start	end	text
11390	15470	Hello, everybody, and welcome back. It is Jordan, CipherTex, and...
15910	16530	Gamozo!
16530	19330	We're here! Okay, so we have another round of live CTF.
19430	22230	Neither one of us has been back today yet.
22230	24290	This is our first stream of the day.
24290	28010	I love that we've got a lot of new casters who've been joining us.
28010	30530	We're preparing for a new round.
30610	33610	They're doing the introduction kind of behind us.
33830	38430	We've got, actually, we can see on their screens as we're looking at them,
38430	40010	four teams ready for this match.
40010	42330	We are going to be casting Macaroni...
42330	44670	Do you say M-Hackaroni or Macaroni?
44670	46270	I'm going to say Macaroni.
46270	46810	Macaroni?
46930	48350	Just because I love it.
48350	49130	I think it sounds better.
49130	49770	Yeah.
49770	51230	I always thought it was M-Hackaroni,
51230	53090	and then I finally heard somebody say Macaroni.
53090	53150	Macaroni?
53150	55110	Oh, no, no, that's way better.
55210	56490	Macaroni and Hypeboy.
56670	58830	We're going to see on this stream.
58910	61430	But we also have Maple Mallard Magistrates,
61430	63090	the other name of PPP,
63570	65930	and Straw Hat in the non-cast.
65930	67010	We're not commenting on them,
67010	69990	but you can see their feeds as well in our alternate streams.
69990	72950	So who's been crushing it so far on the brackets?
72950	76730	I mean, in general, all of these teams are in the winner's bracket.
76730	80210	So every team we're casting right now has never lost.
80310	82150	This is the undefeated bracket.
82890	84590	So this is a great one.
84590	86770	So we're going to see some very quick matches.
86770	87430	I think so.
87450	90530	Hypeboy has just been destroying it so far.
90570	92090	They may have sent up somebody different, though.
92090	93930	Because one thing that's different is this is the first challenge
93930	95710	that we told them was not opponable.
95810	97290	This one is actually more...
97290	98290	We told them it was a Crack Me,
98290	100150	so more reverse engineering Crack Me style challenge.
100150	100710	Oh, all right.
100710	102270	So I might see some IDA today.
102610	104610	Wait, Binary Ninja, I'm sorry.
104610	105950	You know what? I wish that were true.
106150	108610	However, we've actually only seen them.
108610	109290	All right.
109690	111390	Are we about ready for the countdown?
111390	113150	So it looks like we're about ready to go live.
113150	115290	So let's go ahead and let our...
115830	117470	We're going to count it in.
118430	122630	Five, four, three, two, one.
122630	123570	Let's go.
123570	124130	All right.
124130	128230	So we're going to see both teams hop on in and get going.
128910	130410	Who do you want to go with first?
130930	132690	Ah, this is really tough to say.
132690	134050	No Binja that we can pick from?
134050	134130	I know.
134130	135270	Because that would have been the first pick.
135270	136010	That would have been the obvious one.
136010	137190	Let's go ahead and go to Hypeboy first,
137190	140130	because Hypeboy has been just the fastest.
140130	143390	The matches they've won have been incredibly fast so far.
143390	144150	So I've been very impressed.
144150	147070	Although, again, I don't know if they're going to send somebody different
147590	149630	if it's not the same person who's doing punnables.
149630	152250	Now, did you know that every single time I've cast this,
152250	153470	it's gone to sudden death?
153470	153950	Oh, no.
153950	154790	Are you cursed?
154930	156970	Did you curse my challenge?
156970	159330	So, yeah, for full disclosure, this is my challenge.
159330	160770	This is one of the ones I wrote.
161150	163890	And it's actually not something I normally would have done
164930	168730	because I'm not kind of an RE person necessarily.
168730	169870	Was that a drag-and-drop?
169870	170950	What is...
170950	171730	Drag-and-drop.
171730	173130	Drag-and-drop into...
173130	174290	What is this application over here?
174290	174670	It's just VS Code.
174670	177130	It's just VS Code with a terminal on the bottom.
177130	178070	Oh, okay.
178070	179450	So there...
179450	182110	Although, I think I love the shell.
182110	182970	So I'm guessing...
184050	185550	Because it looked like this was a Mac, right?
185550	189230	So it's a Mac that's got a VM probably that they're actually running their VS Code in.
189230	191010	Because I think the...
191010	192770	So they've got their IDA.
192850	193390	Oh, that was...
193390	196870	Did you notice that it was 7.7, I think, was the version of IDA?
197690	201010	Ooh, is that the most recent one that was leaked or what?
201310	203010	No, no, I'm not going to accuse anyone of that.
203010	206590	I'm just saying it's not the latest actual IDA.
206590	208130	So, like, the analysis might be...
208130	208910	Oh, no, voiceover.
208910	210430	Did they hit too many accessibility keys too quickly?
210430	212250	Is that like sticky keys but on Mac?
212250	213010	I think that's my guess.
213010	214090	I think that's what they got.
214090	217230	Oh, I'm really excited to see a little crack me here.
217230	220030	All right, so they're dumping our source code out.
220190	221770	So, okay, that's a very different approach.
221770	225330	Now let's go ahead and actually look over on the other hand at...
225330	227570	If I can hit the right one here.
227890	231290	We've got Macaroni on the other hand still in IDA, right?
231290	233170	So they're still just kind of statically analyzing this.
233170	234810	Is that an SRAN zero?
234870	237930	I don't think that's how you're supposed to seed your random number generator.
237930	238930	So I had a debate.
238930	242170	I had a debate when I made this challenge of how hard I wanted to make it.
242170	244410	And I originally had an SRAN time on it.
244410	248070	And then I thought, no, let's just make it a little bit easier.
248070	250930	During playtesting, it was like, look, we want this to be solved.
251070	253270	So it's a very not random random.
253690	254490	Interesting.
254510	257530	I mean, it looks like there were 40 iterations of RAN.
257530	260610	So at that point, the seed has been very randomized.
260810	266390	But you are going to get the same order with the same count of items here.
266390	266910	Yeah.
266910	270010	So, yeah, they are going to get sort of a fixed order.
270010	272910	But it's not, like, intuitively obvious from static analysis here.
272910	273750	This is interesting.
273850	277790	To figure out this order, you really want to do that dynamically or just kind of run it.
277790	279970	And either with a breakpoint, like, dump them out.
280050	283490	Or, yeah, so actually over here on the other side.
283490	287170	So HypeBoy, again, the first thing that they did, it's really interesting to me.
287170	287910	They heard CrackMe.
287910	290310	So they immediately decompiled, dumped it to text.
290470	292910	And now they're cleaning it up because they want to actually get this buildable.
292910	293750	There we go.
293750	294390	Really?
294530	295710	This is very clean.
295710	297150	I love the way they're doing this.
297150	300390	So all of the functions are very simple mathematical transformations, right?
300390	301410	You can see it right there.
301410	304210	They've got plus, minus, division, multiplication.
304990	307610	And so they're pulling out the constant.
307610	310890	So the plus and minus are just very large constants.
311330	315770	The division is always a smaller number because otherwise you end up with just, like, zeroing out.
315770	317610	You lose all the bits that were kind of there.
318310	321030	Now, did you make this manually or did you obfuscate it?
321030	322010	I had a generator.
322010	324030	So it's pseudo manually generated.
324030	327570	The version that we're running is not, like, auto-generated each time.
327570	330630	There is one fixed copy that it worked on.
330770	331450	And so, okay.
331450	331990	Oh, actually, hold on.
331990	332850	Back on the other side.
332850	333810	Did we miss it?
335470	336190	Simulation manager.
336190	336670	What's that?
336670	338550	Yeah, I don't know, but I saw that.
338550	338970	Okay.
338970	341570	So, again, there's a couple different ways you can solve this.
341570	344050	You could throw it, like, into a solver, like a Z3.
344050	347110	You could throw it into some sort of, like, you know, I'm here, go here.
347110	352290	And, like, one of the tools, like, auto path finds might be able to actually, like, brute force your paths.
352950	359450	So I'm really curious if we're going to see a mix of, like, so they're looking for a congrats.
