WEBVTT

23:05.410 --> 23:08.210
A little

23:34.540 --> 23:35.700
pause...

23:35.700 --> 23:35.720
and we are back.

23:35.720 --> 23:35.800
A little pause...

23:35.800 --> 23:35.800
and we are back.

30:33.640 --> 30:34.040
A little pause...

30:34.040 --> 30:34.040
and we are back.

30:34.040 --> 30:37.640
Everybody , we are here again, the last run of the day.

30:38.080 --> 30:40.480
Apologies for the ten minute delay on this one.

30:40.680 --> 30:42.500
We're trying to hunt down a bad cable.

30:42.500 --> 30:46.580
Somewhere in our infrastructure is a bad cable, and it's causing one of our streams to have issues.

30:46.840 --> 30:49.900
So we might have some intermittent connectivity for one of our players.

30:50.220 --> 30:51.700
Apologies for that.

30:51.760 --> 30:53.320
We're going to go ahead and get a kick off right away.

30:53.320 --> 30:56.420
We want to get these team members back to their teams as soon as we can.

30:56.420 --> 31:03.180
So let's go ahead and get a countdown of 5, 4, 3, 2, 1.

31:03.180 --> 31:04.200
Go!

31:04.720 --> 31:06.780
And now they're off.

31:07.320 --> 31:07.880
Okay.

31:07.880 --> 31:11.280
So we've already got the first one downloaded.

31:11.280 --> 31:12.300
And this particular one...

31:12.300 --> 31:15.140
Actually, can you grab me my notebook over there with our teams and whatnot?

31:15.940 --> 31:19.100
This one, we've got the new organizers.

31:19.800 --> 31:24.060
And I believe we've got Team Taiwan was the name that they requested.

31:24.060 --> 31:31.920
Because it's, again, another one of these mega teams that has a conglomeration of many different teams.

31:31.960 --> 31:37.480
So we've got Team Balsan, Team 217, Team TSJ.TW.

31:37.860 --> 31:42.400
So there's another team that has TW in the name that's Tokyo Westerns, a Japanese team.

31:42.400 --> 31:44.980
But this is the Taiwanese team because it's .TW.

31:45.400 --> 31:50.520
So let's go ahead and take a look at Team Balsan.

31:50.520 --> 31:52.840
It should be the one that I've got over here on my monitor.

31:52.840 --> 31:56.740
And they are already off, and they're in IDA looking at our challenge.

31:56.740 --> 32:01.140
Now, again, you'll notice all of our challenges are named Challenge, just the way that our Docker deployment kind of works.

32:01.140 --> 32:05.680
The official name of this challenge is called Nerd Sniped.

32:05.760 --> 32:06.380
Right.

32:07.000 --> 32:09.700
So what are things you can get Nerd Sniped by?

32:09.700 --> 32:11.420
A lot of things, but yeah.

32:11.880 --> 32:12.600
We'll see how that plays out.

32:12.600 --> 32:14.700
I get Nerd Sniped by, like, a Rubik's Cube?

32:14.700 --> 32:14.860
Yeah.

32:14.860 --> 32:16.180
A good puzzle, maybe?

32:16.180 --> 32:17.280
Yeah, a good puzzle.

32:17.280 --> 32:18.780
Maybe something like that.

32:18.800 --> 32:19.740
That'll do it.

32:19.740 --> 32:22.940
So we got you 1080p back and going.

32:22.940 --> 32:32.620
Hopefully, we'll figure out our issue with our HDMI cable, and we'll have a much better consistent capture across both team members tomorrow.

32:32.780 --> 32:35.040
Something about this cable is like it's heating up or something.

32:35.040 --> 32:40.020
We had several hours of testing last night with no problem, and something's going on now.

32:40.020 --> 32:42.040
So we'll give that a run.

32:42.360 --> 32:45.240
And sure enough, I literally just saw a rename solve puzzle.

32:45.260 --> 32:48.300
So we've renamed this function Solve the Puzzle.

32:48.300 --> 32:51.960
So what they're looking for, they know it's a puzzle of some sort.

32:52.060 --> 32:58.480
I'm curious if we get someone just kind of running it and interacting with the binary, or if we're going to do more static analysis.

32:59.920 --> 33:03.420
But actually, yeah, this should be much higher quality with the full 1080.

33:03.860 --> 33:06.540
Unfortunately, we don't have even the local recordings.

33:06.560 --> 33:08.360
We're also not 1080.

33:08.360 --> 33:09.800
They were only in 720 as well.

33:09.800 --> 33:11.700
So I apologize for those first couple matches.

33:12.140 --> 33:19.060
We're not going to have the higher quality video for those either.

33:19.060 --> 33:26.000
But all 12 other matches from here on out are going to be in high def because we have a lot of these to go.

33:26.000 --> 33:28.760
So you'll see your favorite players that won in the first couple rounds.

33:28.860 --> 33:29.840
They're going to come back.

33:29.840 --> 33:31.400
We're going to see them again.

33:32.980 --> 33:33.900
Oh, no, that was cool.

33:33.980 --> 33:35.500
I didn't notice that website.

33:35.500 --> 33:36.700
Have you seen that one before?

33:37.820 --> 33:38.780
I'm curious what that was.

33:38.780 --> 33:40.400
So now they're on the Ubuntu repo.

33:40.400 --> 33:44.040
They're getting a particular glibc version, which makes sense.

33:44.180 --> 33:45.560
That's often common.

33:45.560 --> 33:49.440
Now, I think for most of these, we included a libc if we thought it was necessary.

33:49.620 --> 33:49.920
Yes.

33:50.080 --> 33:51.900
So it's kind of a hint to the teams.

33:52.660 --> 33:57.280
We're trying to give out everything that we could, make it as self-contained as possible.

33:57.620 --> 34:02.260
And so we'll see if that one ends up being useful.

34:02.260 --> 34:04.180
But we've got our binary challenge.

34:04.180 --> 34:09.720
This one is starting to be a little bit more difficult, though, I would say.

34:09.720 --> 34:13.180
Our challenge difficulty is cranking up a tiny bit.

34:13.660 --> 34:17.000
And we're going to see that kind of trend throughout the whole rest of the weekend.

34:17.000 --> 34:21.400
I'm sure we'll have some easier ones, some that somebody finds an amazing solution to, solves it quickly.

34:21.400 --> 34:28.800
But on the topic of difficulty, we have an idea of what's more difficult and what's easier and so on.

34:28.800 --> 34:31.120
But, of course, we can be wrong.

34:31.120 --> 34:36.460
People can have different specializations in their skill sets and so on.

34:36.460 --> 34:38.680
So something that we might think is...

34:38.680 --> 34:39.760
In both directions, right?

34:39.940 --> 34:41.100
Exactly, yes.

34:41.100 --> 34:46.760
So something that we might think is easy might be actually kind of tricky, and then the other way around.

34:46.760 --> 34:49.400
So it's going to be interesting to see what's going on.

34:49.400 --> 34:53.600
There's still some reverse, like the initial reverse engineering going on of the program.

34:53.600 --> 35:01.520
For example, this kind of step was not really needed in the previous challenge, where we just gave them the full source code with names and everything.

35:02.820 --> 35:04.100
And it is...

35:04.560 --> 35:07.340
Yeah, as an organizer, you have a lot of levers to pull.

35:07.960 --> 35:13.440
It's ironic because we have the organizers here up playing, although, unfortunately, they're on our non-capture screen, unfortunately.

35:14.860 --> 35:16.920
I just had to make sure that we had them lined up right.

35:16.920 --> 35:18.320
I freaked out for a second, not realizing.

35:18.320 --> 35:19.920
Yes, they are on the right halves.

35:21.260 --> 35:24.180
But the team organizers, we're not seeing them.

35:24.180 --> 35:28.380
But as a challenge organizer, as somebody making challenges, you can strip a binary.

35:28.380 --> 35:29.240
You can not strip a binary.

35:29.240 --> 35:30.540
You can include debug symbols.

35:30.540 --> 35:34.140
Yeah, different levels of optimizations.

35:34.140 --> 35:38.760
Because a lot of optimization also kind of acts as a slight obfuscation as well.

35:38.760 --> 35:40.240
Mild obfuscation, yeah.

35:40.660 --> 35:48.280
We have all seen these optimized mem copies and everything, but you have all these bits of magic stuff going on.

35:48.760 --> 35:52.500
Yeah, you get vector operations in your mem copies.

35:53.320 --> 35:59.500
And that's where, to some degree, you can make an easy challenge hard with just tedious things.

35:59.500 --> 36:06.000
So it is interesting that you see a lot of, I would say, cheap challenge design, where it's like, yeah, we just made it harder by doing X.

36:06.040 --> 36:07.600
And it didn't make it more interesting.

36:07.600 --> 36:11.540
It just made it slightly more annoying to do the thing that you want.

36:11.540 --> 36:20.980
So sometimes a really good, easy challenge is actually, you're just really focusing on that one core thing that you want to do, which makes it a lot of fun for what we're doing here.

36:22.320 --> 36:25.880
So still, that's reversing and trying to name different things.

36:25.880 --> 36:30.640
You've seen they named the functions, like solvePuzzle, and you see some variables getting named, like the input.

36:31.920 --> 36:37.200
It's all trying to get an understanding of, what is this program doing?

36:37.560 --> 36:39.220
And there are two parts to it.

36:39.420 --> 36:43.580
First of all, what's the intended functionality of the program?

36:43.580 --> 36:49.640
And then from there, you can start to understand, in what way is it acting not as intended?

36:49.640 --> 36:50.580
Like, where's the bug?

36:50.580 --> 37:00.700
In this case, where the author intended a bug, but in the normal case where it's unintended vulnerabilities, or in this case, what's the surface level intended?

37:00.800 --> 37:02.800
What's it claimed to be able to do?

37:02.960 --> 37:06.300
And then what does it actually do that may be different?

37:07.500 --> 37:10.000
So let's see what we're doing.

37:10.000 --> 37:14.120
And this is nice, too, because this is the first time we've seen a little reverse engineering workflow.

37:14.120 --> 37:14.560
Yes.

37:14.560 --> 37:21.820
A lot of the other ones have been, basically, a quick glance at the code or disassembly has kind of revealed what's going on.

37:21.820 --> 37:24.960
Here, they actually need to kind of understand what is going on.

37:25.620 --> 37:33.560
Okay, so we're still sort of starting our framework for our exploit here, but I think it's just getting the menus and interacting with it, right?

37:33.560 --> 37:34.180
And so we're looking.

37:34.180 --> 37:36.340
Oh, okay, so there's a current puzzle state.

37:36.720 --> 37:39.520
All right, so, that puzzle looked interesting.

37:39.520 --> 37:42.520
That looked like maybe a 9x9 grid of numbers.

37:42.520 --> 37:42.660
Yes , numbers .

37:42.660 --> 37:44.780
It could be maybe like a Sudoku.

37:44.820 --> 37:51.180
I think that's a great guess, and of course, we're a little spoiled here, a little tainted knowledge, but this is indeed a Sudoku.

37:51.600 --> 37:57.620
In fact, when somebody was, like, play testing and validating this challenge, we sort of were like, wait a minute.

37:57.620 --> 38:00.220
You just solve a Sudoku, and that's it?

38:00.220 --> 38:02.040
And the author was like, no, no, no, no, no.

38:02.720 --> 38:05.000
That's not actually possible.

38:05.460 --> 38:07.200
So it is a little bit trickier than that.

38:07.200 --> 38:14.320
So we'll see as our teams discover it's not just a straight put it into a Sudoku solver, get a correct answer, and win.

38:14.740 --> 38:16.280
It is going to be a little bit more tricky.

38:16.280 --> 38:20.520
And this is one I am almost positive we're going to need a hint on.

38:20.620 --> 38:26.300
So I'm going to propose at, like, 15 minutes in, if we don't see...

38:27.200 --> 38:28.200
Like, progress.

38:28.200 --> 38:28.740
Progress.

38:28.740 --> 38:31.460
In fact, why don't you go ahead and take a look at the organizers, maybe, too.

38:31.460 --> 38:32.580
Yes, I will do that.

38:32.580 --> 38:38.420
And if we're looking for them to kind of have a hint as to what they're doing, like, indicate that they know what they're doing.

38:39.260 --> 38:40.360
Yeah, yeah.

38:41.020 --> 38:41.920
Oh, does it come on occasionally?

38:41.920 --> 38:42.500
Okay.

38:42.840 --> 38:44.300
So it's apparently flickering in and out.

38:44.340 --> 38:46.720
Occasionally we're getting our video.

38:46.720 --> 38:48.820
We swapped out the capture card.

