1 00:00:11,390 --> 00:00:13,770 Hello, everybody, and welcome back. 2 00:00:13,790 --> 00:00:15,470 It is Jordan, CipherTex, and... 3 00:00:15,910 --> 00:00:16,530 Gamozo! 4 00:00:16,530 --> 00:00:17,190 We're here! 5 00:00:17,190 --> 00:00:19,330 Okay, so we have another round of live CTF. 6 00:00:19,430 --> 00:00:22,230 Neither one of us has been back today yet. 7 00:00:22,230 --> 00:00:24,290 This is our first stream of the day. 8 00:00:24,290 --> 00:00:28,010 I love that we've got a lot of new casters who've been joining us. 9 00:00:28,010 --> 00:00:30,530 We're preparing for a new round. 10 00:00:30,610 --> 00:00:33,610 They're doing the introduction kind of behind us. 11 00:00:33,830 --> 00:00:40,010 We've got, actually, we can see on their screens as we're looking at them, four teams ready for this match. 12 00:00:40,010 --> 00:00:42,330 We are going to be casting Macaroni... 13 00:00:42,330 --> 00:00:44,670 Do you say M-Hackaroni or Macaroni? 14 00:00:44,670 --> 00:00:46,270 I'm going to say Macaroni. 15 00:00:46,270 --> 00:00:46,810 Macaroni? 16 00:00:46,930 --> 00:00:48,350 Just because I love it. 17 00:00:48,350 --> 00:00:49,130 I think it sounds better. 18 00:00:49,130 --> 00:00:49,770 Yeah. 19 00:00:49,770 --> 00:00:53,090 I always thought it was M-Hackaroni, and then I finally heard somebody say Macaroni. 20 00:00:53,090 --> 00:00:53,150 Macaroni? 21 00:00:53,150 --> 00:00:55,110 Oh, no, no, that's way better. 22 00:00:55,210 --> 00:00:56,490 Macaroni and Hypeboy. 23 00:00:56,670 --> 00:00:58,830 We're going to see on this stream. 24 00:00:58,910 --> 00:01:05,930 But we also have Maple Mallard Magistrates, the other name of PPP, and Straw Hat in the non-cast. 25 00:01:05,930 --> 00:01:09,990 We're not commenting on them, but you can see their feeds as well in our alternate streams. 26 00:01:09,990 --> 00:01:12,950 So who's been crushing it so far on the brackets? 27 00:01:12,950 --> 00:01:16,730 I mean, in general, all of these teams are in the winner's bracket. 28 00:01:16,730 --> 00:01:20,210 So every team we're casting right now has never lost. 29 00:01:20,310 --> 00:01:22,150 This is the undefeated bracket. 30 00:01:22,890 --> 00:01:24,590 So this is a great one. 31 00:01:24,590 --> 00:01:26,770 So we're going to see some very quick matches. 32 00:01:26,770 --> 00:01:27,430 I think so. 33 00:01:27,450 --> 00:01:30,530 Hypeboy has just been destroying it so far. 34 00:01:30,570 --> 00:01:32,090 They may have sent up somebody different, though. 35 00:01:32,090 --> 00:01:35,710 Because one thing that's different is this is the first challenge that we told them was not opponable. 36 00:01:35,810 --> 00:01:37,290 This one is actually more... 37 00:01:37,290 --> 00:01:40,150 We told them it was a Crack Me, so more reverse engineering Crack Me style challenge. 38 00:01:40,150 --> 00:01:40,710 Oh , all right. 39 00:01:40,710 --> 00:01:42,270 So I might see some IDA today. 40 00:01:42,610 --> 00:01:44,610 Wait, Binary Ninja, I'm sorry. 41 00:01:44,610 --> 00:01:44,990 You know what? 42 00:01:44,990 --> 00:01:45,950 I wish that were true. 43 00:01:46,150 --> 00:01:48,610 However, we've actually only seen them. 44 00:01:48,610 --> 00:01:49,290 All right. 45 00:01:49,690 --> 00:01:51,390 Are we about ready for the countdown? 46 00:01:51,390 --> 00:01:53,150 So it looks like we're about ready to go live. 47 00:01:53,150 --> 00:01:55,290 So let's go ahead and let our... 48 00:01:55,830 --> 00:01:57,470 We're going to count it in. 49 00:01:58,430 --> 00:02:02,630 Five, four, three, two, one. 50 00:02:02,630 --> 00:02:03,570 Let's go. 51 00:02:03,570 --> 00:02:04,130 All right. 52 00:02:04,130 --> 00:02:08,230 So we're going to see both teams hop on in and get going. 53 00:02:08,910 --> 00:02:10,410 Who do you want to go with first? 54 00:02:10,930 --> 00:02:12,690 Ah, this is really tough to say. 55 00:02:12,690 --> 00:02:14,050 No Binja that we can pick from? 56 00:02:14,050 --> 00:02:14,130 I know. 57 00:02:14,130 --> 00:02:15,270 Because that would have been the first pick. 58 00:02:15,270 --> 00:02:16,010 That would have been the obvious one. 59 00:02:16,010 --> 00:02:20,130 Let's go ahead and go to Hypeboy first, because Hypeboy has been just the fastest. 60 00:02:20,130 --> 00:02:23,390 The matches they've won have been incredibly fast so far. 61 00:02:23,390 --> 00:02:24,150 So I've been very impressed. 62 00:02:24,150 --> 00:02:29,630 Although, again, I don't know if they're going to send somebody different if it's not the same person who's doing punnables. 63 00:02:29,630 --> 00:02:33,470 Now, did you know that every single time I've cast this, it's gone to sudden death? 64 00:02:33,470 --> 00:02:33,950 Oh, no. 65 00:02:33,950 --> 00:02:34,790 Are you cursed? 66 00:02:34,930 --> 00:02:36,970 Did you curse my challenge? 67 00:02:36,970 --> 00:02:39,330 So, yeah, for full disclosure, this is my challenge. 68 00:02:39,330 --> 00:02:40,770 This is one of the ones I wrote. 69 00:02:41,150 --> 00:02:48,730 And it's actually not something I normally would have done because I'm not kind of an RE person necessarily. 70 00:02:48,730 --> 00:02:49,870 Was that a drag-and-drop? 71 00:02:49,870 --> 00:02:50,950 What is... 72 00:02:50,950 --> 00:02:51,730 Drag-and-drop. 73 00:02:51,730 --> 00:02:53,130 Drag-and-drop into... 74 00:02:53,130 --> 00:02:54,290 What is this application over here? 75 00:02:54,290 --> 00:02:54,670 It's just VS Code. 76 00:02:54,670 --> 00:02:57,130 It's just VS Code with a terminal on the bottom. 77 00:02:57,130 --> 00:02:58,070 Oh, okay. 78 00:02:58,070 --> 00:02:59,450 So there... 79 00:02:59,450 --> 00:03:02,110 Although, I think I love the shell. 80 00:03:02,110 --> 00:03:02,970 So I'm guessing... 81 00:03:04,050 --> 00:03:05,550 Because it looked like this was a Mac, right? 82 00:03:05,550 --> 00:03:09,230 So it's a Mac that's got a VM probably that they're actually running their VS Code in. 83 00:03:09,230 --> 00:03:11,010 Because I think the... 84 00:03:11,010 --> 00:03:12,770 So they've got their IDA. 85 00:03:12,850 --> 00:03:13,390 Oh, that was... 86 00:03:13,390 --> 00:03:16,870 Did you notice that it was 7.7, I think, was the version of IDA? 87 00:03:17,690 --> 00:03:21,010 Ooh, is that the most recent one that was leaked or what? 88 00:03:21,310 --> 00:03:23,010 No, no, I'm not going to accuse anyone of that. 89 00:03:23,010 --> 00:03:26,590 I'm just saying it's not the latest actual IDA. 90 00:03:26,590 --> 00:03:28,130 So , like, the analysis might be... 91 00:03:28,130 --> 00:03:28,910 Oh, no, voiceover. 92 00:03:28,910 --> 00:03:30,430 Did they hit too many accessibility keys too quickly? 93 00:03:30,430 --> 00:03:32,250 Is that like sticky keys but on Mac? 94 00:03:32,250 --> 00:03:33,010 I think that's my guess. 95 00:03:33,010 --> 00:03:34,090 I think that's what they got. 96 00:03:34,090 --> 00:03:37,230 Oh, I'm really excited to see a little crack me here. 97 00:03:37,230 --> 00:03:40,030 All right, so they're dumping our source code out. 98 00:03:40,190 --> 00:03:41,770 So , okay, that's a very different approach. 99 00:03:41,770 --> 00:03:45,330 Now let's go ahead and actually look over on the other hand at... 100 00:03:45,330 --> 00:03:47,570 If I can hit the right one here. 101 00:03:47,890 --> 00:03:51,290 We've got Macaroni on the other hand still in IDA, right? 102 00:03:51,290 --> 00:03:53,170 So they're still just kind of statically analyzing this. 103 00:03:53,170 --> 00:03:54,810 Is that an SRAN zero? 104 00:03:54,870 --> 00:03:57,930 I don't think that's how you're supposed to seed your random number generator. 105 00:03:57,930 --> 00:03:58,930 So I had a debate. 106 00:03:58,930 --> 00:04:02,170 I had a debate when I made this challenge of how hard I wanted to make it. 107 00:04:02,170 --> 00:04:04,410 And I originally had an SRAN time on it. 108 00:04:04,410 --> 00:04:08,070 And then I thought, no, let's just make it a little bit easier. 109 00:04:08,070 --> 00:04:10,930 During playtesting, it was like, look, we want this to be solved. 110 00:04:11,070 --> 00:04:13,270 So it's a very not random random. 111 00:04:13,690 --> 00:04:14,490 Interesting. 112 00:04:14,510 --> 00:04:17,530 I mean, it looks like there were 40 iterations of RAN. 113 00:04:17,530 --> 00:04:20,610 So at that point, the seed has been very randomized. 114 00:04:20,810 --> 00:04:26,390 But you are going to get the same order with the same count of items here. 115 00:04:26,390 --> 00:04:26,910 Yeah. 116 00:04:26,910 --> 00:04:30,010 So, yeah, they are going to get sort of a fixed order. 117 00:04:30,010 --> 00:04:32,910 But it's not, like, intuitively obvious from static analysis here. 118 00:04:32,910 --> 00:04:33,750 This is interesting. 119 00:04:33,850 --> 00:04:37,790 To figure out this order, you really want to do that dynamically or just kind of run it. 120 00:04:37,790 --> 00:04:39,970 And either with a breakpoint, like, dump them out. 121 00:04:40,050 --> 00:04:43,490 Or , yeah, so actually over here on the other side. 122 00:04:43,490 --> 00:04:47,170 So HypeBoy, again, the first thing that they did, it's really interesting to me. 123 00:04:47,170 --> 00:04:47,910 They heard CrackMe. 124 00:04:47,910 --> 00:04:50,310 So they immediately decompiled, dumped it to text. 125 00:04:50,470 --> 00:04:52,910 And now they're cleaning it up because they want to actually get this buildable. 126 00:04:52,910 --> 00:04:53,750 There we go. 127 00:04:53,750 --> 00:04:54,390 Really? 128 00:04:54,530 --> 00:04:55,710 This is very clean. 129 00:04:55,710 --> 00:04:57,150 I love the way they're doing this. 130 00:04:57,150 --> 00:05:00,390 So all of the functions are very simple mathematical transformations, right? 131 00:05:00,390 --> 00:05:01,410 You can see it right there. 132 00:05:01,410 --> 00:05:04,210 They've got plus, minus, division, multiplication. 133 00:05:04,990 --> 00:05:07,610 And so they're pulling out the constant. 134 00:05:07,610 --> 00:05:10,890 So the plus and minus are just very large constants. 135 00:05:11,330 --> 00:05:15,770 The division is always a smaller number because otherwise you end up with just, like, zeroing out. 136 00:05:15,770 --> 00:05:17,610 You lose all the bits that were kind of there. 137 00:05:18,310 --> 00:05:21,030 Now, did you make this manually or did you obfuscate it? 138 00:05:21,030 --> 00:05:22,010 I had a generator. 139 00:05:22,010 --> 00:05:24,030 So it's pseudo manually generated. 140 00:05:24,030 --> 00:05:27,570 The version that we're running is not, like, auto-generated each time. 141 00:05:27,570 --> 00:05:30,630 There is one fixed copy that it worked on. 142 00:05:30,770 --> 00:05:31,450 And so, okay. 143 00:05:31,450 --> 00:05:31,990 Oh, actually, hold on. 144 00:05:31,990 --> 00:05:32,850 Back on the other side. 145 00:05:32,850 --> 00:05:33,810 Did we miss it? 146 00:05:35,470 --> 00:05:36,190 Simulation manager. 