359450	362510	Are they going to drive it towards execution of the congratulations?
362510	363090	Yeah.
363090	370590	So, you know, my solution, I just pulled out all the constants, pulled out it all, put it all into Z3, and then, you know, let it go.
370590	371130	Yeah.
371870	372270	But...
372270	375090	Do you think we're going to see Z3 here today or any sort of solver?
375090	376170	We haven't yet.
376170	376210	Okay.
376210	376770	So I'm curious.
376770	378250	And we don't necessarily have to either.
378250	382510	And some of these are, you know, trivially reversible transformations, right?
382510	382730	Right.
382730	386350	And so there's definitely going to be alternate approaches.
386350	388670	I kind of would like to see a different one.
388670	389230	Yeah.
389230	393690	But certainly I know it's at least solvable with the Z3 approach.
393690	404210	So with SRAN, way back in the day, I'm pretty sure the entropy or, like, the state space of RAND was, like, 16 bits or 32 bits or something quite small.
404210	406450	Is this a brutable problem?
407370	409650	Is this a 2 to the 32 sort of thing?
409650	410310	It's not.
410310	415230	And the reason why, I think, is because the thing that's being randomized is the order of the functions.
415230	417230	So the functions each have all these different transformations.
417230	417570	I see.
417570	421110	So the only thing that's going to be random here is, like, we're going to call a function 10 first or 20, you know.
421110	423970	So that order is, like, sort of fixed random.
423970	427570	It's not just obvious in the code what orders can be called because that has involved the random.
427570	430170	But you could, again, with GDB, you can dump that out.
430170	431210	You could rewrite.
431210	432770	Actually, you could recompile it.
432770	433030	Right.
433030	434070	The source decompiles cleanly.
434070	434830	Pull it out.
434890	435690	Rerun it.
435710	436890	And then print out the order before you run it.
436890	439510	And we got Z3 already over here on hackaroni.
439510	440650	So we do have a Z3.
440650	441190	So that's exactly.
441190	442930	And they've got, you know, the array here.
443170	444970	Are we pulling out constants?
444970	447030	Or I wonder what we're looking at in that array.
447030	448130	So we've got the 8, 4.
448130	448570	Okay.
448570	451190	That actually, the array is almost certainly going to be the order of the functions.
451190	451330	Right.
451330	451470	Right.
451470	454110	So they're saying that's the order of the functions called.
454930	455930	And now they're going to.
455930	457330	Are they just going to do this manually?
457610	458170	It looks like it.
458170	458390	No way.
459450	460170	No way.
460170	460630	Listen.
460630	463370	The name of this challenge is actually John Henry.
463530	463990	Okay.
463990	464270	Okay.
464270	466450	And this is sort of like the John Henry was the railroad man.
466450	467730	Like, you know, hammering all day.
467870	468230	Yeah.
468230	470710	And, like, is he going to beat the railroad machine or whatever?
470710	470950	Right.
470950	471970	So this is kind of.
471970	472910	And this is fantastic.
472990	478030	Because I really thought, like, are people going to write some sort of, like, fully automated extraction?
478090	478110	Yeah.
478110	480210	Or are they just going to, like, copy-paste values to pull it out?
480210	481350	This is terrifying to me.
481390	487270	Because Z3 is, and Python in general, is not very generous if you make a mistake.
487270	487970	It's not.
487970	492070	If one of those slashes is not a two slash and it's a one slash.
492070	492230	Exactly.
492230	493850	You lost the whole thing.
493850	497690	And it might take a long time to figure out where that very, very small error is.
497690	498050	Yeah.
498050	499150	And spoiler alert.
499150	500310	Minor spoiler alert.
500310	505290	I believe the second hint on this challenge tells them that, like, UDIV is not the same as div.
505310	508430	If you actually look at the division operations in Z3.
508430	508710	Oh, no.
508710	511610	There is a difference in signed and unsigned division.
511610	517610	Oh, and if you're looking through here, it would be very hard to catch the difference between a uint and an int
517610	520250	when it comes to just popping through an IDA.
520250	521790	Like, right there, that's an int.
522150	524330	Well, and that may or may not be right, too.
524330	529870	Because, again, the division operation that you're going to get, like, it's implicit a lot of the time.
529870	531970	And so, yeah, it doesn't stand out at all.
531970	533330	Oh, that's really tricky.
533330	535530	So, it wasn't an intentional part of it.
535530	536090	Yeah.
536090	538350	But it very well could be.
538350	542110	And we did know that might bite people, which is why I said that is the second hint that's queued up.
542110	542610	Yeah.
542610	544850	Specifically says, like, yo, go look at these things.
544850	546370	Because that's the operation that's going to...
546370	552050	And what we'll see is, if they try to do this in Z3 without the correct division...
552050	552330	Right.
552330	555270	It'll just be, it'll just turn away, unable to satisfy, right?
555270	555570	Okay.
555570	557950	So, it just kind of, like, times out, which is frustrating.
558070	559370	But honestly convenient.
559370	560350	It's better than...
560870	562790	I mean, getting that time out is like, yeah.
562790	563610	Finding a false answer.
564230	567570	Seeing unsat is like, okay, I know that something is wrong.
567570	568470	I have to do something.
568470	568630	Yeah, yeah.
568630	573010	Well, it can also, the other failure case, sometimes it can just, like, turn.
573010	573030	Yeah.
573030	575250	And just spin, and you don't know if you did it wrong.
575650	578690	Hopefully they realize, again, this is a speed competition.
578910	579110	Right.
579110	581170	I didn't give them something that would take 10 minutes to run in Z3.
581170	582010	That's not the design.
582010	582890	So, if you hit that...
582890	583270	Yeah.
583410	584270	Something has gone wrong.
584270	585350	So, hopefully they'll be, like...
585350	586890	The nice thing is, once they get it, they can run it.
586890	586930	Yeah.
586930	588210	And then go off and do other things.
588210	592250	That's one of the really interesting parts about a CTF and using a solver is, like,
592250	595630	if I'm working on something in the wild and I'm bringing in a solver,
595630	597850	I don't really know if it's satisfiable or not.
597850	598230	Absolutely, yeah.
598410	600590	And in a CTF, you know it's going to be satisfiable.
600650	601770	It's going to be solvable.
601770	603970	Or maybe the Z3 is the wrong tool.
603970	605710	But, like, you know there is a solution.
606010	610070	And, again, this particular challenge, these live CTF challenges are meant to be fast.
610070	610790	They're meant to be really...
610790	611370	Right.
611570	615210	So, we want to showcase the sort of traditional, basic, like, archetypal...
615810	616210	Yeah.
616230	616950	...challenges.
616950	619110	So, what would your threshold be?
619110	622190	When you get approached with a challenge like this and you see that there's, like,
622330	624630	a switch statement with a bunch of different functions,
624630	628690	when would you go immediately to automation or some regex or something to process this
628690	632610	versus this very manual approach, which, honestly, I think is very clean
632610	635250	if all the functions are tiny and it's only 20.
635350	638590	But if you get surprised and you get to a later function and it's big,
638590	639750	you might really regret it.
639750	641610	Yeah, 40 of these functions was meant to...
641610	643990	I did it by hand, certainly, but I also had, you know,
643990	646930	the lack of pressure and stress when I was writing my solution.
646930	647810	I wasn't timed.
648210	650930	I designed it so that I thought it would be faster to...
650930	653250	Although, again, I'm a Binja dev, so, of course, in Binja,
653250	654870	it was, like, four lines of Python...
654870	655230	Right.
655230	656650	...to dump out each function and each operation...
656650	658090	Oh, you wrote a script for it.
658090	658950	So, I wrote a script that...
658950	659090	Okay.
659430	661490	...dynamically, like, pulled out all those contents.
661490	664590	Have we seen anyone write a script for Ida or Binja or Ghidra?
664610	665050	No.
665050	665310	Okay.
665310	666610	I don't think we've seen, so far, anyways.
666610	668410	Although, I haven't caught all of the matches that have been doing...
668410	668530	Yeah.
668530	669350	...other things around it.
669350	670450	But, so far...