38:48.820 --> 38:51.060
That worked for a while until it didn't.

38:51.060 --> 38:52.960
And then we swapped out the USB-C cable.

38:52.960 --> 38:54.500
And that worked for a while until it didn't.

38:54.620 --> 38:59.500
And so now we're convinced that it's just the HDMI cable itself that is causing trouble.

38:59.500 --> 39:02.900
And I think this has been true even if we were direct wired into the laptop.

39:03.000 --> 39:05.780
So it's not the capture on the other side.

39:06.240 --> 39:09.920
Yes, because we also did swap out the USB-C adapter once, too.

39:09.920 --> 39:13.440
So we've swapped every component except the HDMI cable.

39:14.860 --> 39:18.140
Partly because they're like taped to the floor and they're a 30-foot long cable.

39:18.560 --> 39:19.660
Oh, there we go.

39:20.260 --> 39:22.620
I did see a solver pop up briefly.

39:22.620 --> 39:24.280
Yeah, I was just going to say.

39:24.280 --> 39:32.100
The player from the organizers copy-pasted the current state of the puzzle and they googled for a Sudoku solver.

39:32.940 --> 39:35.720
So we'll see to what extent that will help them.

39:37.700 --> 39:42.460
Again, I'm not completely familiar with the intended solution here.

39:42.460 --> 39:50.460
But I would assume that it still involves solving the Sudoku but not only doing that.

39:50.460 --> 39:52.320
It is trickier than that.

39:52.320 --> 39:53.400
Yeah, that's right.

39:54.060 --> 39:56.340
I have a little bit more info.

39:56.520 --> 40:03.140
We're still seeing that kind of solver flashing in and out occasionally on the display.

40:03.500 --> 40:07.620
So there's going to be some memory corruption here.

40:08.800 --> 40:14.760
Although I will say, it is actually a perfectly valid category of challenge in a lot of CTFs.

40:14.760 --> 40:18.820
Where you would actually do have a more programming challenge or puzzle.

40:18.820 --> 40:19.920
That happens.

40:20.660 --> 40:26.040
Honestly, even in moderation, I think those can be fun and enjoyable mixed in amongst the traditional happy competition.

40:26.040 --> 40:35.840
Typically they are branded as PPC is the category in normal CTFs, which I think is like professional programming challenge or something like this.

40:36.140 --> 40:50.340
People familiar with ICPC style algorithms competitions might find, although usually they're kind of framed slightly differently, but it's kind of like the same general idea there.

40:50.340 --> 40:53.180
Yeah, and there's no security flaw.

40:53.180 --> 41:01.440
There's really just rather solving some hard mathematical problem with the right algorithm or with the right approach to kind of get it working.

41:01.440 --> 41:03.380
But that's not the case here.

41:03.380 --> 41:06.400
There's an aspect of that, but that's not enough.

41:06.400 --> 41:10.280
This is truly a component where there is memory corruption involved.

41:11.160 --> 41:17.520
Although, I will say, and I'm looking to see if somebody finds the sort of win function.

41:17.520 --> 41:23.760
When you have a correct solve Sudoku, I think we're going to see.

41:23.760 --> 41:35.840
This function here, they've named it check, returns whether or not we've successfully calculated a value, a valid solve.

41:37.380 --> 41:41.280
The result of that is going to determine basically what you call a win function.

41:41.280 --> 41:43.240
So it is going to do the win for you.

41:43.480 --> 41:46.460
You know that you have to solve it.

41:46.460 --> 41:49.800
You're just questioning, okay, what mechanic will actually get me to solve it?

41:49.800 --> 41:50.920
And can I cheat it?

41:50.920 --> 41:53.020
Do I have to have a combination of a solver plus a cheat?

41:53.180 --> 41:55.480
What is that ratio going to entail?

41:55.480 --> 42:00.040
Because at face value, it kind of looks like you just solve the Sudoku and you win.

42:00.640 --> 42:07.480
Yeah , but you know, Defcon finals, even being a sort of easy live CTF, I would think people would be like, no, wait a minute.

42:07.480 --> 42:09.160
There's something here.

42:09.160 --> 42:15.100
I think if you can also, there's not a lot of values here.

42:15.140 --> 42:22.000
I don't know, I think the idea is that these are just not solvable because there's not enough information.

42:22.000 --> 42:26.440
Some Sudoku balls are very minimal, but they're designed to be solved, made to be solvable.

42:26.440 --> 42:33.160
I think I remember that if you have 13 digits, you're guaranteed to have a unique solution.

42:37.220 --> 42:42.120
Okay, so this one definitely has more than that, but there's going to be some other issues with it still.

42:42.120 --> 42:48.140
I'm not sure if my trivia is correct, but I vaguely remember if you have 13 digits, you have a unique solution.

42:48.140 --> 42:51.440
You can have a unique solution with fewer digits, but it's not guaranteed.

42:51.440 --> 42:55.380
I don't know that that's true, because I can just give you all of the ones, for example.

42:56.020 --> 42:57.340
But that's just nine.

42:57.780 --> 43:02.820
And all the twos, and that doesn't give you enough information to know where all the other numbers are.

43:05.840 --> 43:06.520
Maybe.

43:06.520 --> 43:10.520
Maybe it's 21 or something.

43:10.980 --> 43:12.660
There is a number.

43:13.880 --> 43:20.020
Where's our cracking the cryptic phone a friend and go to the YouTube stream?

43:20.100 --> 43:21.900
Yeah, great channel.

43:21.900 --> 43:22.780
So here we go.

43:22.780 --> 43:25.360
We're seeing a Sudoku solver Python.

43:25.360 --> 43:26.900
We're seeing people investigate that.

43:26.900 --> 43:27.680
All right.

43:27.680 --> 43:29.540
We are now 15 minutes in.

43:29.540 --> 43:39.600
I think we should be preparing our hands, because I actually think this one is a little too subtle, and we're going to have to point them in the right direction without actually giving them the thing.

43:39.600 --> 43:50.000
We should notice now that even though the time is 24, we started 10 minutes late because of technical difficulties, so they are only 15 minutes into the challenge.

43:50.000 --> 43:50.700
Correct.

43:50.700 --> 43:57.640
So we have more time than the clock looks like compared to the other ones where we started much closer to on time.

43:57.640 --> 44:01.020
So we're trying a solver again.

44:01.020 --> 44:05.080
So trying a solver on here, which is not going to be sufficient.

44:05.080 --> 44:09.680
So I think we need to figure out if there is an official hint from the challenge author.

44:09.960 --> 44:18.920
So we've got Glen over in the production booth, as it were, which is otherwise known as the other side of the table that we're sitting on here.

44:20.460 --> 44:23.780
It's going to reach out and see if we have an official...

44:23.780 --> 44:29.160
We have like three times the number of computers compared to the number of crew members for this setup.

44:29.280 --> 44:35.760
We have a lot of displays and an order of magnitude more cables, I think, than...

44:36.940 --> 44:37.620
Yeah.

44:37.620 --> 44:43.960
But it's... And once we find out what is breaking our secondary capture...

44:43.960 --> 44:46.700
Actually, speaking of which, I'm going to go ahead and take a look at the organizers.

44:46.700 --> 44:54.580
I want to see if they're making progress while we figure out what we're doing with that hint, if we're going to give it.

44:54.580 --> 44:58.880
And if you guys have any questions about where we're going, let us know.

44:59.700 --> 45:01.340
And I'll be back with an update.

45:01.340 --> 45:02.240
Great.

45:02.320 --> 45:12.060
So while Jordan does that, we can try to see that we...

45:12.580 --> 45:20.500
I've just been informed that the puzzle that you were given is impossible to solve.

45:20.500 --> 45:21.900
That's kind of the trick here.

45:21.900 --> 45:27.480
At face value, everything looks fine, you just need to solve the Sudoku, but actually there is no solution.

45:27.480 --> 45:30.740
This is an invalid state for the Sudoku.

45:32.200 --> 45:33.760
So once they...

45:33.760 --> 45:49.660
And this is something that can really throw you off, because if you take this and put it into a solver and the solver says, no, there's no solution, you might be starting to think maybe the solver has a bug, or maybe the format of my input is wrong, or something like this.

45:50.660 --> 45:57.060
And only later you might question the impossibility of the puzzle.

45:57.520 --> 46:07.280
So this is where they have to then cheat to solve the impossible Sudoku to then get this win function.

46:08.360 --> 46:21.020
We can see here on the battle screen that they are looking still at the kind of decompilation here, thinking hard about this.

46:22.360 --> 46:25.980
Trying to figure out what is going on here?

46:25.980 --> 46:27.740
Why is this not working?

46:30.100 --> 46:32.560
It's this check function, right?

46:32.980 --> 46:39.820
So they're trying to think about in what way does this function not behave correctly, maybe?

46:39.820 --> 46:44.900
Maybe they have realized that you're given an impossible puzzle.

46:45.760 --> 46:46.880
So let's see.

46:46.880 --> 46:48.500
They're going to try to...

46:48.500 --> 46:51.940
It seems like they're writing a small formatting function.

46:51.940 --> 46:57.640
They're looping through the X and Y axes and printing something.

46:58.780 --> 46:59.980
So yeah.

47:02.680 --> 47:06.020
Still unsure exactly where they're going with that, but let's see.

47:06.020 --> 47:12.960
So quick update is both teams are taking the wrong approach now, and they're still looking for solves.

47:12.960 --> 47:16.440
So the hint they're both going to get is you can't win, you need to cheat.

47:17.240 --> 47:17.820
Right.

47:19.180 --> 47:19.980
Which is...

47:19.980 --> 47:24.680
I almost feel like there's some kind of deeper philosophical thing here.

47:24.680 --> 47:26.220
I mean, it's a true life statement.

47:26.220 --> 47:27.020
Yeah.

47:34.080 --> 47:38.340
I had a lot of thoughts about that, but let's not go too off topic.

47:38.340 --> 47:38.980
Yeah.

47:40.060 --> 47:41.340
So here's the other question.

47:41.340 --> 47:43.500
Do we want to give them a little bit more of a hint?

47:44.020 --> 47:46.220
Do we want to tell them exactly how...

47:46.220 --> 47:48.420
I think we have time, right?

47:48.420 --> 47:48.620
No, no.

47:48.620 --> 47:49.500
We have time.

47:49.500 --> 47:50.560
Let's do that.

47:51.160 --> 47:51.560
And...

47:52.120 --> 47:52.680
Yeah.

47:52.680 --> 47:53.800
In fact...

47:53.800 --> 47:55.220
Well, that's too late now.

47:55.940 --> 48:07.720
I was thinking in terms of since this is the last match of the day, we could have afforded extending the standard game time, but I don't know if it's fair to do that once...

48:07.720 --> 48:09.780
Well, we do it to the same two players.

48:09.780 --> 48:12.460
Either way, it's only fair relative to each other.

48:12.560 --> 48:13.680
Because every match is different.

48:13.680 --> 48:16.160
Different challenges, different conditions, and so to some degree...

48:16.160 --> 48:16.660
Right , right.

48:16.660 --> 48:18.600
So you could argue that it's fair.

48:18.600 --> 48:19.040
But let's see.

48:19.040 --> 48:19.500
You can't win.

48:19.500 --> 48:20.540
You need to cheat.

48:20.960 --> 48:22.200
You need memory corruption.

48:22.320 --> 48:22.980
Yes.

48:27.590 --> 48:29.230
It's dangerous to go alone.

48:29.230 --> 48:29.970
Yeah.

48:30.150 --> 48:31.510
It's dangerous to go alone.

48:31.510 --> 48:32.570
Take this memory corruption.

48:32.570 --> 48:33.370
I love it.

48:36.470 --> 48:37.270
Alright.

48:37.270 --> 48:39.610
Here goes the first tense.

48:39.610 --> 48:40.210
Yes.

48:40.430 --> 48:44.530
We'll see if this gets them on the right track again or if we need to...

48:45.210 --> 48:49.710
In the meantime, I'm trying to decipher what this script is doing.

48:49.710 --> 48:54.630
They have a solve function there which then will not really help them since you can't solve this.

48:57.310 --> 48:57.790
It's...

48:59.730 --> 49:04.430
Yeah, it's still like, you know, a little bit unclear where the players are in this.

49:04.430 --> 49:06.850
Unfortunately, we can't read the minds of the players.

49:06.850 --> 49:09.850
That would be immensely helpful when doing this type of commentary.

49:09.850 --> 49:12.670
We can just try to guess based on what we're seeing on the screen.

49:14.190 --> 49:19.810
Again, if you have any questions or comments from all of you watching this...

49:19.810 --> 49:20.630
I got some smiles.

