --> 57:20.950]  the libc version and then download
[57:20.950 --> 57:22.830]  it. So most of the times
[57:22.830 --> 57:24.590]  I think you need two offsets
[57:24.590 --> 57:26.290]  and then it will match to
[57:26.290 --> 57:28.510]  which version of libc is running.
[57:28.510 --> 57:30.490]  So again, when we're
[57:30.490 --> 57:32.490]  building these challenges, if we
[57:32.490 --> 57:33.970]  don't think they need
[57:34.710 --> 57:36.370]  libc, we're not providing it.
[57:36.370 --> 57:38.550]  That's not true in all competitions though.
[57:38.590 --> 57:40.610]  They may not trust us
[57:40.610 --> 57:42.190]  yet. I think this is like
[57:42.950 --> 57:44.270]  it is a convention
[57:44.270 --> 57:46.890]  among, I would say, experienced
[57:47.750 --> 57:48.290]  organizers
[57:48.290 --> 57:50.530]  within this. Right, because why make
[57:50.530 --> 57:52.350]  that an extra tedious
[57:52.350 --> 57:53.830]  step that it's just
[57:54.350 --> 57:56.230]  mechanical and we all know about the
[57:56.230 --> 57:58.350]  website, we all know how you would do that. However,
[57:59.030 --> 58:00.470]  if you come up with a solution
[58:00.470 --> 58:02.730]  that's different than the intended one,
[58:02.730 --> 58:04.290]  you might have a solution which does
[58:04.290 --> 58:06.270]  require libc and then you might go
[58:06.270 --> 58:07.770]  this route anyway.
[58:08.130 --> 58:10.310]  So it's not necessarily bad, it
[58:10.310 --> 58:12.270]  is just, it should be a hint that maybe
[58:12.270 --> 58:14.330]  you're not taking the intended route. Right.
[58:14.430 --> 58:16.310]  Doesn't mean that you're wrong, but
[58:16.310 --> 58:17.930]  you might be venturing into
[58:17.930 --> 58:20.290]  unknown territory. So let's be thinking about our
[58:20.290 --> 58:22.090]  next hint, because like I said, I'm a little
[58:22.530 --> 58:24.730]  concerned. We might need to do a different one.
[58:24.930 --> 58:26.290]  Yes. I don't know, triple
[58:26.290 --> 58:28.470]  tap control and get the
[58:28.470 --> 58:30.310]  spoken dictation pop up.
[58:31.390 --> 58:32.290]  I'm going to go...
[58:32.930 --> 58:34.290]  Oh, nope, that's just somebody else
[58:34.290 --> 58:36.350]  in the background excited about something. Yeah. I thought for a second
[58:36.350 --> 58:38.210]  we had a surprise win off
[58:38.210 --> 58:40.410]  screen. I'm going to go ahead and check
[58:40.410 --> 58:42.690]  in with...
[58:42.690 --> 58:44.130]  Was it organizers?
[58:46.070 --> 58:46.430]  Organizers...
[58:46.430 --> 58:48.250]  Organizers is unfortunately not being
[58:48.250 --> 58:50.170]  captured. So we're kind of
[58:50.170 --> 58:52.210]  in the dark there. So I'm going to see if I can get
[58:52.290 --> 58:54.130]  a little bit more of an insight. Hopefully we're making good progress there
[58:54.130 --> 58:55.930]  and I can come back with a little bit of an update.
[58:57.090 --> 58:58.190]  And then maybe
[58:58.190 --> 58:59.630]  then go ahead with some hint
[58:59.630 --> 59:01.730]  based on current status.
[59:03.030 --> 59:03.430]  So...
[59:03.990 --> 59:05.670]  Again, they're looking at
[59:07.570 --> 59:08.310]  figuring out
[59:08.310 --> 59:10.290]  libc versions or downloading
[59:11.530 --> 59:12.230]  an Ubuntu
[59:12.230 --> 59:14.190]  image. I'm not entirely
[59:14.190 --> 59:15.830]  sure what's going on there.
[59:15.830 --> 59:17.990]  But, yeah.
[59:19.610 --> 59:21.590]  We'll see if we can manage to
[59:21.590 --> 59:23.530]  see in what direction they're going
[59:23.530 --> 59:25.270]  with this.
[59:34.900 --> 59:36.480]  It would be very
[59:36.480 --> 59:38.340]  interesting to see if they have
[59:38.340 --> 59:40.200]  figured out where
[59:41.020 --> 59:42.580]  this check function is going
[59:42.580 --> 59:44.440]  on. Unfortunately, I don't
[59:44.440 --> 59:46.620]  have the reference solution, so I'm not
[59:47.240 --> 59:48.680]  super familiar with exactly
[59:48.680 --> 59:50.720]  where it's doing
[59:50.720 --> 59:52.020]  something incorrect.
[59:54.660 --> 59:55.620]  Yeah, it's
[59:56.580 --> 59:58.220]  also going to be interesting to hear then what
[59:58.220 --> 01:00:00.780]  the organizers are up to
[01:00:00.780 --> 01:00:02.640]  if they have good progress. So we're also
[01:00:02.640 --> 01:00:04.080]  kind of a little bit in the dark
[01:00:04.580 --> 01:00:05.740]  on that. But
[01:00:07.180 --> 01:00:07.620]  hopefully
[01:00:10.260 --> 01:00:12.620]  I think we are going to give them a hint
[01:00:12.620 --> 01:00:14.400]  that I'd say Jordan
[01:00:14.400 --> 01:00:16.380]  and Glenn are discussing
[01:00:16.520 --> 01:00:18.400]  a little bit, but what's the exact hint that
[01:00:18.400 --> 01:00:19.600]  we want to give them here to
[01:00:20.760 --> 01:00:22.680]  point them in the right direction.
[01:00:27.760 --> 01:00:30.100]  You can see here in the
[01:00:31.560 --> 01:00:32.040]  lower
[01:00:32.040 --> 01:00:34.240]  corner here, we have from time to time
[01:00:35.180 --> 01:00:36.140]  the organizer's
[01:00:36.140 --> 01:00:38.300]  screen flickering in and out.
[01:00:38.500 --> 01:00:40.400]  Unfortunately, that's the tech
[01:00:40.400 --> 01:00:41.920]  situation right now.
[01:00:41.920 --> 01:00:43.100]  And
[01:00:43.920 --> 01:00:45.920]  in the meantime, I can give you a little bit of an update
[01:00:45.920 --> 01:00:47.860]  on the combined
[01:00:47.860 --> 01:00:49.980]  scoreboard for the DEFCON CTF.
[01:00:49.980 --> 01:00:50.760]  We have
[01:00:51.740 --> 01:00:53.780]  still a fairly tight
[01:00:53.780 --> 01:00:55.880]  race. We have a span of
[01:00:55.880 --> 01:00:57.840]  about 18,000
[01:00:57.840 --> 01:00:59.760]  points for the
[01:00:59.760 --> 01:01:01.780]  leaders, Katsubin, down to
[01:01:01.780 --> 01:01:03.720]  14,000 points
[01:01:03.720 --> 01:01:05.820]  for the team in 16th place.
[01:01:05.820 --> 01:01:07.940]  So definitely still,
[01:01:07.940 --> 01:01:10.060]  everyone is definitely still in the game
[01:01:10.060 --> 01:01:11.840]  with top three
[01:01:11.840 --> 01:01:13.780]  being Katsubin, MMM
[01:01:13.780 --> 01:01:15.840]  and Perfect Roots. And they are all
[01:01:15.840 --> 01:01:17.940]  within like, you know,
[01:01:17.940 --> 01:01:18.860]  less than
[01:01:19.560 --> 01:01:21.900]  some percent or so of
[01:01:21.900 --> 01:01:22.440]  each other.
[01:01:22.700 --> 01:01:25.220]  Or maybe like 10%
[01:01:25.220 --> 01:01:27.940]  of each other. So yeah, definitely
[01:01:28.660 --> 01:01:28.980]  a good
[01:01:30.200 --> 01:01:31.860]  competition there.
[01:01:33.100 --> 01:01:33.780]  So,
[01:01:33.780 --> 01:01:35.760]  Jordan is
[01:01:35.760 --> 01:01:37.580]  coming back here. So what's the status?
[01:01:37.580 --> 01:01:39.200]  What's the organizers doing?
[01:01:39.260 --> 01:01:41.440]  We're going to need some hints. They're both still looking.
[01:01:41.440 --> 01:01:43.540]  I don't see any kind of progress. So we're going to drop
[01:01:43.660 --> 01:01:44.040]  a hint.
[01:01:45.640 --> 01:01:47.560]  There's a couple of hints we considered. One is, have you
[01:01:47.560 --> 01:01:49.380]  considered fuzzing? Because
[01:01:49.380 --> 01:01:51.640]  literally just sending in a bunch of bytes
[01:01:51.640 --> 01:01:52.560]  will actually
[01:01:53.780 --> 01:01:55.700]  cause, overwrite your
[01:01:57.400 --> 01:01:57.760]  game
[01:01:57.760 --> 01:01:59.360]  state. So that's the key thing
[01:01:59.360 --> 01:02:01.200]  they need to figure out. If they send in just
[01:02:01.200 --> 01:02:03.460]  too big of a solution, it will actually
[01:02:03.460 --> 01:02:05.560]  corrupt the state. And they'll get
[01:02:05.560 --> 01:02:07.800]  weird boards. And then it's a matter of,
[01:02:07.800 --> 01:02:09.460]  okay, how do I now create a board that
[01:02:09.460 --> 01:02:10.400]  would be solvable?
[01:02:11.060 --> 01:02:13.760]  One that we considered. The other one was
[01:02:14.860 --> 01:02:15.680]  don't let yourself
[01:02:15.680 --> 01:02:16.600]  be boxed in
[01:02:17.220 --> 01:02:19.460]  to your solution. It's a Sudoku puzzle. That's a little
[01:02:19.460 --> 01:02:20.900]  probably more obscure.
[01:02:21.380 --> 01:02:23.060]  I think we're going to go with just
[01:02:25.160 --> 01:02:25.880]  how big
[01:02:25.880 --> 01:02:26.920]  is your solution again?
[01:02:27.100 --> 01:02:28.680]  Or how many bytes is your solution?
[01:02:29.580 --> 01:02:31.480]  As our next hint. And I think we're going to
[01:02:31.480 --> 01:02:33.500]  give them that because there's still some work to be done.
[01:02:33.500 --> 01:02:35.520]  And we want to give them both
[01:02:35.640 --> 01:02:37.560]  a shot at getting it. Otherwise, we're going to
[01:02:37.560 --> 01:02:39.520]  go to our sudden death. So that's the hint we're going to
[01:02:39.520 --> 01:02:41.440]  go with. In the meantime, we had a comment here
[01:02:41.440 --> 01:02:43.160]  from KGIF.
[01:02:43.820 --> 01:02:45.580]  These seem interesting C challenges. I think
[01:02:45.580 --> 01:02:47.640]  I would try them all, but I'm sure I would take a lot longer.
[01:02:47.640 --> 01:02:49.320]  I would too. So that's okay.
[01:02:49.320 --> 01:02:51.700]  But it is a good idea
[01:02:52.600 --> 01:02:53.400]  in general
[01:02:53.400 --> 01:02:54.360]  for CTFs to
[01:02:55.300 --> 01:02:57.900]  try out challenges after they've been solved.
[01:02:57.900 --> 01:02:59.820]  Normally for a lot of CTFs
[01:02:59.820 --> 01:03:01.760]  people publish write-ups.
[01:03:01.760 --> 01:03:03.360]  So you can try the challenges
[01:03:03.360 --> 01:03:05.340]  that you didn't manage to solve
[01:03:05.340 --> 01:03:07.660]  and then use a write-up or so
[01:03:07.660 --> 01:03:09.620]  as a reference and then guide
[01:03:09.620 --> 01:03:11.420]  your attempt as well
[01:03:11.420 --> 01:03:13.000]  to learn more.
[01:03:13.440 --> 01:03:15.760]  I think the idea is that we are releasing
[01:03:15.760 --> 01:03:17.860]  all the challenges. It might take
[01:03:17.960 --> 01:03:19.940]  a few days for us to recover from this
[01:03:19.940 --> 01:03:21.180]  weekend. We have
[01:03:21.820 --> 01:03:23.220]  15 matches, so
[01:03:24.100 --> 01:03:25.520]  another 11 matches
[01:03:25.520 --> 01:03:27.800]  to go after this one.
[01:03:28.040 --> 01:03:29.780]  But yeah, we will
[01:03:29.780 --> 01:03:31.540]  definitely publish them.