670450	674710	And I think that's just because most of the people are focusing on the fast...
675990	677050	Yeah, for sure.
677050	680470	It looks like they already have the code extracted in the way that they want.
680470	680610	Yes.
680610	681110	So, now...
681110	681650	They pulled out those...
681650	683990	Because, again, remember, they just dumped the text from Ida...
683990	684090	Right.
684090	686650	...and then copied and pasted, which I think is definitely a faster approach.
686650	686690	Yeah, which is...
686690	690050	Yeah, I definitely think HypeBoy is ahead at this point.
690330	695510	And I like seeing that Macaroni made that transition into using lambdas.
695510	697970	They were doing, like, def, making the full functions...
697970	700070	...and then they're, like, lambda, lambda, lambda, lambda.
700070	700430	Yep.
700470	703150	So, now it looks like we have very similar things on both sides,
703150	706270	except Macaroni is still manually extracting those,
706270	709710	and it looks like HypeBoy is already kind of approaching the problem here.
709710	710990	Yeah, so they've got the big vector.
710990	712310	They know the size of that.
712310	712450	Yep.
712450	716690	They have created this value at the end where they know that there's this final check.
716690	718090	It must be equal to this value.
718090	718430	Yeah.
718430	720830	So, it's definitely on track.
720830	722590	The question is going to be, again, on their division.
722590	726170	So, you notice they're actually doing just a single division here...
726170	726450	Right.
726450	727310	...on their operations.
727310	732590	And this really is going to need to be the UDIV inside.
732590	732610	Right.
732610	736150	If you're going to use E3 on this, which, again, both are so far.
736150	738790	Is there a way that you can set that on the variable and, say,
738790	741690	just make everything unsigned or something on this variable...
741690	741770	That's a good question.
741770	745410	...where you could just do a one-pass change all of them?
745410	748310	Well, I would probably, honestly, do it with a text replacement at this point,
748310	749530	like multi-cursor or something.
749530	749950	Right. Yeah.
749950	753810	Which is an interesting note that that's basically the fact that they did a text replacement.
753810	755770	They took it out of IDA, deleted a bunch of lines...
755770	757610	...and then manually, like, did multi-cursor to replace it.
757610	760570	I think that's a sort of in-between, like, a full-fledged,
760570	762510	I've written a script to fully automate it...
762510	763010	Right.
763010	766950	...or I'm doing it line at a time by copying and pasting the way we're seeing with Macaroni.
766950	769330	Now, are they going to have to go in reverse RAND?
769330	771010	Oh, there we go. We just saw the double division.
771010	771530	Oh, there it is.
771530	772270	So, they did just...
772270	772370	Okay.
772370	774230	They did just... It's closer.
774230	774890	It's now...
774890	775290	Yeah.
775290	778150	It's what Macaroni is, but there's still neither one is going to get the right answer
778150	782610	until they can realize that that's not quite the same division.
782610	783010	So, I was...
783010	783090	Right.
783090	785850	I was afraid this is going to be a sticking point for teams...
785850	785950	Yeah.
785950	788630	...which, again, worst case, they're going to get that hint.
788630	792030	They will get that after 35 minutes into this round.
792030	792410	Right.
792410	794750	They're going to get notice of that.
794970	797630	Huh. That's really tricky.
798390	798830	So...
798830	800450	Oh, no. Wait a minute. This is interesting.
800550	803790	So, it looks like they're commenting out the actual Z3 components now.
803790	804310	Okay.
804310	806090	Are we trying to brute force?
807370	808430	That's a good question.
808430	810810	Brute forcing a 64-bit value is going to be...
811330	812110	Impossible.
812110	813110	...a little tricky. Yeah.
813110	814050	I don't think they have the compute...
814050	815210	Especially in Python.
815210	815730	Yeah.
815730	819650	I don't think a 32-bit is going to be possible with arrays and stuff in Python,
819650	822190	especially with, like, dynamic dispatch of functions.
822190	822790	So, the arrays...
822790	825070	Yeah, the array, look up for your functions.
825090	825270	Yeah.
825330	827650	Well, the function order...
827650	828490	Yeah, yeah, yeah.
828650	831730	What you really should do at that point is just put them all into the same function...
831730	831870	Right.
831870	833270	...not call them as functions and do them...
833270	833510	Right.
833510	834490	...do them straight through.
834490	834830	Yeah.
834830	835390	That would be the...
835390	836530	If you really wanted to brute force it.
836530	839050	So, let's see, though.
839050	840950	Do you know if there are many solutions?
840950	841050	There are.
841050	841650	Like, are there many...
841650	842730	There are multiple solutions.
842730	846470	Because you say it's 64-bit, but what's the actual space?
846470	847370	I don't know.
847370	848290	Actually, that's a great point.
848290	850430	Like, what if there's a very convenient one, very shallow?
850430	851470	It's possible.
851470	854590	And what I simply did was when I tested it, I got a single solution.
854590	855150	I tested it.
855150	855790	It worked.
855850	858590	And then I went and tried a few other ones.
858590	858970	Yeah.
858970	862090	I would, you know, specify not that, not that, just to get a few more.
862090	862550	Right.
862550	866270	So, I know there's more than one, but I never actually characterized and tried to figure it out.
866270	867630	That would be really fun.
867670	871330	So, it is possible that there's maybe a lot of this and actually just random...
871330	872270	I don't think there are.
872270	873050	Okay.
873190	875210	In fact, earlier versions there were.
875210	877410	So, again, remember I mentioned that I tweaked those constants?
877550	877590	Yeah.
877590	880070	So that, like, the plus and minus are just large random constants,
880070	881750	and then there's a much smaller on the division.
881750	884530	Because if you have a very, very large division, you'll end up with, like, zero or one.
884530	886130	Right. Exactly. Yeah. I see.
886130	888710	And then everything on throughout it, you've sort of lost all those bits in there.
888710	892110	So, by having the smaller, less than a byte-sized division...
892110	892470	Yeah.
892470	894990	I think you're keeping most of the bits of entropy up in there,
894990	896750	or at least most of the bits are kind of floating through.
896750	900170	I think it really depends on what ends at the end of that expression
900170	902690	and where everything wraps up.
902690	904750	So, if someone was watching from home right now
904750	907110	and was interested in tackling this problem,
907110	908930	is there a way for them to get those challenges?
908970	909670	Not yet.
909670	910350	Not yet. Okay.
910350	913030	We will be publishing at the end of the competition,
913030	915030	assuming we're still awake and concurrent.
915030	915210	Okay.
915210	918090	We have a GitHub. We'll be putting all of the challenges.
918250	918670	Perfect.
918670	920270	We have thought about trying to do it kind of live
920270	923330	so people can play along as soon as the round ends.
923330	927850	But, you know, even throughout, you know, it wouldn't be a huge deal
927850	930770	because the teams could certainly like remotely connect to another team's box
930770	931510	and pull the binaries off.
931510	932310	It's a secret.
932310	934370	Once the binary is out, the binary is out.
934370	935190	Exactly, yeah.
935190	936410	That would be fun for us.
936410	937290	Okay, here we go.
937290	939130	Crypto.util.number.
939930	940590	Interesting.
940590	943890	I'm very curious about this alternate approach that we're seeing.
943890	947050	So, I haven't had much time to look at the IDA disassembly.
947050	949110	What does the random factor?
949110	951390	And I guess since it's seeded with the same thing,
951390	953450	you always get the same ordering of the functions.
953450	953870	Exactly.
953870	957090	So, what is the controlled value?
957090	960610	Like the scanf that prompted for that LLU.
960610	964150	You were asked to put the very first value in that is multiplied or added,
964150	965850	like that goes through all these transformations.
965850	966910	I see, okay.
966910	968410	So, you give it that single 64-bit value.
968410	968770	Okay.
968770	971010	And then it's going to call function 8, function 4,
971010	972690	whatever the order of the function is.
972830	975290	So, that random is just a very slight option.
975290	978070	And again, this is one of those things where the challenge could have been easier or harder
978070	980350	based on how we tuned that.
980510	982990	But, you know, we could have, for example, like made every five minutes
983230	984410	a different random order.