49:20.630 --> 49:21.710
I wish you all could have seen it.

49:21.710 --> 49:24.210
But there was like, oh yeah, of course.

49:24.210 --> 49:24.990
Okay, okay.

49:24.990 --> 49:28.670
They were both going down the solver approach.

49:29.090 --> 49:31.010
So I think we're going to see a lot more Ida now.

49:31.010 --> 49:31.470
Right.

49:31.470 --> 49:33.550
We're going to see them actually dig into the binary.

49:33.930 --> 49:34.490
Right.

49:34.730 --> 49:36.030
And follow it that way.

49:37.510 --> 49:46.130
So that's nice to hear that the hint was appropriately leveled and that it was useful to the players.

49:46.150 --> 49:49.810
Yeah, I think they both were at a spot where it's going to help both of them.

49:50.090 --> 49:53.930
We'll see if either one starts to take advantage of that or not.

49:53.930 --> 49:55.270
Okay, yeah, so we're looking at checksec.

49:55.270 --> 49:56.870
We're looking at the binary properties.

49:57.050 --> 49:59.810
And that's actually a great habit to be into.

49:59.810 --> 50:01.530
I really think that a lot of people overlook that.

50:01.530 --> 50:10.610
Again , we saw that last one with Mallard with the ducks where it not being randomized I think added a little bit of extra slowdown there.

50:10.610 --> 50:11.990
Right, yes, definitely.

50:12.090 --> 50:14.070
Because you could have gone straight into...

50:15.070 --> 50:18.430
I think I have this as a pretty good habit.

50:18.590 --> 50:19.970
Always run file.

50:20.090 --> 50:21.490
Always run checksec.

50:23.210 --> 50:27.510
It's kind of like when you're doing reversing engineering challenges.

50:27.510 --> 50:28.710
Always run strings.

50:28.710 --> 50:29.950
Always binwalk.

50:30.050 --> 50:31.990
Just out of habit.

50:31.990 --> 50:34.090
It's just the things that you do.

50:34.770 --> 50:36.350
Alright, so let's watch this.

50:36.350 --> 50:39.550
Okay, so now we're seeing them actually where we want them.

50:39.550 --> 50:41.310
Now they're back to reverse engineering.

50:41.490 --> 50:43.250
They're looking for vulnerabilities.

50:44.170 --> 50:48.830
And what they're going to do is they're going to use the vulnerability to win.

50:48.870 --> 50:57.170
They're going to use the memory corruption to not code execution directly but to the win state.

50:57.170 --> 51:01.430
So what they're going to do is they're going to need to corrupt in such a way that they can create a solved board.

51:01.430 --> 51:03.090
And they should hopefully still remember this, right?

51:03.090 --> 51:05.250
Because they know that the point was to win.

51:05.250 --> 51:05.910
They saw that.

51:05.910 --> 51:07.370
They saw the win state.

51:07.750 --> 51:09.570
That's why they were trying to solve the puzzle.

51:10.050 --> 51:11.370
So I think they know that.

51:11.550 --> 51:18.610
The question is are they going to be able to figure out the memory corruption in time?

51:18.610 --> 51:20.070
So that's the question that we're looking for.

51:20.070 --> 51:21.590
And this is kind of interesting, I think.

51:21.590 --> 51:29.890
This type of pwnable where, like a lot of pwnables you have kind of this like standard workflow where you try to gain control of certain aspects of memory.

51:29.890 --> 51:33.510
Yeah , it's a pointer overwrite or it's something that gets you a memory write.

51:33.510 --> 51:34.690
So you get a pointer overwrite.

51:34.690 --> 51:36.750
To a ROP chain to like, you know.

51:37.410 --> 51:41.570
But here you're just doing kind of like, maybe we call it like a local memory corruption.

51:41.610 --> 51:46.810
Or it's not quite a logic vulnerability in that it is memory corruption but it's not useful.

51:46.810 --> 51:50.130
It's not being used for control flow hijacking.

51:50.130 --> 52:00.930
You're using it specifically to just change the behavior of the state and change the behavior of the functionality through its normal legitimate means but by entering a memory state that it didn't intend for you to enter.

52:00.930 --> 52:08.510
So in a lot of these cases where the program wouldn't crash for example, if the exploit is slightly wrong.

52:08.570 --> 52:10.610
You just failed to get a correct puzzle.

52:10.610 --> 52:11.670
It's just not solved, right?

52:11.670 --> 52:12.110
Yeah .

52:12.590 --> 52:16.090
Which is not to say that they couldn't crash with this vulnerability necessarily.

52:16.090 --> 52:17.850
It depends on how it's actually constructed.

52:18.590 --> 52:28.090
But there are certainly use cases, or there are cases where an exploit isn't actually exploitable in the direct code execution state.

52:28.090 --> 52:32.790
It is rather just by exercising some other logical state of the program.

52:33.210 --> 52:43.290
In general, everything we say here about the pwnables and general ideas there are a lot of ifs and buts and stuff to all of these exceptions.

52:43.290 --> 52:48.930
But we're trying to make some broad strokes here about different types of challenges.

52:50.290 --> 52:51.350
I'm a little nervous.

52:51.350 --> 52:54.870
This one feels like the first one we might have to unleash a sudden death.

52:54.870 --> 52:55.950
I'm hoping we don't.

52:56.690 --> 53:02.190
And I like the challenge, because like we're talking about, I think it has that good twist.

53:02.490 --> 53:08.070
You're going to not get a pointer overwrite, but you're going to influence the state of the binary.

53:08.510 --> 53:09.310
I'm hoping.

53:09.310 --> 53:12.930
And we've seen great work from all the teams so far.

53:12.930 --> 53:14.710
So we know we have high quality people.

53:15.450 --> 53:17.250
We'll see how it's going.

53:18.450 --> 53:21.090
This is also, I said, one of the larger binaries.

53:21.090 --> 53:22.710
We all get very small binaries.

53:22.710 --> 53:24.150
Very, very self-contained.

53:24.150 --> 53:25.170
This one's a little bigger.

53:25.170 --> 53:30.250
It's still, I think, small on the CTF scale of things, which in CTF is smaller than real-world binaries.

53:30.290 --> 53:35.150
But relative to the live CTF binaries, this is larger than some of them.

53:36.270 --> 53:41.310
Yeah, luckily they don't have to sift through a 300 megabyte binary.

53:41.310 --> 53:42.030
What?

53:42.030 --> 53:46.230
Who doesn't love sorting out massive binaries?

53:46.230 --> 53:51.950
Yeah, I think I remember opening the Minecraft binary in IDA at some point.

53:52.330 --> 53:56.390
Then I went to bed and continued the day after.

53:56.390 --> 54:01.310
I think it was just barely finished, but it took eight or nine hours to analyze that.

54:01.990 --> 54:08.270
Big binary or even obfuscated binaries can take a long time to analyze for sure.

54:09.550 --> 54:10.390
Here we go.

54:10.390 --> 54:10.990
So let's look.

54:10.990 --> 54:13.210
We're seeing an int64 int.

54:14.830 --> 54:18.310
So making sure the types are correct.

54:19.530 --> 54:20.990
That's good.

54:20.990 --> 54:32.790
I think analyzing the types is useful, although what I will say is that just looking at decompiled code is maybe not the best way to analyze any kind of type issues, right?

54:32.790 --> 54:38.470
No, I think it's a good start to give you the big picture.

54:38.470 --> 54:43.850
And but then at some point you might have to drill down on things.

54:43.850 --> 54:48.450
And I think this is also kind of interesting again with different types of pwnable challenges.

54:48.710 --> 54:54.130
Some pwnable challenges the bug is obvious and the exploitation is difficult.

54:54.230 --> 55:00.430
And then you have these more reversing heavy pwnables where you have to figure out very complex data structure.

55:00.430 --> 55:04.730
But once you have sorted everything out the bug just appears.

55:04.930 --> 55:07.830
And then from there it's typically not that hard.

55:08.250 --> 55:17.910
And I think our previous examples several of our previous challenges were more on the side of like, it's obvious where the bug was, but actually landing it was sort of the tricky part.

55:17.910 --> 55:20.790
We just let you run syscalls, but which ones?

55:20.790 --> 55:21.650
That's the tricky part.

55:21.650 --> 55:23.690
Your payload, the execution.

55:23.850 --> 55:25.230
Same thing with not coding.

55:25.230 --> 55:27.870
We just ran your bytes, sort of you had to do that.

55:27.950 --> 55:32.870
I think those shell coding heavy and constrained environments are some of my favorite challenges.

55:33.210 --> 55:40.250
Probably because I'm just bad at the more, I don't want to say tedious, but the more in-depth long-term reverse engineering.

55:41.910 --> 55:45.310
I'm more of a reverse engineer myself, so I like those things .

55:45.310 --> 55:52.030
But then, for example, when you get to these complex heap exploitation things , then I'm completely out of luck there.

55:52.030 --> 55:55.510
There's always just familiarity and experience with it.

55:55.510 --> 56:02.230
One of the things I was going to mention and I say this, I don't do the reversing heavy ones as an author of a reverse engineering tool.

56:02.230 --> 56:03.810
Maybe that's why you built the tool, right?

56:03.930 --> 56:06.570
That's also why I have coworkers who are much better than I am.

56:06.830 --> 56:08.790
I highly recommend that approach.

56:10.390 --> 56:17.850
But one of the things that I was going to comment on is that I like one of the things that Ghidor, I think, really does well that a lot of

56:21.190 --> 56:25.730
both Ida and Binja have actually changed as a result is their side-by-side view.

56:25.730 --> 56:33.230
Having the synchronized side-by-side decouplation with this assembly, I think was a really important improvement in the standard workflow.

56:33.510 --> 56:38.890
And so now you'll see Ida and Binja both have much better split-pane synchronization, those kind of workflows.

56:39.270 --> 56:45.690
I mean, I assume Ilfac also was inspired and was like, oh yeah, I like the way that Ghidor does that too.

56:46.370 --> 56:49.850
Certainly from Binja's perspective, we definitely did that as well.

56:50.650 --> 56:52.510
So I do think it's good seeing difference.

56:52.510 --> 56:55.650
Oh, here we go, we've got I don't know, is that the same?

56:55.650 --> 56:56.850
That's just the same screen.

56:56.850 --> 56:58.890
But we are...

56:58.890 --> 57:06.610
They're looking at libc trying to download the appropriate libc version, right?

57:06.610 --> 57:17.910
They're using this webpage where you can put in offsets for different functions to match up with.

57:17.910 --> 57:21.770
Yeah, like fingerprint the libc version and then download it.

57:21.770 --> 57:28.510
So most of the times I think you need two offsets and then it will match to which version of libc is running.

57:28.510 --> 57:36.370
So again, when we're building these challenges, if we don't think they need libc, we're not providing it.

57:36.370 --> 57:38.550
That's not true in all competitions though.

57:38.590 --> 57:41.250
They may not trust us yet.

57:41.250 --> 57:49.130
I think this is like it is a convention among, I would say, experienced organizers within this.

57:49.130 --> 57:57.310
Right, because why make that an extra tedious step that it's just mechanical and we all know about the website, we all know how you would do that.

57:57.310 --> 58:07.770
However, if you come up with a solution that's different than the intended one, you might have a solution which does require libc and then you might go this route anyway.

58:08.130 --> 58:13.950
So it's not necessarily bad, it is just, it should be a hint that maybe you're not taking the intended route.

58:13.950 --> 58:14.330
Right.

58:14.430 --> 58:19.250
Doesn't mean that you're wrong, but you might be venturing into unknown territory.

58:19.250 --> 58:23.130
So let's be thinking about our next hint, because like I said, I'm a little concerned.

58:23.130 --> 58:24.730
We might need to do a different one.

58:24.930 --> 58:25.290
Yes .

58:25.690 --> 58:30.310
I don't know, triple tap control and get the spoken dictation pop up.

58:31.390 --> 58:32.290
I'm going to go...

58:32.930 --> 58:35.450
Oh, nope, that's just somebody else in the background excited about something.

58:35.450 --> 58:35.790
Yeah.

58:35.790 --> 58:38.830
I thought for a second we had a surprise win off screen.

58:38.930 --> 58:42.690
I'm going to go ahead and check in with...

58:42.690 --> 58:44.130
Was it organizers?

58:46.070 --> 58:46.430
Organizers...

58:46.430 --> 58:49.030
Organizers is unfortunately not being captured.

58:49.390 --> 58:51.250
So we're kind of in the dark there.

58:51.490 --> 58:52.990
So I'm going to see if I can get a little bit more of an insight.