147 00:05:36,190 --> 00:05:36,670 What's that? 148 00:05:36,670 --> 00:05:38,550 Yeah, I don't know, but I saw that. 149 00:05:38,550 --> 00:05:38,970 Okay. 150 00:05:38,970 --> 00:05:41,570 So, again, there's a couple different ways you can solve this. 151 00:05:41,570 --> 00:05:44,050 You could throw it, like, into a solver, like a Z3. 152 00:05:44,050 --> 00:05:47,110 You could throw it into some sort of, like, you know, I'm here, go here. 153 00:05:47,110 --> 00:05:52,290 And, like, one of the tools, like, auto path finds might be able to actually, like, brute force your paths. 154 00:05:52,950 --> 00:05:59,450 So I'm really curious if we're going to see a mix of, like, so they're looking for a congrats. 155 00:05:59,450 --> 00:06:02,510 Are they going to drive it towards execution of the congratulations? 156 00:06:02,510 --> 00:06:03,090 Yeah. 157 00:06:03,090 --> 00:06:10,590 So, you know, my solution, I just pulled out all the constants, pulled out it all, put it all into Z3, and then, you know, let it go. 158 00:06:10,590 --> 00:06:11,130 Yeah. 159 00:06:11,870 --> 00:06:12,270 But... 160 00:06:12,270 --> 00:06:15,090 Do you think we're going to see Z3 here today or any sort of solver? 161 00:06:15,090 --> 00:06:16,170 We haven't yet. 162 00:06:16,170 --> 00:06:16,210 Okay. 163 00:06:16,210 --> 00:06:16,770 So I'm curious. 164 00:06:16,770 --> 00:06:18,250 And we don't necessarily have to either. 165 00:06:18,250 --> 00:06:22,510 And some of these are, you know, trivially reversible transformations, right? 166 00:06:22,510 --> 00:06:22,730 Right . 167 00:06:22,730 --> 00:06:26,350 And so there's definitely going to be alternate approaches. 168 00:06:26,350 --> 00:06:28,670 I kind of would like to see a different one. 169 00:06:28,670 --> 00:06:29,230 Yeah. 170 00:06:29,230 --> 00:06:33,690 But certainly I know it's at least solvable with the Z3 approach. 171 00:06:33,690 --> 00:06:44,210 So with SRAN, way back in the day, I'm pretty sure the entropy or, like, the state space of RAND was, like, 16 bits or 32 bits or something quite small. 172 00:06:44,210 --> 00:06:46,450 Is this a brutable problem? 173 00:06:47,370 --> 00:06:49,650 Is this a 2 to the 32 sort of thing? 174 00:06:49,650 --> 00:06:50,310 It's not. 175 00:06:50,310 --> 00:06:55,230 And the reason why, I think, is because the thing that's being randomized is the order of the functions. 176 00:06:55,230 --> 00:06:57,230 So the functions each have all these different transformations. 177 00:06:57,230 --> 00:06:57,570 I see. 178 00:06:57,570 --> 00:07:01,110 So the only thing that's going to be random here is, like, we're going to call a function 10 first or 20, you know. 179 00:07:01,110 --> 00:07:03,970 So that order is, like, sort of fixed random. 180 00:07:03,970 --> 00:07:07,570 It's not just obvious in the code what orders can be called because that has involved the random. 181 00:07:07,570 --> 00:07:10,170 But you could, again, with GDB, you can dump that out. 182 00:07:10,170 --> 00:07:11,210 You could rewrite. 183 00:07:11,210 --> 00:07:12,770 Actually, you could recompile it. 184 00:07:12,770 --> 00:07:13,030 Right. 185 00:07:13,030 --> 00:07:14,070 The source decompiles cleanly. 186 00:07:14,070 --> 00:07:14,830 Pull it out. 187 00:07:14,890 --> 00:07:15,690 Rerun it. 188 00:07:15,710 --> 00:07:16,890 And then print out the order before you run it. 189 00:07:16,890 --> 00:07:19,510 And we got Z3 already over here on hackaroni. 190 00:07:19,510 --> 00:07:20,650 So we do have a Z3. 191 00:07:20,650 --> 00:07:21,190 So that's exactly. 192 00:07:21,190 --> 00:07:22,930 And they've got, you know, the array here. 193 00:07:23,170 --> 00:07:24,970 Are we pulling out constants? 194 00:07:24,970 --> 00:07:27,030 Or I wonder what we're looking at in that array. 195 00:07:27,030 --> 00:07:28,130 So we've got the 8, 4. 196 00:07:28,130 --> 00:07:28,570 Okay. 197 00:07:28,570 --> 00:07:31,190 That actually, the array is almost certainly going to be the order of the functions. 198 00:07:31,190 --> 00:07:31,330 Right. 199 00:07:31,330 --> 00:07:31,470 Right. 200 00:07:31,470 --> 00:07:34,110 So they're saying that's the order of the functions called. 201 00:07:34,930 --> 00:07:35,930 And now they're going to. 202 00:07:35,930 --> 00:07:37,330 Are they just going to do this manually? 203 00:07:37,610 --> 00:07:38,170 It looks like it. 204 00:07:38,170 --> 00:07:38,390 No way. 205 00:07:39,450 --> 00:07:40,170 No way. 206 00:07:40,170 --> 00:07:40,630 Listen. 207 00:07:40,630 --> 00:07:43,370 The name of this challenge is actually John Henry. 208 00:07:43,530 --> 00:07:43,990 Okay. 209 00:07:43,990 --> 00:07:44,270 Okay. 210 00:07:44,270 --> 00:07:46,450 And this is sort of like the John Henry was the railroad man. 211 00:07:46,450 --> 00:07:47,730 Like, you know, hammering all day. 212 00:07:47,870 --> 00:07:48,230 Yeah. 213 00:07:48,230 --> 00:07:50,710 And, like, is he going to beat the railroad machine or whatever? 214 00:07:50,710 --> 00:07:50,950 Right. 215 00:07:50,950 --> 00:07:51,970 So this is kind of. 216 00:07:51,970 --> 00:07:52,910 And this is fantastic. 217 00:07:52,990 --> 00:07:58,030 Because I really thought, like, are people going to write some sort of, like, fully automated extraction? 218 00:07:58,090 --> 00:07:58,110 Yeah . 219 00:07:58,110 --> 00:08:00,210 Or are they just going to, like, copy-paste values to pull it out? 220 00:08:00,210 --> 00:08:01,350 This is terrifying to me. 221 00:08:01,390 --> 00:08:07,270 Because Z3 is, and Python in general, is not very generous if you make a mistake. 222 00:08:07,270 --> 00:08:07,970 It's not. 223 00:08:07,970 --> 00:08:12,070 If one of those slashes is not a two slash and it's a one slash. 224 00:08:12,070 --> 00:08:12,230 Exactly . 225 00:08:12,230 --> 00:08:13,850 You lost the whole thing. 226 00:08:13,850 --> 00:08:17,690 And it might take a long time to figure out where that very, very small error is. 227 00:08:17,690 --> 00:08:18,050 Yeah. 228 00:08:18,050 --> 00:08:19,150 And spoiler alert. 229 00:08:19,150 --> 00:08:20,310 Minor spoiler alert. 230 00:08:20,310 --> 00:08:25,290 I believe the second hint on this challenge tells them that, like, UDIV is not the same as div. 231 00:08:25,310 --> 00:08:28,430 If you actually look at the division operations in Z3. 232 00:08:28,430 --> 00:08:28,710 Oh , no . 233 00:08:28,710 --> 00:08:31,610 There is a difference in signed and unsigned division. 234 00:08:31,610 --> 00:08:40,250 Oh, and if you're looking through here, it would be very hard to catch the difference between a uint and an int when it comes to just popping through an IDA. 235 00:08:40,250 --> 00:08:41,790 Like, right there, that's an int. 236 00:08:42,150 --> 00:08:44,330 Well, and that may or may not be right, too. 237 00:08:44,330 --> 00:08:49,870 Because, again, the division operation that you're going to get, like, it's implicit a lot of the time. 238 00:08:49,870 --> 00:08:51,970 And so, yeah, it doesn't stand out at all. 239 00:08:51,970 --> 00:08:53,330 Oh, that's really tricky. 240 00:08:53,330 --> 00:08:55,530 So, it wasn't an intentional part of it. 241 00:08:55,530 --> 00:08:56,090 Yeah. 242 00:08:56,090 --> 00:08:58,350 But it very well could be. 243 00:08:58,350 --> 00:09:02,110 And we did know that might bite people, which is why I said that is the second hint that's queued up. 244 00:09:02,110 --> 00:09:02,610 Yeah. 245 00:09:02,610 --> 00:09:04,850 Specifically says, like, yo, go look at these things. 246 00:09:04,850 --> 00:09:06,370 Because that's the operation that's going to... 247 00:09:06,370 --> 00:09:12,050 And what we'll see is, if they try to do this in Z3 without the correct division... 248 00:09:12,050 --> 00:09:12,330 Right. 249 00:09:12,330 --> 00:09:15,270 It'll just be, it'll just turn away, unable to satisfy, right? 250 00:09:15,270 --> 00:09:15,570 Okay. 251 00:09:15,570 --> 00:09:17,950 So , it just kind of, like, times out, which is frustrating. 252 00:09:18,070 --> 00:09:19,370 But honestly convenient. 253 00:09:19,370 --> 00:09:20,350 It's better than... 254 00:09:20,870 --> 00:09:22,790 I mean, getting that time out is like, yeah. 255 00:09:22,790 --> 00:09:23,610 Finding a false answer. 256 00:09:24,230 --> 00:09:27,570 Seeing unsat is like, okay, I know that something is wrong. 257 00:09:27,570 --> 00:09:28,470 I have to do something. 258 00:09:28,470 --> 00:09:28,630 Yeah , yeah. 259 00:09:28,630 --> 00:09:33,010 Well, it can also, the other failure case, sometimes it can just, like, turn. 260 00:09:33,010 --> 00:09:33,030 Yeah. 261 00:09:33,030 --> 00:09:35,250 And just spin, and you don't know if you did it wrong. 262 00:09:35,650 --> 00:09:38,690 Hopefully they realize, again, this is a speed competition. 263 00:09:38,910 --> 00:09:39,110 Right. 264 00:09:39,110 --> 00:09:41,170 I didn't give them something that would take 10 minutes to run in Z3. 265 00:09:41,170 --> 00:09:42,010 That's not the design. 266 00:09:42,010 --> 00:09:42,890 So, if you hit that... 267 00:09:42,890 --> 00:09:43,270 Yeah. 268 00:09:43,410 --> 00:09:44,270 Something has gone wrong. 269 00:09:44,270 --> 00:09:45,350 So, hopefully they'll be, like... 270 00:09:45,350 --> 00:09:46,890 The nice thing is, once they get it, they can run it. 271 00:09:46,890 --> 00:09:46,930 Yeah. 272 00:09:46,930 --> 00:09:48,210 And then go off and do other things. 273 00:09:48,210 --> 00:09:57,850 That's one of the really interesting parts about a CTF and using a solver is, like, if I'm working on something in the wild and I'm bringing in a solver, I don't really know if it's satisfiable or not. 274 00:09:57,850 --> 00:09:58,230 Absolutely , yeah. 275 00:09:58,410 --> 00:10:00,590 And in a CTF, you know it's going to be satisfiable. 276 00:10:00,650 --> 00:10:01,770 It's going to be solvable. 277 00:10:01,770 --> 00:10:03,970 Or maybe the Z3 is the wrong tool. 278 00:10:03,970 --> 00:10:05,710 But, like, you know there is a solution. 279 00:10:06,010 --> 00:10:10,070 And, again, this particular challenge, these live CTF challenges are meant to be fast. 280 00:10:10,070 --> 00:10:10,790 They're meant to be really... 281 00:10:10,790 --> 00:10:11,370 Right. 282 00:10:11,570 --> 00:10:15,210 So, we want to showcase the sort of traditional, basic, like, archetypal... 283 00:10:15,810 --> 00:10:16,210 Yeah. 284 00:10:16,230 --> 00:10:16,950 ...challenges. 285 00:10:16,950 --> 00:10:19,110 So, what would your threshold be? 286 00:10:19,110 --> 00:10:30,850 When you get approached with a challenge like this and you see that there's, like, a switch statement with a bunch of different functions, when would you go immediately to automation or some regex or something to process this versus this very manual approach, 287 00:10:30,850 --> 00:10:35,250 which, honestly, I think is very clean if all the functions are tiny and it's only 20. 288 00:10:35,350 --> 00:10:39,750 But if you get surprised and you get to a later function and it's big, you might really regret it. 289 00:10:39,750 --> 00:10:41,610 Yeah, 40 of these functions was meant to... 290 00:10:41,610 --> 00:10:46,930 I did it by hand, certainly, but I also had, you know, the lack of pressure and stress when I was writing my solution. 