984410	984950	Yes, yes.
984950	986770	So, you have to get your solution under that time,
986770	989210	and that would sort of hint that you knew it would be solvable in less than that.
989210	989830	Huh.
990130	991990	This is going to be really interesting.
992110	995030	So, switching back over, it looks like, yeah, where are we on macaroni?
995350	996890	They've got their mixture.
996890	997930	We've got Python errors right now.
997930	998630	Oh, no, yeah.
998630	999550	I have seen a couple of...
999550	1000430	Which is not a good sign.
1000430	1001110	What is this?
1001970	1004890	Unsupported operand type for bitvectoref and int.
1004890	1008550	Oh, you're going to need to convert those raw constants, aren't you?
1008550	1009950	No, you shouldn't have to if you...
1010670	1014210	There's like two different bitvector things in Z3,
1014210	1017090	and I think one of them you can just do straight up like Python things,
1017090	1017850	and one you can't.
1017850	1019750	I never remember which is which.
1019870	1023090	The other one is, again, that...
1023090	1024350	What happened here?
1024350	1024790	Oh, yeah.
1024790	1026830	So, again, we're trying to do kind of text replacements.
1026890	1028690	Oh, now we're back to signed division.
1028690	1032390	We're back to floating point division in Python,
1032390	1034310	which is just not even close to right.
1034310	1036230	Is that allowed on Bitvex at all?
1036230	1037250	Do you get an error when you do that?
1037250	1038150	They're going to get that error, yeah.
1038150	1038570	Okay.
1038570	1039990	That's exactly what they're going to run.
1040190	1041290	Oh, it's solving.
1041630	1042290	Is it?
1042290	1043290	Did they actually get that?
1043290	1045030	It said it's solving.
1046950	1047670	I don't...
1047670	1048490	It does say it's solving.
1048490	1048730	Okay.
1048730	1049530	Oh, again.
1049570	1051830	So, if it's working, it's...
1051830	1053530	Again, I don't think they're going to get the right answer.
1053530	1054190	I think it's going to run.
1054190	1056670	I think they're going to run into that situation where it's just going to,
1056670	1059190	like, spin forever because they don't have the right division.
1059210	1060190	I could be wrong.
1060270	1061130	I'm not an expert in Z3.
1061130	1064370	Well, with that SRAN, the functions aren't running 0 through 20 in order,
1064370	1064670	are they?
1064670	1064950	No, they're not.
1064950	1065310	They're not.
1065310	1068350	And it looks like this is kind of assuming that they are?
1068350	1070210	Well, so they have the R at the beginning.
1070210	1072630	Oh, did they run through and get the values?
1072630	1074210	Let's keep an eye out on whether the...
1074210	1074710	Oh, here we go.
1074710	1074890	Hold on.
1074890	1075190	What did they...
1075190	1077110	Oh, they just changed...
1077110	1078410	Oh, so I think they're inverting.
1078410	1078610	Yeah.
1078610	1080810	So, now they're just trying to invert all the operations.
1080810	1082730	And this is something that I didn't actually try,
1082730	1084330	but it might be a valid solution.
1084470	1087690	You may very well literally just be able to, like, invert all the operations.
1088290	1090570	Although, you'll notice they didn't change the order.
1090730	1092370	So, if you're dividing one way, do you multiply...
1092370	1093170	It's actually in my head.
1093170	1093690	Like, does it...
1093690	1094650	Maybe it doesn't matter?
1094650	1095430	Or, like, I forget the...
1095430	1099870	I don't know if it works directly like that, but I'm also not some math genius.
1099870	1101970	Oh, I did just see Macaroni do a really smart thing.
1101970	1103710	Oh, and actually, we just saw the same thing from Hypeboy.
1103850	1105650	Checking the scoreboard.
1105650	1105750	Checking for hints.
1105750	1108290	Because the hints do come in at 20 minutes and ends.
1108290	1110150	I think we're not quite there yet, but we may be close.
1110150	1111190	Very close, yeah.
1111190	1111910	So, that was really...
1111910	1115230	You can tell, I think, in the beginning rounds, teams were still figuring that out.
1115230	1115650	Yeah.
1115730	1120210	It is cool to see that they're remembering that.
1120210	1123150	And, again, if we talk about, like, the hints,
1123150	1124610	the first hint, I don't think we'll tell them anything.
1124610	1128190	It's just kind of more of a generic, like, you know, use the solve or something like that.
1128470	1130450	I forget the exact details of the hint,
1130450	1134750	but that second hint is going to be the one that gives them, like, hey, division's important.
1134750	1135590	Look at UDIV.
1135590	1135910	Right.
1135910	1139930	Because, again, I think that's going to be something that's going to block them.
1139930	1143670	So, that would give them, like, 15 more minutes to solve that before we run into a serious situation.
1143670	1146950	Yeah, now it looks like we're doing some Vim Regex replacement here
1146950	1149990	to, I guess, do some sort of transform on the code.
1150050	1151150	But this is kind of scary.
1151150	1155010	I wonder if there is a saved copy of the original form of these operators.
1155010	1158530	Because if there isn't, are you just relying on your undo buffer?
1158530	1160670	What if you lose those?
1160950	1163630	Because Macaroni did all of these manually.
1163630	1167970	So, if they lose this, that's another 10 minutes of data entry, basically.
1167970	1172790	And I think they opened themselves up to just copy pasta errors or to, like, typos way more than what we saw.
1172790	1173670	That's very dangerous.
1173670	1177870	Especially, like, when you're copying from Ida, you have, like, the C syntax, right?
1177870	1179470	You have the ULL and stuff.
1179470	1182010	So, you have to, like, make sure you're not copying the U.
1182010	1187850	And it's very easy to grab the U, double backspace, remove one digit, and then you're just toast.
1187850	1191110	So, let's see. We're looking into...
1191110	1195630	Okay, so now they're just taking each of the functions.
1196690	1203630	Oh, are they going to transform it so they get the order and they just have everything in order?
1203850	1207790	Because it looks like they're going to try and do some sort of a transform on the code itself.
1211470	1214990	Oh, they're trying to use Python to do the regex.
1214990	1216250	And now you've got two problems, right?
1216250	1216930	Yeah.
1216930	1220590	When you use a regex, now you have two problems.
1220590	1222470	If you think your problem is solved with a regex expression.
1222830	1223830	So, they're changing...
1223830	1227290	This is really scary.
1227430	1232310	Like, when I see this, I see very high chance of risk.
1233170	1233870	Ooh.
1233870	1234970	That's not what they wanted.
1234970	1236250	I don't think that's what they wanted at all.
1236250	1237950	Multiply, minus, plus...
1237950	1240090	Divide. I mean...
1240090	1244350	Oh, wait, hold on. Are they doing a single, like, character right now?
1244490	1246250	That's just...
1246250	1248390	This is an interesting approach.
1248390	1249530	I'm not sure what's going on with that.
1249530	1250550	I'm not sure either.
1250550	1251550	Let's go ahead and take a look back at...
1251550	1252750	Not us.
1252750	1254530	Let's go ahead and take a look back at Hypeware, rather.
1254530	1255110	Alright.
1256090	1256870	Oh, we're in it.
1256870	1258290	Okay, init debugger.
1258350	1259070	Interesting.
1259090	1261210	So, like I said, I kind of expected...
1261210	1263990	I wondered if people were going to pull the debugger to get the array order out.
1263990	1265310	And is this 64-bit?
1265310	1265670	It is.
1265930	1267310	64-bit x86.
1267310	1268310	Yep, exactly.
1268310	1273270	Oh, we're looking at this straight assembly, which is always a sign that maybe you're not confident
1273270	1276610	in the information that you're getting directly from the decompiler.
1276610	1279490	Well, and again, that's actually really wise on that division in particular.
1279490	1279730	Right.
1279730	1281650	Because that might be a way...
1281650	1285550	It jogs your memory, and you don't just think about the abstraction level at the C layer.
1285550	1285590	Exactly, yeah.
1285590	1288030	But you start thinking about what's actually happening.
1288030	1289090	Okay, so where are they breakpointing?
1289090	1291190	They're breakpointing on...