58:52.990 --> 58:55.930
Hopefully we're making good progress there and I can come back with a little bit of an update.

58:57.090 --> 59:01.730
And then maybe then go ahead with some hint based on current status.

59:03.030 --> 59:03.430
So...

59:03.990 --> 59:13.010
Again, they're looking at figuring out libc versions or downloading an Ubuntu image.

59:13.010 --> 59:15.830
I'm not entirely sure what's going on there.

59:15.830 --> 59:17.990
But, yeah.

59:19.610 --> 59:25.270
We'll see if we can manage to see in what direction they're going with this.

59:34.900 --> 59:43.440
It would be very interesting to see if they have figured out where this check function is going on.

59:43.520 --> 59:52.020
Unfortunately, I don't have the reference solution, so I'm not super familiar with exactly where it's doing something incorrect.

59:54.660 --> 01:00:02.240
Yeah, it's also going to be interesting to hear then what the organizers are up to if they have good progress.

01:00:02.240 --> 01:00:05.500
So we're also kind of a little bit in the dark on that.

01:00:05.720 --> 01:00:22.680
But hopefully I think we are going to give them a hint that I'd say Jordan and Glenn are discussing a little bit, but what's the exact hint that we want to give them here to point them in the right direction.

01:00:27.760 --> 01:00:38.300
You can see here in the lower corner here, we have from time to time the organizer's screen flickering in and out.

01:00:38.500 --> 01:00:41.920
Unfortunately, that's the tech situation right now.

01:00:41.920 --> 01:00:49.980
And in the meantime, I can give you a little bit of an update on the combined scoreboard for the DEFCON CTF.

01:00:49.980 --> 01:00:54.600
We have still a fairly tight race.

01:00:54.600 --> 01:01:05.820
We have a span of about 18,000 points for the leaders, Katsubin, down to 14,000 points for the team in 16th place.

01:01:05.820 --> 01:01:15.120
So definitely still, everyone is definitely still in the game with top three being Katsubin, MMM and Perfect Roots.

01:01:15.120 --> 01:01:22.440
And they are all within like, you know, less than some percent or so of each other.

01:01:22.700 --> 01:01:26.560
Or maybe like 10% of each other.

01:01:26.560 --> 01:01:31.860
So yeah, definitely a good competition there.

01:01:33.100 --> 01:01:36.620
So, Jordan is coming back here.

01:01:36.620 --> 01:01:37.580
So what's the status?

01:01:37.580 --> 01:01:39.200
What's the organizers doing?

01:01:39.260 --> 01:01:40.140
We're going to need some hints.

01:01:40.140 --> 01:01:41.440
They're both still looking.

01:01:41.440 --> 01:01:42.460
I don't see any kind of progress.

01:01:42.460 --> 01:01:44.040
So we're going to drop a hint.

01:01:45.640 --> 01:01:47.040
There's a couple of hints we considered.

01:01:47.040 --> 01:01:48.640
One is, have you considered fuzzing?

01:01:49.020 --> 01:01:58.120
Because literally just sending in a bunch of bytes will actually cause, overwrite your game state.

01:01:58.360 --> 01:02:00.280
So that's the key thing they need to figure out.

01:02:00.280 --> 01:02:05.080
If they send in just too big of a solution, it will actually corrupt the state.

01:02:05.120 --> 01:02:06.480
And they'll get weird boards.

01:02:06.680 --> 01:02:10.400
And then it's a matter of, okay , how do I now create a board that would be solvable?

01:02:11.060 --> 01:02:12.500
One that we considered.

01:02:12.660 --> 01:02:18.260
The other one was don't let yourself be boxed in to your solution.

01:02:18.260 --> 01:02:19.120
It's a Sudoku puzzle.

01:02:19.120 --> 01:02:20.900
That's a little probably more obscure.

01:02:21.380 --> 01:02:26.920
I think we're going to go with just how big is your solution again?

01:02:27.100 --> 01:02:28.680
Or how many bytes is your solution?

01:02:29.580 --> 01:02:31.000
As our next hint.

01:02:31.000 --> 01:02:33.500
And I think we're going to give them that because there's still some work to be done.

01:02:33.500 --> 01:02:36.800
And we want to give them both a shot at getting it.

01:02:37.000 --> 01:02:38.460
Otherwise, we're going to go to our sudden death.

01:02:38.460 --> 01:02:40.280
So that's the hint we're going to go with.

01:02:40.440 --> 01:02:43.160
In the meantime, we had a comment here from KGIF.

01:02:43.820 --> 01:02:45.340
These seem interesting C challenges.

01:02:45.340 --> 01:02:47.640
I think I would try them all, but I'm sure I would take a lot longer.

01:02:47.640 --> 01:02:48.380
I would too.

01:02:48.380 --> 01:02:49.320
So that's okay.

01:02:49.320 --> 01:02:57.900
But it is a good idea in general for CTFs to try out challenges after they've been solved.

01:02:57.900 --> 01:03:01.760
Normally for a lot of CTFs people publish write-ups.

01:03:01.760 --> 01:03:13.000
So you can try the challenges that you didn't manage to solve and then use a write-up or so as a reference and then guide your attempt as well to learn more.

01:03:13.440 --> 01:03:16.720
I think the idea is that we are releasing all the challenges.

01:03:16.720 --> 01:03:20.700
It might take a few days for us to recover from this weekend.

01:03:20.700 --> 01:03:27.800
We have 15 matches, so another 11 matches to go after this one.

01:03:28.040 --> 01:03:31.540
But yeah, we will definitely publish them.

01:03:31.920 --> 01:03:42.140
You can even organize your own mini tournament in your own CTF team or hacker space.

01:03:42.960 --> 01:03:56.760
I know that I heard from before the competition that Shellfish actually did some practice for this tournament by doing a small mini competition of their own within the team.

01:03:56.760 --> 01:03:58.400
And it paid off.

01:03:58.400 --> 01:04:00.080
At least it appears it paid off.

01:04:00.080 --> 01:04:02.280
As one of the winning teams.

01:04:02.460 --> 01:04:04.120
Yeah, we'll see how far they can go.

01:04:05.840 --> 01:04:07.960
So we have the hints prepared.

01:04:07.960 --> 01:04:10.640
Jordan is going to go and hand that off to the players.

01:04:11.640 --> 01:04:12.440
We are...

01:04:12.440 --> 01:04:13.640
What's the clock at?

01:04:13.640 --> 01:04:16.080
So 5.45.

01:04:16.080 --> 01:04:24.320
So we are 35 minutes into the game which means that we are running up against the sudden death clock here.

01:04:24.320 --> 01:04:27.200
Let's see if they can manage to figure out this.

01:04:27.200 --> 01:04:38.660
On the other hand, this is also kind of a similar situation to the previous challenge where we were 35 minutes into the game and then it kind of just clicked for one of the players and they managed to go all the way.

01:04:38.660 --> 01:04:42.760
So it's going to be really exciting to see what's going on.

01:04:42.760 --> 01:04:50.240
Still a bit difficult to get a read on Balson's progress or their understanding.

01:04:50.320 --> 01:04:53.240
They're kind of looking at the code, probably thinking very hard about it.

01:04:53.240 --> 01:04:58.020
You can see the mouse moving around, trying to build this mental model of what's going on.

01:04:58.020 --> 01:05:00.540
Kind of like running the code in your head.

01:05:00.540 --> 01:05:02.300
What if this has this value?

01:05:02.500 --> 01:05:05.240
It's probably the least interesting part of a live CTF.

01:05:05.240 --> 01:05:08.300
That's the only downside when you have a more reverse engineering heavy challenge.

01:05:08.720 --> 01:05:14.660
You're just seeing people maybe name stuff if you're lucky or add comments but most of the time it's just looking at it.

01:05:15.180 --> 01:05:20.780
You know you're getting closer when you start seeing a crash in a debugger and a payload being written and we don't have it yet.

01:05:20.780 --> 01:05:27.040
I'm going to go ahead and keep an eye on the organizers just briefly and see if we get any kind of that similar progress.

01:05:27.720 --> 01:05:29.460
So we have...

01:05:30.720 --> 01:05:31.540
Oh, okay.

01:05:31.540 --> 01:05:32.900
We did have a comment somebody else pointed out.

01:05:32.900 --> 01:05:34.080
Thank you for clarifying.

01:05:34.900 --> 01:05:42.960
The reason that somebody was looking for the libc was to actually run it because if you don't have the same VM handy, you can't run that libc.

01:05:42.960 --> 01:05:47.260
So you can just grab the libc from another version of Linux to be able to run the binary.

01:05:47.260 --> 01:05:50.840
So that is another completely valid reason that you might do that.

01:05:51.360 --> 01:06:00.340
Probably just easier to maybe look at a previous stream or... I don't think we told people what platform that all of our challenges were created on.

01:06:00.340 --> 01:06:04.200
That's actually a good note for future things.

01:06:04.200 --> 01:06:06.840
Because that's, again, normal in a CTF.

01:06:06.840 --> 01:06:07.500
Happens all the time.

01:06:07.500 --> 01:06:11.760
You have to figure out the OS that it was created for, match version information and whatnot.

01:06:11.800 --> 01:06:14.100
Not our intention to make that part of the challenge here.

01:06:14.100 --> 01:06:14.860
And it's a thing.

01:06:14.860 --> 01:06:24.740
It's like Ubuntu 22 was somewhat recently went in LTS release and a lot of people haven't updated to that yet.

01:06:25.400 --> 01:06:32.440
I will accept shared responsibility on this because, you know, update your computers, people.

01:06:32.860 --> 01:06:40.520
20.04, 22.04 would probably be the Ubuntu most common or Debian, certainly it's frequently.

01:06:40.520 --> 01:06:43.220
But alright, I'm going to go take a look at the ordinances and I'll be back and we'll see how it's going.

01:06:43.220 --> 01:06:44.140
Awesome.

01:06:45.200 --> 01:06:51.900
I was talking about something when it comes to these challenges.

01:06:52.920 --> 01:06:56.960
Trying to get back on my train of thought there.

01:07:01.000 --> 01:07:03.060
Oh, yes.

01:07:05.280 --> 01:07:09.400
Looking at another player, looking at code, trying to figure things out.

01:07:09.400 --> 01:07:20.800
A lot of times when I talk to people who are not experienced CTF players or don't know what CTFs are, you often get the question like, oh, is this some kind of eSports thing?

01:07:20.800 --> 01:07:24.340
Or like, could you make this into some kind of eSports thing?

01:07:24.340 --> 01:07:28.020
And to an extent this is kind of what we're trying to do here.

01:07:28.360 --> 01:07:39.400
But of course, it has its shortcomings that some aspects of CTF is kind of like watching someone else take a maths exam.

01:07:39.400 --> 01:07:42.360
It's, you know, occasionally not the most exciting.

01:07:42.360 --> 01:07:54.040
So we're really trying to, by adding this commentary and trying to understand what the players are doing, we're trying to make this an interesting and educational experience for all of you viewers there.

01:07:54.460 --> 01:08:01.260
So I hope you do enjoy this and have some takeaways.

01:08:01.260 --> 01:08:08.500
And definitely check out the challenges afterwards to also kind of get a feel for...

01:08:09.860 --> 01:08:18.980
Some of these might seem simple, but when you're sitting here and actually trying to do it, you have to consider and take into account all of these small little details.

01:08:19.600 --> 01:08:27.800
If you're just off by one, a small bit somewhere, the whole thing doesn't work, you need to do all this troubleshooting, debugging.

01:08:28.840 --> 01:08:35.240
And I think I mentioned it earlier, but when you're writing exploits, you are...

01:08:35.240 --> 01:08:39.560
Essentially, it's like software development, but with your hands tied behind your back.

01:08:39.560 --> 01:08:57.800
You don't get all the nice tools and helps and error messages that you get during normal software development processes, where you have all of these modern tools to help you, but here you're trying to bend something in a way that was not intended to be used.

01:08:57.800 --> 01:09:02.140
You're messing with the state of memory and so on.

01:09:03.100 --> 01:09:15.080
You really have everything stacked against you, and that is a big part of the challenge when doing these memory corruption challenges.

01:09:15.860 --> 01:09:24.420
Looking here at the code, we can see that the Bowser player is writing some small helper function here to send a number.

01:09:24.660 --> 01:09:36.460
Maybe they're going to try to use this to try to send a different number of numbers and see if they get any kind of reaction out of that.

01:09:37.640 --> 01:09:43.500
I haven't really seen yet what... oh, so now they're going to send like a thousand zeros.

01:09:43.560 --> 01:09:44.860
That's interesting.

01:09:47.480 --> 01:09:49.560
So we comment here like, yeah, it's unsolvable.