291 00:10:46,930 --> 00:10:47,810 I wasn't timed. 292 00:10:48,210 --> 00:10:50,930 I designed it so that I thought it would be faster to... 293 00:10:50,930 --> 00:10:54,870 Although, again, I'm a Binja dev, so, of course, in Binja, it was, like, four lines of Python... 294 00:10:54,870 --> 00:10:55,230 Right. 295 00:10:55,230 --> 00:10:56,650 ...to dump out each function and each operation... 296 00:10:56,650 --> 00:10:58,090 Oh, you wrote a script for it. 297 00:10:58,090 --> 00:10:58,950 So, I wrote a script that... 298 00:10:58,950 --> 00:10:59,090 Okay. 299 00:10:59,430 --> 00:11:01,490 ...dynamically, like, pulled out all those contents. 300 00:11:01,490 --> 00:11:04,590 Have we seen anyone write a script for Ida or Binja or Ghidra? 301 00:11:04,610 --> 00:11:05,050 No. 302 00:11:05,050 --> 00:11:05,310 Okay. 303 00:11:05,310 --> 00:11:06,610 I don't think we've seen, so far, anyways. 304 00:11:06,610 --> 00:11:08,410 Although, I haven't caught all of the matches that have been doing... 305 00:11:08,410 --> 00:11:08,530 Yeah. 306 00:11:08,530 --> 00:11:09,350 ...other things around it. 307 00:11:09,350 --> 00:11:10,450 But, so far... 308 00:11:10,450 --> 00:11:14,710 And I think that's just because most of the people are focusing on the fast... 309 00:11:15,990 --> 00:11:17,050 Yeah, for sure. 310 00:11:17,050 --> 00:11:20,470 It looks like they already have the code extracted in the way that they want. 311 00:11:20,470 --> 00:11:20,610 Yes . 312 00:11:20,610 --> 00:11:21,110 So, now... 313 00:11:21,110 --> 00:11:21,650 They pulled out those... 314 00:11:21,650 --> 00:11:23,990 Because, again, remember, they just dumped the text from Ida... 315 00:11:23,990 --> 00:11:24,090 Right. 316 00:11:24,090 --> 00:11:26,650 ...and then copied and pasted, which I think is definitely a faster approach. 317 00:11:26,650 --> 00:11:26,690 Yeah , which is... 318 00:11:26,690 --> 00:11:30,050 Yeah, I definitely think HypeBoy is ahead at this point. 319 00:11:30,330 --> 00:11:35,510 And I like seeing that Macaroni made that transition into using lambdas. 320 00:11:35,510 --> 00:11:37,970 They were doing, like, def, making the full functions... 321 00:11:37,970 --> 00:11:40,070 ...and then they're, like, lambda, lambda, lambda, lambda. 322 00:11:40,070 --> 00:11:40,430 Yep . 323 00:11:40,470 --> 00:11:49,710 So, now it looks like we have very similar things on both sides, except Macaroni is still manually extracting those, and it looks like HypeBoy is already kind of approaching the problem here. 324 00:11:49,710 --> 00:11:50,990 Yeah , so they've got the big vector. 325 00:11:50,990 --> 00:11:52,310 They know the size of that. 326 00:11:52,310 --> 00:11:52,450 Yep. 327 00:11:52,450 --> 00:11:56,690 They have created this value at the end where they know that there's this final check. 328 00:11:56,690 --> 00:11:58,090 It must be equal to this value. 329 00:11:58,090 --> 00:11:58,430 Yeah . 330 00:11:58,430 --> 00:12:00,830 So, it's definitely on track. 331 00:12:00,830 --> 00:12:02,590 The question is going to be, again, on their division. 332 00:12:02,590 --> 00:12:06,170 So, you notice they're actually doing just a single division here... 333 00:12:06,170 --> 00:12:06,450 Right. 334 00:12:06,450 --> 00:12:07,310 ...on their operations. 335 00:12:07,310 --> 00:12:12,590 And this really is going to need to be the UDIV inside. 336 00:12:12,590 --> 00:12:12,610 Right . 337 00:12:12,610 --> 00:12:16,150 If you're going to use E3 on this, which, again, both are so far. 338 00:12:16,150 --> 00:12:21,690 Is there a way that you can set that on the variable and, say, just make everything unsigned or something on this variable... 339 00:12:21,690 --> 00:12:21,770 That's a good question. 340 00:12:21,770 --> 00:12:25,410 ...where you could just do a one-pass change all of them? 341 00:12:25,410 --> 00:12:29,530 Well, I would probably, honestly, do it with a text replacement at this point, like multi-cursor or something. 342 00:12:29,530 --> 00:12:29,530 Right . 343 00:12:29,530 --> 00:12:29,950 Yeah. 344 00:12:29,950 --> 00:12:33,810 Which is an interesting note that that's basically the fact that they did a text replacement. 345 00:12:33,810 --> 00:12:35,770 They took it out of IDA, deleted a bunch of lines... 346 00:12:35,770 --> 00:12:37,610 ...and then manually, like, did multi-cursor to replace it. 347 00:12:37,610 --> 00:12:42,510 I think that's a sort of in-between, like, a full-fledged, I've written a script to fully automate it... 348 00:12:42,510 --> 00:12:43,010 Right. 349 00:12:43,010 --> 00:12:46,950 ...or I'm doing it line at a time by copying and pasting the way we're seeing with Macaroni. 350 00:12:46,950 --> 00:12:49,330 Now, are they going to have to go in reverse RAND? 351 00:12:49,330 --> 00:12:49,830 Oh, there we go. 352 00:12:49,830 --> 00:12:51,010 We just saw the double division. 353 00:12:51,010 --> 00:12:51,530 Oh, there it is. 354 00:12:51,530 --> 00:12:52,270 So, they did just... 355 00:12:52,270 --> 00:12:52,370 Okay . 356 00:12:52,370 --> 00:12:54,230 They did just... It's closer. 357 00:12:54,230 --> 00:12:54,890 It's now... 358 00:12:54,890 --> 00:12:55,290 Yeah. 359 00:12:55,290 --> 00:13:02,610 It's what Macaroni is, but there's still neither one is going to get the right answer until they can realize that that's not quite the same division. 360 00:13:02,610 --> 00:13:03,010 So, I was... 361 00:13:03,010 --> 00:13:03,090 Right. 362 00:13:03,090 --> 00:13:05,850 I was afraid this is going to be a sticking point for teams... 363 00:13:05,850 --> 00:13:05,950 Yeah. 364 00:13:05,950 --> 00:13:08,630 ...which, again, worst case, they're going to get that hint. 365 00:13:08,630 --> 00:13:12,030 They will get that after 35 minutes into this round. 366 00:13:12,030 --> 00:13:12,410 Right . 367 00:13:12,410 --> 00:13:14,750 They're going to get notice of that. 368 00:13:14,970 --> 00:13:15,750 Huh. 369 00:13:16,110 --> 00:13:17,630 That's really tricky. 370 00:13:18,390 --> 00:13:18,830 So... 371 00:13:18,830 --> 00:13:19,110 Oh, no. 372 00:13:19,110 --> 00:13:19,390 Wait a minute. 373 00:13:19,390 --> 00:13:20,450 This is interesting. 374 00:13:20,550 --> 00:13:23,790 So, it looks like they're commenting out the actual Z3 components now. 375 00:13:23,790 --> 00:13:24,310 Okay. 376 00:13:24,310 --> 00:13:26,090 Are we trying to brute force? 377 00:13:27,370 --> 00:13:28,430 That's a good question. 378 00:13:28,430 --> 00:13:30,810 Brute forcing a 64-bit value is going to be... 379 00:13:31,330 --> 00:13:32,110 Impossible. 380 00:13:32,110 --> 00:13:32,890 ...a little tricky. 381 00:13:32,890 --> 00:13:33,110 Yeah. 382 00:13:33,110 --> 00:13:34,050 I don't think they have the compute... 383 00:13:34,050 --> 00:13:35,210 Especially in Python. 384 00:13:35,210 --> 00:13:35,730 Yeah. 385 00:13:35,730 --> 00:13:42,190 I don't think a 32-bit is going to be possible with arrays and stuff in Python, especially with, like, dynamic dispatch of functions. 386 00:13:42,190 --> 00:13:42,790 So , the arrays... 387 00:13:42,790 --> 00:13:45,070 Yeah, the array, look up for your functions. 388 00:13:45,090 --> 00:13:45,270 Yeah . 389 00:13:45,330 --> 00:13:47,650 Well, the function order... 390 00:13:47,650 --> 00:13:48,490 Yeah, yeah, yeah. 391 00:13:48,650 --> 00:13:51,730 What you really should do at that point is just put them all into the same function... 392 00:13:51,730 --> 00:13:51,870 Right. 393 00:13:51,870 --> 00:13:53,270 ...not call them as functions and do them... 394 00:13:53,270 --> 00:13:53,510 Right. 395 00:13:53,510 --> 00:13:54,490 ...do them straight through. 396 00:13:54,490 --> 00:13:54,830 Yeah. 397 00:13:54,830 --> 00:13:55,390 That would be the... 398 00:13:55,390 --> 00:13:56,530 If you really wanted to brute force it. 399 00:13:56,530 --> 00:13:59,050 So, let's see, though. 400 00:13:59,050 --> 00:14:00,950 Do you know if there are many solutions? 401 00:14:00,950 --> 00:14:01,050 There are. 402 00:14:01,050 --> 00:14:01,650 Like, are there many... 403 00:14:01,650 --> 00:14:02,730 There are multiple solutions. 404 00:14:02,730 --> 00:14:06,470 Because you say it's 64-bit, but what's the actual space? 405 00:14:06,470 --> 00:14:07,370 I don't know. 406 00:14:07,370 --> 00:14:08,290 Actually, that's a great point. 407 00:14:08,290 --> 00:14:10,430 Like , what if there's a very convenient one, very shallow? 408 00:14:10,430 --> 00:14:11,470 It's possible. 409 00:14:11,470 --> 00:14:14,590 And what I simply did was when I tested it, I got a single solution. 410 00:14:14,590 --> 00:14:15,150 I tested it. 411 00:14:15,150 --> 00:14:15,790 It worked. 412 00:14:15,850 --> 00:14:18,590 And then I went and tried a few other ones. 413 00:14:18,590 --> 00:14:18,970 Yeah. 414 00:14:18,970 --> 00:14:22,090 I would, you know, specify not that, not that, just to get a few more. 415 00:14:22,090 --> 00:14:22,550 Right. 416 00:14:22,550 --> 00:14:26,270 So, I know there's more than one, but I never actually characterized and tried to figure it out. 417 00:14:26,270 --> 00:14:27,630 That would be really fun. 418 00:14:27,670 --> 00:14:31,330 So, it is possible that there's maybe a lot of this and actually just random... 419 00:14:31,330 --> 00:14:32,270 I don't think there are. 420 00:14:32,270 --> 00:14:33,050 Okay. 421 00:14:33,190 --> 00:14:35,210 In fact, earlier versions there were. 422 00:14:35,210 --> 00:14:37,410 So, again, remember I mentioned that I tweaked those constants? 423 00:14:37,550 --> 00:14:37,590 Yeah. 424 00:14:37,590 --> 00:14:41,750 So that, like, the plus and minus are just large random constants, and then there's a much smaller on the division. 425 00:14:41,750 --> 00:14:44,530 Because if you have a very, very large division, you'll end up with, like, zero or one. 426 00:14:44,530 --> 00:14:44,610 Right . 427 00:14:44,910 --> 00:14:45,390 Exactly. 428 00:14:45,390 --> 00:14:45,550 Yeah. 429 00:14:45,550 --> 00:14:46,130 I see. 430 00:14:46,130 --> 00:14:48,710 And then everything on throughout it, you've sort of lost all those bits in there. 431 00:14:48,710 --> 00:14:52,110 So, by having the smaller, less than a byte-sized division... 432 00:14:52,110 --> 00:14:52,470 Yeah. 433 00:14:52,470 --> 00:14:56,750 I think you're keeping most of the bits of entropy up in there, or at least most of the bits are kind of floating through. 434 00:14:56,750 --> 00:15:02,690 I think it really depends on what ends at the end of that expression and where everything wraps up. 435 00:15:02,690 --> 00:15:08,930 So, if someone was watching from home right now and was interested in tackling this problem, is there a way for them to get those challenges? 436 00:15:08,970 --> 00:15:09,670 Not yet. 437 00:15:09,670 --> 00:15:10,090 Not yet. 438 00:15:10,090 --> 00:15:10,350 Okay. 439 00:15:10,350 --> 00:15:15,030 We will be publishing at the end of the competition, assuming we're still awake and concurrent. 440 00:15:15,030 --> 00:15:15,210 Okay . 441 00:15:15,210 --> 00:15:16,110 We have a GitHub. 