[01:03:31.920 --> 01:03:33.200]  You can even
[01:03:33.780 --> 01:03:35.320]  organize your own mini
[01:03:35.320 --> 01:03:37.900]  tournament in your own
[01:03:37.900 --> 01:03:39.280]  CTF team or
[01:03:40.040 --> 01:03:42.140]  hacker space.
[01:03:42.960 --> 01:03:43.540]  I know
[01:03:43.540 --> 01:03:45.740]  that I heard from
[01:03:45.740 --> 01:03:47.240]  before the competition that
[01:03:47.780 --> 01:03:49.760]  Shellfish actually did some practice
[01:03:49.760 --> 01:03:50.840]  for this tournament
[01:03:51.570 --> 01:03:52.980]  by doing a small
[01:03:53.780 --> 01:03:55.800]  mini competition of their
[01:03:55.800 --> 01:03:56.760]  own within the team.
[01:03:56.760 --> 01:03:58.400]  And it paid off.
[01:03:58.400 --> 01:04:00.080]  At least it appears it paid off.
[01:04:00.080 --> 01:04:02.280]  As one of the winning teams.
[01:04:02.460 --> 01:04:04.120]  Yeah, we'll see how far they can go.
[01:04:05.840 --> 01:04:06.240]  So
[01:04:06.700 --> 01:04:08.680]  we have the hints prepared. Jordan is going to go
[01:04:08.680 --> 01:04:10.640]  and hand that off to the players.
[01:04:11.640 --> 01:04:12.440]  We are...
[01:04:12.440 --> 01:04:13.640]  What's the clock at?
[01:04:13.640 --> 01:04:16.560]  So 5.45. So we are
[01:04:16.560 --> 01:04:18.680]  35 minutes into the game
[01:04:18.680 --> 01:04:20.160]  which means that we are running
[01:04:21.360 --> 01:04:22.840]  up against the sudden death
[01:04:22.840 --> 01:04:24.320]  clock here.
[01:04:24.320 --> 01:04:26.400]  Let's see if they can manage to figure out
[01:04:26.900 --> 01:04:28.320]  this. On the other hand, this is also kind of
[01:04:28.440 --> 01:04:29.700]  a similar situation to
[01:04:30.180 --> 01:04:32.420]  the previous challenge where we were 35 minutes
[01:04:32.420 --> 01:04:33.860]  into the game and then
[01:04:34.320 --> 01:04:36.320]  it kind of just clicked for one
[01:04:36.320 --> 01:04:38.660]  of the players and they managed to go all the way.
[01:04:38.660 --> 01:04:40.260]  So it's
[01:04:40.260 --> 01:04:42.760]  going to be really exciting to see what's going on.
[01:04:42.760 --> 01:04:43.600]  Still a bit
[01:04:44.280 --> 01:04:46.640]  difficult to get a
[01:04:46.640 --> 01:04:48.900]  read on Balson's
[01:04:48.900 --> 01:04:50.760]  progress or their understanding.
[01:04:50.760 --> 01:04:52.180]  They're kind of looking at the code, probably
[01:04:52.180 --> 01:04:54.040]  thinking very hard about it. You can see the mouse
[01:04:54.040 --> 01:04:56.080]  moving around, trying to build this
[01:04:56.080 --> 01:04:58.020]  mental model of what's going on.
[01:04:58.020 --> 01:05:00.540]  Kind of like running the code in your head.
[01:05:00.540 --> 01:05:02.300]  What if this has this value?
[01:05:02.500 --> 01:05:04.040]  It's probably the least interesting
[01:05:04.040 --> 01:05:05.960]  part of a live CTF. That's the only downside
[01:05:05.960 --> 01:05:08.300]  when you have a more reverse engineering heavy challenge.
[01:05:08.720 --> 01:05:09.740]  You're just seeing people
[01:05:09.740 --> 01:05:12.080]  maybe name stuff if you're lucky or add comments
[01:05:12.080 --> 01:05:14.660]  but most of the time it's just looking at it.
[01:05:15.180 --> 01:05:16.160]  You know you're getting
[01:05:16.160 --> 01:05:18.060]  closer when you start seeing a crash in a debugger
[01:05:18.060 --> 01:05:20.080]  and a payload being written and we
[01:05:20.080 --> 01:05:21.820]  don't have it yet. I'm going to go ahead and keep an eye
[01:05:21.820 --> 01:05:23.760]  on the organizers just briefly
[01:05:24.160 --> 01:05:26.020]  and see if we get any kind of that similar
[01:05:26.400 --> 01:05:27.040]  progress.
[01:05:27.720 --> 01:05:29.460]  So we have...
[01:05:30.720 --> 01:05:32.140]  Oh, okay. We did have a comment
[01:05:32.140 --> 01:05:34.080]  somebody else pointed out. Thank you for clarifying.
[01:05:34.900 --> 01:05:35.880]  The reason that
[01:05:35.880 --> 01:05:37.900]  somebody was looking for the libc was to actually run it
[01:05:37.900 --> 01:05:39.380]  because if you don't have the same VM
[01:05:40.560 --> 01:05:41.860]  handy, you can't run
[01:05:41.860 --> 01:05:43.900]  that libc. So you can just grab the libc
[01:05:43.900 --> 01:05:45.220]  from another version
[01:05:45.820 --> 01:05:48.000]  of Linux to be able to run the binary. So that is another
[01:05:48.000 --> 01:05:49.960]  completely valid reason that you might
[01:05:49.960 --> 01:05:52.040]  do that. Probably just
[01:05:52.040 --> 01:05:54.220]  easier to maybe look at a previous stream
[01:05:54.800 --> 01:05:56.380]  or... I don't think we
[01:05:56.380 --> 01:05:58.320]  told people what platform
[01:05:58.320 --> 01:06:00.340]  that all of our challenges were created on.
[01:06:00.340 --> 01:06:01.700]  That's actually a good note
[01:06:02.580 --> 01:06:04.200]  for future things.
[01:06:04.200 --> 01:06:05.880]  Because that's, again, normal
[01:06:05.880 --> 01:06:08.140]  in a CTF. Happens all the time. You have to figure
[01:06:08.140 --> 01:06:10.040]  out the OS that it was created for,
[01:06:10.040 --> 01:06:11.760]  match version information and whatnot.
[01:06:11.800 --> 01:06:14.100]  Not our intention to make that part of the challenge here.
[01:06:14.100 --> 01:06:15.820]  And it's a thing. It's like Ubuntu
[01:06:15.820 --> 01:06:16.820]  22 was
[01:06:17.900 --> 01:06:19.940]  somewhat recently went in LTS
[01:06:19.940 --> 01:06:21.780]  release and a lot of people
[01:06:22.540 --> 01:06:23.880]  haven't updated to that
[01:06:23.880 --> 01:06:24.740]  yet.
[01:06:25.400 --> 01:06:27.820]  I will accept
[01:06:27.820 --> 01:06:29.740]  shared responsibility on this
[01:06:29.740 --> 01:06:32.440]  because, you know, update your computers, people.
[01:06:32.860 --> 01:06:34.000]  20.04,
[01:06:34.000 --> 01:06:35.780]  22.04 would probably be the
[01:06:35.780 --> 01:06:37.520]  Ubuntu most common
[01:06:37.520 --> 01:06:39.520]  or Debian, certainly
[01:06:39.520 --> 01:06:41.640]  it's frequently. But alright, I'm going to go take a look at the ordinances
[01:06:41.640 --> 01:06:43.220]  and I'll be back and we'll see how it's going.
[01:06:43.220 --> 01:06:44.140]  Awesome.
[01:06:45.200 --> 01:06:47.140]  I was talking
[01:06:47.140 --> 01:06:48.140]  about something
[01:06:49.500 --> 01:06:51.900]  when it comes to these challenges.
[01:06:52.920 --> 01:06:55.160]  Trying to get back on my
[01:06:55.160 --> 01:06:56.960]  train of thought there.
[01:07:01.000 --> 01:07:03.060]  Oh, yes.
[01:07:05.280 --> 01:07:07.100]  Looking at another player,
[01:07:07.100 --> 01:07:09.400]  looking at code, trying to figure things out.
[01:07:09.400 --> 01:07:11.100]  A lot of times when I talk to people
[01:07:12.000 --> 01:07:12.900]  who are
[01:07:12.900 --> 01:07:15.360]  not experienced CTF players or don't know what CTFs
[01:07:15.360 --> 01:07:17.360]  are, you often get the question
[01:07:17.360 --> 01:07:19.060]  like, oh, is this some kind of
[01:07:19.060 --> 01:07:21.100]  eSports thing? Or like, could
[01:07:21.100 --> 01:07:22.440]  you make this into some kind of
[01:07:23.440 --> 01:07:25.160]  eSports thing? And to an extent
[01:07:25.160 --> 01:07:26.820]  this is kind of what we're trying to do
[01:07:26.820 --> 01:07:28.860]  here. But
[01:07:28.860 --> 01:07:31.540]  of course, it has its shortcomings
[01:07:31.540 --> 01:07:33.280]  that some aspects
[01:07:33.280 --> 01:07:34.600]  of CTF
[01:07:35.560 --> 01:07:37.180]  is kind of like watching
[01:07:37.180 --> 01:07:39.400]  someone else take a maths exam.
[01:07:39.400 --> 01:07:41.020]  It's, you know, occasionally
[01:07:41.020 --> 01:07:43.280]  not the most exciting. So we're
[01:07:43.280 --> 01:07:45.200]  really trying to, by adding this
[01:07:45.200 --> 01:07:47.380]  commentary and trying to understand what the players are doing,
[01:07:47.380 --> 01:07:49.320]  we're trying to make this an interesting and educational
[01:07:49.880 --> 01:07:51.140]  experience for all of you
[01:07:52.600 --> 01:07:54.040]  viewers there.
[01:07:54.460 --> 01:07:55.200]  So I
[01:07:55.200 --> 01:07:57.240]  hope you do
[01:07:58.940 --> 01:07:59.420]  enjoy
[01:07:59.420 --> 01:08:01.260]  this and have some takeaways.
[01:08:01.260 --> 01:08:03.040]  And definitely check out the challenges
[01:08:03.720 --> 01:08:04.200]  afterwards
[01:08:05.580 --> 01:08:07.440]  to also kind of get a feel
[01:08:08.060 --> 01:08:08.500]  for...
[01:08:09.860 --> 01:08:11.360]  Some of these might seem
[01:08:11.360 --> 01:08:13.460]  simple, but when you're sitting here and actually trying to
[01:08:13.460 --> 01:08:14.480]  do it, you have to
[01:08:15.900 --> 01:08:17.480]  consider and take into account all of these
[01:08:17.480 --> 01:08:18.980]  small little details.
[01:08:19.600 --> 01:08:21.440]  If you're just off by one,
[01:08:21.660 --> 01:08:23.500]  a small bit somewhere,
[01:08:23.500 --> 01:08:25.620]  the whole thing doesn't work,
[01:08:25.620 --> 01:08:27.800]  you need to do all this troubleshooting, debugging.
[01:08:28.840 --> 01:08:29.020]  And
[01:08:29.680 --> 01:08:31.340]  I think I mentioned it earlier, but
[01:08:31.340 --> 01:08:33.720]  when you're writing exploits,
[01:08:33.720 --> 01:08:35.240]  you are...
[01:08:35.240 --> 01:08:37.260]  Essentially, it's like software development,
[01:08:37.260 --> 01:08:39.220]  but with your hands tied behind your
[01:08:39.220 --> 01:08:41.060]  back. You don't get all the nice
[01:08:41.060 --> 01:08:43.060]  tools and helps and error messages
[01:08:43.060 --> 01:08:45.080]  that you get during normal software
[01:08:45.080 --> 01:08:47.160]  development processes, where
[01:08:47.160 --> 01:08:48.720]  you have all of these modern
[01:08:49.240 --> 01:08:51.240]  tools to help you, but here you're
[01:08:52.000 --> 01:08:52.900]  trying to bend
[01:08:52.900 --> 01:08:55.060]  something in a way that was
[01:08:55.060 --> 01:08:57.100]  not intended to
[01:08:57.100 --> 01:08:59.060]  be used. You're messing with
[01:08:59.060 --> 01:09:00.100]  the state of memory
[01:09:00.820 --> 01:09:02.140]  and so on.
[01:09:03.100 --> 01:09:04.120]  You really
[01:09:04.120 --> 01:09:05.860]  have everything stacked
[01:09:06.680 --> 01:09:08.160]  against you, and
[01:09:08.160 --> 01:09:10.200]  that is a big part of the
[01:09:10.200 --> 01:09:11.360]  challenge when doing these
[01:09:12.180 --> 01:09:15.080]  memory corruption challenges.