1291190	1292910	Yeah, this is really interesting.
1292910	1298190	I'm kind of surprised no one has a symbolic engine that allows them to just run this very simple main function
1298190	1300150	and just get the symbolic expression.
1300150	1301050	I wondered about that.
1301050	1305270	We did think somebody could just auto-pwn this with the right automation.
1305270	1311450	Yeah, I think it'd be a one-minute solve because I didn't see any modulo operators, so it should be quite easy.
1311450	1312210	Exactly, exactly.
1312230	1315890	And yeah, that's kind of interesting.
1316990	1320490	Do you know how long it takes for Z3 to solve this when you have the right expression?
1320490	1324650	So at least on my hardware, it took, I think, less than a minute.
1324650	1330290	In fact, at one point, I had made it up to 50 functions, and it was starting to take three or four minutes to solve.
1330290	1333610	So I intentionally dropped it back down to 40 because I wanted it to be less than a minute.
1333610	1335550	I wanted it to be fairly clear.
1335590	1340130	I didn't want people guessing, like, well, is it taking too long because I've done something wrong or because...
1340130	1340330	Yeah.
1340390	1345710	So the correct solution should take about a minute to run, which I think is hopefully right.
1345710	1349390	Did you symbolically simplify the expression or mathematically simplify it?
1349390	1353490	No, no, no. I literally just copied and pasted, put in all those constraints, and let it go.
1353490	1354310	Yeah, okay.
1354310	1358710	So there's a chance that someone could probably get it even faster if they reduced...
1358710	1364730	Because right now they're doing this whole lambda function thing, which will be a pretty bloated expression, and I'm sure it reduces down.
1364730	1365050	Oh, yeah, yeah.
1365050	1370010	But that's always a tough thing in C3 is, like, is it faster to do a simplification pass?
1370010	1379130	Or I've had it where, like, doing a couple functions, simplifying, adding a couple more functions, simplifying has been faster than putting the whole thing in.
1379130	1380530	But I've also had the opposite.
1380630	1385390	I'm sure if you've worked a lot more with it, you kind of have a good feel for which way to do that.
1385390	1385810	I have not, ironically.
1385810	1387750	So for me, this was actually one of the very first...
1387750	1394810	I mean, I've done a couple other challenges involving Z3 over the years, but actually partly I wrote this as an excuse to explore this more and to try it out.
1394810	1395250	Yeah.
1395410	1404090	And also because, like, as I said earlier, the goal of a lot of these live CTF challenges are, like, what's the core element behind some of these common challenges that we run into?
1404090	1404490	Yeah.
1404490	1409290	And so I thought, like, just, oh, like a basic crack me where you use Z3, you pull out some formula, and you run it through.
1409290	1415950	And again, knowing that, like, okay, with these transformations, there's probably other approaches, which I think they've both abandoned Z3.
1415970	1419390	It seems to me, like, that neither one is really using a Z3.
1419390	1419830	Yeah.
1419830	1422090	So we're not seeing Z3 at all.
1422090	1422530	Yeah.
1422530	1427810	They're really actually just trying to, like, do the bit shifting and inversion.
1427810	1428230	Right.
1428230	1430490	Which quite possibly worked.
1430490	1431190	You haven't tried it.
1431190	1431850	I haven't tried it.
1431850	1433070	So it might run, it might not.
1433070	1433190	Yeah.
1433190	1434530	There may be other reasons why it wouldn't.
1434530	1436290	That could be quite difficult.
1436290	1441510	I think it really depends on, like, how these operators overflow and everything.
1441510	1442610	I don't necessarily know.
1442610	1444870	Making sure that you model things the same way.
1444870	1445630	Yes.
1445630	1445830	Exactly.
1445830	1446530	Yeah.
1447310	1448030	Huh.
1448030	1450610	So I am going to be very curious.
1450990	1451790	What do we have over here?
1451790	1455750	Why do we have multiple things on Hype Boy?
1455750	1459530	So base is not invertible for the given modulus.
1459530	1462170	So whatever inversion function they're trying to do.
1462370	1463410	Wow.
1464850	1465590	That's interesting.
1465590	1466550	I've never actually seen that.
1466550	1471270	Apparently the Cryptolibrary has, like, an inversion where you can say just invert this math operation.
1471350	1471830	Yeah.
1472470	1473130	Or, no, no, no.
1473130	1474250	Is that bit inversion?
1474550	1477730	I'm not sure what that inverse function is, actually.
1478050	1478410	Right.
1478410	1479550	I'll definitely be looking that one up.
1479550	1480750	I see the shift in mask.
1480750	1483870	It looks like it's trying to make sure that those are 64-bit values.
1483870	1484070	Right.
1484070	1486270	But shouldn't Bitvex handle that for you?
1486270	1487710	Again, they're not using Bitvex at all, right?
1487710	1490470	They've switched over to a pure, like, basic math.
1490470	1492970	Which, again, might be possible.
1492970	1494070	I just don't know.
1494070	1499870	If I were to ever approach a bit problem, I would never use Python for it when it comes to this.
1499870	1500550	It's not well-studied.
1500550	1500630	Right.
1500630	1501670	It really isn't.
1501670	1502070	Yeah.
1503690	1505690	But it's hard to switch over.
1506170	1506830	Yes.
1506910	1510750	And it's really fascinating to me, too, that both of them started with a solver.
1510750	1513230	Both of them just decided to bail on it when they're like, wait a minute.
1513230	1514870	The solver is not the right approach.
1514870	1516510	But it still could be.
1516510	1516750	Yeah.
1516750	1518070	Again, it is absolutely doable.
1518070	1521690	So they're going to get that hint at 35 minutes to use a solver.
1521690	1526950	Well, they're going to get the hints that's going to tell them to particularly use Z3's UDIF.
1526950	1530250	In fact, actually, I'm going to go put the mic down, and I'm going to go ask what the hint is,
1530250	1531770	because I don't remember what it was.
1531770	1532270	All right.
1532270	1533990	I'll come back, and I'll let everybody know.
1534010	1534810	Sounds good.
1534810	1535390	Yeah.
1536610	1537350	All right.
1537350	1537890	Yeah.
1538270	1543090	Hypeboy's really got kind of all of this weird bit operation going on.
1543090	1549030	They're trying to mask everything down to get to that, you know, 64-bit bitwise operations,
1549030	1553230	which in the big space of Python, it's kind of hard to get that.
1553730	1554930	Did you get our info?
1554930	1556410	I did indeed confirm.
1556410	1557030	All right.
1557030	1560490	As I thought, it specifically says use Z3 UDIF.
1560490	1562010	So it's pretty, like, clear.
1563790	1567270	But again, they might not be wrong.
1567270	1569510	I'm not going to say this isn't solvable this way.
1569510	1574630	I just feel like there's a lot of, like, easy ways to mess it up and to try to get your exact...
1574630	1575390	Yeah.
1575810	1576830	It's interesting.
1576830	1577630	What was that over there?
1577630	1580750	Oh, we've got on macaroni.
1581690	1582110	Yeah.
1582110	1583810	We have the list of all the functions.
1583950	1585310	We apply the...
1585310	1590550	They're applying the transform onto those functions to, I guess, order them in the right way.
1590550	1592370	But we have two F13s, I just noticed.
1592370	1593110	I don't know what they were...
1593110	1594390	They, like, duplicated it.
1594390	1594930	Oh, 14.
1594930	1595130	Were they...
1595130	1595850	Oh, no.
1595850	1597150	Did they add them all by one again?
1597150	1597990	Oh, no.
1597990	1599750	The copy pasta risk is real.
1600010	1600730	Yeah.
1600990	1603090	Because, yeah, X over 49.
1603090	1606670	So they did a little bit of macro to, like, to increase the digit.
1606670	1607890	Is that control A or something?
1607890	1608470	I forget the exact...
1608470	1612630	There's a key to, like, literally increase the number that I'm currently selected is a hot key in there.
1612630	1613170	Yeah.
1613170	1614650	And then they macro'd that.
1614970	1615330	So, again...
1615330	1618030	And then they're going to go manually fix up this.