442 00:15:16,110 --> 00:15:18,090 We'll be putting all of the challenges. 443 00:15:18,250 --> 00:15:18,670 Perfect. 444 00:15:18,670 --> 00:15:23,330 We have thought about trying to do it kind of live so people can play along as soon as the round ends. 445 00:15:23,330 --> 00:15:31,510 But, you know, even throughout, you know, it wouldn't be a huge deal because the teams could certainly like remotely connect to another team's box and pull the binaries off. 446 00:15:31,510 --> 00:15:32,310 It's a secret. 447 00:15:32,310 --> 00:15:34,370 Once the binary is out, the binary is out. 448 00:15:34,370 --> 00:15:35,190 Exactly, yeah. 449 00:15:35,190 --> 00:15:36,410 That would be fun for us. 450 00:15:36,410 --> 00:15:37,290 Okay, here we go. 451 00:15:37,290 --> 00:15:39,130 Crypto.util.number. 452 00:15:39,930 --> 00:15:40,590 Interesting. 453 00:15:40,590 --> 00:15:43,890 I'm very curious about this alternate approach that we're seeing. 454 00:15:43,890 --> 00:15:47,050 So, I haven't had much time to look at the IDA disassembly. 455 00:15:47,050 --> 00:15:49,110 What does the random factor? 456 00:15:49,110 --> 00:15:53,450 And I guess since it's seeded with the same thing, you always get the same ordering of the functions. 457 00:15:53,450 --> 00:15:53,870 Exactly. 458 00:15:53,870 --> 00:15:57,090 So, what is the controlled value? 459 00:15:57,090 --> 00:16:00,610 Like the scanf that prompted for that LLU. 460 00:16:00,610 --> 00:16:05,850 You were asked to put the very first value in that is multiplied or added, like that goes through all these transformations. 461 00:16:05,850 --> 00:16:06,910 I see, okay. 462 00:16:06,910 --> 00:16:08,410 So , you give it that single 64-bit value. 463 00:16:08,410 --> 00:16:08,770 Okay. 464 00:16:08,770 --> 00:16:12,690 And then it's going to call function 8, function 4, whatever the order of the function is. 465 00:16:12,830 --> 00:16:15,290 So , that random is just a very slight option. 466 00:16:15,290 --> 00:16:20,350 And again, this is one of those things where the challenge could have been easier or harder based on how we tuned that. 467 00:16:20,510 --> 00:16:24,410 But, you know, we could have, for example, like made every five minutes a different random order. 468 00:16:24,410 --> 00:16:24,950 Yes, yes. 469 00:16:24,950 --> 00:16:29,210 So, you have to get your solution under that time, and that would sort of hint that you knew it would be solvable in less than that. 470 00:16:29,210 --> 00:16:29,830 Huh. 471 00:16:30,130 --> 00:16:31,990 This is going to be really interesting. 472 00:16:32,110 --> 00:16:35,030 So, switching back over, it looks like, yeah, where are we on macaroni? 473 00:16:35,350 --> 00:16:36,890 They've got their mixture. 474 00:16:36,890 --> 00:16:37,930 We've got Python errors right now. 475 00:16:37,930 --> 00:16:38,630 Oh, no, yeah. 476 00:16:38,630 --> 00:16:39,550 I have seen a couple of... 477 00:16:39,550 --> 00:16:40,430 Which is not a good sign. 478 00:16:40,430 --> 00:16:41,110 What is this? 479 00:16:41,970 --> 00:16:44,890 Unsupported operand type for bitvectoref and int. 480 00:16:44,890 --> 00:16:48,550 Oh, you're going to need to convert those raw constants, aren't you? 481 00:16:48,550 --> 00:16:49,950 No, you shouldn't have to if you... 482 00:16:50,670 --> 00:16:57,850 There's like two different bitvector things in Z3, and I think one of them you can just do straight up like Python things, and one you can't. 483 00:16:57,850 --> 00:16:59,750 I never remember which is which. 484 00:16:59,870 --> 00:17:03,090 The other one is, again, that... 485 00:17:03,090 --> 00:17:04,350 What happened here? 486 00:17:04,350 --> 00:17:04,790 Oh, yeah. 487 00:17:04,790 --> 00:17:06,830 So, again, we're trying to do kind of text replacements. 488 00:17:06,890 --> 00:17:08,690 Oh, now we're back to signed division. 489 00:17:08,690 --> 00:17:14,310 We're back to floating point division in Python, which is just not even close to right. 490 00:17:14,310 --> 00:17:16,230 Is that allowed on Bitvex at all? 491 00:17:16,230 --> 00:17:17,250 Do you get an error when you do that? 492 00:17:17,250 --> 00:17:18,150 They're going to get that error, yeah. 493 00:17:18,150 --> 00:17:18,570 Okay. 494 00:17:18,570 --> 00:17:19,990 That's exactly what they're going to run. 495 00:17:20,190 --> 00:17:21,290 Oh, it's solving. 496 00:17:21,630 --> 00:17:22,290 Is it? 497 00:17:22,290 --> 00:17:23,290 Did they actually get that? 498 00:17:23,290 --> 00:17:25,030 It said it's solving. 499 00:17:26,950 --> 00:17:27,670 I don't... 500 00:17:27,670 --> 00:17:28,490 It does say it's solving. 501 00:17:28,490 --> 00:17:28,730 Okay. 502 00:17:28,730 --> 00:17:29,530 Oh, again. 503 00:17:29,570 --> 00:17:31,830 So, if it's working, it's... 504 00:17:31,830 --> 00:17:33,530 Again, I don't think they're going to get the right answer. 505 00:17:33,530 --> 00:17:34,190 I think it's going to run. 506 00:17:34,190 --> 00:17:39,190 I think they're going to run into that situation where it's just going to, like, spin forever because they don't have the right division. 507 00:17:39,210 --> 00:17:40,190 I could be wrong. 508 00:17:40,270 --> 00:17:41,130 I'm not an expert in Z3. 509 00:17:41,130 --> 00:17:44,670 Well , with that SRAN, the functions aren't running 0 through 20 in order, are they? 510 00:17:44,670 --> 00:17:44,950 No , they're not. 511 00:17:44,950 --> 00:17:45,310 They're not. 512 00:17:45,310 --> 00:17:48,350 And it looks like this is kind of assuming that they are? 513 00:17:48,350 --> 00:17:50,210 Well , so they have the R at the beginning. 514 00:17:50,210 --> 00:17:52,630 Oh, did they run through and get the values? 515 00:17:52,630 --> 00:17:54,210 Let's keep an eye out on whether the... 516 00:17:54,210 --> 00:17:54,710 Oh, here we go. 517 00:17:54,710 --> 00:17:54,890 Hold on. 518 00:17:54,890 --> 00:17:55,190 What did they... 519 00:17:55,190 --> 00:17:57,110 Oh, they just changed... 520 00:17:57,110 --> 00:17:58,410 Oh, so I think they're inverting. 521 00:17:58,410 --> 00:17:58,610 Yeah. 522 00:17:58,610 --> 00:18:00,810 So, now they're just trying to invert all the operations. 523 00:18:00,810 --> 00:18:04,330 And this is something that I didn't actually try, but it might be a valid solution. 524 00:18:04,470 --> 00:18:07,690 You may very well literally just be able to, like, invert all the operations. 525 00:18:08,290 --> 00:18:10,570 Although, you'll notice they didn't change the order. 526 00:18:10,730 --> 00:18:12,370 So, if you're dividing one way, do you multiply... 527 00:18:12,370 --> 00:18:13,170 It's actually in my head. 528 00:18:13,170 --> 00:18:13,690 Like, does it... 529 00:18:13,690 --> 00:18:14,650 Maybe it doesn't matter? 530 00:18:14,650 --> 00:18:15,430 Or, like, I forget the... 531 00:18:15,430 --> 00:18:19,870 I don't know if it works directly like that, but I'm also not some math genius. 532 00:18:19,870 --> 00:18:21,970 Oh, I did just see Macaroni do a really smart thing. 533 00:18:21,970 --> 00:18:23,710 Oh, and actually, we just saw the same thing from Hypeboy. 534 00:18:23,850 --> 00:18:25,650 Checking the scoreboard. 535 00:18:25,650 --> 00:18:25,750 Checking for hints . 536 00:18:25,750 --> 00:18:28,290 Because the hints do come in at 20 minutes and ends. 537 00:18:28,290 --> 00:18:30,150 I think we're not quite there yet, but we may be close. 538 00:18:30,150 --> 00:18:31,190 Very close, yeah. 539 00:18:31,190 --> 00:18:31,910 So, that was really... 540 00:18:31,910 --> 00:18:35,230 You can tell, I think, in the beginning rounds, teams were still figuring that out. 541 00:18:35,230 --> 00:18:35,650 Yeah. 542 00:18:35,730 --> 00:18:40,210 It is cool to see that they're remembering that. 543 00:18:40,210 --> 00:18:44,610 And, again, if we talk about, like, the hints, the first hint, I don't think we'll tell them anything. 544 00:18:44,610 --> 00:18:48,190 It's just kind of more of a generic, like, you know, use the solve or something like that. 545 00:18:48,470 --> 00:18:54,750 I forget the exact details of the hint, but that second hint is going to be the one that gives them, like, hey, division's important. 546 00:18:54,750 --> 00:18:55,590 Look at UDIV. 547 00:18:55,590 --> 00:18:55,910 Right. 548 00:18:55,910 --> 00:18:59,930 Because, again, I think that's going to be something that's going to block them. 549 00:18:59,930 --> 00:19:03,670 So , that would give them, like, 15 more minutes to solve that before we run into a serious situation. 550 00:19:03,670 --> 00:19:09,990 Yeah, now it looks like we're doing some Vim Regex replacement here to, I guess, do some sort of transform on the code. 551 00:19:10,050 --> 00:19:11,150 But this is kind of scary. 552 00:19:11,150 --> 00:19:15,010 I wonder if there is a saved copy of the original form of these operators. 553 00:19:15,010 --> 00:19:18,530 Because if there isn't, are you just relying on your undo buffer? 554 00:19:18,530 --> 00:19:20,670 What if you lose those? 555 00:19:20,950 --> 00:19:23,630 Because Macaroni did all of these manually. 556 00:19:23,630 --> 00:19:27,970 So, if they lose this, that's another 10 minutes of data entry, basically. 557 00:19:27,970 --> 00:19:32,790 And I think they opened themselves up to just copy pasta errors or to, like, typos way more than what we saw. 558 00:19:32,790 --> 00:19:33,670 That's very dangerous. 559 00:19:33,670 --> 00:19:37,870 Especially, like, when you're copying from Ida, you have, like, the C syntax, right? 560 00:19:37,870 --> 00:19:39,470 You have the ULL and stuff. 561 00:19:39,470 --> 00:19:42,010 So, you have to, like, make sure you're not copying the U. 562 00:19:42,010 --> 00:19:47,850 And it's very easy to grab the U, double backspace, remove one digit, and then you're just toast. 563 00:19:47,850 --> 00:19:48,590 So, let's see. 564 00:19:48,590 --> 00:19:51,110 We're looking into... 565 00:19:51,110 --> 00:19:55,630 Okay, so now they're just taking each of the functions. 566 00:19:56,690 --> 00:20:03,630 Oh, are they going to transform it so they get the order and they just have everything in order? 567 00:20:03,850 --> 00:20:07,790 Because it looks like they're going to try and do some sort of a transform on the code itself. 568 00:20:11,470 --> 00:20:14,990 Oh, they're trying to use Python to do the regex. 569 00:20:14,990 --> 00:20:16,250 And now you've got two problems, right? 570 00:20:16,250 --> 00:20:16,930 Yeah. 571 00:20:16,930 --> 00:20:20,590 When you use a regex, now you have two problems. 572 00:20:20,590 --> 00:20:22,470 If you think your problem is solved with a regex expression. 573 00:20:22,830 --> 00:20:23,830 So, they're changing... 574 00:20:23,830 --> 00:20:27,290 This is really scary. 575 00:20:27,430 --> 00:20:32,310 Like, when I see this, I see very high chance of risk. 576 00:20:33,170 --> 00:20:33,870 Ooh. 577 00:20:33,870 --> 00:20:34,970 That's not what they wanted. 578 00:20:34,970 --> 00:20:36,250 I don't think that's what they wanted at all. 579 00:20:36,250 --> 00:20:37,950 Multiply , minus, plus... 580 00:20:37,950 --> 00:20:38,810 Divide. 