[01:09:15.860 --> 01:09:16.460]  Looking
[01:09:16.460 --> 01:09:18.140]  here at the code, we can
[01:09:18.140 --> 01:09:20.120]  see that the
[01:09:20.120 --> 01:09:22.220]  Bowser player is writing some small
[01:09:22.220 --> 01:09:24.420]  helper function here to send a number.
[01:09:24.660 --> 01:09:26.340]  Maybe they're going to try to
[01:09:26.340 --> 01:09:28.040]  use this to try to send
[01:09:28.220 --> 01:09:30.100]  a different number of
[01:09:30.100 --> 01:09:31.520]  numbers and
[01:09:32.100 --> 01:09:34.020]  see if they get any kind of reaction
[01:09:34.540 --> 01:09:36.460]  out of that.
[01:09:37.640 --> 01:09:38.180]  I haven't
[01:09:38.180 --> 01:09:39.960]  really seen yet
[01:09:40.760 --> 01:09:42.180]  what... oh, so now they're going to send
[01:09:42.180 --> 01:09:43.960]  like a thousand zeros. That's
[01:09:43.960 --> 01:09:44.860]  interesting.
[01:09:47.480 --> 01:09:48.000]  So we
[01:09:48.000 --> 01:09:49.960]  comment here like, yeah, it's unsolvable. Yeah, like
[01:09:49.960 --> 01:09:52.100]  the Sudoku itself is unsolvable
[01:09:52.100 --> 01:09:54.120]  and that's kind of like the twist of this whole thing.
[01:09:55.020 --> 01:09:56.000]  At face value
[01:09:56.000 --> 01:09:57.800]  you just sold a Sudoku and win,
[01:09:57.800 --> 01:09:59.540]  but then it's unsolvable.
[01:10:00.000 --> 01:10:01.440]  Yeah, that's kind of like the recap
[01:10:01.440 --> 01:10:03.880]  for people just recently tuning in.
[01:10:04.360 --> 01:10:05.740]  Speaking of recap,
[01:10:05.740 --> 01:10:07.740]  just to tell you again a little bit
[01:10:07.740 --> 01:10:09.100]  about what we're doing here.
[01:10:09.360 --> 01:10:11.340]  We're here in Vegas
[01:10:11.340 --> 01:10:13.180]  on site at DEFCON, so
[01:10:13.580 --> 01:10:15.660]  organizing this live CDF as part
[01:10:15.660 --> 01:10:16.400]  of the
[01:10:17.400 --> 01:10:19.380]  official DEFCON CDF.
[01:10:19.380 --> 01:10:21.460]  This is kind of like a sub-event where all the 16
[01:10:21.460 --> 01:10:22.780]  participating teams
[01:10:23.920 --> 01:10:25.580]  participate in this single
[01:10:25.580 --> 01:10:27.480]  elimination knockout tournament where
[01:10:27.480 --> 01:10:29.700]  in each match the teams send one
[01:10:29.700 --> 01:10:30.860]  player to go
[01:10:31.460 --> 01:10:33.380]  head-to-head against the other team
[01:10:33.380 --> 01:10:35.780]  to be the first one to solve a
[01:10:36.900 --> 01:10:37.860]  relatively simple
[01:10:37.860 --> 01:10:39.700]  CDF challenge.
[01:10:39.700 --> 01:10:41.580]  I mean, relatively is relative.
[01:10:41.580 --> 01:10:44.300]  Yes, yes. I really want to stress
[01:10:44.300 --> 01:10:46.360]  relatively. And I want to be clear, I wouldn't
[01:10:46.360 --> 01:10:47.820]  personally solve half of the ones that we're fielding
[01:10:47.820 --> 01:10:50.280]  in the allotted time.
[01:10:50.280 --> 01:10:51.840]  I tried some of them and I could
[01:10:51.840 --> 01:10:53.960]  get them, but it may be taking a little bit longer.
[01:10:53.960 --> 01:10:56.000]  I have a lot of respect for these
[01:10:56.000 --> 01:10:57.620]  people. They're all very, very good.
[01:10:58.000 --> 01:11:00.540]  And they're dealing with the pressure of being on camera.
[01:11:00.680 --> 01:11:02.120]  There's a crowd standing around
[01:11:02.120 --> 01:11:03.380]  and watching them.
[01:11:04.000 --> 01:11:05.460]  It can be
[01:11:06.440 --> 01:11:07.880]  pretty nerve-wracking.
[01:11:09.160 --> 01:11:10.120]  I'm predicting
[01:11:10.120 --> 01:11:12.060]  that is quite
[01:11:12.060 --> 01:11:13.840]  the visual effect there.
[01:11:13.840 --> 01:11:15.160]  Yeah, you know, the
[01:11:16.080 --> 01:11:17.820]  photosensitivity warnings here.
[01:11:18.180 --> 01:11:19.340]  I think it's only on our monitor.
[01:11:19.360 --> 01:11:21.900]  No, it's on stream as well.
[01:11:21.900 --> 01:11:23.940]  We have some glitching. Not sure what that's
[01:11:23.940 --> 01:11:25.620]  about. Feels like our whole
[01:11:25.620 --> 01:11:27.560]  infrastructure is slowly melting.
[01:11:27.660 --> 01:11:29.940]  No, it's fine. Wow.
[01:11:29.940 --> 01:11:30.240]  That is
[01:11:31.680 --> 01:11:32.640]  unusual.
[01:11:33.520 --> 01:11:35.620]  Maybe we're getting hacked by the players.
[01:11:35.620 --> 01:11:38.000]  Through the HDMI cables.
[01:11:38.000 --> 01:11:39.260]  They're playing the other game.
[01:11:39.520 --> 01:11:41.280]  The other CTF challenge.
[01:11:41.740 --> 01:11:43.780]  We would be lying if we would say
[01:11:43.780 --> 01:11:45.660]  that we did not have a discussion about
[01:11:46.440 --> 01:11:47.700]  what shenanigans could
[01:11:47.700 --> 01:11:48.900]  the teams try to pull off.
[01:11:48.900 --> 01:11:50.940]  And how we would measure against it.
[01:11:51.520 --> 01:11:52.560]  Doing that kind of
[01:11:52.560 --> 01:11:54.180]  threat analysis
[01:11:54.180 --> 01:11:56.500]  or threat modeling.
[01:11:57.060 --> 01:11:58.520]  We have three more minutes.
[01:11:58.660 --> 01:12:00.900]  Three more minutes until it's gone.
[01:12:00.900 --> 01:12:03.060]  This has been a very fast 45 minutes.
[01:12:03.400 --> 01:12:04.580]  It's looking unlikely
[01:12:05.540 --> 01:12:06.860]  that either one... I did see
[01:12:06.860 --> 01:12:08.420]  some debugger action.
[01:12:09.320 --> 01:12:11.240]  I'm going to make one last pass.
[01:12:11.240 --> 01:12:12.560]  If we see somebody very close,
[01:12:12.560 --> 01:12:14.540]  they're making progress, we might be able to give them
[01:12:14.540 --> 01:12:16.560]  just a little bit extra. But basically,
[01:12:16.560 --> 01:12:17.720]  we're about ready to deploy.
[01:12:20.460 --> 01:12:22.320]  Or if they actually want to extend it.
[01:12:23.460 --> 01:12:24.280]  That's not a bad idea.
[01:12:24.800 --> 01:12:26.520]  If they both say they want to extend it,
[01:12:26.520 --> 01:12:28.180]  we'll let them go because they're the last one.
[01:12:28.960 --> 01:12:30.840]  So the rules are, if one of them
[01:12:30.840 --> 01:12:32.580]  says they want to go sudden death,
[01:12:32.580 --> 01:12:34.420]  then we go sudden death. If both of them want to extend it,
[01:12:34.420 --> 01:12:35.100]  then it's fine.
[01:12:35.560 --> 01:12:36.840]  But ask them
[01:12:40.860 --> 01:12:42.020]  one on one.
[01:12:42.200 --> 01:12:43.820]  To not give any pressure.
[01:12:44.480 --> 01:12:45.260]  Yeah, I mean,
[01:12:45.260 --> 01:12:48.020]  it would be cool to see a solution on this.
[01:12:48.020 --> 01:12:49.480]  And I think we do,
[01:12:49.480 --> 01:12:51.260]  since we have been keeping up with the schedule,
[01:12:51.260 --> 01:12:53.260]  we do have that kind of time.
[01:12:54.520 --> 01:12:55.540]  But again,
[01:12:55.540 --> 01:12:57.480]  yeah, it's difficult
[01:12:57.480 --> 01:12:59.660]  to say what the players want.
[01:12:59.660 --> 01:13:02.000]  This is also kind of like a game theory thing.
[01:13:02.000 --> 01:13:03.680]  Do you want to go to sudden death or not?
[01:13:03.680 --> 01:13:05.460]  It's a high risk
[01:13:06.120 --> 01:13:07.020]  environment, right?
[01:13:07.020 --> 01:13:08.820]  When you're going super fast.
[01:13:09.080 --> 01:13:11.420]  Do you think, because you also don't know
[01:13:11.420 --> 01:13:13.100]  the progress of the other player,
[01:13:13.100 --> 01:13:15.500]  do you think you have better progress than the other
[01:13:15.500 --> 01:13:17.580]  player in this challenge right now?
[01:13:17.580 --> 01:13:19.640]  And if you don't,
[01:13:19.640 --> 01:13:21.440]  do you think you have a better chance of
[01:13:21.440 --> 01:13:23.380]  beating them in the sudden death one versus
[01:13:23.380 --> 01:13:25.680]  catching up with them in the parent challenge?
[01:13:25.680 --> 01:13:27.460]  It's definitely
[01:13:27.460 --> 01:13:29.360]  not an easy decision
[01:13:29.360 --> 01:13:31.200]  to make by the players.
[01:13:31.820 --> 01:13:33.100]  So, what's
[01:13:33.100 --> 01:13:35.520]  the verdict? What do you think?
[01:13:35.900 --> 01:13:37.580]  If you're in their shoes...
[01:13:37.580 --> 01:13:39.360]  Oh no, I would say extend it. Absolutely.
[01:13:40.140 --> 01:13:41.720]  We have a game here.
[01:13:42.600 --> 01:13:43.720]  I'm happy with this
[01:13:43.720 --> 01:13:45.140]  because I don't want to change the rules
[01:13:45.140 --> 01:13:46.600]  in a way that they're unhappy with, but
[01:13:46.600 --> 01:13:49.500]  they both want to solve it. Nobody wants to give up
[01:13:49.500 --> 01:13:51.360]  on a challenge that you've been
[01:13:51.360 --> 01:13:53.440]  working hard, that you have a little
[01:13:53.440 --> 01:13:55.320]  bit of an idea. I'm glad.
[01:13:55.320 --> 01:13:56.960]  I really want to see them see this through.
[01:13:56.960 --> 01:13:58.840]  We'll let them go. It's the last one of the day,
[01:13:58.840 --> 01:14:00.740]  so we're not running over anything else.
[01:14:01.700 --> 01:14:02.880]  I'm actually kind of excited.
[01:14:03.200 --> 01:14:05.260]  So, a story
[01:14:05.260 --> 01:14:07.260]  related to that. So, I was playing
[01:14:07.260 --> 01:14:08.840]  in the qualifiers for the DEF CON
[01:14:09.360 --> 01:14:11.400]  CTF with our Scandinavian
[01:14:11.400 --> 01:14:13.160]  team, NorseCode,
[01:14:13.160 --> 01:14:15.020]  and I was basically sitting
[01:14:15.020 --> 01:14:16.880]  all weekend with one challenge.
[01:14:17.200 --> 01:14:19.240]  I mean, I took breaks and met some friends
[01:14:19.240 --> 01:14:21.600]  and stuff, but there was a lot of hours.
[01:14:21.600 --> 01:14:23.680]  This was Paris Challenge? This was Paris Challenge.
[01:14:23.820 --> 01:14:25.220]  It was the crypto-pwnable
[01:14:25.220 --> 01:14:27.120]  thing. So, after... I don't know
[01:14:27.120 --> 01:14:28.980]  if I spent... I don't remember
[01:14:28.980 --> 01:14:30.980]  if it was like 10, 20, or 30 hours on this, but
[01:14:30.980 --> 01:14:32.720]  regardless, I
[01:14:33.260 --> 01:14:35.340]  solved it like two minutes after
[01:14:35.340 --> 01:14:36.980]  the CTF ended.
[01:14:36.980 --> 01:14:39.040]  And that... yeah.
[01:14:39.060 --> 01:14:41.800]  On the one hand, it's crushing, and on the other hand, though,
[01:14:41.800 --> 01:14:43.100]  you still solved it.