1618030	1619730	And that's...
1619730	1621430	Was that 13 or 14?
1621430	1622710	This is really scary.
1622710	1624130	But they're back to bit back.
1624130	1625630	So we are seeing...
1625630	1625690	Yeah.
1625690	1627830	And they added F40 to it.
1627830	1630810	So it really comes down to if they have these expressions right.
1630810	1633290	And I don't think they do with the single div.
1633750	1634070	Yeah.
1634130	1635010	That's what they're going to run to.
1635010	1638330	But the good news is, then, if they do get that hint and kind of come back to it...
1638330	1638610	Yeah.
1638610	1641930	They might be better prepared for it than the approach we're seeing from BitBoy.
1641930	1647170	I think that the timing of when that hint comes in could be a really, really big deciding factor.
1647170	1648010	And it's like any minute now.
1648010	1648390	The first hint's gone out.
1648390	1650510	But, again, the first hint wasn't very useful.
1650510	1651190	I don't even...
1651190	1652890	Was it 20 minutes and 35 minutes?
1652890	1654150	20 minutes and 35 minutes.
1654150	1654450	Okay.
1654450	1659390	So we've still got another maybe 10 minutes, I think, before, give or take, before the next hint goes out.
1659570	1660290	Oof.
1660610	1663170	It was about five minutes ago that we saw the first hint go.
1663170	1663770	Yeah.
1663770	1666490	They could definitely do it.
1666490	1670950	And I am glad that, you know, in our playtesting, like I said, this division bit us as well.
1670950	1674130	So we at least knew that was going to be a gotcha.
1674130	1676630	I know where Macaroni is in their headspace right now.
1676630	1677890	I see exactly what's going on.
1677890	1682470	They're looking at, around this F13 through 15, they're looking at Ida.
1682650	1687410	They're concerned that they have something wrong.
1687530	1688430	And it's just...
1688430	1690290	Oh, hey, they're going to use dog bolts.
1690290	1690690	Yeah.
1690690	1691930	So they want a second opinion, too.
1691930	1692230	Right.
1692230	1693890	And this is, I mean, this is terrifying.
1694270	1700690	It's basically like, is it time to just give up and just basically try from scratch with a new approach?
1700690	1706450	Or do you go and you try and manually verify that you have the right implementations of these operations?
1706450	1708250	And I don't know.
1708250	1710130	That's really, really, really tough.
1710390	1715150	Especially in a speed competition, right, where like literally every second kind of counts and you're just nervous.
1715150	1717410	Are we going to see a script by any chance?
1717450	1718870	Oh, a database snapshot.
1718870	1719530	Nice.
1719530	1720170	Okay.
1720970	1721550	Decompiler Explorer.
1721550	1722790	It's just dogbolt.org.
1722790	1723670	It's all you got to do.
1723730	1726670	I stole that name from somebody else on Twitter when we created this.
1726670	1730010	So this is actually a joint project from a couple of folks.
1730010	1734770	So Ilfax from Hexrays and Vector35, makers of Binary Ninja, we both pay for the hosting.
1734830	1737550	And Vector35, we wrote most of the actual interface.
1737870	1740090	Some of the Angular folks have some code that are part of it, too.
1740330	1740810	OpenAI?
1740950	1743010	Did I see a chat GPT?
1743010	1743650	We are seeing a chat GPT.
1743650	1743770	Wow.
1743770	1746290	They almost did it quickly, like they were embarrassed, though, to show it.
1746290	1752890	Can you rewrite those functions?
1754090	1754370	Okay.
1754370	1757450	So they're going to use this as a smarter text replacement, maybe?
1758030	1758690	I'm curious.
1758690	1760490	I am kind of excited.
1760490	1767990	Now, would you trust the result of chat GPT to the level of a solver being able to reason about it?
1767990	1775170	I think if all they're going to ask it to do is to do a bunch of formatting and to paste in a bunch of output, I feel like that's a fair thing.
1775170	1780090	Fun note, by the way, the binary ninja that's running a dog bolt is not the latest dev version.
1780190	1784870	So it actually, I think on these operations it's all fine, but for some of the...
1784870	1786310	Oh, and Anger and Ghidorah are still...
1786830	1787710	They'll get there.
1787710	1788550	They'll come through.
1788550	1790450	How big would you say this binary was?
1790450	1791750	Oh, it's not very large.
1791750	1796030	I could pull it up separately, but it's not super big.
1796230	1799490	In fact, usually IDA comes back faster on Decompiler Explorer.
1799490	1801550	In this particular one, it's...
1801550	1802750	Let's see.
1803230	1804290	No way.
1804290	1805650	That looks very good.
1805650	1807770	Your text processing, again...
1807770	1808410	That looks...
1808410	1809450	It's not terrible.
1809450	1810690	Very good.
1811270	1812330	No way.
1812330	1816170	Yeah, but I think it's good for that.
1817230	1818650	I mean, that...
1818650	1819510	That's pretty good.
1819510	1822250	I didn't really see anything that looked off in there.
1822250	1824350	But the problem is you don't know.
1824350	1824970	Yeah.
1825310	1827390	Oh, did they have to teach you about division?
1827390	1828410	Oh, no.
1828410	1830450	Oh, no.
1831270	1832590	Oh, no.
1832590	1833390	Everyone's like...
1833850	1834250	Macaroni.
1834250	1834770	No.
1835390	1837870	Poking around the same thing.
1839170	1842350	And they have F40, which shouldn't be in there.
1842450	1843150	It's not.
1843150	1844310	There is no F40.
1844310	1847870	Yeah, so there are only 40 total functions starting at function 0 to function 39.
1848170	1850790	Now, are they going to go and just change it to a double div?
1850790	1851570	What's the order, though?
1851570	1852010	Hold on.
1852010	1852530	Oh, no.
1852530	1853010	Okay, no.
1853070	1854430	They're doing the transform.
1854430	1855410	They do look up their array.
1855410	1857630	I think the way they do this is pretty good.
1857630	1858110	That part's fine.
1858110	1858470	Right.
1858470	1858550	Absolutely.
1858550	1862610	Do you think if they had the double div operator, this is just already basically solved?
1862610	1863430	No, no, no.
1863430	1867010	Because, again, the double div is still signed, I think.
1867010	1869310	Can you write the inverse of those functions?
1871810	1872950	I don't... yeah.
1872950	1876630	See, now, at a certain point, you're going a step too far.
1876630	1877230	Right.
1877330	1878590	It's going to start hallucinating on you.
1878590	1880070	I don't know if this is it or not.
1880090	1883070	Oh, and you notice their solver just said something about a stat in the background.
1883070	1884750	So that, actually, I'm a big fan of.
1884750	1889690	If they're running a different copy of the script with the solver while they go out and try to do the inversion, that's good for them.
1889690	1891330	Two different approaches at the same time.
1891390	1892410	That's a good way to go.
1892410	1893370	Great use of time.
1893370	1895410	Hard to keep both that in your head, but...
1895410	1897830	Yes, and make sure you don't invert one thing from the other.
1897830	1899790	Are those the inverse?
1901470	1907770	Or did it just do a dumb inversion where it did a negation or something?
1908130	1911890	And what are they going to... oh, they're doing all... so here's their division.
1911890	1913470	They're going to get rid of their division again.
1913590	1915170	But, again, that's not quite what they want.
1915170	1918750	But they're going to be well situated when that thing comes through.
1918750	1921170	And HypeBoy just checked on that hint.
1921170	1923850	And just as a... okay, so they're still looking for the hint.
1923850	1926790	They know it's not too far out, but we do have a few more minutes.
1926850	1929970	Let's actually go ahead and follow up with what HypeBoy's been doing to catch up with them.
1929970	1932390	Because I still see... I don't think they're... yeah, still no Z3.
1932470	1934890	All their Z3 solver stuff is still coming out.
1934890	1940630	So they're still leaning into that inversion approach of really just trying to invert the operations.
1940630	1941030	Right.
1941030	1942050	To see if they can get that value.
1942050	1946010	And I guess the goal is to just run through and just run it through backwards?
1946070	1947250	Yeah, you'll just get a constant out.