581 00:20:38,810 --> 00:20:40,090 I mean... 582 00:20:40,090 --> 00:20:40,630 Oh, wait, hold on. 583 00:20:40,630 --> 00:20:44,350 Are they doing a single, like, character right now? 584 00:20:44,490 --> 00:20:46,250 That's just... 585 00:20:46,250 --> 00:20:48,390 This is an interesting approach. 586 00:20:48,390 --> 00:20:49,530 I'm not sure what's going on with that. 587 00:20:49,530 --> 00:20:50,550 I'm not sure either. 588 00:20:50,550 --> 00:20:51,550 Let's go ahead and take a look back at... 589 00:20:51,550 --> 00:20:52,750 Not us. 590 00:20:52,750 --> 00:20:54,530 Let's go ahead and take a look back at Hypeware, rather. 591 00:20:54,530 --> 00:20:55,110 Alright. 592 00:20:56,090 --> 00:20:56,870 Oh, we're in it. 593 00:20:56,870 --> 00:20:58,290 Okay, init debugger. 594 00:20:58,350 --> 00:20:59,070 Interesting. 595 00:20:59,090 --> 00:21:01,210 So, like I said, I kind of expected... 596 00:21:01,210 --> 00:21:03,990 I wondered if people were going to pull the debugger to get the array order out. 597 00:21:03,990 --> 00:21:05,310 And is this 64-bit? 598 00:21:05,310 --> 00:21:05,670 It is. 599 00:21:05,930 --> 00:21:07,310 64-bit x86. 600 00:21:07,310 --> 00:21:08,310 Yep, exactly. 601 00:21:08,310 --> 00:21:16,610 Oh, we're looking at this straight assembly, which is always a sign that maybe you're not confident in the information that you're getting directly from the decompiler. 602 00:21:16,610 --> 00:21:19,490 Well , and again, that's actually really wise on that division in particular. 603 00:21:19,490 --> 00:21:19,730 Right. 604 00:21:19,730 --> 00:21:21,650 Because that might be a way... 605 00:21:21,650 --> 00:21:25,550 It jogs your memory, and you don't just think about the abstraction level at the C layer. 606 00:21:25,550 --> 00:21:25,590 Exactly , yeah. 607 00:21:25,590 --> 00:21:28,030 But you start thinking about what's actually happening. 608 00:21:28,030 --> 00:21:29,090 Okay, so where are they breakpointing? 609 00:21:29,090 --> 00:21:31,190 They're breakpointing on... 610 00:21:31,190 --> 00:21:32,910 Yeah, this is really interesting. 611 00:21:32,910 --> 00:21:40,150 I'm kind of surprised no one has a symbolic engine that allows them to just run this very simple main function and just get the symbolic expression. 612 00:21:40,150 --> 00:21:41,050 I wondered about that. 613 00:21:41,050 --> 00:21:45,270 We did think somebody could just auto-pwn this with the right automation. 614 00:21:45,270 --> 00:21:51,450 Yeah, I think it'd be a one-minute solve because I didn't see any modulo operators, so it should be quite easy. 615 00:21:51,450 --> 00:21:52,210 Exactly , exactly. 616 00:21:52,230 --> 00:21:55,890 And yeah, that's kind of interesting. 617 00:21:56,990 --> 00:22:00,490 Do you know how long it takes for Z3 to solve this when you have the right expression? 618 00:22:00,490 --> 00:22:04,650 So at least on my hardware, it took, I think, less than a minute. 619 00:22:04,650 --> 00:22:10,290 In fact, at one point, I had made it up to 50 functions, and it was starting to take three or four minutes to solve. 620 00:22:10,290 --> 00:22:13,610 So I intentionally dropped it back down to 40 because I wanted it to be less than a minute. 621 00:22:13,610 --> 00:22:15,550 I wanted it to be fairly clear. 622 00:22:15,590 --> 00:22:20,130 I didn't want people guessing, like, well, is it taking too long because I've done something wrong or because... 623 00:22:20,130 --> 00:22:20,330 Yeah . 624 00:22:20,390 --> 00:22:25,710 So the correct solution should take about a minute to run, which I think is hopefully right. 625 00:22:25,710 --> 00:22:29,390 Did you symbolically simplify the expression or mathematically simplify it? 626 00:22:29,390 --> 00:22:30,030 No, no, no. 627 00:22:30,030 --> 00:22:33,490 I literally just copied and pasted, put in all those constraints, and let it go. 628 00:22:33,490 --> 00:22:34,310 Yeah, okay. 629 00:22:34,310 --> 00:22:38,710 So there's a chance that someone could probably get it even faster if they reduced... 630 00:22:38,710 --> 00:22:44,730 Because right now they're doing this whole lambda function thing, which will be a pretty bloated expression, and I'm sure it reduces down. 631 00:22:44,730 --> 00:22:45,050 Oh , yeah, yeah. 632 00:22:45,050 --> 00:22:50,010 But that's always a tough thing in C3 is, like, is it faster to do a simplification pass? 633 00:22:50,010 --> 00:22:59,130 Or I've had it where, like, doing a couple functions, simplifying, adding a couple more functions, simplifying has been faster than putting the whole thing in. 634 00:22:59,130 --> 00:23:00,530 But I've also had the opposite. 635 00:23:00,630 --> 00:23:05,390 I'm sure if you've worked a lot more with it, you kind of have a good feel for which way to do that. 636 00:23:05,390 --> 00:23:05,810 I have not , ironically. 637 00:23:05,810 --> 00:23:07,750 So for me, this was actually one of the very first... 638 00:23:07,750 --> 00:23:14,810 I mean, I've done a couple other challenges involving Z3 over the years, but actually partly I wrote this as an excuse to explore this more and to try it out. 639 00:23:14,810 --> 00:23:15,250 Yeah. 640 00:23:15,410 --> 00:23:24,090 And also because, like, as I said earlier, the goal of a lot of these live CTF challenges are, like, what's the core element behind some of these common challenges that we run into? 641 00:23:24,090 --> 00:23:24,490 Yeah. 642 00:23:24,490 --> 00:23:29,290 And so I thought, like, just, oh, like a basic crack me where you use Z3, you pull out some formula, and you run it through. 643 00:23:29,290 --> 00:23:35,950 And again, knowing that, like, okay, with these transformations, there's probably other approaches, which I think they've both abandoned Z3. 644 00:23:35,970 --> 00:23:39,390 It seems to me, like, that neither one is really using a Z3. 645 00:23:39,390 --> 00:23:39,830 Yeah. 646 00:23:39,830 --> 00:23:42,090 So we're not seeing Z3 at all. 647 00:23:42,090 --> 00:23:42,530 Yeah. 648 00:23:42,530 --> 00:23:47,810 They're really actually just trying to, like, do the bit shifting and inversion. 649 00:23:47,810 --> 00:23:48,230 Right. 650 00:23:48,230 --> 00:23:50,490 Which quite possibly worked. 651 00:23:50,490 --> 00:23:51,190 You haven't tried it. 652 00:23:51,190 --> 00:23:51,850 I haven't tried it. 653 00:23:51,850 --> 00:23:53,070 So it might run, it might not. 654 00:23:53,070 --> 00:23:53,190 Yeah. 655 00:23:53,190 --> 00:23:54,530 There may be other reasons why it wouldn't. 656 00:23:54,530 --> 00:23:56,290 That could be quite difficult. 657 00:23:56,290 --> 00:24:01,510 I think it really depends on, like, how these operators overflow and everything. 658 00:24:01,510 --> 00:24:02,610 I don't necessarily know. 659 00:24:02,610 --> 00:24:04,870 Making sure that you model things the same way. 660 00:24:04,870 --> 00:24:05,630 Yes. 661 00:24:05,630 --> 00:24:05,830 Exactly . 662 00:24:05,830 --> 00:24:06,530 Yeah. 663 00:24:07,310 --> 00:24:08,030 Huh. 664 00:24:08,030 --> 00:24:10,610 So I am going to be very curious. 665 00:24:10,990 --> 00:24:11,790 What do we have over here? 666 00:24:11,790 --> 00:24:15,750 Why do we have multiple things on Hype Boy? 667 00:24:15,750 --> 00:24:19,530 So base is not invertible for the given modulus. 668 00:24:19,530 --> 00:24:22,170 So whatever inversion function they're trying to do. 669 00:24:22,370 --> 00:24:23,410 Wow. 670 00:24:24,850 --> 00:24:25,590 That's interesting. 671 00:24:25,590 --> 00:24:26,550 I've never actually seen that. 672 00:24:26,550 --> 00:24:31,270 Apparently the Cryptolibrary has, like, an inversion where you can say just invert this math operation. 673 00:24:31,350 --> 00:24:31,830 Yeah. 674 00:24:32,470 --> 00:24:33,130 Or, no, no, no. 675 00:24:33,130 --> 00:24:34,250 Is that bit inversion? 676 00:24:34,550 --> 00:24:37,730 I'm not sure what that inverse function is, actually. 677 00:24:38,050 --> 00:24:38,410 Right. 678 00:24:38,410 --> 00:24:39,550 I'll definitely be looking that one up. 679 00:24:39,550 --> 00:24:40,750 I see the shift in mask. 680 00:24:40,750 --> 00:24:43,870 It looks like it's trying to make sure that those are 64-bit values. 681 00:24:43,870 --> 00:24:44,070 Right. 682 00:24:44,070 --> 00:24:46,270 But shouldn't Bitvex handle that for you? 683 00:24:46,270 --> 00:24:47,710 Again, they're not using Bitvex at all, right? 684 00:24:47,710 --> 00:24:50,470 They've switched over to a pure, like, basic math. 685 00:24:50,470 --> 00:24:52,970 Which, again, might be possible. 686 00:24:52,970 --> 00:24:54,070 I just don't know. 687 00:24:54,070 --> 00:24:59,870 If I were to ever approach a bit problem, I would never use Python for it when it comes to this. 688 00:24:59,870 --> 00:25:00,550 It's not well-studied. 689 00:25:00,550 --> 00:25:00,630 Right . 690 00:25:00,630 --> 00:25:01,670 It really isn't. 691 00:25:01,670 --> 00:25:02,070 Yeah . 692 00:25:03,690 --> 00:25:05,690 But it's hard to switch over. 693 00:25:06,170 --> 00:25:06,830 Yes. 694 00:25:06,910 --> 00:25:10,750 And it's really fascinating to me, too, that both of them started with a solver. 695 00:25:10,750 --> 00:25:13,230 Both of them just decided to bail on it when they're like, wait a minute. 696 00:25:13,230 --> 00:25:14,870 The solver is not the right approach. 697 00:25:14,870 --> 00:25:16,510 But it still could be. 698 00:25:16,510 --> 00:25:16,750 Yeah. 699 00:25:16,750 --> 00:25:18,070 Again, it is absolutely doable. 700 00:25:18,070 --> 00:25:21,690 So they're going to get that hint at 35 minutes to use a solver. 701 00:25:21,690 --> 00:25:26,950 Well, they're going to get the hints that's going to tell them to particularly use Z3's UDIF. 702 00:25:26,950 --> 00:25:31,770 In fact, actually, I'm going to go put the mic down, and I'm going to go ask what the hint is, because I don't remember what it was. 703 00:25:31,770 --> 00:25:32,270 All right. 704 00:25:32,270 --> 00:25:33,990 I'll come back, and I'll let everybody know. 705 00:25:34,010 --> 00:25:34,810 Sounds good. 706 00:25:34,810 --> 00:25:35,390 Yeah. 707 00:25:36,610 --> 00:25:37,350 All right. 708 00:25:37,350 --> 00:25:37,890 Yeah. 709 00:25:38,270 --> 00:25:43,090 Hypeboy's really got kind of all of this weird bit operation going on. 710 00:25:43,090 --> 00:25:53,230 They're trying to mask everything down to get to that, you know, 64-bit bitwise operations, which in the big space of Python, it's kind of hard to get that. 711 00:25:53,730 --> 00:25:54,930 Did you get our info? 712 00:25:54,930 --> 00:25:56,410 I did indeed confirm. 713 00:25:56,410 --> 00:25:57,030 All right. 714 00:25:57,030 --> 00:26:00,490 As I thought, it specifically says use Z3 UDIF. 715 00:26:00,490 --> 00:26:02,010 So it's pretty, like, clear. 716 00:26:03,790 --> 00:26:07,270 But again, they might not be wrong. 717 00:26:07,270 --> 00:26:09,510 I'm not going to say this isn't solvable this way. 718 00:26:09,510 --> 00:26:14,630 I just feel like there's a lot of, like, easy ways to mess it up and to try to get your exact... 