[01:14:43.100 --> 01:14:45.200]  You still solved it. And that's the thing.
[01:14:46.140 --> 01:14:46.580]  When
[01:14:47.140 --> 01:14:49.300]  the time ran out, I could
[01:14:49.300 --> 01:14:50.580]  have just stopped, because
[01:14:51.940 --> 01:14:53.340]  it doesn't matter anymore.
[01:14:53.340 --> 01:14:54.700]  We're not going to get any points.
[01:14:54.700 --> 01:14:57.180]  I was so close. I did not want
[01:14:57.180 --> 01:14:58.180]  to stop there.
[01:14:59.000 --> 01:14:59.700]  So, the only
[01:15:02.460 --> 01:15:03.340]  saving grace
[01:15:03.340 --> 01:15:05.200]  or you want to call it for that, was that
[01:15:05.200 --> 01:15:07.300]  in the end, solving that
[01:15:07.300 --> 01:15:09.200]  challenge or not would not have affected whether
[01:15:09.200 --> 01:15:11.220]  we qualified or not. That would have been
[01:15:11.220 --> 01:15:13.120]  crushing. That's a little demoralizing.
[01:15:13.120 --> 01:15:15.200]  It would have been the difference. Luckily, even
[01:15:15.200 --> 01:15:17.320]  with those points, we would have been just
[01:15:17.320 --> 01:15:19.200]  below the qualifying limit.
[01:15:19.200 --> 01:15:21.000]  So, at least you had clarity there
[01:15:21.000 --> 01:15:23.600]  either way. Yeah, I was comfortable with that.
[01:15:23.600 --> 01:15:24.860]  That was fine. And also, that means that
[01:15:24.860 --> 01:15:25.580]  I could
[01:15:26.900 --> 01:15:29.460]  be part of this without having to
[01:15:30.340 --> 01:15:31.480]  betray the team,
[01:15:31.480 --> 01:15:33.540]  right? So, yeah.
[01:15:33.680 --> 01:15:34.940]  Turned out okay.
[01:15:35.180 --> 01:15:37.480]  So, we are...
[01:15:39.240 --> 01:15:39.960]  There's a
[01:15:39.960 --> 01:15:41.720]  question here about whether it was
[01:15:41.720 --> 01:15:44.880]  NCATS. No, this was the
[01:15:45.800 --> 01:15:47.860]  crypto-pwnable
[01:15:48.000 --> 01:15:48.400]  challenge.
[01:15:48.400 --> 01:15:50.840]  It was about a function closure thing.
[01:15:50.840 --> 01:15:52.460]  C++. We could go ask
[01:15:52.460 --> 01:15:53.940]  Perry. She's somewhere. She just
[01:15:53.940 --> 01:15:56.460]  was in the room. She just left. Right.
[01:15:56.460 --> 01:15:58.560]  But, yeah, I've heard a number of people
[01:15:58.560 --> 01:15:59.560]  that worked on that. It was a great challenge.
[01:15:59.560 --> 01:16:02.000]  I enjoyed it a lot.
[01:16:02.960 --> 01:16:04.100]  But it was tough.
[01:16:04.140 --> 01:16:05.220]  Okay. So,
[01:16:05.820 --> 01:16:07.700]  we don't have a hard time with it now.
[01:16:07.700 --> 01:16:09.440]  Now, it's basically we're just going to let it go
[01:16:09.440 --> 01:16:11.620]  until either we are convinced it's going
[01:16:11.620 --> 01:16:13.120]  to take way too long or
[01:16:15.140 --> 01:16:15.860]  we'll see
[01:16:15.860 --> 01:16:17.680]  at this point. But they both want to
[01:16:17.680 --> 01:16:19.700]  keep going. I would love for one of them
[01:16:19.700 --> 01:16:21.700]  to get it. It not only means we get to save
[01:16:21.700 --> 01:16:23.600]  one of our sudden deaths, but I think
[01:16:23.600 --> 01:16:25.720]  it's just way more fulfilling for them and for the audience
[01:16:25.720 --> 01:16:27.680]  to see the hard
[01:16:27.680 --> 01:16:29.660]  one solved. So, we're looking forward to
[01:16:29.660 --> 01:16:30.360]  it.
[01:16:31.580 --> 01:16:33.540]  It is interesting that we've got rock gadget
[01:16:33.540 --> 01:16:35.780]  address. It looks like
[01:16:35.900 --> 01:16:37.580]  a template, I think, that this existed because
[01:16:37.580 --> 01:16:39.700]  hopefully they have an idea that that
[01:16:39.700 --> 01:16:40.600]  is...
[01:16:41.600 --> 01:16:43.420]  Someone is writing something very deliberate
[01:16:43.420 --> 01:16:45.680]  here, right? This is like to print
[01:16:45.680 --> 01:16:47.260]  out the board
[01:16:47.260 --> 01:16:48.280]  somehow, but
[01:16:50.080 --> 01:16:51.620]  let's see. They are
[01:16:54.220 --> 01:16:55.640]  trying to see. I mean, this
[01:16:55.640 --> 01:16:57.500]  double loop there is to print out some
[01:16:57.500 --> 01:17:00.000]  state, but that part above,
[01:17:00.000 --> 01:17:01.300]  you see something where they're
[01:17:01.300 --> 01:17:03.620]  cutting off. They're swapping.
[01:17:06.560 --> 01:17:07.760]  All right.
[01:17:08.700 --> 01:17:09.660]  Oh, is this just
[01:17:09.660 --> 01:17:10.820]  to generate
[01:17:12.560 --> 01:17:13.540]  a solution that they
[01:17:13.540 --> 01:17:15.340]  want? I mean, I would just search the internet for
[01:17:15.340 --> 01:17:17.380]  solve Sudoku board and copy and paste it, but
[01:17:17.380 --> 01:17:19.580]  if that is what they're doing, that would be
[01:17:19.580 --> 01:17:21.620]  valid too. Right. So, the idea is that you want
[01:17:21.620 --> 01:17:23.460]  to overflow and stuff to basically
[01:17:25.040 --> 01:17:25.560]  insert...
[01:17:25.560 --> 01:17:27.600]  to modify the state into something
[01:17:27.600 --> 01:17:29.480]  that's either solvable or
[01:17:29.480 --> 01:17:30.780]  already solved.
[01:17:31.860 --> 01:17:33.600]  And so, they need to
[01:17:33.600 --> 01:17:35.680]  have that. Okay. So, we're seeing
[01:17:35.680 --> 01:17:37.940]  interesting. We're seeing calculations. We're seeing
[01:17:37.940 --> 01:17:40.080]  length calculations.
[01:17:41.840 --> 01:17:43.560]  Unfortunately, I was hoping we'd get some
[01:17:43.560 --> 01:17:44.000]  more
[01:17:45.380 --> 01:17:48.360]  video from the new organizer. Oh, it came in briefly.
[01:17:48.380 --> 01:17:49.260]  Yes.
[01:17:49.300 --> 01:17:51.700]  There was some debugger output there, right?
[01:17:51.700 --> 01:17:53.860]  Yeah. Yeah. We'll leave it up for a second
[01:17:53.860 --> 01:17:55.620]  and just kind of show them both and we might be able to see
[01:17:55.800 --> 01:17:57.980]  a little bit. Yep. Yep. See there? It's coming on.
[01:17:58.440 --> 01:17:59.600]  Man, that's tantalizing.
[01:17:59.600 --> 01:18:01.100]  That's so mean. Yeah.
[01:18:01.100 --> 01:18:03.760]  This cable has been...
[01:18:03.760 --> 01:18:05.600]  Yeah. We might have to do some
[01:18:05.600 --> 01:18:07.760]  shopping. Oh, there is definitely a shopping run tonight.
[01:18:07.760 --> 01:18:09.540]  Yes. So, we should be able to have this solved
[01:18:09.940 --> 01:18:11.600]  and out of the way. And that way
[01:18:11.600 --> 01:18:13.460]  we got a long day, eight hours tomorrow
[01:18:13.460 --> 01:18:16.000]  of hopefully uninterrupted stream.
[01:18:16.380 --> 01:18:17.720]  Yeah. We'll see. We'll see if that
[01:18:17.720 --> 01:18:19.660]  turns out to be the case. I mean, given that it's only
[01:18:19.660 --> 01:18:21.800]  been... we swapped out
[01:18:21.800 --> 01:18:23.580]  the capture card, the USB-C
[01:18:23.580 --> 01:18:25.640]  cable. The HDMI is the only thing we
[01:18:25.640 --> 01:18:27.740]  haven't swapped out, but it's been that same side of the
[01:18:27.740 --> 01:18:29.880]  table consistently. Yes.
[01:18:29.880 --> 01:18:31.260]  That's been having these problems.
[01:18:31.720 --> 01:18:33.380]  Makes me think that, yeah, we've just got
[01:18:33.380 --> 01:18:34.660]  an HDMI cable that
[01:18:35.900 --> 01:18:36.980]  is suspicious.
[01:18:37.640 --> 01:18:39.480]  So, we'll see if we
[01:18:39.480 --> 01:18:41.060]  can get that going. All right.
[01:18:41.740 --> 01:18:43.580]  Actually, I'm going to go ahead and do another
[01:18:43.580 --> 01:18:45.480]  in-person look. I'm going to go ahead and take a look at new
[01:18:45.480 --> 01:18:47.620]  organizers. We'll be back with an
[01:18:47.620 --> 01:18:49.540]  update shortly. Debugger is
[01:18:49.540 --> 01:18:51.200]  generally a good sign. Yes.
[01:18:51.640 --> 01:18:52.480]  Oh, wait.
[01:18:54.000 --> 01:18:55.660]  I saw a bin bash
[01:18:55.660 --> 01:18:57.180]  string in the debugger there
[01:18:57.180 --> 01:18:58.180]  somehow.
[01:18:59.620 --> 01:19:01.800]  But that doesn't really make sense, right?
[01:19:01.800 --> 01:19:03.520]  Well, I mean, with the intended
[01:19:03.520 --> 01:19:05.620]  solution, that doesn't mean they're not going to do...
[01:19:06.340 --> 01:19:07.620]  And there also is the...
[01:19:08.660 --> 01:19:09.560]  So, I'm trying to remember
[01:19:09.560 --> 01:19:11.720]  how the win function runs.
[01:19:11.720 --> 01:19:13.400]  It may be from the win function
[01:19:13.960 --> 01:19:15.460]  on the stack as well, too.
[01:19:15.460 --> 01:19:17.460]  I don't remember. But no, they shouldn't be getting to
[01:19:17.460 --> 01:19:19.380]  that. Yes. Let's see. I don't
[01:19:19.380 --> 01:19:21.400]  see the...
[01:19:21.400 --> 01:19:22.720]  In the meantime, I wanted to
[01:19:23.860 --> 01:19:25.700]  just ask people who are
[01:19:26.160 --> 01:19:27.420]  watching whether you are
[01:19:28.020 --> 01:19:29.480]  like... Is anyone here
[01:19:29.480 --> 01:19:31.400]  in Vegas attending
[01:19:31.400 --> 01:19:33.480]  DEF CON? Or are you watching from
[01:19:34.200 --> 01:19:35.560]  all over the world?
[01:19:35.560 --> 01:19:37.140]  Like, who do we have here?
[01:19:37.140 --> 01:19:39.480]  We saw someone from Kenya even chimed in earlier
[01:19:39.480 --> 01:19:41.680]  and said they were watching. So, we know we do have
[01:19:42.280 --> 01:19:43.880]  some worldwide watchers.
[01:19:43.880 --> 01:19:45.860]  We'll go and see those analytics afterwards
[01:19:45.860 --> 01:19:47.400]  to see who's watching.
[01:19:48.580 --> 01:19:49.140]  But, yeah.
[01:19:49.420 --> 01:19:51.740]  Do we have any people? By the way,
[01:19:51.740 --> 01:19:52.600]  if you are
[01:19:54.040 --> 01:19:55.960]  here at DEF CON,
[01:19:55.960 --> 01:19:57.620]  feel free to come by
[01:19:57.620 --> 01:20:00.060]  in the CTF area.
[01:20:01.000 --> 01:20:01.800]  We probably won't be able to
[01:20:01.800 --> 01:20:03.840]  talk a ton, but hopefully
[01:20:03.840 --> 01:20:05.740]  we get some breaks. If you come during matches,
[01:20:05.740 --> 01:20:07.920]  you can watch the matches. If you come between matches,
[01:20:07.920 --> 01:20:09.680]  you can have a chat with
[01:20:09.680 --> 01:20:11.980]  us, hopefully, if we're not panicking.