01:09:49.560 --> 01:09:54.120
Yeah, like the Sudoku itself is unsolvable and that's kind of like the twist of this whole thing.

01:09:55.020 --> 01:09:59.540
At face value you just sold a Sudoku and win, but then it's unsolvable.

01:10:00.000 --> 01:10:03.880
Yeah, that's kind of like the recap for people just recently tuning in.

01:10:04.360 --> 01:10:09.100
Speaking of recap, just to tell you again a little bit about what we're doing here.

01:10:09.360 --> 01:10:19.380
We're here in Vegas on site at DEFCON, so organizing this live CDF as part of the official DEFCON CDF.

01:10:19.380 --> 01:10:39.120
This is kind of like a sub-event where all the 16 participating teams participate in this single elimination knockout tournament where in each match the teams send one player to go head-to-head against the other team to be the first one to solve a relatively simple CDF challenge.

01:10:39.540 --> 01:10:41.440
I mean , relatively is relative.

01:10:41.440 --> 01:10:42.160
Yes, yes.

01:10:42.200 --> 01:10:44.300
I really want to stress relatively.

01:10:44.300 --> 01:10:49.000
And I want to be clear, I wouldn't personally solve half of the ones that we're fielding in the allotted time.

01:10:49.540 --> 01:10:53.960
I tried some of them and I could get them , but it may be taking a little bit longer.

01:10:53.960 --> 01:10:56.260
I have a lot of respect for these people.

01:10:56.260 --> 01:10:57.620
They're all very, very good.

01:10:58.000 --> 01:11:00.540
And they're dealing with the pressure of being on camera.

01:11:00.680 --> 01:11:03.380
There's a crowd standing around and watching them.

01:11:04.000 --> 01:11:07.880
It can be pretty nerve-wracking.

01:11:09.160 --> 01:11:13.840
I'm predicting that is quite the visual effect there.

01:11:13.840 --> 01:11:17.820
Yeah, you know, the photosensitivity warnings here.

01:11:18.180 --> 01:11:19.340
I think it's only on our monitor.

01:11:19.360 --> 01:11:21.900
No, it's on stream as well.

01:11:21.900 --> 01:11:23.280
We have some glitching.

01:11:23.280 --> 01:11:24.680
Not sure what that's about.

01:11:24.800 --> 01:11:27.560
Feels like our whole infrastructure is slowly melting.

01:11:27.660 --> 01:11:28.880
No, it's fine.

01:11:28.980 --> 01:11:29.940
Wow.

01:11:29.940 --> 01:11:32.640
That is unusual.

01:11:33.520 --> 01:11:35.620
Maybe we're getting hacked by the players.

01:11:35.620 --> 01:11:38.000
Through the HDMI cables.

01:11:38.000 --> 01:11:39.260
They're playing the other game.

01:11:39.520 --> 01:11:41.280
The other CTF challenge.

01:11:41.740 --> 01:11:48.900
We would be lying if we would say that we did not have a discussion about what shenanigans could the teams try to pull off.

01:11:48.900 --> 01:11:50.940
And how we would measure against it.

01:11:51.520 --> 01:11:56.500
Doing that kind of threat analysis or threat modeling.

01:11:57.060 --> 01:11:58.520
We have three more minutes.

01:11:58.660 --> 01:12:00.900
Three more minutes until it's gone.

01:12:00.900 --> 01:12:03.060
This has been a very fast 45 minutes.

01:12:03.400 --> 01:12:08.420
It's looking unlikely that either one... I did see some debugger action.

01:12:09.320 --> 01:12:11.240
I'm going to make one last pass.

01:12:11.240 --> 01:12:15.520
If we see somebody very close, they're making progress, we might be able to give them just a little bit extra.

01:12:15.520 --> 01:12:17.720
But basically, we're about ready to deploy.

01:12:20.460 --> 01:12:22.320
Or if they actually want to extend it.

01:12:23.460 --> 01:12:24.280
That's not a bad idea.

01:12:24.800 --> 01:12:28.180
If they both say they want to extend it, we'll let them go because they're the last one.

01:12:28.960 --> 01:12:33.260
So the rules are, if one of them says they want to go sudden death, then we go sudden death.

01:12:33.260 --> 01:12:35.100
If both of them want to extend it, then it's fine.

01:12:35.560 --> 01:12:36.840
But ask them

01:12:40.860 --> 01:12:42.020
one on one.

01:12:42.200 --> 01:12:43.820
To not give any pressure.

01:12:44.480 --> 01:12:48.020
Yeah, I mean, it would be cool to see a solution on this.

01:12:48.020 --> 01:12:53.260
And I think we do, since we have been keeping up with the schedule, we do have that kind of time.

01:12:54.520 --> 01:12:59.660
But again, yeah, it's difficult to say what the players want.

01:12:59.660 --> 01:13:02.000
This is also kind of like a game theory thing.

01:13:02.000 --> 01:13:03.680
Do you want to go to sudden death or not?

01:13:03.680 --> 01:13:07.020
It's a high risk environment, right?

01:13:07.020 --> 01:13:08.820
When you're going super fast.

01:13:09.080 --> 01:13:17.580
Do you think, because you also don't know the progress of the other player, do you think you have better progress than the other player in this challenge right now?

01:13:17.580 --> 01:13:25.680
And if you don't, do you think you have a better chance of beating them in the sudden death one versus catching up with them in the parent challenge?

01:13:25.680 --> 01:13:31.200
It's definitely not an easy decision to make by the players.

01:13:31.820 --> 01:13:34.560
So, what's the verdict?

01:13:34.560 --> 01:13:35.520
What do you think?

01:13:35.900 --> 01:13:37.580
If you're in their shoes...

01:13:37.580 --> 01:13:38.840
Oh no, I would say extend it.

01:13:38.840 --> 01:13:39.360
Absolutely.

01:13:40.140 --> 01:13:41.720
We have a game here.

01:13:42.600 --> 01:13:48.240
I'm happy with this because I don't want to change the rules in a way that they're unhappy with, but they both want to solve it.

01:13:48.380 --> 01:13:54.300
Nobody wants to give up on a challenge that you've been working hard, that you have a little bit of an idea.

01:13:54.500 --> 01:13:55.320
I'm glad.

01:13:55.320 --> 01:13:56.960
I really want to see them see this through.

01:13:56.960 --> 01:13:57.600
We'll let them go.

01:13:57.600 --> 01:14:00.740
It's the last one of the day, so we're not running over anything else.

01:14:01.700 --> 01:14:02.880
I'm actually kind of excited.

01:14:03.200 --> 01:14:06.100
So, a story related to that.

01:14:06.100 --> 01:14:16.880
So, I was playing in the qualifiers for the DEF CON CTF with our Scandinavian team, NorseCode, and I was basically sitting all weekend with one challenge.

01:14:17.200 --> 01:14:21.600
I mean, I took breaks and met some friends and stuff, but there was a lot of hours.

01:14:21.600 --> 01:14:22.140
This was Paris Challenge?

01:14:22.140 --> 01:14:23.680
This was Paris Challenge.

01:14:23.820 --> 01:14:26.000
It was the crypto-pwnable thing.

01:14:26.380 --> 01:14:36.980
So, after... I don't know if I spent... I don't remember if it was like 10, 20, or 30 hours on this, but regardless, I solved it like two minutes after the CTF ended.

01:14:36.980 --> 01:14:39.040
And that... yeah.

01:14:39.060 --> 01:14:43.100
On the one hand, it's crushing, and on the other hand, though, you still solved it.

01:14:43.100 --> 01:14:44.420
You still solved it.

01:14:44.420 --> 01:14:45.200
And that's the thing.

01:14:46.140 --> 01:14:53.340
When the time ran out, I could have just stopped, because it doesn't matter anymore.

01:14:53.340 --> 01:14:54.700
We're not going to get any points.

01:14:54.700 --> 01:14:56.260
I was so close.

01:14:56.260 --> 01:14:58.180
I did not want to stop there.

01:14:59.000 --> 01:15:10.340
So, the only saving grace or you want to call it for that, was that in the end, solving that challenge or not would not have affected whether we qualified or not.

01:15:10.340 --> 01:15:11.860
That would have been crushing.

01:15:11.860 --> 01:15:13.120
That's a little demoralizing.

01:15:13.120 --> 01:15:14.440
It would have been the difference.

01:15:14.440 --> 01:15:19.200
Luckily, even with those points, we would have been just below the qualifying limit.

01:15:19.200 --> 01:15:21.900
So, at least you had clarity there either way.

01:15:21.900 --> 01:15:23.600
Yeah, I was comfortable with that.

01:15:23.600 --> 01:15:24.020
That was fine.

01:15:24.020 --> 01:15:31.680
And also, that means that I could be part of this without having to betray the team, right?

01:15:31.680 --> 01:15:33.540
So, yeah.

01:15:33.680 --> 01:15:34.940
Turned out okay.

01:15:35.180 --> 01:15:37.480
So , we are...

01:15:39.240 --> 01:15:41.760
There's a question here about whether it was NCATS .

01:15:41.760 --> 01:15:46.680
No, this was the crypto-pwnable challenge.

01:15:47.300 --> 01:15:49.800
It was about a function closure thing.

01:15:49.960 --> 01:15:50.660
C++.

01:15:50.660 --> 01:15:52.180
We could go ask Perry.

01:15:52.180 --> 01:15:52.720
She's somewhere .

01:15:52.720 --> 01:15:53.940
She just was in the room.

01:15:53.940 --> 01:15:54.660
She just left.

01:15:54.660 --> 01:15:55.220
Right.

01:15:55.520 --> 01:15:58.520
But, yeah, I've heard a number of people that worked on that.

01:15:58.520 --> 01:15:59.560
It was a great challenge.

01:15:59.560 --> 01:16:02.000
I enjoyed it a lot.

01:16:02.960 --> 01:16:04.100
But it was tough.

01:16:04.140 --> 01:16:04.420
Okay.

01:16:04.420 --> 01:16:07.700
So, we don't have a hard time with it now.

01:16:07.700 --> 01:16:16.340
Now, it's basically we're just going to let it go until either we are convinced it's going to take way too long or we'll see at this point.

01:16:16.340 --> 01:16:18.460
But they both want to keep going.

01:16:18.620 --> 01:16:20.280
I would love for one of them to get it.

01:16:20.280 --> 01:16:28.880
It not only means we get to save one of our sudden deaths, but I think it's just way more fulfilling for them and for the audience to see the hard one solved.

01:16:28.880 --> 01:16:30.360
So, we're looking forward to it.

01:16:31.580 --> 01:16:34.300
It is interesting that we've got rock gadget address.

01:16:34.300 --> 01:16:40.600
It looks like a template, I think, that this existed because hopefully they have an idea that that is...

01:16:41.600 --> 01:16:44.360
Someone is writing something very deliberate here, right?

01:16:44.360 --> 01:16:50.920
This is like to print out the board somehow, but let's see.

01:16:50.920 --> 01:16:55.040
They are trying to see.

01:16:55.040 --> 01:17:02.620
I mean, this double loop there is to print out some state, but that part above, you see something where they're cutting off.

01:17:02.640 --> 01:17:03.620
They're swapping.

01:17:06.560 --> 01:17:07.760
All right.

01:17:08.700 --> 01:17:13.660
Oh, is this just to generate a solution that they want?

01:17:13.660 --> 01:17:20.140
I mean, I would just search the internet for solve Sudoku board and copy and paste it, but if that is what they're doing, that would be valid too.

01:17:20.140 --> 01:17:20.280
Right.

01:17:20.280 --> 01:17:25.560
So, the idea is that you want to overflow and stuff to basically insert...

01:17:25.560 --> 01:17:30.780
to modify the state into something that's either solvable or already solved.

01:17:31.860 --> 01:17:34.300
And so, they need to have that.

01:17:34.300 --> 01:17:34.420
Okay.

01:17:34.420 --> 01:17:35.960
So, we're seeing interesting.

01:17:35.960 --> 01:17:37.260
We're seeing calculations.

01:17:37.260 --> 01:17:40.080
We're seeing length calculations.

01:17:41.840 --> 01:17:46.720
Unfortunately, I was hoping we'd get some more video from the new organizer.

01:17:46.720 --> 01:17:48.360
Oh, it came in briefly.

01:17:48.380 --> 01:17:49.260
Yes.

01:17:49.300 --> 01:17:51.700
There was some debugger output there, right?

01:17:51.700 --> 01:17:52.620
Yeah.

01:17:52.620 --> 01:17:52.940
Yeah.

01:17:52.940 --> 01:17:56.200
We'll leave it up for a second and just kind of show them both and we might be able to see a little bit.