719 00:26:14,630 --> 00:26:15,390 Yeah. 720 00:26:15,810 --> 00:26:16,830 It's interesting. 721 00:26:16,830 --> 00:26:17,630 What was that over there? 722 00:26:17,630 --> 00:26:20,750 Oh , we've got on macaroni. 723 00:26:21,690 --> 00:26:22,110 Yeah. 724 00:26:22,110 --> 00:26:23,810 We have the list of all the functions. 725 00:26:23,950 --> 00:26:25,310 We apply the... 726 00:26:25,310 --> 00:26:30,550 They're applying the transform onto those functions to, I guess, order them in the right way. 727 00:26:30,550 --> 00:26:32,370 But we have two F13s, I just noticed. 728 00:26:32,370 --> 00:26:33,110 I don't know what they were... 729 00:26:33,110 --> 00:26:34,390 They, like, duplicated it. 730 00:26:34,390 --> 00:26:34,930 Oh, 14. 731 00:26:34,930 --> 00:26:35,130 Were they... 732 00:26:35,130 --> 00:26:35,850 Oh, no. 733 00:26:35,850 --> 00:26:37,150 Did they add them all by one again? 734 00:26:37,150 --> 00:26:37,990 Oh, no. 735 00:26:37,990 --> 00:26:39,750 The copy pasta risk is real. 736 00:26:40,010 --> 00:26:40,730 Yeah. 737 00:26:40,990 --> 00:26:43,090 Because, yeah, X over 49. 738 00:26:43,090 --> 00:26:46,670 So they did a little bit of macro to, like, to increase the digit. 739 00:26:46,670 --> 00:26:47,890 Is that control A or something? 740 00:26:47,890 --> 00:26:48,470 I forget the exact... 741 00:26:48,470 --> 00:26:52,630 There's a key to, like, literally increase the number that I'm currently selected is a hot key in there. 742 00:26:52,630 --> 00:26:53,170 Yeah. 743 00:26:53,170 --> 00:26:54,650 And then they macro'd that. 744 00:26:54,970 --> 00:26:55,330 So , again... 745 00:26:55,330 --> 00:26:58,030 And then they're going to go manually fix up this. 746 00:26:58,030 --> 00:26:59,730 And that's... 747 00:26:59,730 --> 00:27:01,430 Was that 13 or 14? 748 00:27:01,430 --> 00:27:02,710 This is really scary. 749 00:27:02,710 --> 00:27:04,130 But they're back to bit back. 750 00:27:04,130 --> 00:27:05,630 So we are seeing... 751 00:27:05,630 --> 00:27:05,690 Yeah. 752 00:27:05,690 --> 00:27:07,830 And they added F40 to it. 753 00:27:07,830 --> 00:27:10,810 So it really comes down to if they have these expressions right. 754 00:27:10,810 --> 00:27:13,290 And I don't think they do with the single div. 755 00:27:13,750 --> 00:27:14,070 Yeah. 756 00:27:14,130 --> 00:27:15,010 That's what they're going to run to. 757 00:27:15,010 --> 00:27:18,330 But the good news is, then, if they do get that hint and kind of come back to it... 758 00:27:18,330 --> 00:27:18,610 Yeah . 759 00:27:18,610 --> 00:27:21,930 They might be better prepared for it than the approach we're seeing from BitBoy. 760 00:27:21,930 --> 00:27:27,170 I think that the timing of when that hint comes in could be a really, really big deciding factor. 761 00:27:27,170 --> 00:27:28,010 And it's like any minute now. 762 00:27:28,010 --> 00:27:28,390 The first hint's gone out. 763 00:27:28,390 --> 00:27:30,510 But, again, the first hint wasn't very useful. 764 00:27:30,510 --> 00:27:31,190 I don't even... 765 00:27:31,190 --> 00:27:32,890 Was it 20 minutes and 35 minutes? 766 00:27:32,890 --> 00:27:34,150 20 minutes and 35 minutes. 767 00:27:34,150 --> 00:27:34,450 Okay. 768 00:27:34,450 --> 00:27:39,390 So we've still got another maybe 10 minutes, I think, before, give or take, before the next hint goes out. 769 00:27:39,570 --> 00:27:40,290 Oof. 770 00:27:40,610 --> 00:27:43,170 It was about five minutes ago that we saw the first hint go. 771 00:27:43,170 --> 00:27:43,770 Yeah. 772 00:27:43,770 --> 00:27:46,490 They could definitely do it. 773 00:27:46,490 --> 00:27:50,950 And I am glad that, you know, in our playtesting, like I said, this division bit us as well. 774 00:27:50,950 --> 00:27:54,130 So we at least knew that was going to be a gotcha. 775 00:27:54,130 --> 00:27:56,630 I know where Macaroni is in their headspace right now. 776 00:27:56,630 --> 00:27:57,890 I see exactly what's going on. 777 00:27:57,890 --> 00:28:02,470 They're looking at, around this F13 through 15, they're looking at Ida. 778 00:28:02,650 --> 00:28:07,410 They're concerned that they have something wrong. 779 00:28:07,530 --> 00:28:08,430 And it's just... 780 00:28:08,430 --> 00:28:10,290 Oh, hey, they're going to use dog bolts. 781 00:28:10,290 --> 00:28:10,690 Yeah. 782 00:28:10,690 --> 00:28:11,930 So they want a second opinion, too. 783 00:28:11,930 --> 00:28:12,230 Right. 784 00:28:12,230 --> 00:28:13,890 And this is, I mean, this is terrifying. 785 00:28:14,270 --> 00:28:20,690 It's basically like, is it time to just give up and just basically try from scratch with a new approach? 786 00:28:20,690 --> 00:28:26,450 Or do you go and you try and manually verify that you have the right implementations of these operations? 787 00:28:26,450 --> 00:28:28,250 And I don't know. 788 00:28:28,250 --> 00:28:30,130 That's really, really, really tough. 789 00:28:30,390 --> 00:28:35,150 Especially in a speed competition, right, where like literally every second kind of counts and you're just nervous. 790 00:28:35,150 --> 00:28:37,410 Are we going to see a script by any chance? 791 00:28:37,450 --> 00:28:38,870 Oh, a database snapshot. 792 00:28:38,870 --> 00:28:39,530 Nice. 793 00:28:39,530 --> 00:28:40,170 Okay. 794 00:28:40,970 --> 00:28:41,550 Decompiler Explorer. 795 00:28:41,550 --> 00:28:42,790 It's just dogbolt.org. 796 00:28:42,790 --> 00:28:43,670 It's all you got to do. 797 00:28:43,730 --> 00:28:46,670 I stole that name from somebody else on Twitter when we created this. 798 00:28:46,670 --> 00:28:50,010 So this is actually a joint project from a couple of folks. 799 00:28:50,010 --> 00:28:54,770 So Ilfax from Hexrays and Vector35, makers of Binary Ninja, we both pay for the hosting. 800 00:28:54,830 --> 00:28:57,550 And Vector35, we wrote most of the actual interface. 801 00:28:57,870 --> 00:29:00,090 Some of the Angular folks have some code that are part of it, too. 802 00:29:00,330 --> 00:29:00,810 OpenAI? 803 00:29:00,950 --> 00:29:03,010 Did I see a chat GPT? 804 00:29:03,010 --> 00:29:03,650 We are seeing a chat GPT. 805 00:29:03,650 --> 00:29:03,770 Wow. 806 00:29:03,770 --> 00:29:06,290 They almost did it quickly, like they were embarrassed, though, to show it. 807 00:29:06,290 --> 00:29:12,890 Can you rewrite those functions? 808 00:29:14,090 --> 00:29:14,370 Okay. 809 00:29:14,370 --> 00:29:17,450 So they're going to use this as a smarter text replacement, maybe? 810 00:29:18,030 --> 00:29:18,690 I'm curious. 811 00:29:18,690 --> 00:29:20,490 I am kind of excited. 812 00:29:20,490 --> 00:29:27,990 Now, would you trust the result of chat GPT to the level of a solver being able to reason about it? 813 00:29:27,990 --> 00:29:35,170 I think if all they're going to ask it to do is to do a bunch of formatting and to paste in a bunch of output, I feel like that's a fair thing. 814 00:29:35,170 --> 00:29:40,090 Fun note, by the way, the binary ninja that's running a dog bolt is not the latest dev version. 815 00:29:40,190 --> 00:29:44,870 So it actually, I think on these operations it's all fine, but for some of the... 816 00:29:44,870 --> 00:29:46,310 Oh, and Anger and Ghidorah are still... 817 00:29:46,830 --> 00:29:47,710 They'll get there. 818 00:29:47,710 --> 00:29:48,550 They'll come through. 819 00:29:48,550 --> 00:29:50,450 How big would you say this binary was? 820 00:29:50,450 --> 00:29:51,750 Oh, it's not very large. 821 00:29:51,750 --> 00:29:56,030 I could pull it up separately, but it's not super big. 822 00:29:56,230 --> 00:29:59,490 In fact, usually IDA comes back faster on Decompiler Explorer. 823 00:29:59,490 --> 00:30:01,550 In this particular one, it's... 824 00:30:01,550 --> 00:30:02,750 Let's see. 825 00:30:03,230 --> 00:30:04,290 No way. 826 00:30:04,290 --> 00:30:05,650 That looks very good. 827 00:30:05,650 --> 00:30:07,770 Your text processing, again... 828 00:30:07,770 --> 00:30:08,410 That looks... 829 00:30:08,410 --> 00:30:09,450 It's not terrible. 830 00:30:09,450 --> 00:30:10,690 Very good. 831 00:30:11,270 --> 00:30:12,330 No way. 832 00:30:12,330 --> 00:30:16,170 Yeah, but I think it's good for that. 833 00:30:17,230 --> 00:30:18,650 I mean, that... 834 00:30:18,650 --> 00:30:19,510 That's pretty good. 835 00:30:19,510 --> 00:30:22,250 I didn't really see anything that looked off in there. 836 00:30:22,250 --> 00:30:24,350 But the problem is you don't know. 837 00:30:24,350 --> 00:30:24,970 Yeah. 838 00:30:25,310 --> 00:30:27,390 Oh, did they have to teach you about division? 839 00:30:27,390 --> 00:30:28,410 Oh, no. 840 00:30:28,410 --> 00:30:30,450 Oh, no. 841 00:30:31,270 --> 00:30:32,590 Oh, no. 842 00:30:32,590 --> 00:30:33,390 Everyone's like... 843 00:30:33,850 --> 00:30:34,250 Macaroni. 844 00:30:34,250 --> 00:30:34,770 No. 845 00:30:35,390 --> 00:30:37,870 Poking around the same thing. 846 00:30:39,170 --> 00:30:42,350 And they have F40, which shouldn't be in there. 847 00:30:42,450 --> 00:30:43,150 It's not. 848 00:30:43,150 --> 00:30:44,310 There is no F40. 849 00:30:44,310 --> 00:30:47,870 Yeah , so there are only 40 total functions starting at function 0 to function 39. 850 00:30:48,170 --> 00:30:50,790 Now, are they going to go and just change it to a double div? 851 00:30:50,790 --> 00:30:51,570 What's the order, though? 852 00:30:51,570 --> 00:30:52,010 Hold on. 853 00:30:52,010 --> 00:30:52,530 Oh, no. 854 00:30:52,530 --> 00:30:53,010 Okay, no. 855 00:30:53,070 --> 00:30:54,430 They're doing the transform. 856 00:30:54,430 --> 00:30:55,410 They do look up their array. 857 00:30:55,410 --> 00:30:57,630 I think the way they do this is pretty good. 858 00:30:57,630 --> 00:30:58,110 That part's fine. 859 00:30:58,110 --> 00:30:58,470 Right. 860 00:30:58,470 --> 00:30:58,550 Absolutely. 861 00:30:58,550 --> 00:31:02,610 Do you think if they had the double div operator, this is just already basically solved? 862 00:31:02,610 --> 00:31:03,430 No, no, no. 863 00:31:03,430 --> 00:31:07,010 Because, again, the double div is still signed, I think. 864 00:31:07,010 --> 00:31:09,310 Can you write the inverse of those functions? 865 00:31:11,810 --> 00:31:12,950 I don't... yeah. 866 00:31:12,950 --> 00:31:16,630 See, now, at a certain point, you're going a step too far. 867 00:31:16,630 --> 00:31:17,230 Right. 868 00:31:17,330 --> 00:31:18,590 It's going to start hallucinating on you. 869 00:31:18,590 --> 00:31:20,070 I don't know if this is it or not. 870 00:31:20,090 --> 00:31:23,070 Oh, and you notice their solver just said something about a stat in the background. 871 00:31:23,070 --> 00:31:24,750 So that, actually, I'm a big fan of. 872 00:31:24,750 --> 00:31:29,690 If they're running a different copy of the script with the solver while they go out and try to do the inversion, that's good for them. 873 00:31:29,690 --> 00:31:31,330 Two different approaches at the same time. 874 00:31:31,390 --> 00:31:32,410 That's a good way to go. 875 00:31:32,410 --> 00:31:33,370 Great use of time. 876 00:31:33,370 --> 00:31:35,410 Hard to keep both that in your head, but... 877 00:31:35,410 --> 00:31:37,830 Yes , and make sure you don't invert one thing from the other. 