[01:20:12.780 --> 01:20:14.100]  Yeah, someone's watching
[01:20:14.100 --> 01:20:16.420]  from the CTF floor. Okay, nice.
[01:20:16.420 --> 01:20:17.800]  And also from Europe.
[01:20:17.800 --> 01:20:19.780]  In the hotel room, giving your feet a break.
[01:20:19.780 --> 01:20:22.240]  Yeah, that's a wise decision, I think.
[01:20:22.240 --> 01:20:24.200]  I'm ready for my feet,
[01:20:24.200 --> 01:20:25.940]  my throat, like, several
[01:20:25.940 --> 01:20:26.700]  parts of me need a break.
[01:20:27.400 --> 01:20:29.160]  We've been talking here for several hours now.
[01:20:29.160 --> 01:20:31.960]  This is interesting. These ASCII
[01:20:31.960 --> 01:20:34.060]  values are being converted to integers.
[01:20:34.860 --> 01:20:35.880]  So, we're
[01:20:35.880 --> 01:20:37.860]  looking at debugger dump of the game state.
[01:20:37.860 --> 01:20:38.240]  Nice.
[01:20:38.240 --> 01:20:40.180]  So, we do see
[01:20:40.180 --> 01:20:42.180]  the game state. It's
[01:20:42.180 --> 01:20:44.100]  really obvious to see those numbers.
[01:20:44.360 --> 01:20:45.120]  Cool.
[01:20:47.000 --> 01:20:48.100]  Yeah, and you can
[01:20:48.100 --> 01:20:50.360]  see, look at that base
[01:20:50.880 --> 01:20:52.060]  thing there. You have, like,
[01:20:52.060 --> 01:20:54.040]  generating a list of integers from 0 to
[01:20:54.040 --> 01:20:55.380]  96, which is
[01:20:56.220 --> 01:20:57.100]  interesting.
[01:20:58.060 --> 01:20:58.940]  Yeah.
[01:20:59.920 --> 01:21:02.480]  We have watchers from Estonia and Brazil.
[01:21:02.480 --> 01:21:03.980]  People who are saying they want to go
[01:21:03.980 --> 01:21:06.300]  visit DEF CON in the future. Yeah, I think
[01:21:06.300 --> 01:21:08.220]  DEF CON is a cool event to
[01:21:08.220 --> 01:21:10.220]  visit. I think they're
[01:21:10.220 --> 01:21:12.140]  trying to increase the amount of streaming and online
[01:21:12.140 --> 01:21:14.220]  presence as well, too. So, you probably will be able to find
[01:21:14.220 --> 01:21:16.320]  other streams. I think there's
[01:21:16.320 --> 01:21:17.840]  even some webcam, like, 360-degree
[01:21:17.840 --> 01:21:20.320]  virtual cameras they're putting up in a couple of the rooms where you can
[01:21:20.320 --> 01:21:22.260]  watch what's going on. So, they're trying
[01:21:22.260 --> 01:21:24.200]  to improve the accessibility.
[01:21:24.200 --> 01:21:26.060]  I mean, certainly with COVID,
[01:21:26.060 --> 01:21:28.340]  in general, most conferences have tried to
[01:21:28.340 --> 01:21:30.140]  adapt better for... Oh, okay, we have
[01:21:30.140 --> 01:21:32.240]  somebody watching right next to our
[01:21:32.240 --> 01:21:33.900]  camera. Let's hope they don't bump it.
[01:21:36.880 --> 01:21:38.420]  But, anyway, again,
[01:21:38.420 --> 01:21:40.380]  checking the code here
[01:21:40.380 --> 01:21:42.440]  they're writing. I'm trying
[01:21:42.440 --> 01:21:44.660]  to get a better feel for what they're doing.
[01:21:45.440 --> 01:21:46.700]  Again, they're generating
[01:21:47.060 --> 01:21:48.740]  a list of numbers.
[01:21:49.400 --> 01:21:50.360]  Okay. Also, they
[01:21:50.360 --> 01:21:52.480]  need to find the right offset
[01:21:52.480 --> 01:21:54.360]  for their overflow. This actually looks
[01:21:54.360 --> 01:21:56.360]  really good. Yes. This actually does look really
[01:21:56.360 --> 01:21:58.420]  good. I'm glad we let them go. Because once they finish this...
[01:21:58.420 --> 01:22:00.020]  Yeah, if they get the right offsets.
[01:22:00.020 --> 01:22:02.680]  Let me go look at the other one, but we might be closing in. Yes.
[01:22:06.420 --> 01:22:06.700]  So,
[01:22:06.700 --> 01:22:07.620]  that's really cool.
[01:22:08.300 --> 01:22:10.820]  Once they get that thing, it's going to be real quick.
[01:22:10.820 --> 01:22:13.000]  We are probably going to miss...
[01:22:13.000 --> 01:22:14.340]  There's a big risk we're going to miss
[01:22:14.340 --> 01:22:16.600]  the moment. So, basically,
[01:22:16.600 --> 01:22:18.660]  if I'm reading this correctly, what they're trying to
[01:22:18.660 --> 01:22:20.920]  do is find the offset in memory.
[01:22:20.920 --> 01:22:22.660]  Like, they're overflowing
[01:22:22.660 --> 01:22:24.820]  something, and then how far
[01:22:24.820 --> 01:22:26.560]  into this do they want to put
[01:22:26.560 --> 01:22:28.500]  whatever they are placing there,
[01:22:28.500 --> 01:22:30.520]  which should be the solved or solvable
[01:22:31.580 --> 01:22:32.460]  state.
[01:22:34.380 --> 01:22:35.260]  So,
[01:22:35.260 --> 01:22:37.520]  yeah, they might definitely be on to something.
[01:22:37.520 --> 01:22:39.200]  They're switching the numbers around
[01:22:39.320 --> 01:22:41.080]  a little bit. Maybe it's that they
[01:22:41.080 --> 01:22:43.980]  switched the zeros to a one,
[01:22:44.980 --> 01:22:45.480]  which
[01:22:45.480 --> 01:22:48.100]  seems to have crashed the program.
[01:22:48.260 --> 01:22:48.480]  And then
[01:22:50.000 --> 01:22:51.920]  checking why this is happening.
[01:22:52.920 --> 01:22:53.300]  Yeah, we
[01:22:53.300 --> 01:22:55.420]  have someone from Morocco as well. Cool.
[01:22:57.400 --> 01:22:57.900]  It's
[01:22:57.900 --> 01:22:59.860]  cool to see we have people all over.
[01:23:00.680 --> 01:23:01.580]  I guess
[01:23:01.580 --> 01:23:02.920]  I'm trying to
[01:23:04.340 --> 01:23:05.100]  work out
[01:23:05.100 --> 01:23:07.060]  what time it is across the world
[01:23:07.060 --> 01:23:08.280]  at the moment.
[01:23:09.240 --> 01:23:09.340]  But
[01:23:10.620 --> 01:23:12.760]  people watching from Europe, it's like
[01:23:12.760 --> 01:23:14.380]  in the middle of the night there.
[01:23:14.920 --> 01:23:15.840]  So, that's
[01:23:16.980 --> 01:23:18.020]  dedication.
[01:23:19.180 --> 01:23:20.980]  Hope you're enjoying it.
[01:23:21.440 --> 01:23:22.640]  Trying to see here,
[01:23:22.640 --> 01:23:25.520]  they're just quickly looking at the disassembly again.
[01:23:27.040 --> 01:23:27.560]  Trying
[01:23:27.560 --> 01:23:28.200]  to
[01:23:29.320 --> 01:23:30.780]  maybe looking for some specific
[01:23:30.780 --> 01:23:32.600]  offset or so.
[01:23:35.140 --> 01:23:36.520]  Yes, they did get
[01:23:36.520 --> 01:23:39.080]  some specific offset to put a
[01:23:40.620 --> 01:23:41.220]  breakpoint
[01:23:41.220 --> 01:23:43.220]  there, right? And then they're also looking
[01:23:43.220 --> 01:23:45.580]  at the base.
[01:23:45.580 --> 01:23:47.120]  Oh, yeah, to make the breakpoint.
[01:23:47.120 --> 01:23:51.620]  Or maybe not the breakpoint, or the
[01:23:51.620 --> 01:23:55.180]  offset, where to inspect the memory.
[01:23:55.180 --> 01:23:57.380]  Oh, yeah.
[01:23:57.380 --> 01:23:58.460]  People saying they're watching from like, yeah,
[01:23:58.460 --> 01:23:59.820]  definitely middle of the night.
[01:24:00.840 --> 01:24:01.520]  You know.
[01:24:05.990 --> 01:24:06.690]  Awesome.
[01:24:06.690 --> 01:24:08.370]  Netherlands represented as well.
[01:24:08.570 --> 01:24:10.590]  So, I'm seeing some interesting
[01:24:10.590 --> 01:24:12.510]  stuff there, but what
[01:24:12.510 --> 01:24:13.150]  did you see
[01:24:14.590 --> 01:24:16.490]  from the organizers?
[01:24:16.490 --> 01:24:17.990]  Yeah, so the...
[01:24:17.990 --> 01:24:20.330]  I mean, I hate to take bets.
[01:24:20.350 --> 01:24:23.150]  Because I've lost a lot of money at this table so far.
[01:24:23.570 --> 01:24:26.770]  If this was a
[01:24:26.770 --> 01:24:29.030]  gambling arrangement, I would not be doing so well.
[01:24:29.030 --> 01:24:30.810]  But, I will...
[01:24:30.810 --> 01:24:33.190]  I also feel like I tend to favor my side of the table.
[01:24:33.190 --> 01:24:34.890]  And then we've had all these surprise victories
[01:24:34.890 --> 01:24:37.130]  from the other ones pop up several times.
[01:24:37.130 --> 01:24:39.410]  But, all that said,
[01:24:39.410 --> 01:24:40.550]  I do think Team Taiwan
[01:24:41.530 --> 01:24:42.970]  has a little bit of a leap. So, looking
[01:24:42.970 --> 01:24:45.090]  at the new organizers, we've got
[01:24:45.270 --> 01:24:47.130]  a script. It has a bunch of...
[01:24:47.130 --> 01:24:48.970]  It's a mixture of GDB, some
[01:24:48.970 --> 01:24:50.770]  PwnTools, and then as well as, you know, sending inputs
[01:24:50.770 --> 01:24:52.090]  and kind of breaking in.
[01:24:52.570 --> 01:24:54.850]  I didn't get the sense that they had
[01:24:55.370 --> 01:24:56.850]  an overall plan
[01:24:56.850 --> 01:24:58.530]  for what to do.
[01:24:59.110 --> 01:25:00.870]  But again, definitely
[01:25:00.870 --> 01:25:02.490]  the one thing I've learned is that I don't know
[01:25:02.490 --> 01:25:04.890]  what I'm doing anyways. It is really hard
[01:25:04.890 --> 01:25:06.510]  to understand exactly what's going on in their head.
[01:25:06.510 --> 01:25:07.950]  So, you're not always right.
[01:25:09.270 --> 01:25:10.530]  Whereas, I will say
[01:25:14.350 --> 01:25:15.070]  it certainly
[01:25:15.070 --> 01:25:16.550]  looks like with that offset, right?
[01:25:16.550 --> 01:25:18.910]  We're seeing a valid, solved
[01:25:18.910 --> 01:25:20.890]  Sudoku trying to find the right
[01:25:20.890 --> 01:25:23.030]  offset to line it up. Which sounds
[01:25:23.030 --> 01:25:24.630]  like, from what I understand of it,
[01:25:24.630 --> 01:25:26.370]  is the intended solution.
[01:25:27.970 --> 01:25:28.410]  So...
[01:25:29.050 --> 01:25:30.230]  We'll see.
[01:25:31.870 --> 01:25:32.570]  Yep.
[01:25:34.370 --> 01:25:34.810]  It's...
[01:25:35.690 --> 01:25:36.330]  Can we
[01:25:36.330 --> 01:25:38.450]  get some confirmation?
[01:25:38.450 --> 01:25:39.730]  Is the solution...
[01:25:39.730 --> 01:25:42.410]  If it's just misaligning the correct board, the certain number of
[01:25:42.410 --> 01:25:44.350]  bytes, will that trigger it, essentially?
[01:25:45.870 --> 01:25:46.750]  Any correct board
[01:25:46.750 --> 01:25:48.390]  at the right offset. So just put the right amount
[01:25:48.390 --> 01:25:50.490]  of padding bytes in, and then it will overwrite it the right...
[01:25:59.400 --> 01:26:00.440]  Say again?
[01:26:07.030 --> 01:26:07.910]  Yep.
[01:26:09.290 --> 01:26:09.690]  Uh...