1947250	1951150	If you could perfectly model the inverse of those operations, yeah, that would happen.
1951150	1954170	It's just... yeah, just tricky to do.
1954170	1956590	And there's a lot of ways to get that wrong.
1957470	1958270	So we'll see.
1958270	1960210	And with the Z3, there's basically only one way to get it wrong.
1960210	1961390	And it's literally just the division.
1961390	1962790	It's just the division that makes it tricky.
1962790	1966390	I see the double division went back in over on macaroni.
1966390	1968410	So did they get an unsat?
1968410	1969930	So we've got a... yeah, sat assertion error.
1969930	1972130	Okay, so they know that it was unsat.
1972310	1972970	Okay.
1972970	1975090	And then they're changing it again with the double division.
1975090	1978950	So again, I'm actually... did they miss a zero when they copied that?
1979950	1981850	It was on which side of it was it?
1982050	1985630	Is that highlighted all the way to the other zero on macaroni?
1985630	1986690	Zero, zero, L, L.
1988010	1990010	Also, let's see.
1990010	1991710	Where is their final comparison?
1991950	1994230	So the array... order the arrays.
1996490	1998590	Unlocking in 227 seconds.
1998590	2000010	Oh, I didn't even notice that before.
2000010	2000490	It does give them the...
2000490	2000970	Yeah, yeah.
2000970	2001890	That's great.
2001890	2002690	It does let them know...
2002690	2003650	I think I saw Glenn...
2003650	2004850	They do have the right value.
2004850	2005350	Okay.
2005350	2007370	So the value is correct at 100 at the end.
2007810	2008450	Interesting.
2009170	2010670	They really need those double divisions.
2010670	2014750	For context, when I wrote this, I literally just had a debug version of it.
2014750	2016950	I put in the input value I wanted to be the answer,
2016950	2018670	and then I just checked the value at the end,
2018670	2020170	and then I hard-coded it back in and recompiled it, right?
2020170	2020570	Yeah.
2020570	2022270	So it's really easy to find the solution.
2022270	2024050	Now, I did still have to write the Z-theory.
2024050	2025090	I did still have to prove it was solvable,
2025090	2027510	and that's also how I could find over multiple solutions,
2027510	2031110	but it's kind of easy on a forward operation.
2031110	2031430	Okay, hold on.
2031430	2031850	What are we doing here?
2031850	2032730	Out equals...
2032730	2033590	Zmod.
2033810	2034450	Zmod.
2035250	2035950	Oh, no.
2036650	2037570	Yeah, okay.
2037570	2040050	So they're essentially doing now what we saw before.
2040050	2041930	They're trying to constrain.
2041990	2043210	We're going to use SageMath.
2043730	2044430	Really?
2044430	2047570	So are they going to do the sort of inversion approach that we've seen?
2047570	2048290	Yeah.
2048410	2052230	But they're going to use Sage to try to do these inversions
2052230	2055890	and try to model the way that the opcodes are going to behave,
2055890	2057510	but invert them.
2057590	2058090	Right.
2058870	2062590	Yeah, so I was a little skeptical of some of these inversion attempts,
2062590	2064350	but I actually really like that...
2064350	2065930	Inverse of that doesn't exist.
2065930	2070550	I really like the HypeBoy approach here where they're still got their solvers kind of running.
2070550	2070570	Right.
2070570	2077390	So run a solver, but then let it go and see if you get an answer while you go off and try other things.
2077390	2078830	Was that HypeBoy or Macaroni?
2078830	2079670	I'm sorry, thank you.
2079710	2080430	Macaroni.
2080730	2081090	Yeah.
2081230	2084650	HypeBoy still seems that we can double check on them over there.
2085010	2086510	They have a whole new Python script?
2086530	2087850	They're back to Z3.
2087870	2088550	Hold on, did they?
2088550	2088610	Yeah.
2088610	2090130	Okay, they didn't see the hint yet, though.
2090130	2092390	So how do you do the unsigned divide in Z3?
2092390	2093590	It's just a function called UDIV.
2093590	2095910	It's literally a built-in operation called UDIV.
2095910	2098790	Which is why we tell them the exact function name in that hint.
2098790	2099110	Right.
2099110	2102390	Because I think that will be the last stumbling block that either one can do.
2102390	2104290	The other thing is I'm keeping an eye on our alerts.
2104290	2105830	I don't think I've seen the others.
2105830	2113170	So remember, as a reminder to our viewers, you can go over to the other streams and you can watch the two other players that have been doing this.
2113170	2115950	So we've got Maple Mallards and Straw Hats.
2116070	2116930	And I haven't seen the alerts.
2116930	2117530	They're still working away.
2117530	2119250	I think they're still working away as well.
2119250	2122550	So my bet is I really wasn't trying to troll everyone.
2122570	2124030	It's kind of interesting.
2124030	2128890	I've used Z3 for one time, and it was for a MapleStory hacking thing.
2128890	2130290	It's a long story.
2130750	2132810	It's a long MapleStory, maybe?
2133270	2134130	Gosh.
2134170	2134330	Sorry.
2136930	2141990	And I've already had it drilled into me to make sure that I'm doing the right div operator.
2142090	2143070	And I've used it once.
2143070	2147850	So you would think that people who have done this a lot would probably immediately be going to that.
2147850	2153570	Now, maybe it's because they saw int64 and IDA or something, and they're just taking that.
2153570	2154570	Immediately jump from there.
2154570	2156210	Yeah, that's entirely possible.
2156450	2158750	Yeah, that's really tricky.
2158810	2162230	Is it all of the functions are unsigned, or is it just one of them is unsigned?
2162230	2165290	Because if you did that, that's just rude.
2165990	2169150	So the values themselves are all unsigned values.
2169150	2170950	And in source, you don't differentiate.
2170950	2172530	You just div, multiply, whatever.
2172530	2176610	And it just happens to be if you have unsigned values, it's going to be an unsigned div.
2176610	2182270	But again, in decompilation, you just see division, multiplication, and subtraction.
2182710	2184510	Does Binja differentiate those?
2184510	2187230	Binja does actually show you in high-level IL.
2187590	2189290	It does U slash or whatever?
2189290	2190070	It can do U, yeah.
2190070	2196690	So Binja will actually tell you if it knows the operation signedness of your comparison or whatever it is, which is not valid C.
2196690	2203090	It's one of our arguments about why ILs are better than just pseudo C or C output, because you can actually do hinting as to what type of thing it is.
2203090	2204470	To me, that's mandatory.
2204470	2210590	Whenever I have printed out any of my ILs, it's always on all of the operations that are signed or unsigned.
2210590	2211610	It is explicit.
2211610	2212970	S or U.
2212970	2215090	It's just so important.
2215090	2217470	It's the difference of having a no day and not.
2217470	2222570	Or in this case, spending an extra 15, 20 minutes getting your solver to work.
2222570	2223670	Okay, actually, let's go back.
2223670	2226750	We've got... I'm seeing in HypeBoy, we now...
2226750	2227990	Oh, is that it?
2227990	2229330	They've got a V4.
2229430	2230710	Hold on, hold on.
2231110	2231630	They're running it.
2231630	2232290	They've got a value.
2232290	2233370	Okay, yeah, yeah, they've got a value.
2233370	2234350	They're running it.
2234650	2235390	Oh, no.
2235770	2236370	Now, let's see.
2236370	2237470	Are they checking the input?
2237470	2238570	Does it check?
2238570	2240010	Are they doing the inversion thing?
2240010	2240930	Well, they're putting it...
2240930	2242090	What format is the input?
2242090	2243810	Is it hexadecimal or is it...
2243810	2247850	It was LLU, so it should be an unsigned 64-bit int.
2247910	2249910	That actually tricked someone up yesterday.
2249910	2252070	For about 20 or 25 minutes...
2252070	2252590	Oh, no.
2252590	2256470	...one of the teams, I think, didn't know that it was hex.
2256470	2257230	Yeah, yeah, yeah.
2257790	2258190	And...
2258190	2258970	I don't see...
2258970	2260370	They haven't checked the...
2260870	2263430	Okay, so then copy-paste errors.