878 00:31:37,830 --> 00:31:39,790 Are those the inverse? 879 00:31:41,470 --> 00:31:47,770 Or did it just do a dumb inversion where it did a negation or something? 880 00:31:48,130 --> 00:31:51,890 And what are they going to... oh, they're doing all... so here's their division. 881 00:31:51,890 --> 00:31:53,470 They're going to get rid of their division again. 882 00:31:53,590 --> 00:31:55,170 But, again, that's not quite what they want. 883 00:31:55,170 --> 00:31:58,750 But they're going to be well situated when that thing comes through. 884 00:31:58,750 --> 00:32:01,170 And HypeBoy just checked on that hint. 885 00:32:01,170 --> 00:32:03,850 And just as a... okay, so they're still looking for the hint. 886 00:32:03,850 --> 00:32:06,790 They know it's not too far out, but we do have a few more minutes. 887 00:32:06,850 --> 00:32:09,970 Let's actually go ahead and follow up with what HypeBoy's been doing to catch up with them. 888 00:32:09,970 --> 00:32:12,390 Because I still see... I don't think they're... yeah, still no Z3. 889 00:32:12,470 --> 00:32:14,890 All their Z3 solver stuff is still coming out. 890 00:32:14,890 --> 00:32:20,630 So they're still leaning into that inversion approach of really just trying to invert the operations. 891 00:32:20,630 --> 00:32:21,030 Right. 892 00:32:21,030 --> 00:32:22,050 To see if they can get that value. 893 00:32:22,050 --> 00:32:26,010 And I guess the goal is to just run through and just run it through backwards? 894 00:32:26,070 --> 00:32:27,250 Yeah, you'll just get a constant out. 895 00:32:27,250 --> 00:32:31,150 If you could perfectly model the inverse of those operations, yeah, that would happen. 896 00:32:31,150 --> 00:32:34,170 It's just... yeah, just tricky to do. 897 00:32:34,170 --> 00:32:36,590 And there's a lot of ways to get that wrong. 898 00:32:37,470 --> 00:32:38,270 So we'll see. 899 00:32:38,270 --> 00:32:40,210 And with the Z3, there's basically only one way to get it wrong. 900 00:32:40,210 --> 00:32:41,390 And it's literally just the division. 901 00:32:41,390 --> 00:32:42,790 It's just the division that makes it tricky. 902 00:32:42,790 --> 00:32:46,390 I see the double division went back in over on macaroni. 903 00:32:46,390 --> 00:32:48,410 So did they get an unsat? 904 00:32:48,410 --> 00:32:49,930 So we've got a... yeah, sat assertion error. 905 00:32:49,930 --> 00:32:52,130 Okay, so they know that it was unsat. 906 00:32:52,310 --> 00:32:52,970 Okay. 907 00:32:52,970 --> 00:32:55,090 And then they're changing it again with the double division. 908 00:32:55,090 --> 00:32:58,950 So again, I'm actually... did they miss a zero when they copied that? 909 00:32:59,950 --> 00:33:01,850 It was on which side of it was it? 910 00:33:02,050 --> 00:33:05,630 Is that highlighted all the way to the other zero on macaroni? 911 00:33:05,630 --> 00:33:06,690 Zero , zero, L, L. 912 00:33:08,010 --> 00:33:10,010 Also, let's see. 913 00:33:10,010 --> 00:33:11,710 Where is their final comparison? 914 00:33:11,950 --> 00:33:14,230 So the array... order the arrays. 915 00:33:16,490 --> 00:33:18,590 Unlocking in 227 seconds. 916 00:33:18,590 --> 00:33:20,010 Oh, I didn't even notice that before. 917 00:33:20,010 --> 00:33:20,490 It does give them the... 918 00:33:20,490 --> 00:33:20,970 Yeah, yeah. 919 00:33:20,970 --> 00:33:21,890 That's great. 920 00:33:21,890 --> 00:33:22,690 It does let them know... 921 00:33:22,690 --> 00:33:23,650 I think I saw Glenn... 922 00:33:23,650 --> 00:33:24,850 They do have the right value. 923 00:33:24,850 --> 00:33:25,350 Okay. 924 00:33:25,350 --> 00:33:27,370 So the value is correct at 100 at the end. 925 00:33:27,810 --> 00:33:28,450 Interesting. 926 00:33:29,170 --> 00:33:30,670 They really need those double divisions. 927 00:33:30,670 --> 00:33:34,750 For context, when I wrote this, I literally just had a debug version of it. 928 00:33:34,750 --> 00:33:40,170 I put in the input value I wanted to be the answer, and then I just checked the value at the end, and then I hard-coded it back in and recompiled it, right? 929 00:33:40,170 --> 00:33:40,570 Yeah. 930 00:33:40,570 --> 00:33:42,270 So it's really easy to find the solution. 931 00:33:42,270 --> 00:33:44,050 Now, I did still have to write the Z-theory. 932 00:33:44,050 --> 00:33:51,110 I did still have to prove it was solvable, and that's also how I could find over multiple solutions, but it's kind of easy on a forward operation. 933 00:33:51,110 --> 00:33:51,430 Okay, hold on. 934 00:33:51,430 --> 00:33:51,850 What are we doing here? 935 00:33:51,850 --> 00:33:52,730 Out equals... 936 00:33:52,730 --> 00:33:53,590 Zmod. 937 00:33:53,810 --> 00:33:54,450 Zmod. 938 00:33:55,250 --> 00:33:55,950 Oh, no. 939 00:33:56,650 --> 00:33:57,570 Yeah, okay. 940 00:33:57,570 --> 00:34:00,050 So they're essentially doing now what we saw before. 941 00:34:00,050 --> 00:34:01,930 They're trying to constrain. 942 00:34:01,990 --> 00:34:03,210 We're going to use SageMath. 943 00:34:03,730 --> 00:34:04,430 Really? 944 00:34:04,430 --> 00:34:07,570 So are they going to do the sort of inversion approach that we've seen? 945 00:34:07,570 --> 00:34:08,290 Yeah. 946 00:34:08,410 --> 00:34:17,510 But they're going to use Sage to try to do these inversions and try to model the way that the opcodes are going to behave, but invert them. 947 00:34:17,590 --> 00:34:18,090 Right . 948 00:34:18,870 --> 00:34:24,350 Yeah, so I was a little skeptical of some of these inversion attempts, but I actually really like that... 949 00:34:24,350 --> 00:34:25,930 Inverse of that doesn't exist. 950 00:34:25,930 --> 00:34:30,550 I really like the HypeBoy approach here where they're still got their solvers kind of running. 951 00:34:30,550 --> 00:34:30,570 Right. 952 00:34:30,570 --> 00:34:37,390 So run a solver, but then let it go and see if you get an answer while you go off and try other things. 953 00:34:37,390 --> 00:34:38,830 Was that HypeBoy or Macaroni? 954 00:34:38,830 --> 00:34:39,670 I'm sorry, thank you. 955 00:34:39,710 --> 00:34:40,430 Macaroni. 956 00:34:40,730 --> 00:34:41,090 Yeah . 957 00:34:41,230 --> 00:34:44,650 HypeBoy still seems that we can double check on them over there. 958 00:34:45,010 --> 00:34:46,510 They have a whole new Python script? 959 00:34:46,530 --> 00:34:47,850 They're back to Z3. 960 00:34:47,870 --> 00:34:48,550 Hold on, did they? 961 00:34:48,550 --> 00:34:48,610 Yeah. 962 00:34:48,610 --> 00:34:50,130 Okay, they didn't see the hint yet, though. 963 00:34:50,130 --> 00:34:52,390 So how do you do the unsigned divide in Z3? 964 00:34:52,390 --> 00:34:53,590 It's just a function called UDIV. 965 00:34:53,590 --> 00:34:55,910 It's literally a built-in operation called UDIV. 966 00:34:55,910 --> 00:34:58,790 Which is why we tell them the exact function name in that hint. 967 00:34:58,790 --> 00:34:59,110 Right. 968 00:34:59,110 --> 00:35:02,390 Because I think that will be the last stumbling block that either one can do. 969 00:35:02,390 --> 00:35:04,290 The other thing is I'm keeping an eye on our alerts. 970 00:35:04,290 --> 00:35:05,830 I don't think I've seen the others. 971 00:35:05,830 --> 00:35:13,170 So remember, as a reminder to our viewers, you can go over to the other streams and you can watch the two other players that have been doing this. 972 00:35:13,170 --> 00:35:15,950 So we've got Maple Mallards and Straw Hats. 973 00:35:16,070 --> 00:35:16,930 And I haven't seen the alerts. 974 00:35:16,930 --> 00:35:17,530 They're still working away. 975 00:35:17,530 --> 00:35:19,250 I think they're still working away as well. 976 00:35:19,250 --> 00:35:22,550 So my bet is I really wasn't trying to troll everyone. 977 00:35:22,570 --> 00:35:24,030 It's kind of interesting. 978 00:35:24,030 --> 00:35:28,890 I've used Z3 for one time, and it was for a MapleStory hacking thing. 979 00:35:28,890 --> 00:35:30,290 It's a long story. 980 00:35:30,750 --> 00:35:32,810 It's a long MapleStory, maybe? 981 00:35:33,270 --> 00:35:34,130 Gosh. 982 00:35:34,170 --> 00:35:34,330 Sorry . 983 00:35:36,930 --> 00:35:41,990 And I've already had it drilled into me to make sure that I'm doing the right div operator. 984 00:35:42,090 --> 00:35:43,070 And I've used it once. 985 00:35:43,070 --> 00:35:47,850 So you would think that people who have done this a lot would probably immediately be going to that. 986 00:35:47,850 --> 00:35:53,570 Now, maybe it's because they saw int64 and IDA or something, and they're just taking that. 987 00:35:53,570 --> 00:35:54,570 Immediately jump from there. 988 00:35:54,570 --> 00:35:56,210 Yeah, that's entirely possible. 989 00:35:56,450 --> 00:35:58,750 Yeah, that's really tricky. 990 00:35:58,810 --> 00:36:02,230 Is it all of the functions are unsigned, or is it just one of them is unsigned? 991 00:36:02,230 --> 00:36:05,290 Because if you did that, that's just rude. 992 00:36:05,990 --> 00:36:09,150 So the values themselves are all unsigned values. 993 00:36:09,150 --> 00:36:10,950 And in source, you don't differentiate. 994 00:36:10,950 --> 00:36:12,530 You just div, multiply, whatever. 995 00:36:12,530 --> 00:36:16,610 And it just happens to be if you have unsigned values, it's going to be an unsigned div. 996 00:36:16,610 --> 00:36:22,270 But again, in decompilation, you just see division, multiplication, and subtraction. 997 00:36:22,710 --> 00:36:24,510 Does Binja differentiate those? 998 00:36:24,510 --> 00:36:27,230 Binja does actually show you in high-level IL. 999 00:36:27,590 --> 00:36:29,290 It does U slash or whatever? 1000 00:36:29,290 --> 00:36:30,070 It can do U, yeah. 1001 00:36:30,070 --> 00:36:36,690 So Binja will actually tell you if it knows the operation signedness of your comparison or whatever it is, which is not valid C. 1002 00:36:36,690 --> 00:36:43,090 It's one of our arguments about why ILs are better than just pseudo C or C output, because you can actually do hinting as to what type of thing it is. 1003 00:36:43,090 --> 00:36:44,470 To me, that's mandatory. 1004 00:36:44,470 --> 00:36:50,590 Whenever I have printed out any of my ILs, it's always on all of the operations that are signed or unsigned. 1005 00:36:50,590 --> 00:36:51,610 It is explicit. 1006 00:36:51,610 --> 00:36:52,970 S or U. 1007 00:36:52,970 --> 00:36:55,090 It's just so important. 1008 00:36:55,090 --> 00:36:57,470 It's the difference of having a no day and not. 1009 00:36:57,470 --> 00:37:02,570 Or in this case, spending an extra 15, 20 minutes getting your solver to work. 1010 00:37:02,570 --> 00:37:03,670 Okay, actually, let's go back. 1011 00:37:03,670 --> 00:37:06,750 We've got... I'm seeing in HypeBoy, we now... 1012 00:37:06,750 --> 00:37:07,990 Oh, is that it? 1013 00:37:07,990 --> 00:37:09,330 They've got a V4. 1014 00:37:09,430 --> 00:37:10,710 Hold on, hold on. 1015 00:37:11,110 --> 00:37:11,630 They're running it. 1016 00:37:11,630 --> 00:37:12,290 They've got a value. 1017 00:37:12,290 --> 00:37:13,370 Okay, yeah, yeah, they've got a value. 