01:17:56.200 --> 01:17:56.400
Yep.

01:17:56.400 --> 01:17:56.600
Yep.

01:17:56.600 --> 01:17:57.000
See there?

01:17:57.000 --> 01:17:57.980
It's coming on.

01:17:58.440 --> 01:17:59.600
Man, that's tantalizing.

01:17:59.600 --> 01:18:00.640
That's so mean.

01:18:00.640 --> 01:18:01.100
Yeah.

01:18:01.100 --> 01:18:03.760
This cable has been...

01:18:03.760 --> 01:18:04.100
Yeah.

01:18:04.100 --> 01:18:05.940
We might have to do some shopping.

01:18:05.940 --> 01:18:07.760
Oh, there is definitely a shopping run tonight.

01:18:07.760 --> 01:18:08.120
Yes.

01:18:08.120 --> 01:18:11.160
So, we should be able to have this solved and out of the way.

01:18:11.300 --> 01:18:16.000
And that way we got a long day, eight hours tomorrow of hopefully uninterrupted stream.

01:18:16.380 --> 01:18:16.680
Yeah.

01:18:16.680 --> 01:18:17.080
We'll see.

01:18:17.080 --> 01:18:18.840
We'll see if that turns out to be the case.

01:18:18.840 --> 01:18:24.340
I mean, given that it's only been... we swapped out the capture card, the USB-C cable.

01:18:24.720 --> 01:18:29.160
The HDMI is the only thing we haven't swapped out, but it's been that same side of the table consistently.

01:18:29.360 --> 01:18:29.880
Yes.

01:18:29.880 --> 01:18:31.260
That's been having these problems.

01:18:31.720 --> 01:18:36.980
Makes me think that, yeah, we've just got an HDMI cable that is suspicious.

01:18:37.640 --> 01:18:40.380
So, we'll see if we can get that going.

01:18:40.380 --> 01:18:41.060
All right.

01:18:41.740 --> 01:18:44.560
Actually, I'm going to go ahead and do another in-person look.

01:18:44.560 --> 01:18:46.180
I'm going to go ahead and take a look at new organizers.

01:18:46.740 --> 01:18:48.200
We'll be back with an update shortly.

01:18:49.060 --> 01:18:50.740
Debugger is generally a good sign.

01:18:50.740 --> 01:18:51.200
Yes.

01:18:51.640 --> 01:18:52.480
Oh, wait.

01:18:54.000 --> 01:18:58.180
I saw a bin bash string in the debugger there somehow.

01:18:59.620 --> 01:19:01.800
But that doesn't really make sense, right?

01:19:01.800 --> 01:19:05.620
Well, I mean, with the intended solution, that doesn't mean they're not going to do...

01:19:06.340 --> 01:19:07.620
And there also is the...

01:19:08.660 --> 01:19:11.720
So, I'm trying to remember how the win function runs.

01:19:11.720 --> 01:19:15.460
It may be from the win function on the stack as well, too.

01:19:15.460 --> 01:19:16.060
I don't remember.

01:19:16.060 --> 01:19:18.260
But no, they shouldn't be getting to that.

01:19:18.740 --> 01:19:18.880
Yes.

01:19:18.880 --> 01:19:19.200
Let's see.

01:19:19.200 --> 01:19:21.400
I don't see the...

01:19:21.400 --> 01:19:32.060
In the meantime, I wanted to just ask people who are watching whether you are like... Is anyone here in Vegas attending DEF CON?

01:19:32.060 --> 01:19:35.560
Or are you watching from all over the world?

01:19:35.560 --> 01:19:37.140
Like, who do we have here?

01:19:37.140 --> 01:19:40.760
We saw someone from Kenya even chimed in earlier and said they were watching.

01:19:40.760 --> 01:19:43.880
So, we know we do have some worldwide watchers.

01:19:43.880 --> 01:19:47.400
We'll go and see those analytics afterwards to see who's watching.

01:19:48.580 --> 01:19:49.140
But, yeah.

01:19:49.420 --> 01:19:50.720
Do we have any people?

01:19:51.000 --> 01:20:00.060
By the way, if you are here at DEF CON, feel free to come by in the CTF area.

01:20:01.000 --> 01:20:04.700
We probably won't be able to talk a ton, but hopefully we get some breaks.

01:20:04.700 --> 01:20:06.540
If you come during matches, you can watch the matches.

01:20:06.540 --> 01:20:11.980
If you come between matches, you can have a chat with us, hopefully, if we're not panicking.

01:20:12.780 --> 01:20:15.440
Yeah, someone's watching from the CTF floor.

01:20:15.440 --> 01:20:16.420
Okay, nice.

01:20:16.420 --> 01:20:17.800
And also from Europe.

01:20:17.800 --> 01:20:19.780
In the hotel room, giving your feet a break.

01:20:19.780 --> 01:20:22.240
Yeah, that's a wise decision, I think.

01:20:22.240 --> 01:20:26.700
I'm ready for my feet, my throat, like, several parts of me need a break.

01:20:27.400 --> 01:20:29.160
We've been talking here for several hours now.

01:20:29.160 --> 01:20:30.900
This is interesting.

01:20:30.900 --> 01:20:34.060
These ASCII values are being converted to integers.

01:20:34.860 --> 01:20:37.860
So, we're looking at debugger dump of the game state.

01:20:37.860 --> 01:20:38.240
Nice.

01:20:38.240 --> 01:20:41.360
So, we do see the game state.

01:20:41.740 --> 01:20:44.100
It's really obvious to see those numbers.

01:20:44.360 --> 01:20:45.120
Cool.

01:20:47.000 --> 01:20:51.620
Yeah, and you can see, look at that base thing there.

01:20:51.620 --> 01:20:57.100
You have, like, generating a list of integers from 0 to 96, which is interesting.

01:20:58.060 --> 01:20:58.940
Yeah.

01:20:59.920 --> 01:21:02.480
We have watchers from Estonia and Brazil.

01:21:02.480 --> 01:21:05.780
People who are saying they want to go visit DEF CON in the future.

01:21:05.780 --> 01:21:09.080
Yeah, I think DEF CON is a cool event to visit.

01:21:09.640 --> 01:21:13.000
I think they're trying to increase the amount of streaming and online presence as well, too.

01:21:13.000 --> 01:21:15.980
So, you probably will be able to find other streams.

01:21:15.980 --> 01:21:21.260
I think there's even some webcam, like, 360-degree virtual cameras they're putting up in a couple of the rooms where you can watch what's going on.

01:21:21.260 --> 01:21:24.200
So, they're trying to improve the accessibility.

01:21:24.200 --> 01:21:32.660
I mean, certainly with COVID, in general, most conferences have tried to adapt better for... Oh, okay, we have somebody watching right next to our camera.

01:21:32.660 --> 01:21:33.900
Let's hope they don't bump it.

01:21:36.880 --> 01:21:41.240
But, anyway, again, checking the code here they're writing.

01:21:41.700 --> 01:21:44.660
I'm trying to get a better feel for what they're doing.

01:21:45.440 --> 01:21:48.740
Again, they're generating a list of numbers.

01:21:49.400 --> 01:21:49.980
Okay.

01:21:49.980 --> 01:21:53.760
Also, they need to find the right offset for their overflow.

01:21:53.760 --> 01:21:54.940
This actually looks really good.

01:21:54.940 --> 01:21:55.340
Yes.

01:21:55.340 --> 01:21:56.660
This actually does look really good.

01:21:56.660 --> 01:21:56.860
I'm glad we let them go.

01:21:56.860 --> 01:21:58.420
Because once they finish this...

01:21:58.420 --> 01:22:00.020
Yeah, if they get the right offsets.

01:22:00.020 --> 01:22:02.020
Let me go look at the other one, but we might be closing in.

01:22:02.020 --> 01:22:02.680
Yes.

01:22:06.420 --> 01:22:07.620
So, that's really cool.

01:22:08.300 --> 01:22:10.820
Once they get that thing, it's going to be real quick.

01:22:10.820 --> 01:22:13.000
We are probably going to miss...

01:22:13.000 --> 01:22:15.540
There's a big risk we're going to miss the moment.

01:22:15.620 --> 01:22:20.920
So, basically, if I'm reading this correctly, what they're trying to do is find the offset in memory.

01:22:20.920 --> 01:22:32.460
Like , they're overflowing something, and then how far into this do they want to put whatever they are placing there, which should be the solved or solvable state.

01:22:34.380 --> 01:22:37.520
So, yeah, they might definitely be on to something.

01:22:37.520 --> 01:22:40.060
They're switching the numbers around a little bit.

01:22:40.060 --> 01:22:48.100
Maybe it's that they switched the zeros to a one, which seems to have crashed the program.

01:22:48.260 --> 01:22:51.920
And then checking why this is happening.

01:22:52.920 --> 01:22:54.700
Yeah, we have someone from Morocco as well.

01:22:54.700 --> 01:22:55.420
Cool.

01:22:57.400 --> 01:22:59.860
It's cool to see we have people all over.

01:23:00.680 --> 01:23:08.280
I guess I'm trying to work out what time it is across the world at the moment.

01:23:09.240 --> 01:23:14.380
But people watching from Europe, it's like in the middle of the night there.

01:23:14.920 --> 01:23:18.020
So, that's dedication.

01:23:19.180 --> 01:23:20.980
Hope you're enjoying it.

01:23:21.440 --> 01:23:25.520
Trying to see here, they're just quickly looking at the disassembly again.

01:23:27.040 --> 01:23:32.600
Trying to maybe looking for some specific offset or so.

01:23:35.140 --> 01:23:41.480
Yes, they did get some specific offset to put a breakpoint there, right?

01:23:41.480 --> 01:23:44.220
And then they're also looking at the base.

01:23:45.340 --> 01:23:46.540
Oh, yeah, to make the breakpoint.

01:23:46.540 --> 01:23:53.000
Or maybe not the breakpoint, or the offset, where to inspect the memory.

01:23:54.800 --> 01:23:55.720
Oh, yeah.

01:23:56.600 --> 01:23:59.820
People saying they're watching from like, yeah, definitely middle of the night.

01:24:00.840 --> 01:24:01.520
You know.

01:24:05.990 --> 01:24:06.690
Awesome.

01:24:06.690 --> 01:24:08.370
Netherlands represented as well.

01:24:08.570 --> 01:24:16.490
So, I'm seeing some interesting stuff there, but what did you see from the organizers?

01:24:16.490 --> 01:24:17.990
Yeah, so the...

01:24:17.990 --> 01:24:20.330
I mean, I hate to take bets.

01:24:20.350 --> 01:24:23.150
Because I've lost a lot of money at this table so far.

01:24:23.570 --> 01:24:29.030
If this was a gambling arrangement, I would not be doing so well.

01:24:29.030 --> 01:24:30.810
But, I will...

01:24:30.810 --> 01:24:33.190
I also feel like I tend to favor my side of the table.

01:24:33.190 --> 01:24:37.130
And then we've had all these surprise victories from the other ones pop up several times.

01:24:37.130 --> 01:24:42.570
But, all that said, I do think Team Taiwan has a little bit of a leap.

01:24:42.570 --> 01:24:46.250
So, looking at the new organizers, we've got a script.

01:24:46.270 --> 01:24:47.130
It has a bunch of...

01:24:47.130 --> 01:24:52.090
It's a mixture of GDB, some PwnTools, and then as well as, you know, sending inputs and kind of breaking in.

01:24:52.570 --> 01:24:58.530
I didn't get the sense that they had an overall plan for what to do.

01:24:59.110 --> 01:25:03.650
But again, definitely the one thing I've learned is that I don't know what I'm doing anyways.

01:25:03.650 --> 01:25:06.510
It is really hard to understand exactly what's going on in their head.

01:25:06.510 --> 01:25:07.950
So, you're not always right.

01:25:09.270 --> 01:25:10.530
Whereas, I will say

01:25:14.350 --> 01:25:16.550
it certainly looks like with that offset, right?

01:25:16.550 --> 01:25:21.810
We're seeing a valid, solved Sudoku trying to find the right offset to line it up.

01:25:21.810 --> 01:25:26.370
Which sounds like, from what I understand of it, is the intended solution.

01:25:27.970 --> 01:25:28.410
So...

01:25:29.050 --> 01:25:30.230
We'll see.

01:25:31.870 --> 01:25:32.570
Yep.

01:25:34.370 --> 01:25:34.810
It's...

01:25:35.690 --> 01:25:38.450
Can we get some confirmation?

01:25:38.450 --> 01:25:39.730
Is the solution...

01:25:39.730 --> 01:25:44.350
If it's just misaligning the correct board, the certain number of bytes, will that trigger it, essentially?