[01:26:10.290 --> 01:26:12.150]  Then you mark it as solved? Yeah.
[01:26:19.720 --> 01:26:20.100]  Oh, just
[01:26:20.100 --> 01:26:22.260]  send anything, and it will just mark it as solved?
[01:26:22.520 --> 01:26:23.320]  Right.
[01:26:24.140 --> 01:26:25.420]  Okay. So what
[01:26:25.860 --> 01:26:27.760]  our producer there said was that
[01:26:29.000 --> 01:26:30.140]  first you send
[01:26:31.240 --> 01:26:32.180]  a solvable state,
[01:26:32.180 --> 01:26:33.140]  you overwrite the
[01:26:34.820 --> 01:26:35.960]  thing, the state, with
[01:26:35.960 --> 01:26:37.880]  the solvable one, and then you just send something to
[01:26:38.440 --> 01:26:39.740]  trigger the recheck, and then
[01:26:39.740 --> 01:26:42.080]  have it be solved, and then you get the win
[01:26:42.080 --> 01:26:43.540]  there.
[01:26:45.880 --> 01:26:47.960]  We can see here,
[01:26:47.960 --> 01:26:50.460]  they are working out in a text editor...
[01:26:50.460 --> 01:26:52.300]  Yeah, it still looks like they're trying to solve
[01:26:52.300 --> 01:26:54.120]  the state as it exists, not
[01:26:54.120 --> 01:26:54.940]  overwrite
[01:26:56.560 --> 01:26:58.140]  the state with their
[01:26:58.140 --> 01:27:00.120]  solve. So what I saw, I wonder...
[01:27:00.760 --> 01:27:01.740]  I'm a little afraid
[01:27:01.740 --> 01:27:04.000]  they got the overwrite, but if their exploit
[01:27:04.000 --> 01:27:06.000]  didn't try to send another round
[01:27:06.000 --> 01:27:07.920]  for validation, it
[01:27:07.920 --> 01:27:10.360]  overwrote it, but then never...
[01:27:10.360 --> 01:27:12.340]  Oh, wow. That would be
[01:27:13.000 --> 01:27:13.880]  terrible.
[01:27:14.260 --> 01:27:16.320]  So it is possible that they potentially had
[01:27:16.320 --> 01:27:18.120]  the right solution, just
[01:27:18.120 --> 01:27:20.360]  didn't re-trigger it to be
[01:27:20.360 --> 01:27:22.040]  able to actually get to the win function.
[01:27:23.860 --> 01:27:24.300]  So...
[01:27:25.580 --> 01:27:26.460]  we will
[01:27:26.460 --> 01:27:28.360]  see. We're only
[01:27:28.540 --> 01:27:30.200]  a little bit late. Actually, technically
[01:27:30.200 --> 01:27:32.600]  we have two more minutes before the original length of this.
[01:27:32.600 --> 01:27:34.240]  And we're letting them run long just because
[01:27:34.240 --> 01:27:36.140]  of the last one of the day.
[01:27:37.300 --> 01:27:38.480]  And we prefer they have a chance
[01:27:38.480 --> 01:27:39.860]  to do it if they can, but
[01:27:40.720 --> 01:27:42.240]  our voices will give out,
[01:27:42.240 --> 01:27:44.140]  and there will be some point in which we say,
[01:27:44.140 --> 01:27:45.760]  sorry, we're cutting you off.
[01:27:45.920 --> 01:27:47.700]  But none of us want that to happen, so
[01:27:48.500 --> 01:27:49.660]  we'll see.
[01:27:49.740 --> 01:27:51.780]  We're taking a bet here and
[01:27:52.660 --> 01:27:54.180]  hoping this will work.
[01:27:55.580 --> 01:27:56.360]  We're also about
[01:27:56.360 --> 01:27:58.420]  to lose power on our chat.
[01:27:58.860 --> 01:28:00.540]  Tunisia? Excellent. Welcome.
[01:28:00.540 --> 01:28:02.060]  Yeah. I've been to Tunisia
[01:28:02.060 --> 01:28:03.680]  for a CTF competition.
[01:28:04.040 --> 01:28:06.340]  I think I got invited to speak there one time
[01:28:06.340 --> 01:28:08.340]  at a conference. There we go.
[01:28:09.120 --> 01:28:10.740]  Let's see if that actually powers it.
[01:28:10.740 --> 01:28:12.480]  I don't know what this is plugged into at this point.
[01:28:13.040 --> 01:28:14.500]  Yeah. We have power on one
[01:28:14.500 --> 01:28:16.160]  of our screens here. All right, good.
[01:28:16.180 --> 01:28:18.440]  We also have a graphical glitch
[01:28:18.440 --> 01:28:20.500]  on the Balsun screen.
[01:28:20.500 --> 01:28:22.360]  But it's just blocking the ads, so I'm okay
[01:28:22.360 --> 01:28:24.440]  with it. That sounds great. I wish all
[01:28:24.440 --> 01:28:26.540]  of my graphics glitches just blocked out ads
[01:28:26.540 --> 01:28:28.300]  as I surfed on the web.
[01:28:28.620 --> 01:28:30.620]  So, as an employee of a
[01:28:30.620 --> 01:28:33.080]  big ad tech company, I would have to...
[01:28:33.080 --> 01:28:34.620]  A large tech company
[01:28:34.620 --> 01:28:37.020]  whose revenue might depend heavily on ads?
[01:28:37.020 --> 01:28:37.660]  Yeah.
[01:28:38.380 --> 01:28:39.040]  Yeah.
[01:28:40.460 --> 01:28:42.300]  Are you allowed to run ad blockers?
[01:28:42.560 --> 01:28:43.920]  Nah, I'm not going to make a tug of war.
[01:28:44.600 --> 01:28:46.500]  All right. I'm not going to do that.
[01:28:46.980 --> 01:28:48.760]  All right. So, here we go.
[01:28:52.290 --> 01:28:52.570]  So,
[01:28:53.090 --> 01:28:53.490]  this
[01:28:54.510 --> 01:28:56.470]  still feels like we're trying to solve it.
[01:28:57.270 --> 01:28:58.530]  I don't see...
[01:28:59.450 --> 01:29:00.510]  I don't see
[01:29:01.210 --> 01:29:01.610]  the...
[01:29:04.190 --> 01:29:05.390]  the exploit.
[01:29:05.390 --> 01:29:06.170]  I don't see them actually
[01:29:07.510 --> 01:29:08.290]  exploiting it.
[01:29:10.010 --> 01:29:11.530]  This might still work
[01:29:11.530 --> 01:29:13.050]  if their idea is to just
[01:29:13.890 --> 01:29:15.630]  overwrite a couple of values
[01:29:15.630 --> 01:29:17.910]  and then make it solvable and then put it in the solution.
[01:29:17.910 --> 01:29:18.990]  It's not a fast solution.
[01:29:18.990 --> 01:29:21.070]  They're going to inherently have to overwrite the whole thing though, right?
[01:29:21.070 --> 01:29:23.030]  Because they're just linearly overwriting it.
[01:29:23.030 --> 01:29:25.590]  It might be that they think they can only overwrite
[01:29:25.590 --> 01:29:27.810]  the beginning of it or something like this.
[01:29:27.810 --> 01:29:29.590]  It's still going to have a null at the end.
[01:29:29.610 --> 01:29:30.830]  No, no, no. Not necessarily.
[01:29:30.830 --> 01:29:33.210]  Because it's going to convert in... Okay, that's fair.
[01:29:33.210 --> 01:29:34.810]  I mean, it could work.
[01:29:34.810 --> 01:29:37.150]  It's not the intended play, but
[01:29:37.150 --> 01:29:39.170]  it could probably work.
[01:29:40.010 --> 01:29:41.050]  So, yeah.
[01:29:41.590 --> 01:29:43.210]  Unless there's a question mark at the very
[01:29:43.210 --> 01:29:45.050]  end of the puzzle. If there's an unallocated one
[01:29:45.050 --> 01:29:46.070]  at the very end, that
[01:29:47.170 --> 01:29:49.690]  would have to be...
[01:29:49.690 --> 01:29:50.730]  Well, we'll see.
[01:29:51.270 --> 01:29:53.250]  We'll see. All right.
[01:29:53.890 --> 01:29:54.790]  A few more...
[01:29:54.790 --> 01:29:56.390]  A few more bits.
[01:29:56.810 --> 01:29:58.670]  Thanks everybody for hanging with us. This has been
[01:29:59.210 --> 01:30:00.870]  just utterly exhausting and
[01:30:00.870 --> 01:30:02.130]  super exciting.
[01:30:02.770 --> 01:30:04.630]  Just as a quick recap from our
[01:30:04.630 --> 01:30:06.590]  earlier games, we had
[01:30:07.490 --> 01:30:08.950]  a nail-biter of a finish
[01:30:08.950 --> 01:30:10.930]  at the very beginning from Shellfish
[01:30:10.930 --> 01:30:12.370]  versus PTB WTL.
[01:30:12.370 --> 01:30:14.910]  They were, I think, within
[01:30:15.230 --> 01:30:16.810]  a few keystrokes of each other.
[01:30:16.810 --> 01:30:18.370]  You can't get a tighter match.
[01:30:18.510 --> 01:30:21.070]  We were looking at one screen...
[01:30:21.070 --> 01:30:22.230]  About to declare a winner.
[01:30:22.250 --> 01:30:25.310]  Then all of a sudden, it popped. It just was so quick.
[01:30:25.470 --> 01:30:26.530]  So that was fantastic.
[01:30:26.530 --> 01:30:29.530]  Make sure you go back and check the replay on that one.
[01:30:29.530 --> 01:30:31.650]  We're going to end the stream today
[01:30:31.650 --> 01:30:34.110]  when we're done with this particular challenge.
[01:30:34.810 --> 01:30:35.730]  Sorry about that.
[01:30:35.730 --> 01:30:37.630]  I hit the microphone. We're going to end the stream
[01:30:37.630 --> 01:30:39.650]  today once we're
[01:30:39.650 --> 01:30:40.970]  done with this challenge.
[01:30:41.230 --> 01:30:42.530]  And we wrap it up.
[01:30:43.030 --> 01:30:45.030]  But we'll be back tomorrow.
[01:30:45.090 --> 01:30:47.330]  A long day tomorrow. So the stream is going to run for
[01:30:47.330 --> 01:30:49.410]  eight hours straight. Actually, I guess nine
[01:30:49.410 --> 01:30:50.570]  at least because we've got
[01:30:51.630 --> 01:30:52.690]  eight total hours.
[01:30:53.470 --> 01:30:54.990]  Each one's a one hour thing.
[01:30:55.610 --> 01:30:57.530]  We'll see. We may end up needing a break.
[01:30:57.530 --> 01:30:59.610]  We're going to try to get breaks by trading off.
[01:30:59.610 --> 01:31:01.570]  You're going to see some guest commentators.
[01:31:01.570 --> 01:31:03.990]  We're going to have some other people come in and fill out different roles.
[01:31:03.990 --> 01:31:05.630]  Should we... I think it was already
[01:31:05.630 --> 01:31:07.650]  written on Twitter, but the idea
[01:31:07.650 --> 01:31:09.150]  is to have... We have
[01:31:10.310 --> 01:31:10.750]  LiveOverflow
[01:31:11.610 --> 01:31:13.210]  probably joining in.
[01:31:13.310 --> 01:31:14.930]  And Camoso.
[01:31:14.990 --> 01:31:16.290]  Brandon Falk.
[01:31:18.530 --> 01:31:19.410]  Two popular
[01:31:20.090 --> 01:31:21.250]  people in the
[01:31:22.090 --> 01:31:22.530]  security
[01:31:24.470 --> 01:31:25.790]  concentration space.
[01:31:27.110 --> 01:31:28.210]  I'm excited.
[01:31:28.210 --> 01:31:29.690]  Looking forward to chatting
[01:31:29.690 --> 01:31:31.790]  with both of them. And I'm also
[01:31:31.790 --> 01:31:33.690]  looking forward to have a break as we each
[01:31:33.690 --> 01:31:35.710]  get to maybe alternate
[01:31:35.710 --> 01:31:37.570]  every other round. So one of us
[01:31:37.570 --> 01:31:39.230]  will get to take a rest. And also
[01:31:39.650 --> 01:31:41.830]  make sure we give our producer, Glenn,
[01:31:42.170 --> 01:31:43.070]  a break as well.
[01:31:43.510 --> 01:31:45.190]  We'll be cycling through that.
[01:31:46.510 --> 01:31:47.210]  We've got
[01:31:47.850 --> 01:31:49.250]  a variety of different challenges.