2264370	2265990	Okay, now, are they going to check that scan out?
2265990	2266630	Please go check...
2266630	2267270	Yes, no, no, no.
2267330	2268570	Go check the scan out.
2268810	2270030	Go look for that input.
2270090	2271090	It was LLU.
2271090	2272230	I do remember that.
2272630	2273070	Okay, so...
2273070	2274610	That was, like, the very first thing that I picked out.
2274610	2275550	You didn't notice this one was LLU.
2275550	2277630	I should remember, but I wrote this two weeks ago,
2277630	2278850	so, like, I don't even remember my own...
2278850	2280170	Yeah, that was, like, the first thing...
2280170	2281030	I actually switched it back and forth.
2281030	2283390	A couple times, I was doing hexadecimal.
2283390	2284170	A couple times, I was doing...
2284170	2284490	Yeah.
2285470	2286510	...doing integer values.
2287430	2287810	CPyNamespace.
2287890	2288450	Okay.
2288450	2289450	So, they should have...
2292270	2293210	Oh, fantastic.
2293290	2294510	Okay, so I just got a little introduction.
2294510	2295510	Was that a love letter?
2295550	2296250	It was.
2296250	2297030	They're telling me how much...
2297030	2298770	No, they're telling me that Straw Hat won.
2298770	2301470	So, Straw Hat has beaten Maple Mallard...
2301470	2301670	Okay.
2301670	2302430	...in our uncasted one.
2302430	2303890	So, if you were watching that stream,
2303890	2304630	and you've joined us now,
2304630	2305590	you may have already seen the end of it.
2305590	2306010	Wow.
2306010	2308270	Straw Hat won their version,
2308270	2309410	and they, again, got a different number
2309410	2310470	than the expected solution,
2310470	2311490	but I'm not at all surprised.
2311870	2312350	Z3UDIV.
2312730	2313310	Okay.
2313310	2314370	He finally popped it up.
2314470	2315370	Oh, and UDIV is not defined.
2315370	2316590	We are seeing it on both of them.
2316590	2316810	Yep.
2316810	2317390	We're seeing...
2317390	2318970	Okay, so both have the hints.
2319190	2319570	Yeah.
2319570	2320870	This should be it.
2320870	2321410	Honestly?
2321410	2323670	So, at this point, it's a race to see...
2323670	2323890	I...
2323890	2324890	...who can fix their implementation.
2324890	2326650	I'm putting my money on Macaroni,
2326650	2329070	because if they go back to chat GPT
2329070	2330190	to do that transform,
2330190	2331210	to do the UDIV,
2331210	2332730	they're going to get the result very fast.
2332730	2332930	There's always complications, though.
2332930	2333110	Watch.
2333110	2333850	They're just doing a...
2333850	2334270	Manual.
2334270	2335390	...event macro,
2335390	2336050	and they're doing it,
2336050	2337090	and they're almost done.
2337090	2338450	It's kind of interesting that we've...
2338450	2338990	Uh-oh, uh-oh.
2339770	2340330	We've got a...
2340330	2340870	Oh, here it is.
2340870	2341110	Here it is.
2341110	2341470	Hypoidoh.
2341510	2343030	Hypoidoh is coming through.
2343030	2344210	They've got a value.
2344210	2344990	They've got a value.
2344990	2346070	It shows correct.
2346070	2347030	And now they just have to...
2347750	2348630	Get it in there.
2348630	2349390	Submitter 12.
2349530	2350130	They've got it.
2350130	2350790	I think they've got it.
2350790	2351410	Here it is.
2351410	2352930	And that's going to be...
2352930	2353650	That is it.
2353650	2354570	That is it.
2354850	2355090	Congratulations.
2355090	2355670	Oh, no.
2355670	2357390	And we just had one so close.
2358010	2359210	Macaroni was just behind it.
2359210	2360290	That hit was exactly...
2360290	2360630	Yeah.
2360630	2361170	...all they needed.
2361410	2361570	Wow.
2361570	2362950	That was so close.
2362950	2365410	We thought that might do it, sure enough.
2365410	2367870	It was kind of crazy that Macaroni
2368250	2372210	did the manual copy-pasting from IDA initially,
2372210	2376090	but also used the most automated chat GPT approach.
2376130	2376170	Chat GPT.
2376170	2377330	So it was just two complete...
2378130	2378810	Ends of the spectrum.
2378810	2379230	Yeah.
2379230	2379830	Yeah, yeah, yeah.
2379830	2380550	We saw both.
2380550	2381050	But that was...
2381050	2381170	Oh.
2381170	2382450	Yeah, and it was exactly the hit.
2382450	2383170	It was the UDIF.
2383170	2384030	They just needed the UDIF.
2384030	2384150	No way.
2384150	2386710	They both got it within just seconds of each other.
2386710	2386970	Wow.
2386970	2388670	It is interesting, though, to note that I think,
2388670	2390730	as we saw, Straw Hat actually won theirs.
2390730	2392110	Before, I think that hit may have come out.
2392110	2393310	That hit just came out.
2393310	2393690	Yeah.
2393690	2395630	They all fixed it and were able to solve it.
2395630	2397310	But I'm going to go back and watch the VOD now
2397310	2398330	and see what Straw Hat did.
2398330	2398850	Right.
2398850	2400850	Because I think their solution may not even
2400850	2402610	have been exactly the same.
2402870	2405770	Honestly, I think, in my head, one of the approaches
2405770	2408790	that maybe would have come up to me is just
2408790	2410870	randomly try both signed and unsigned.
2410870	2413330	Like, make a generic function.
2413330	2413570	Right.
2413570	2414630	Because how many divs were there?
2414630	2415170	Five?
2415250	2415870	What is that?
2415870	2418390	Two to the five different combos and just try
2418390	2419670	all possible combos.
2419670	2421050	And you know it's at least the same one for each
2421050	2421710	of your divisions, right?
2421710	2421910	Right.
2421910	2422930	So you don't have to, like, do it.
2422930	2424490	You can just do it five times, essentially,
2424490	2425770	which makes it a lot easier.
2425770	2426090	Yeah.
2426190	2427490	So, ah, that was fantastic.
2427490	2427730	All right.
2427730	2429250	Well, I'm excited because we haven't had to use
2429250	2430650	another sudden death, which is always good.
2430650	2431230	Yeah.
2431310	2432330	We had a good round.
2432330	2434330	Everyone, we've got two victors.
2434410	2436870	Congratulations to Hypeboy and to Straw Hat
2436870	2437790	for their wins.
2437850	2441030	But, honestly, Macaroni and PPP that lost,
2441030	2442990	they're playing into the lower bracket now.
2442990	2444490	They can still be back in the finals.
2444490	2444990	For sure.
2445030	2445950	Yeah, absolutely.
2445990	2447370	Now, I don't want to put you on the spot,
2447370	2449190	but who do we have coming up next?
2449310	2450570	Ah, let me pull up that.
2450570	2452650	I've got the chart right here.
2452650	2453950	So, actually, we can, I think we could,
2453950	2455770	well, I won't do the bracket on stream.
2456250	2458250	Next up, we're going to do a couple more
2458250	2459390	from the lower bracket, actually.
2459390	2459630	Okay.
2459630	2462390	So, I think we're going to pull in,
2462810	2464690	the next two are going to be,
2464690	2467130	actually, the two from this that lost
2467130	2468250	are going to be right back around.
2468250	2468990	So, they're going to be coming in
2468990	2470470	for Macaroni versus Shellfish.
2470470	2470810	Okay.
2470810	2472990	And Maple Mallard versus Norse Code.
2473150	2473710	All right.
2473710	2476030	So, again, even those lower bracket matches
2476030	2478450	are going to be fierce and great competitors.
2478450	2480030	Perfect. Sounds good.
2480030	2480890	Awesome. Look forward to it.
2480890	2482010	Thanks, everybody, for joining us.
2482010	2484490	We'll see you just in about 15 minutes
2484490	2486210	as we reset, get the new teams in here,
2486210	2486970	and we'll be back.
2486970	2487490	Cheers.
2487490	2488110	Take care.
2494420	2495820	♪♪♪