01:25:45.870 --> 01:25:47.710
Any correct board at the right offset.

01:25:47.710 --> 01:25:50.490
So just put the right amount of padding bytes in, and then it will overwrite it the right...

01:25:59.400 --> 01:26:00.440
Say again?

01:26:07.030 --> 01:26:07.910
Yep.

01:26:09.290 --> 01:26:09.690
Uh...

01:26:10.290 --> 01:26:11.590
Then you mark it as solved?

01:26:11.590 --> 01:26:12.150
Yeah.

01:26:19.720 --> 01:26:22.260
Oh, just send anything, and it will just mark it as solved?

01:26:22.520 --> 01:26:23.320
Right.

01:26:24.140 --> 01:26:24.940
Okay.

01:26:24.940 --> 01:26:43.540
So what our producer there said was that first you send a solvable state, you overwrite the thing, the state, with the solvable one, and then you just send something to trigger the recheck, and then have it be solved, and then you get the win there.

01:26:45.880 --> 01:26:50.460
We can see here, they are working out in a text editor...

01:26:50.460 --> 01:26:58.800
Yeah, it still looks like they're trying to solve the state as it exists, not overwrite the state with their solve.

01:26:58.800 --> 01:27:00.120
So what I saw, I wonder...

01:27:00.760 --> 01:27:10.360
I'm a little afraid they got the overwrite, but if their exploit didn't try to send another round for validation, it overwrote it, but then never...

01:27:10.360 --> 01:27:11.880
Oh, wow.

01:27:11.880 --> 01:27:13.880
That would be terrible.

01:27:14.260 --> 01:27:22.040
So it is possible that they potentially had the right solution, just didn't re-trigger it to be able to actually get to the win function.

01:27:23.860 --> 01:27:24.300
So...

01:27:25.580 --> 01:27:27.300
we will see.

01:27:27.820 --> 01:27:29.300
We're only a little bit late.

01:27:29.300 --> 01:27:32.600
Actually, technically we have two more minutes before the original length of this.

01:27:32.600 --> 01:27:36.140
And we're letting them run long just because of the last one of the day.

01:27:37.300 --> 01:27:45.760
And we prefer they have a chance to do it if they can, but our voices will give out, and there will be some point in which we say, sorry, we're cutting you off.

01:27:45.920 --> 01:27:49.660
But none of us want that to happen, so we'll see.

01:27:49.740 --> 01:27:54.180
We're taking a bet here and hoping this will work.

01:27:55.580 --> 01:27:58.420
We're also about to lose power on our chat.

01:27:58.860 --> 01:27:59.480
Tunisia?

01:27:59.480 --> 01:27:59.920
Excellent.

01:27:59.920 --> 01:28:00.540
Welcome.

01:28:00.540 --> 01:28:01.200
Yeah.

01:28:01.240 --> 01:28:03.680
I've been to Tunisia for a CTF competition.

01:28:04.040 --> 01:28:07.080
I think I got invited to speak there one time at a conference.

01:28:07.240 --> 01:28:08.340
There we go.

01:28:09.120 --> 01:28:10.740
Let's see if that actually powers it.

01:28:10.740 --> 01:28:12.480
I don't know what this is plugged into at this point.

01:28:13.040 --> 01:28:13.240
Yeah.

01:28:13.240 --> 01:28:15.180
We have power on one of our screens here.

01:28:15.180 --> 01:28:16.160
All right, good.

01:28:16.180 --> 01:28:20.500
We also have a graphical glitch on the Balsun screen.

01:28:20.500 --> 01:28:22.680
But it's just blocking the ads, so I'm okay with it.

01:28:22.680 --> 01:28:23.500
That sounds great.

01:28:23.500 --> 01:28:28.300
I wish all of my graphics glitches just blocked out ads as I surfed on the web.

01:28:28.620 --> 01:28:37.020
So, as an employee of a big ad tech company, I would have to... A large tech company whose revenue might depend heavily on ads?

01:28:37.020 --> 01:28:37.660
Yeah.

01:28:38.380 --> 01:28:39.040
Yeah.

01:28:40.460 --> 01:28:42.300
Are you allowed to run ad blockers?

01:28:42.560 --> 01:28:43.920
Nah, I'm not going to make a tug of war.

01:28:44.600 --> 01:28:45.080
All right.

01:28:45.240 --> 01:28:46.500
I'm not going to do that.

01:28:46.980 --> 01:28:47.360
All right.

01:28:47.360 --> 01:28:48.760
So, here we go.

01:28:52.290 --> 01:28:56.470
So, this still feels like we're trying to solve it.

01:28:57.270 --> 01:28:58.530
I don't see...

01:28:59.450 --> 01:29:01.610
I don't see the...

01:29:04.190 --> 01:29:05.390
the exploit.

01:29:05.390 --> 01:29:08.290
I don't see them actually exploiting it.

01:29:10.010 --> 01:29:17.910
This might still work if their idea is to just overwrite a couple of values and then make it solvable and then put it in the solution.

01:29:17.910 --> 01:29:18.990
It's not a fast solution.

01:29:18.990 --> 01:29:21.070
They're going to inherently have to overwrite the whole thing though, right?

01:29:21.070 --> 01:29:23.030
Because they're just linearly overwriting it.

01:29:23.030 --> 01:29:27.810
It might be that they think they can only overwrite the beginning of it or something like this.

01:29:27.810 --> 01:29:29.590
It's still going to have a null at the end.

01:29:29.610 --> 01:29:30.330
No, no, no.

01:29:30.330 --> 01:29:30.830
Not necessarily.

01:29:30.830 --> 01:29:33.210
Because it's going to convert in... Okay, that's fair.

01:29:33.210 --> 01:29:34.810
I mean, it could work.

01:29:34.810 --> 01:29:39.170
It's not the intended play, but it could probably work.

01:29:40.010 --> 01:29:41.050
So, yeah.

01:29:41.590 --> 01:29:43.930
Unless there's a question mark at the very end of the puzzle.

01:29:43.930 --> 01:29:49.690
If there's an unallocated one at the very end, that would have to be...

01:29:49.690 --> 01:29:50.730
Well, we'll see.

01:29:51.270 --> 01:29:52.430
We'll see.

01:29:52.430 --> 01:29:53.250
All right.

01:29:53.890 --> 01:29:54.790
A few more...

01:29:54.790 --> 01:29:56.390
A few more bits.

01:29:56.810 --> 01:29:57.990
Thanks everybody for hanging with us.

01:29:57.990 --> 01:30:02.130
This has been just utterly exhausting and super exciting.

01:30:02.770 --> 01:30:12.370
Just as a quick recap from our earlier games, we had a nail-biter of a finish at the very beginning from Shellfish versus PTB WTL.

01:30:12.370 --> 01:30:16.810
They were, I think, within a few keystrokes of each other.

01:30:16.810 --> 01:30:18.370
You can't get a tighter match.

01:30:18.510 --> 01:30:21.070
We were looking at one screen...

01:30:21.070 --> 01:30:22.230
About to declare a winner.

01:30:22.250 --> 01:30:23.990
Then all of a sudden, it popped.

01:30:23.990 --> 01:30:25.310
It just was so quick.

01:30:25.470 --> 01:30:26.530
So that was fantastic.

01:30:26.530 --> 01:30:29.530
Make sure you go back and check the replay on that one.

01:30:29.530 --> 01:30:34.110
We're going to end the stream today when we're done with this particular challenge.

01:30:34.810 --> 01:30:35.730
Sorry about that.

01:30:35.730 --> 01:30:36.610
I hit the microphone.

01:30:36.790 --> 01:30:40.970
We're going to end the stream today once we're done with this challenge.

01:30:41.230 --> 01:30:42.530
And we wrap it up.

01:30:43.030 --> 01:30:45.030
But we'll be back tomorrow.

01:30:45.090 --> 01:30:46.110
A long day tomorrow.

01:30:46.110 --> 01:30:48.610
So the stream is going to run for eight hours straight.

01:30:48.610 --> 01:30:52.690
Actually, I guess nine at least because we've got eight total hours.

01:30:53.470 --> 01:30:54.990
Each one's a one hour thing.

01:30:55.610 --> 01:30:56.330
We'll see.

01:30:56.330 --> 01:30:57.530
We may end up needing a break.

01:30:57.530 --> 01:30:59.610
We're going to try to get breaks by trading off.

01:30:59.610 --> 01:31:01.570
You're going to see some guest commentators.

01:31:01.570 --> 01:31:03.990
We're going to have some other people come in and fill out different roles.

01:31:03.990 --> 01:31:13.210
Should we... I think it was already written on Twitter, but the idea is to have... We have LiveOverflow probably joining in.

01:31:13.310 --> 01:31:14.930
And Camoso.

01:31:14.990 --> 01:31:16.290
Brandon Falk.

01:31:18.530 --> 01:31:25.790
Two popular people in the security concentration space.

01:31:27.110 --> 01:31:28.210
I'm excited.

01:31:28.210 --> 01:31:30.710
Looking forward to chatting with both of them.

01:31:31.410 --> 01:31:37.070
And I'm also looking forward to have a break as we each get to maybe alternate every other round.

01:31:37.070 --> 01:31:38.850
So one of us will get to take a rest.

01:31:38.850 --> 01:31:43.070
And also make sure we give our producer, Glenn, a break as well.

01:31:43.510 --> 01:31:45.190
We'll be cycling through that.

01:31:46.510 --> 01:31:49.250
We've got a variety of different challenges.

01:31:49.850 --> 01:31:56.230
Maybe for any of the teams that happen to be listening, we want to talk about the overall types of challenges that we have.

01:31:56.230 --> 01:32:00.390
No super spoilers, but I will say I think we're pretty representative.

01:32:01.970 --> 01:32:04.650
Heavy pwned focus, a little bit of RE.

01:32:05.090 --> 01:32:10.550
There's certainly a little bit like shell coding or constrained exploitation.

01:32:14.110 --> 01:32:16.590
Just having a quick look here again.

01:32:16.590 --> 01:32:18.030
Yeah, trying to get caught back up.

01:32:19.290 --> 01:32:19.890
Oh man.

01:32:19.890 --> 01:32:21.430
So they have a solution there, right?

01:32:21.430 --> 01:32:26.770
They have a solved solution, but... Yeah .

01:32:26.830 --> 01:32:30.910
There's a hashtag free Jordan, Glenn and Kalle in the chat.

01:32:30.910 --> 01:32:34.230
So yeah, just to clarify, that's my nickname .

01:32:35.170 --> 01:32:36.290
Yeah .

01:32:37.650 --> 01:32:39.250
Jack Carter, thank you.

01:32:39.370 --> 01:32:44.130
I mean, thank you Negasoro , this random person who showed up in our chat.

01:32:44.190 --> 01:32:50.670
Certainly not the author of this particular challenge that is stymied our opponents for so long.

01:32:52.050 --> 01:32:53.590
But you're not wrong.

01:32:53.590 --> 01:32:58.970
If they just would hack harder, we could take a break and we could get some dinner.

01:32:59.830 --> 01:33:01.570
Let us consider this.

01:33:01.570 --> 01:33:06.850
I would say we are going to have to hit sudden death pretty soon because we're looking at another several minutes of sudden death as well.

01:33:10.470 --> 01:33:11.590
We'll take a look.

01:33:11.590 --> 01:33:13.750
Maybe I'll take one more pass at new organizers.

01:33:14.130 --> 01:33:18.130
We'll talk about having a...

01:33:18.130 --> 01:33:19.830
We'll consider what we want to go.

01:33:20.930 --> 01:33:21.590
Yeah.

01:33:22.550 --> 01:33:24.370
I'll go ahead and give a bit of a...

01:33:24.370 --> 01:33:25.810
Oh, just use a data glove.

01:33:26.090 --> 01:33:27.130
What is a data glove?

01:33:27.130 --> 01:33:28.470
That's a reference I don't get.

01:33:28.470 --> 01:33:32.630
Isn't that the game controller thing?

01:33:32.630 --> 01:33:34.510
No, that's a power glove.

01:33:34.510 --> 01:33:36.590
A child of the 80s, of course.

01:33:36.590 --> 01:33:37.190
Yeah.

01:33:38.370 --> 01:33:40.550
Sam, no trolling.

01:33:40.550 --> 01:33:41.110
No trolling.

01:33:41.370 --> 01:33:41.850
No.

01:33:43.450 --> 01:33:44.730
We will find you.

01:33:44.730 --> 01:33:45.530
You're in the room.

01:33:45.530 --> 01:33:46.550
We remember this.

01:33:46.550 --> 01:33:48.510
We don't talk like that.