[01:31:49.850 --> 01:31:51.970]  Maybe for any of the teams that happen to be listening,
[01:31:52.430 --> 01:31:53.550]  we want to talk about
[01:31:53.550 --> 01:31:55.590]  the overall types of challenges that
[01:31:55.590 --> 01:31:57.670]  we have. No super spoilers,
[01:31:57.670 --> 01:31:59.390]  but I will say I think we're pretty
[01:31:59.390 --> 01:32:00.390]  representative.
[01:32:01.970 --> 01:32:03.550]  Heavy pwned focus,
[01:32:03.650 --> 01:32:04.650]  a little bit of RE.
[01:32:05.090 --> 01:32:07.630]  There's certainly
[01:32:07.910 --> 01:32:09.490]  a little bit like shell coding or constrained
[01:32:09.490 --> 01:32:10.550]  exploitation.
[01:32:14.110 --> 01:32:15.750]  Just having a quick look
[01:32:15.750 --> 01:32:18.030]  here again. Yeah, trying to get caught back up.
[01:32:19.290 --> 01:32:19.890]  Oh man.
[01:32:19.890 --> 01:32:21.430]  So they have a solution there, right?
[01:32:21.430 --> 01:32:24.010]  They have a
[01:32:24.010 --> 01:32:26.210]  solved solution, but...
[01:32:26.210 --> 01:32:27.630]  Yeah. There's a
[01:32:27.630 --> 01:32:30.130]  hashtag free Jordan, Glenn and Kalle
[01:32:30.130 --> 01:32:31.330]  in the chat.
[01:32:31.330 --> 01:32:33.670]  So yeah, just to clarify, that's my
[01:32:33.670 --> 01:32:35.730]  nickname.
[01:32:35.730 --> 01:32:38.050]  Yeah.
[01:32:38.050 --> 01:32:39.930]  Jack Carter, thank you.
[01:32:39.930 --> 01:32:42.290]  I mean, thank you
[01:32:42.290 --> 01:32:43.670]  Negasoro, this random person who
[01:32:43.670 --> 01:32:46.190]  showed up in our chat. Certainly not the author
[01:32:46.190 --> 01:32:48.750]  of this particular challenge that is
[01:32:48.750 --> 01:32:49.350]  stymied our opponents
[01:32:49.350 --> 01:32:50.670]  for so long.
[01:32:52.050 --> 01:32:53.590]  But you're not wrong.
[01:32:53.590 --> 01:32:55.230]  If they just would hack harder,
[01:32:55.230 --> 01:32:56.870]  we could take a break and we could
[01:32:57.510 --> 01:32:58.970]  get some dinner.
[01:32:59.830 --> 01:33:01.570]  Let us consider this.
[01:33:01.570 --> 01:33:03.270]  I would say we are going to have to hit sudden death
[01:33:03.270 --> 01:33:05.250]  pretty soon because we're looking at another several
[01:33:05.250 --> 01:33:06.850]  minutes of sudden death as well.
[01:33:10.470 --> 01:33:11.590]  We'll take a look.
[01:33:11.590 --> 01:33:13.750]  Maybe I'll take one more pass at new organizers.
[01:33:14.130 --> 01:33:15.190]  We'll talk about having
[01:33:17.730 --> 01:33:18.130]  a...
[01:33:18.130 --> 01:33:19.830]  We'll consider what we want to go.
[01:33:20.930 --> 01:33:21.590]  Yeah.
[01:33:22.550 --> 01:33:24.370]  I'll go ahead and give a bit of a...
[01:33:24.370 --> 01:33:25.810]  Oh, just use a data glove.
[01:33:26.090 --> 01:33:28.470]  What is a data glove? That's a reference I don't get.
[01:33:28.470 --> 01:33:30.510]  Isn't that the
[01:33:31.230 --> 01:33:32.630]  game controller thing?
[01:33:32.630 --> 01:33:34.510]  No, that's a power glove.
[01:33:34.510 --> 01:33:36.590]  A child of the 80s, of course.
[01:33:36.590 --> 01:33:37.190]  Yeah.
[01:33:38.370 --> 01:33:40.550]  Sam, no trolling.
[01:33:40.550 --> 01:33:41.110]  No trolling.
[01:33:41.370 --> 01:33:41.850]  No.
[01:33:43.450 --> 01:33:45.530]  We will find you. You're in the room.
[01:33:45.530 --> 01:33:46.550]  We remember this.
[01:33:46.550 --> 01:33:48.510]  We don't talk like that.
[01:33:49.290 --> 01:33:50.650]  Next you're going to be asking for
[01:33:50.650 --> 01:33:53.250]  network forensics or something crazy.
[01:33:53.250 --> 01:33:55.190]  We might call the goons.
[01:33:55.790 --> 01:33:57.550]  I'll go check out new organizers
[01:33:57.550 --> 01:33:58.570]  and we'll be back.
[01:33:58.570 --> 01:34:01.430]  I'll give an update on the Defcon CTF
[01:34:01.430 --> 01:34:03.430]  scoreboard in the meantime.
[01:34:05.550 --> 01:34:07.430]  We have a slightly
[01:34:07.430 --> 01:34:08.750]  larger spread now
[01:34:09.730 --> 01:34:10.330]  with
[01:34:11.090 --> 01:34:13.650]  spanning from just below 14,000
[01:34:13.650 --> 01:34:14.550]  and up to
[01:34:14.550 --> 01:34:16.770]  just above 18,000 points
[01:34:17.550 --> 01:34:19.690]  between the 16th and the 1st place
[01:34:19.690 --> 01:34:21.470]  with Katsubin
[01:34:21.470 --> 01:34:23.430]  in 1st place, MMM in
[01:34:23.430 --> 01:34:25.870]  2nd place and Perfect Root in 3rd place.
[01:34:25.890 --> 01:34:27.170]  And if I'm not
[01:34:27.170 --> 01:34:28.950]  misremembering, I think
[01:34:29.570 --> 01:34:31.250]  last year we did have a top
[01:34:31.250 --> 01:34:33.070]  fight between Katsubin and
[01:34:33.650 --> 01:34:35.450]  PPP as well.
[01:34:35.450 --> 01:34:36.670]  They have kind of
[01:34:36.670 --> 01:34:38.990]  pulled ahead, those two teams, and created
[01:34:39.290 --> 01:34:41.170]  a slight gap down to 3rd place.
[01:34:41.170 --> 01:34:43.170]  I do think
[01:34:43.170 --> 01:34:44.930]  this mirrors
[01:34:44.930 --> 01:34:47.210]  some of what we saw last year
[01:34:47.210 --> 01:34:49.050]  with regards to
[01:34:49.050 --> 01:34:50.330]  the standings, but
[01:34:51.030 --> 01:34:53.410]  this is only the first day of the Defcon CTF.
[01:34:53.410 --> 01:34:55.370]  A lot of stuff can happen.
[01:34:55.770 --> 01:34:57.490]  This is far from over.
[01:34:57.830 --> 01:34:58.810]  We're going to be
[01:34:59.570 --> 01:35:00.130]  keeping
[01:35:01.290 --> 01:35:02.510]  an eye on that
[01:35:03.690 --> 01:35:05.230]  throughout the weekend and give
[01:35:05.230 --> 01:35:06.330]  you updates.
[01:35:08.290 --> 01:35:09.350]  If you're here
[01:35:09.350 --> 01:35:11.110]  in the CTF room, you can see this
[01:35:11.110 --> 01:35:12.810]  really funny
[01:35:13.830 --> 01:35:15.230]  visualization the Nautilus
[01:35:15.230 --> 01:35:17.210]  Institute have put up. It's some
[01:35:17.210 --> 01:35:19.330]  3D animation of a bunch of
[01:35:19.330 --> 01:35:22.210]  weird machines,
[01:35:22.210 --> 01:35:23.530]  one for each team,
[01:35:23.530 --> 01:35:25.310]  spitting random objects at
[01:35:25.310 --> 01:35:27.330]  the other teams. I guess
[01:35:27.330 --> 01:35:29.830]  it's showing who is attacking whom.
[01:35:29.970 --> 01:35:31.670]  Possibly there's seashells
[01:35:31.670 --> 01:35:33.490]  and stuff flying around.
[01:35:34.150 --> 01:35:35.350]  I guess there's some joke
[01:35:35.350 --> 01:35:37.390]  there about shells and seashells.
[01:35:37.390 --> 01:35:40.370]  But again,
[01:35:40.370 --> 01:35:41.250]  taking a look at
[01:35:42.750 --> 01:35:43.870]  the screen
[01:35:43.870 --> 01:35:45.730]  of Balsan here,
[01:35:45.730 --> 01:35:48.170]  I'm still not entirely sure.
[01:35:48.170 --> 01:35:48.730]  They have this
[01:35:49.490 --> 01:35:51.310]  partial solution or a solution.
[01:35:51.310 --> 01:35:53.450]  They've split up the solution into two parts
[01:35:53.450 --> 01:35:54.050]  and then
[01:35:55.850 --> 01:35:57.390]  trying to send
[01:35:57.390 --> 01:35:59.390]  some data
[01:36:00.050 --> 01:36:01.890]  and then they're sending the other solution.
[01:36:01.890 --> 01:36:04.030]  Still not exactly sure what's going on.
[01:36:06.350 --> 01:36:07.270]  So,
[01:36:07.270 --> 01:36:07.870]  we have
[01:36:07.870 --> 01:36:09.950]  data handler, crazy keyboards.
[01:36:09.950 --> 01:36:11.550]  Yeah, I will have to look that up
[01:36:12.390 --> 01:36:13.590]  afterwards.
[01:36:13.990 --> 01:36:15.790]  But yeah, I'm still thinking
[01:36:16.570 --> 01:36:17.830]  Power Gloves would
[01:36:18.610 --> 01:36:21.030]  really help out in this situation.
[01:36:21.150 --> 01:36:22.090]  Maybe you could have
[01:36:22.090 --> 01:36:24.010]  different ROP gadgets
[01:36:24.010 --> 01:36:26.250]  mapped to the different buttons
[01:36:26.250 --> 01:36:28.130]  and stuff. That's the way
[01:36:28.130 --> 01:36:30.090]  to go. Anyway,
[01:36:30.090 --> 01:36:32.230]  you can see them in the debugger
[01:36:32.230 --> 01:36:33.970]  here, inspecting the memory there
[01:36:34.150 --> 01:36:36.190]  a little bit. So I'm looking at the global
[01:36:36.190 --> 01:36:38.130]  variables. You can see you have the standard in and standard
[01:36:38.130 --> 01:36:40.210]  out objects and then further down
[01:36:40.210 --> 01:36:42.290]  they have these objects. And you can see
[01:36:42.290 --> 01:36:44.410]  the byte values
[01:36:44.410 --> 01:36:46.630]  there in the middle of the
[01:36:46.630 --> 01:36:47.850]  printed out block
[01:36:47.850 --> 01:36:50.030]  with the different digits of the
[01:36:50.030 --> 01:36:51.530]  Sudoku solution.
[01:36:54.450 --> 01:36:56.150]  Yeah, it feels
[01:36:56.150 --> 01:36:57.170]  like they are
[01:36:58.770 --> 01:37:00.230]  very close to getting
[01:37:00.230 --> 01:37:02.230]  it, but still a bit
[01:37:02.230 --> 01:37:04.630]  unsure exactly what's going on.
[01:37:08.470 --> 01:37:10.210]  Yeah, we have Jordan coming
[01:37:10.210 --> 01:37:12.170]  back here now, so we'll get an update on
[01:37:12.170 --> 01:37:14.190]  where we are. We are going to give
[01:37:14.190 --> 01:37:16.190]  them a sudden death hint. We're going to
[01:37:16.190 --> 01:37:18.210]  give them a hint that is just... because here's
[01:37:18.210 --> 01:37:19.770]  the thing that we have missed
[01:37:19.770 --> 01:37:22.050]  talking about it so far. I was looking back over with
[01:37:22.050 --> 01:37:23.210]  the example solution
[01:37:25.050 --> 01:37:25.850]  and the
[01:37:26.570 --> 01:37:28.230]  nuance here is
[01:37:28.230 --> 01:37:29.490]  there's a length check that
[01:37:29.990 --> 01:37:32.510]  has been showing up a little bit. That length check basically
[01:37:33.890 --> 01:37:34.290]  prevents
[01:37:34.290 --> 01:37:36.290]  you from, even if you overwrite it with a fully solved
[01:37:36.290 --> 01:37:38.130]  board, from actually
[01:37:38.630 --> 01:37:40.370]  solving it on that throw.
[01:37:40.370 --> 01:37:41.970]  So you overwrite the state of the board
[01:37:41.970 --> 01:37:44.050]  all but the last one.