1018 00:37:13,370 --> 00:37:14,350 They're running it. 1019 00:37:14,650 --> 00:37:15,390 Oh, no. 1020 00:37:15,770 --> 00:37:16,370 Now, let's see. 1021 00:37:16,370 --> 00:37:17,470 Are they checking the input? 1022 00:37:17,470 --> 00:37:18,570 Does it check? 1023 00:37:18,570 --> 00:37:20,010 Are they doing the inversion thing? 1024 00:37:20,010 --> 00:37:20,930 Well, they're putting it... 1025 00:37:20,930 --> 00:37:22,090 What format is the input? 1026 00:37:22,090 --> 00:37:23,810 Is it hexadecimal or is it... 1027 00:37:23,810 --> 00:37:27,850 It was LLU, so it should be an unsigned 64-bit int. 1028 00:37:27,910 --> 00:37:29,910 That actually tricked someone up yesterday. 1029 00:37:29,910 --> 00:37:32,070 For about 20 or 25 minutes... 1030 00:37:32,070 --> 00:37:32,590 Oh, no. 1031 00:37:32,590 --> 00:37:36,470 ...one of the teams, I think, didn't know that it was hex. 1032 00:37:36,470 --> 00:37:37,230 Yeah, yeah, yeah. 1033 00:37:37,790 --> 00:37:38,190 And... 1034 00:37:38,190 --> 00:37:38,970 I don't see... 1035 00:37:38,970 --> 00:37:40,370 They haven't checked the... 1036 00:37:40,870 --> 00:37:43,430 Okay, so then copy-paste errors. 1037 00:37:44,370 --> 00:37:45,990 Okay, now, are they going to check that scan out? 1038 00:37:45,990 --> 00:37:46,630 Please go check... 1039 00:37:46,630 --> 00:37:47,270 Yes, no, no, no. 1040 00:37:47,330 --> 00:37:48,570 Go check the scan out. 1041 00:37:48,810 --> 00:37:50,030 Go look for that input. 1042 00:37:50,090 --> 00:37:51,090 It was LLU. 1043 00:37:51,090 --> 00:37:52,230 I do remember that. 1044 00:37:52,630 --> 00:37:53,070 Okay, so... 1045 00:37:53,070 --> 00:37:54,610 That was, like, the very first thing that I picked out. 1046 00:37:54,610 --> 00:37:55,550 You didn't notice this one was LLU. 1047 00:37:55,550 --> 00:37:58,850 I should remember, but I wrote this two weeks ago, so, like, I don't even remember my own... 1048 00:37:58,850 --> 00:38:00,170 Yeah, that was, like, the first thing... 1049 00:38:00,170 --> 00:38:01,030 I actually switched it back and forth. 1050 00:38:01,030 --> 00:38:03,390 A couple times, I was doing hexadecimal. 1051 00:38:03,390 --> 00:38:04,170 A couple times, I was doing... 1052 00:38:04,170 --> 00:38:04,490 Yeah. 1053 00:38:05,470 --> 00:38:06,510 ...doing integer values. 1054 00:38:07,430 --> 00:38:07,810 CPyNamespace. 1055 00:38:07,890 --> 00:38:08,450 Okay. 1056 00:38:08,450 --> 00:38:09,450 So, they should have... 1057 00:38:12,270 --> 00:38:13,210 Oh, fantastic. 1058 00:38:13,290 --> 00:38:14,510 Okay, so I just got a little introduction. 1059 00:38:14,510 --> 00:38:15,510 Was that a love letter? 1060 00:38:15,550 --> 00:38:16,250 It was. 1061 00:38:16,250 --> 00:38:17,030 They're telling me how much... 1062 00:38:17,030 --> 00:38:18,770 No, they're telling me that Straw Hat won. 1063 00:38:18,770 --> 00:38:21,470 So, Straw Hat has beaten Maple Mallard... 1064 00:38:21,470 --> 00:38:21,670 Okay. 1065 00:38:21,670 --> 00:38:22,430 ...in our uncasted one. 1066 00:38:22,430 --> 00:38:25,590 So, if you were watching that stream, and you've joined us now, you may have already seen the end of it. 1067 00:38:25,590 --> 00:38:26,010 Wow. 1068 00:38:26,010 --> 00:38:31,490 Straw Hat won their version, and they, again, got a different number than the expected solution, but I'm not at all surprised. 1069 00:38:31,870 --> 00:38:32,350 Z3UDIV. 1070 00:38:32,730 --> 00:38:33,310 Okay. 1071 00:38:33,310 --> 00:38:34,370 He finally popped it up. 1072 00:38:34,470 --> 00:38:35,370 Oh, and UDIV is not defined. 1073 00:38:35,370 --> 00:38:36,590 We are seeing it on both of them. 1074 00:38:36,590 --> 00:38:36,810 Yep. 1075 00:38:36,810 --> 00:38:37,390 We're seeing... 1076 00:38:37,390 --> 00:38:38,970 Okay, so both have the hints. 1077 00:38:39,190 --> 00:38:39,570 Yeah. 1078 00:38:39,570 --> 00:38:40,870 This should be it. 1079 00:38:40,870 --> 00:38:41,410 Honestly? 1080 00:38:41,410 --> 00:38:43,670 So, at this point, it's a race to see... 1081 00:38:43,670 --> 00:38:43,890 I... 1082 00:38:43,890 --> 00:38:44,890 ...who can fix their implementation. 1083 00:38:44,890 --> 00:38:52,730 I'm putting my money on Macaroni, because if they go back to chat GPT to do that transform, to do the UDIV, they're going to get the result very fast. 1084 00:38:52,730 --> 00:38:52,930 There's always complications , though. 1085 00:38:52,930 --> 00:38:53,110 Watch. 1086 00:38:53,110 --> 00:38:53,850 They're just doing a... 1087 00:38:53,850 --> 00:38:54,270 Manual. 1088 00:38:54,270 --> 00:38:57,090 ...event macro, and they're doing it, and they're almost done. 1089 00:38:57,090 --> 00:38:58,450 It's kind of interesting that we've... 1090 00:38:58,450 --> 00:38:58,990 Uh -oh , uh-oh. 1091 00:38:59,770 --> 00:39:00,330 We've got a... 1092 00:39:00,330 --> 00:39:00,870 Oh, here it is. 1093 00:39:00,870 --> 00:39:01,110 Here it is. 1094 00:39:01,110 --> 00:39:01,470 Hypoidoh. 1095 00:39:01,510 --> 00:39:03,030 Hypoidoh is coming through. 1096 00:39:03,030 --> 00:39:04,210 They've got a value. 1097 00:39:04,210 --> 00:39:04,990 They've got a value. 1098 00:39:04,990 --> 00:39:06,070 It shows correct. 1099 00:39:06,070 --> 00:39:07,030 And now they just have to... 1100 00:39:07,750 --> 00:39:08,630 Get it in there. 1101 00:39:08,630 --> 00:39:09,390 Submitter 12. 1102 00:39:09,530 --> 00:39:10,130 They've got it. 1103 00:39:10,130 --> 00:39:10,790 I think they've got it. 1104 00:39:10,790 --> 00:39:11,410 Here it is. 1105 00:39:11,410 --> 00:39:12,930 And that's going to be... 1106 00:39:12,930 --> 00:39:13,650 That is it. 1107 00:39:13,650 --> 00:39:14,570 That is it. 1108 00:39:14,850 --> 00:39:15,090 Congratulations . 1109 00:39:15,090 --> 00:39:15,670 Oh, no. 1110 00:39:15,670 --> 00:39:17,390 And we just had one so close. 1111 00:39:18,010 --> 00:39:19,210 Macaroni was just behind it. 1112 00:39:19,210 --> 00:39:20,290 That hit was exactly... 1113 00:39:20,290 --> 00:39:20,630 Yeah. 1114 00:39:20,630 --> 00:39:21,170 ...all they needed. 1115 00:39:21,410 --> 00:39:21,570 Wow. 1116 00:39:21,570 --> 00:39:22,950 That was so close. 1117 00:39:22,950 --> 00:39:25,410 We thought that might do it, sure enough. 1118 00:39:25,410 --> 00:39:36,090 It was kind of crazy that Macaroni did the manual copy-pasting from IDA initially, but also used the most automated chat GPT approach. 1119 00:39:36,130 --> 00:39:36,170 Chat GPT. 1120 00:39:36,170 --> 00:39:37,330 So it was just two complete... 1121 00:39:38,130 --> 00:39:38,810 Ends of the spectrum. 1122 00:39:38,810 --> 00:39:39,230 Yeah. 1123 00:39:39,230 --> 00:39:39,830 Yeah, yeah, yeah. 1124 00:39:39,830 --> 00:39:40,550 We saw both. 1125 00:39:40,550 --> 00:39:41,050 But that was... 1126 00:39:41,050 --> 00:39:41,170 Oh . 1127 00:39:41,170 --> 00:39:42,450 Yeah, and it was exactly the hit. 1128 00:39:42,450 --> 00:39:43,170 It was the UDIF. 1129 00:39:43,170 --> 00:39:44,030 They just needed the UDIF. 1130 00:39:44,030 --> 00:39:44,150 No way. 1131 00:39:44,150 --> 00:39:46,710 They both got it within just seconds of each other. 1132 00:39:46,710 --> 00:39:46,970 Wow. 1133 00:39:46,970 --> 00:39:50,730 It is interesting, though, to note that I think, as we saw, Straw Hat actually won theirs. 1134 00:39:50,730 --> 00:39:52,110 Before, I think that hit may have come out. 1135 00:39:52,110 --> 00:39:53,310 That hit just came out. 1136 00:39:53,310 --> 00:39:53,690 Yeah. 1137 00:39:53,690 --> 00:39:55,630 They all fixed it and were able to solve it. 1138 00:39:55,630 --> 00:39:58,330 But I'm going to go back and watch the VOD now and see what Straw Hat did. 1139 00:39:58,330 --> 00:39:58,850 Right. 1140 00:39:58,850 --> 00:40:02,610 Because I think their solution may not even have been exactly the same. 1141 00:40:02,870 --> 00:40:10,870 Honestly, I think, in my head, one of the approaches that maybe would have come up to me is just randomly try both signed and unsigned. 1142 00:40:10,870 --> 00:40:13,330 Like, make a generic function. 1143 00:40:13,330 --> 00:40:13,570 Right . 1144 00:40:13,570 --> 00:40:14,630 Because how many divs were there? 1145 00:40:14,630 --> 00:40:15,170 Five? 1146 00:40:15,250 --> 00:40:15,870 What is that? 1147 00:40:15,870 --> 00:40:19,670 Two to the five different combos and just try all possible combos. 1148 00:40:19,670 --> 00:40:21,710 And you know it's at least the same one for each of your divisions, right? 1149 00:40:21,710 --> 00:40:21,910 Right. 1150 00:40:21,910 --> 00:40:22,930 So you don't have to, like, do it. 1151 00:40:22,930 --> 00:40:25,770 You can just do it five times, essentially, which makes it a lot easier. 1152 00:40:25,770 --> 00:40:26,090 Yeah . 1153 00:40:26,190 --> 00:40:27,490 So, ah, that was fantastic. 1154 00:40:27,490 --> 00:40:27,730 All right. 1155 00:40:27,730 --> 00:40:30,650 Well, I'm excited because we haven't had to use another sudden death, which is always good. 1156 00:40:30,650 --> 00:40:31,230 Yeah. 1157 00:40:31,310 --> 00:40:32,330 We had a good round. 1158 00:40:32,330 --> 00:40:34,330 Everyone, we've got two victors. 1159 00:40:34,410 --> 00:40:37,790 Congratulations to Hypeboy and to Straw Hat for their wins. 1160 00:40:37,850 --> 00:40:42,990 But, honestly, Macaroni and PPP that lost, they're playing into the lower bracket now. 1161 00:40:42,990 --> 00:40:44,490 They can still be back in the finals. 1162 00:40:44,490 --> 00:40:44,990 For sure. 1163 00:40:45,030 --> 00:40:45,950 Yeah, absolutely. 1164 00:40:45,990 --> 00:40:49,190 Now, I don't want to put you on the spot, but who do we have coming up next? 1165 00:40:49,310 --> 00:40:50,570 Ah, let me pull up that. 1166 00:40:50,570 --> 00:40:52,650 I've got the chart right here. 1167 00:40:52,650 --> 00:40:55,770 So, actually, we can, I think we could, well, I won't do the bracket on stream. 1168 00:40:56,250 --> 00:40:59,390 Next up, we're going to do a couple more from the lower bracket, actually. 1169 00:40:59,390 --> 00:40:59,630 Okay. 1170 00:40:59,630 --> 00:41:08,250 So, I think we're going to pull in, the next two are going to be, actually, the two from this that lost are going to be right back around. 1171 00:41:08,250 --> 00:41:10,470 So, they're going to be coming in for Macaroni versus Shellfish. 1172 00:41:10,470 --> 00:41:10,810 Okay. 1173 00:41:10,810 --> 00:41:12,990 And Maple Mallard versus Norse Code. 1174 00:41:13,150 --> 00:41:13,710 All right. 1175 00:41:13,710 --> 00:41:18,450 So, again, even those lower bracket matches are going to be fierce and great competitors. 1176 00:41:18,450 --> 00:41:19,150 Perfect. 1177 00:41:19,290 --> 00:41:20,030 Sounds good. 1178 00:41:20,030 --> 00:41:20,410 Awesome. 1179 00:41:20,410 --> 00:41:20,890 Look forward to it. 1180 00:41:20,890 --> 00:41:22,010 Thanks, everybody, for joining us. 1181 00:41:22,010 --> 00:41:26,970 We'll see you just in about 15 minutes as we reset, get the new teams in here, and we'll be back. 1182 00:41:26,970 --> 00:41:27,490 Cheers. 1183 00:41:27,490 --> 00:41:28,110 Take care. 1184 00:41:34,420 --> 00:41:35,820 ♪♪♪