01:33:49.290 --> 01:33:53.250
Next you're going to be asking for network forensics or something crazy.

01:33:53.250 --> 01:33:55.190
We might call the goons.

01:33:55.790 --> 01:33:58.570
I'll go check out new organizers and we'll be back.

01:33:58.570 --> 01:34:03.430
I'll give an update on the Defcon CTF scoreboard in the meantime.

01:34:05.550 --> 01:34:25.870
We have a slightly larger spread now with spanning from just below 14,000 and up to just above 18,000 points between the 16th and the 1st place with Katsubin in 1st place, MMM in 2nd place and Perfect Root in 3rd place.

01:34:25.890 --> 01:34:35.450
And if I'm not misremembering, I think last year we did have a top fight between Katsubin and PPP as well.

01:34:35.450 --> 01:34:41.170
They have kind of pulled ahead, those two teams, and created a slight gap down to 3rd place.

01:34:41.170 --> 01:34:53.410
I do think this mirrors some of what we saw last year with regards to the standings, but this is only the first day of the Defcon CTF.

01:34:53.410 --> 01:34:55.370
A lot of stuff can happen.

01:34:55.770 --> 01:34:57.490
This is far from over.

01:34:57.830 --> 01:35:06.330
We're going to be keeping an eye on that throughout the weekend and give you updates.

01:35:08.290 --> 01:35:16.250
If you're here in the CTF room, you can see this really funny visualization the Nautilus Institute have put up.

01:35:16.250 --> 01:35:26.470
It's some 3D animation of a bunch of weird machines, one for each team, spitting random objects at the other teams.

01:35:26.530 --> 01:35:29.830
I guess it's showing who is attacking whom.

01:35:29.970 --> 01:35:33.490
Possibly there's seashells and stuff flying around.

01:35:34.150 --> 01:35:37.390
I guess there's some joke there about shells and seashells.

01:35:37.390 --> 01:35:48.170
But again, taking a look at the screen of Balsan here, I'm still not entirely sure.

01:35:48.170 --> 01:35:51.310
They have this partial solution or a solution.

01:35:51.310 --> 01:36:01.890
They've split up the solution into two parts and then trying to send some data and then they're sending the other solution.

01:36:01.890 --> 01:36:04.030
Still not exactly sure what's going on.

01:36:06.350 --> 01:36:09.950
So, we have data handler, crazy keyboards.

01:36:09.950 --> 01:36:13.590
Yeah, I will have to look that up afterwards.

01:36:13.990 --> 01:36:21.030
But yeah, I'm still thinking Power Gloves would really help out in this situation.

01:36:21.150 --> 01:36:26.630
Maybe you could have different ROP gadgets mapped to the different buttons and stuff.

01:36:26.630 --> 01:36:29.010
That's the way to go.

01:36:29.590 --> 01:36:34.990
Anyway, you can see them in the debugger here, inspecting the memory there a little bit.

01:36:34.990 --> 01:36:36.670
So I'm looking at the global variables.

01:36:36.670 --> 01:36:41.810
You can see you have the standard in and standard out objects and then further down they have these objects.

01:36:41.810 --> 01:36:51.530
And you can see the byte values there in the middle of the printed out block with the different digits of the Sudoku solution.

01:36:54.450 --> 01:37:04.630
Yeah, it feels like they are very close to getting it, but still a bit unsure exactly what's going on.

01:37:08.470 --> 01:37:13.330
Yeah, we have Jordan coming back here now, so we'll get an update on where we are.

01:37:13.330 --> 01:37:15.770
We are going to give them a sudden death hint.

01:37:15.770 --> 01:37:21.170
We're going to give them a hint that is just... because here's the thing that we have missed talking about it so far.

01:37:21.170 --> 01:37:31.450
I was looking back over with the example solution and the nuance here is there's a length check that has been showing up a little bit.

01:37:31.450 --> 01:37:40.370
That length check basically prevents you from, even if you overwrite it with a fully solved board, from actually solving it on that throw.

01:37:40.370 --> 01:37:44.050
So you overwrite the state of the board all but the last one.

01:37:44.470 --> 01:37:46.050
And the last one you leave empty.

01:37:46.050 --> 01:37:50.070
And then you can just solve it by overwriting the correct last answer.

01:37:50.170 --> 01:37:50.610
I see.

01:37:50.610 --> 01:38:02.010
So it's a little bit along the lines of what we've been talking about, but it seems that they've done a weaker variant of that where they didn't have as good of a solution.

01:38:02.330 --> 01:38:06.350
There's a question here about is there anywhere that explains the CTF format?

01:38:06.350 --> 01:38:08.410
There's an AD going on as well as these 1v1s.

01:38:08.410 --> 01:38:09.030
Yes.

01:38:09.030 --> 01:38:19.870
So kind of like the main CTF, the DEFCON CTF, is the traditional DEFCON attack defense that we all know and love.

01:38:20.110 --> 01:38:24.550
Although there have been variants and twists to it over the years.

01:38:25.530 --> 01:38:35.350
Then within this competition, this live CTF is like a sub-event where it's running parallel to the attack defense aspect of this.

01:38:35.350 --> 01:38:53.630
So each team sends one player for each match and then we play this knockout tournament and at the end this will generate a ranking from the knockout tournament which is then fed back in and will affect the scores of the main CTF event.

01:38:53.630 --> 01:39:01.850
So this will be valuable and might definitely affect the final standings of the DEFCON CTF.

01:39:01.850 --> 01:39:12.430
I'm not completely aware of what the weighting factor is, how the scoring model works for the CTF.

01:39:14.010 --> 01:39:26.270
So I couldn't tell you exactly how valuable it is to win the tournament versus getting second place, but we've been trying to find a balance where the teams can definitely help.

01:39:26.270 --> 01:39:35.090
I'll tell you in a second, but first I'm going to deliver the hints and I'll be right back and we'll see if we can bring this one home.

01:39:35.090 --> 01:39:37.510
Right, can you just read me the hints here first?

01:39:37.510 --> 01:39:38.510
Here we go.

01:39:38.610 --> 01:39:40.890
First attempt, overwrite almost all.

01:39:40.910 --> 01:39:43.250
Second attempt solves due to length check.

01:39:43.250 --> 01:39:43.930
Yes.

01:39:44.090 --> 01:39:46.610
This is the hint and we will see if this does it.

01:39:46.610 --> 01:39:50.350
Yeah, this is almost like a straight up solution.

01:39:50.350 --> 01:39:53.310
This could almost be like a write-up for the...

01:39:53.310 --> 01:39:56.530
You have to understand what the program does and that's the state that they've got.

01:39:59.050 --> 01:40:09.850
So now we're going to give them the final, hopefully final hint here that will just hopefully blow this case wide open and have them solve it from there.

01:40:09.950 --> 01:40:14.550
Did we get any reaction from the players on that?

01:40:14.550 --> 01:40:15.650
I was too busy coming back.

01:40:15.650 --> 01:40:17.010
I should have watched.

01:40:17.010 --> 01:40:17.990
Okay, okay, I see.

01:40:18.090 --> 01:40:20.310
Yeah, we got some forehead touching.

01:40:20.410 --> 01:40:21.010
Okay.

01:40:21.010 --> 01:40:22.270
Says our producer.

01:40:22.390 --> 01:40:23.070
Yes.

01:40:24.530 --> 01:40:25.410
So we'll see.

01:40:25.410 --> 01:40:26.010
Will it...

01:40:26.010 --> 01:40:27.330
I think this was...

01:40:27.330 --> 01:40:28.930
This one I think is on us.

01:40:28.930 --> 01:40:29.090
Yeah.

01:40:29.090 --> 01:40:32.450
I think this was a little too subtle for what we're kind of aiming for.

01:40:32.450 --> 01:40:37.590
And again, being in a high pressure thing it's just not to say that these are not excellent exploiters.

01:40:37.590 --> 01:40:39.430
It is just very hard and there's...

01:40:39.430 --> 01:40:42.210
This was a little bit of nuance, a little subtle nuance.

01:40:42.210 --> 01:40:42.850
Oh yeah.

01:40:42.850 --> 01:40:49.270
Because of the way that the length check happens in the binary, you can't actually fully overwrite and expect it to do it.

01:40:49.270 --> 01:40:53.030
It will already know that it's an invalid attempt and so it's not solvable.

01:40:53.030 --> 01:41:00.850
But then you have overwritten the correct state such that you can then solve it because you moved it from an insolvable state to a solvable state.

01:41:00.850 --> 01:41:01.250
Right.

01:41:01.510 --> 01:41:02.670
Somebody else might have got it.

01:41:02.670 --> 01:41:03.330
You don't know.

01:41:03.330 --> 01:41:05.650
But it's definitely... This is definitely a little harder.

01:41:05.650 --> 01:41:08.570
Certainly it's more subtle than some of our previous challenges.

01:41:08.890 --> 01:41:09.310
Yes.

01:41:09.690 --> 01:41:10.730
But we'll see.

01:41:10.730 --> 01:41:15.270
We'll do our best to keep dialing in the difficulty and see how it goes.

01:41:15.270 --> 01:41:17.810
So let's keep an eye out for the winner.

01:41:17.810 --> 01:41:28.070
We may see, because we're not looking at the new organizers, we might get that off screen or we might see Team Taiwan pull it off here in the main window.

01:41:28.110 --> 01:41:33.490
So I keep rooting for whoever we have the capture card working on just by very nature of being on my side of the table.

01:41:33.490 --> 01:41:34.750
Yeah, yeah, yeah.

01:41:35.030 --> 01:41:45.370
But you know, like being a Swiss, not citizen, but Swiss resident, I'm kind of like maybe rooting for organizers a little bit.

01:41:46.330 --> 01:41:48.330
Are they a Swiss team?

01:41:48.330 --> 01:41:52.590
So they are a Swiss-British-American team, I think.

01:41:52.950 --> 01:41:54.690
There we go!

01:41:54.690 --> 01:41:55.570
Alright.

01:41:55.570 --> 01:41:58.150
So there we have the winner.

01:41:58.770 --> 01:41:59.890
Congratulations.

01:42:00.150 --> 01:42:01.690
Awesome, awesome.

01:42:02.650 --> 01:42:03.870
Oh my god.

01:42:03.870 --> 01:42:04.790
Down to the end.

01:42:04.790 --> 01:42:05.690
It happened again.

01:42:05.690 --> 01:42:06.390
It happened again.

01:42:06.390 --> 01:42:08.410
Go congratulate them.

01:42:08.410 --> 01:42:09.430
Go talk to the team.

01:42:09.510 --> 01:42:11.350
I'm going to go ahead and see all out.

01:42:11.470 --> 01:42:12.490
Just a quick summary.

01:42:12.490 --> 01:42:15.570
I think we've already kind of covered what's happening the rest of the day.

01:42:15.590 --> 01:42:17.090
We're going to go recuperate.

01:42:17.090 --> 01:42:20.950
We're going to fix our HDMI cable so we'll come back with tomorrow.

01:42:21.130 --> 01:42:28.630
We'll hopefully have the ability to see both screens more effectively instead of having the flickering that we had this time.

01:42:28.930 --> 01:42:31.690
And we look forward to seeing eight challenges.

01:42:31.690 --> 01:42:32.550
We're going to have eight more rounds.

01:42:32.550 --> 01:42:33.910
We're going to finish up in the morning.

01:42:33.910 --> 01:42:35.850
Four more rounds of round one.

01:42:36.090 --> 01:42:38.490
And then in the afternoon we're going to move straight into round two.

01:42:38.490 --> 01:42:42.450
And we're going to go all the way from eight teams all the way down to four by the end of tomorrow.

01:42:42.450 --> 01:42:44.830
So come back and see that long day.

01:42:44.870 --> 01:42:46.030
Look forward to seeing you then.

01:42:46.070 --> 01:42:47.290
Take care and have a good one.

01:54:50.520 --> 01:54:50.580
.

01:54:50.680 --> 01:54:50.740
.

01:54:52.300 --> 01:54:52.360
.

01:54:52.360 --> 01:54:52.380
.

01:54:52.380 --> 01:54:52.400
.

01:54:52.400 --> 01:54:52.460
.

01:54:52.700 --> 01:54:52.760
.

01:54:52.760 --> 01:54:52.780
.

01:54:52.780 --> 01:54:52.800
.

01:54:52.800 --> 01:54:52.820
.

01:54:52.820 --> 01:54:52.840
.

01:54:52.840 --> 01:54:52.960
.

01:54:52.960 --> 01:54:52.980
.

01:54:52.980 --> 01:54:53.020
.

01:56:08.890 --> 01:56:10.290
.