[01:37:44.470 --> 01:37:46.410]  And the last one you leave empty. And then
[01:37:46.410 --> 01:37:48.470]  you can just solve it by overwriting the correct
[01:37:48.890 --> 01:37:50.070]  last answer.
[01:37:50.170 --> 01:37:52.210]  I see. So it's a little bit
[01:37:52.210 --> 01:37:54.110]  along the lines of what we've been talking about, but
[01:37:54.110 --> 01:37:56.270]  it seems that they've done a weaker
[01:37:56.270 --> 01:37:57.650]  variant of that where
[01:37:59.310 --> 01:38:00.210]  they didn't have
[01:38:00.210 --> 01:38:02.010]  as good of a solution.
[01:38:02.330 --> 01:38:03.590]  There's a question here about
[01:38:04.110 --> 01:38:06.350]  is there anywhere that explains the CTF format?
[01:38:06.350 --> 01:38:08.410]  There's an AD going on as well as these 1v1s.
[01:38:08.410 --> 01:38:10.590]  Yes. So kind of like the main
[01:38:11.710 --> 01:38:12.350]  CTF,
[01:38:12.350 --> 01:38:13.850]  the DEFCON CTF, is the
[01:38:15.350 --> 01:38:16.390]  traditional DEFCON
[01:38:16.390 --> 01:38:17.930]  attack defense that
[01:38:17.930 --> 01:38:19.870]  we all know and love.
[01:38:20.110 --> 01:38:22.210]  Although there have been variants and
[01:38:22.210 --> 01:38:24.550]  twists to it over the years.
[01:38:25.530 --> 01:38:26.090]  Then
[01:38:26.090 --> 01:38:28.870]  within this competition, this live CTF
[01:38:28.870 --> 01:38:30.710]  is like a sub-event
[01:38:30.710 --> 01:38:32.790]  where it's running parallel
[01:38:32.790 --> 01:38:34.110]  to the attack defense
[01:38:34.110 --> 01:38:36.430]  aspect of this. So each team
[01:38:36.430 --> 01:38:38.610]  sends one player for each match
[01:38:38.610 --> 01:38:40.110]  and then we play this
[01:38:40.110 --> 01:38:42.170]  knockout tournament and at the end this will
[01:38:42.170 --> 01:38:43.230]  generate a ranking
[01:38:44.090 --> 01:38:46.390]  from the knockout tournament which is then
[01:38:46.390 --> 01:38:48.490]  fed back in and will
[01:38:49.950 --> 01:38:50.510]  affect
[01:38:50.510 --> 01:38:52.310]  the scores of the main CTF
[01:38:52.310 --> 01:38:53.810]  event. So
[01:38:54.670 --> 01:38:56.370]  this will be
[01:38:56.370 --> 01:38:58.190]  valuable and might
[01:38:58.190 --> 01:39:00.410]  definitely affect the final standings
[01:39:00.410 --> 01:39:02.330]  of the DEFCON CTF. I'm not
[01:39:02.330 --> 01:39:03.790]  completely aware of
[01:39:04.310 --> 01:39:06.350]  what the weighting
[01:39:06.350 --> 01:39:08.330]  factor is, how the scoring model
[01:39:08.330 --> 01:39:10.690]  works for the
[01:39:10.690 --> 01:39:12.430]  CTF.
[01:39:14.010 --> 01:39:15.570]  So I couldn't tell you
[01:39:16.310 --> 01:39:18.310]  exactly how valuable it is
[01:39:18.310 --> 01:39:20.010]  to win the tournament versus
[01:39:20.010 --> 01:39:22.110]  getting second place, but we've
[01:39:22.110 --> 01:39:23.930]  been trying to find a balance where
[01:39:24.850 --> 01:39:26.010]  the teams can definitely
[01:39:26.010 --> 01:39:27.490]  help. I'll tell you in a second, but
[01:39:28.990 --> 01:39:30.070]  first I'm going to deliver the
[01:39:30.070 --> 01:39:31.990]  hints and I'll be right back and
[01:39:31.990 --> 01:39:33.370]  we'll see if we can
[01:39:33.990 --> 01:39:35.950]  bring this one home. Right, can you just
[01:39:35.950 --> 01:39:38.510]  read me the hints here first? Here we go.
[01:39:38.610 --> 01:39:40.150]  First attempt, overwrite almost
[01:39:40.150 --> 01:39:42.090]  all. Second attempt solves
[01:39:42.090 --> 01:39:43.930]  due to length check. Yes.
[01:39:44.090 --> 01:39:46.090]  This is the hint and we will see if this
[01:39:46.090 --> 01:39:47.450]  does it. Yeah, this is
[01:39:47.450 --> 01:39:49.130]  almost like a straight up
[01:39:49.130 --> 01:39:51.490]  solution. This could almost
[01:39:51.490 --> 01:39:53.310]  be like a write-up for the...
[01:39:53.310 --> 01:39:55.390]  You have to understand what the program does and that's
[01:39:55.390 --> 01:39:56.530]  the state that they've got.
[01:39:59.050 --> 01:40:00.570]  So now we're going to give them
[01:40:00.570 --> 01:40:03.450]  the final, hopefully final
[01:40:03.450 --> 01:40:04.570]  hint here that will just
[01:40:05.350 --> 01:40:07.070]  hopefully blow this case wide open
[01:40:07.610 --> 01:40:09.850]  and have them solve it from there.
[01:40:09.950 --> 01:40:10.850]  Did we get any
[01:40:12.770 --> 01:40:13.210]  reaction
[01:40:13.210 --> 01:40:15.650]  from the players on that? I was too busy coming back.
[01:40:15.650 --> 01:40:17.990]  I should have watched. Okay, okay, I see.
[01:40:18.090 --> 01:40:19.570]  Yeah, we got some forehead
[01:40:19.570 --> 01:40:21.610]  touching. Okay. Says our
[01:40:21.610 --> 01:40:23.070]  producer. Yes.
[01:40:24.530 --> 01:40:26.010]  So we'll see. Will it...
[01:40:26.010 --> 01:40:27.330]  I think this was...
[01:40:27.330 --> 01:40:29.650]  This one I think is on us. Yeah. I think this was
[01:40:29.790 --> 01:40:31.670]  a little too subtle for what we're kind of
[01:40:31.670 --> 01:40:33.870]  aiming for. And again, being in a high pressure thing
[01:40:34.910 --> 01:40:35.650]  it's just not to
[01:40:35.650 --> 01:40:37.590]  say that these are not excellent exploiters.
[01:40:37.590 --> 01:40:39.430]  It is just very hard and there's...
[01:40:39.430 --> 01:40:42.210]  This was a little bit of nuance, a little subtle nuance.
[01:40:42.210 --> 01:40:43.370]  Oh yeah. Because of the
[01:40:43.370 --> 01:40:45.130]  way that the length check happens
[01:40:45.130 --> 01:40:47.370]  in the binary, you can't actually
[01:40:47.870 --> 01:40:49.270]  fully overwrite and expect it to do it.
[01:40:49.270 --> 01:40:51.350]  It will already know that it's an invalid attempt
[01:40:51.350 --> 01:40:53.310]  and so it's not solvable. But then
[01:40:53.310 --> 01:40:55.270]  you have overwritten the correct state
[01:40:55.270 --> 01:40:57.310]  such that you can then solve it
[01:40:57.310 --> 01:40:59.270]  because you moved it from an insolvable state
[01:40:59.270 --> 01:41:01.250]  to a solvable state. Right.
[01:41:01.510 --> 01:41:03.330]  Somebody else might have got it. You don't know.
[01:41:03.330 --> 01:41:05.290]  But it's definitely... This is definitely a little
[01:41:05.290 --> 01:41:07.130]  harder. Certainly it's more subtle than
[01:41:07.130 --> 01:41:09.310]  some of our previous challenges. Yes.
[01:41:09.690 --> 01:41:11.410]  But we'll see. We'll do our best
[01:41:11.410 --> 01:41:13.330]  to keep dialing in the difficulty
[01:41:13.330 --> 01:41:15.270]  and see how it goes.
[01:41:15.270 --> 01:41:17.530]  So let's keep an eye out for the
[01:41:17.530 --> 01:41:19.430]  winner. We may see, because we're not looking at the
[01:41:19.430 --> 01:41:21.690]  new organizers, we might get that
[01:41:21.690 --> 01:41:22.670]  off screen
[01:41:23.730 --> 01:41:25.110]  or we might see Team Taiwan
[01:41:25.110 --> 01:41:27.370]  pull it off here in the main
[01:41:27.370 --> 01:41:29.390]  window. So I keep
[01:41:29.390 --> 01:41:31.470]  rooting for whoever we have the capture card working on
[01:41:31.470 --> 01:41:33.490]  just by very nature of being on my side of the table.
[01:41:33.490 --> 01:41:34.750]  Yeah, yeah, yeah.
[01:41:35.030 --> 01:41:37.110]  But you know, like
[01:41:38.170 --> 01:41:38.970]  being a
[01:41:38.970 --> 01:41:40.890]  Swiss, not citizen,
[01:41:40.890 --> 01:41:42.770]  but Swiss resident, I'm kind of like
[01:41:42.770 --> 01:41:45.370]  maybe rooting for organizers a little bit.
[01:41:46.330 --> 01:41:46.890]  Are they
[01:41:47.790 --> 01:41:48.990]  a Swiss team? So they are
[01:41:49.490 --> 01:41:51.010]  a Swiss-British-American
[01:41:51.010 --> 01:41:52.590]  team, I think.
[01:41:52.950 --> 01:41:54.690]  There we go!
[01:41:54.690 --> 01:41:56.250]  Alright. So there
[01:41:56.250 --> 01:41:58.150]  we have the winner.
[01:41:58.770 --> 01:42:01.690]  Congratulations. Awesome, awesome.
[01:42:02.650 --> 01:42:03.870]  Oh my god.
[01:42:03.870 --> 01:42:04.790]  Down to the end.
[01:42:04.790 --> 01:42:06.390]  It happened again. It happened again.
[01:42:06.390 --> 01:42:08.410]  Go congratulate them.
[01:42:08.410 --> 01:42:10.270]  Go talk to the team. I'm going to go ahead and see
[01:42:10.270 --> 01:42:12.490]  all out. Just a quick summary.
[01:42:12.490 --> 01:42:14.250]  I think we've already kind of covered what's
[01:42:14.250 --> 01:42:16.150]  happening the rest of the day. We're going to go
[01:42:16.150 --> 01:42:18.430]  recuperate. We're going to fix our HDMI cable
[01:42:18.430 --> 01:42:20.950]  so we'll come back with tomorrow.
[01:42:21.130 --> 01:42:22.490]  We'll hopefully have
[01:42:23.470 --> 01:42:24.370]  the ability to see
[01:42:24.370 --> 01:42:25.530]  both screens more effectively
[01:42:26.170 --> 01:42:28.630]  instead of having the flickering that we had this time.
[01:42:28.930 --> 01:42:30.490]  And we look forward to seeing
[01:42:30.490 --> 01:42:32.550]  eight challenges. We're going to have eight more rounds.
[01:42:32.550 --> 01:42:33.910]  We're going to finish up in the morning.
[01:42:33.910 --> 01:42:35.850]  Four more rounds of round one.
[01:42:36.090 --> 01:42:37.970]  And then in the afternoon we're going to move straight into
[01:42:37.970 --> 01:42:40.050]  round two. And we're going to go all the way from eight teams
[01:42:40.050 --> 01:42:41.990]  all the way down to four by the end of
[01:42:41.990 --> 01:42:43.470]  tomorrow. So come back and
[01:42:43.470 --> 01:42:46.030]  see that long day. Look forward to seeing you then.
[01:42:46.070 --> 01:42:47.290]  Take care and have a good one.
[01:54:50.520 --> 01:54:50.580]  .
[01:54:50.680 --> 01:54:50.740]  .
[01:54:52.300 --> 01:54:52.360]  .
[01:54:52.360 --> 01:54:52.380]  .
[01:54:52.380 --> 01:54:52.400]  .
[01:54:52.400 --> 01:54:52.460]  .
[01:54:52.700 --> 01:54:52.760]  .
[01:54:52.760 --> 01:54:52.780]  .
[01:54:52.780 --> 01:54:52.800]  .
[01:54:52.800 --> 01:54:52.820]  .
[01:54:52.820 --> 01:54:52.840]  .
[01:54:52.840 --> 01:54:52.960]  .
[01:54:52.960 --> 01:54:52.980]  .
[01:54:52.980 --> 01:54:53.020]  .
[01:56:08.890 --> 01:56:10.290]  .