[00:11.390 --> 00:15.470] Hello, everybody, and welcome back. It is Jordan, CipherTex, and... [00:15.910 --> 00:16.530] Gamozo! [00:16.530 --> 00:19.330] We're here! Okay, so we have another round of live CTF. [00:19.430 --> 00:22.230] Neither one of us has been back today yet. [00:22.230 --> 00:24.290] This is our first stream of the day. [00:24.290 --> 00:28.010] I love that we've got a lot of new casters who've been joining us. [00:28.010 --> 00:30.530] We're preparing for a new round. [00:30.610 --> 00:33.610] They're doing the introduction kind of behind us. [00:33.830 --> 00:38.430] We've got, actually, we can see on their screens as we're looking at them, [00:38.430 --> 00:40.010] four teams ready for this match. [00:40.010 --> 00:42.330] We are going to be casting Macaroni... [00:42.330 --> 00:44.670] Do you say M-Hackaroni or Macaroni? [00:44.670 --> 00:46.270] I'm going to say Macaroni. [00:46.270 --> 00:46.810] Macaroni? [00:46.930 --> 00:48.350] Just because I love it. [00:48.350 --> 00:49.130] I think it sounds better. [00:49.130 --> 00:49.770] Yeah. [00:49.770 --> 00:51.230] I always thought it was M-Hackaroni, [00:51.230 --> 00:53.090] and then I finally heard somebody say Macaroni. [00:53.090 --> 00:53.150] Macaroni? [00:53.150 --> 00:55.110] Oh, no, no, that's way better. [00:55.210 --> 00:56.490] Macaroni and Hypeboy. [00:56.670 --> 00:58.830] We're going to see on this stream. [00:58.910 --> 01:01.430] But we also have Maple Mallard Magistrates, [01:01.430 --> 01:03.090] the other name of PPP, [01:03.570 --> 01:05.930] and Straw Hat in the non-cast. [01:05.930 --> 01:07.010] We're not commenting on them, [01:07.010 --> 01:09.990] but you can see their feeds as well in our alternate streams. [01:09.990 --> 01:12.950] So who's been crushing it so far on the brackets? [01:12.950 --> 01:16.730] I mean, in general, all of these teams are in the winner's bracket. [01:16.730 --> 01:20.210] So every team we're casting right now has never lost. [01:20.310 --> 01:22.150] This is the undefeated bracket. [01:22.890 --> 01:24.590] So this is a great one. [01:24.590 --> 01:26.770] So we're going to see some very quick matches. [01:26.770 --> 01:27.430] I think so. [01:27.450 --> 01:30.530] Hypeboy has just been destroying it so far. [01:30.570 --> 01:32.090] They may have sent up somebody different, though. [01:32.090 --> 01:33.930] Because one thing that's different is this is the first challenge [01:33.930 --> 01:35.710] that we told them was not opponable. [01:35.810 --> 01:37.290] This one is actually more... [01:37.290 --> 01:38.290] We told them it was a Crack Me, [01:38.290 --> 01:40.150] so more reverse engineering Crack Me style challenge. [01:40.150 --> 01:40.710] Oh, all right. [01:40.710 --> 01:42.270] So I might see some IDA today. [01:42.610 --> 01:44.610] Wait, Binary Ninja, I'm sorry. [01:44.610 --> 01:45.950] You know what? I wish that were true. [01:46.150 --> 01:48.610] However, we've actually only seen them. [01:48.610 --> 01:49.290] All right. [01:49.690 --> 01:51.390] Are we about ready for the countdown? [01:51.390 --> 01:53.150] So it looks like we're about ready to go live. [01:53.150 --> 01:55.290] So let's go ahead and let our... [01:55.830 --> 01:57.470] We're going to count it in. [01:58.430 --> 02:02.630] Five, four, three, two, one. [02:02.630 --> 02:03.570] Let's go. [02:03.570 --> 02:04.130] All right. [02:04.130 --> 02:08.230] So we're going to see both teams hop on in and get going. [02:08.910 --> 02:10.410] Who do you want to go with first? [02:10.930 --> 02:12.690] Ah, this is really tough to say. [02:12.690 --> 02:14.050] No Binja that we can pick from? [02:14.050 --> 02:14.130] I know. [02:14.130 --> 02:15.270] Because that would have been the first pick. [02:15.270 --> 02:16.010] That would have been the obvious one. [02:16.010 --> 02:17.190] Let's go ahead and go to Hypeboy first, [02:17.190 --> 02:20.130] because Hypeboy has been just the fastest. [02:20.130 --> 02:23.390] The matches they've won have been incredibly fast so far. [02:23.390 --> 02:24.150] So I've been very impressed. [02:24.150 --> 02:27.070] Although, again, I don't know if they're going to send somebody different [02:27.590 --> 02:29.630] if it's not the same person who's doing punnables. [02:29.630 --> 02:32.250] Now, did you know that every single time I've cast this, [02:32.250 --> 02:33.470] it's gone to sudden death? [02:33.470 --> 02:33.950] Oh, no. [02:33.950 --> 02:34.790] Are you cursed? [02:34.930 --> 02:36.970] Did you curse my challenge? [02:36.970 --> 02:39.330] So, yeah, for full disclosure, this is my challenge. [02:39.330 --> 02:40.770] This is one of the ones I wrote. [02:41.150 --> 02:43.890] And it's actually not something I normally would have done [02:44.930 --> 02:48.730] because I'm not kind of an RE person necessarily. [02:48.730 --> 02:49.870] Was that a drag-and-drop? [02:49.870 --> 02:50.950] What is... [02:50.950 --> 02:51.730] Drag-and-drop. [02:51.730 --> 02:53.130] Drag-and-drop into... [02:53.130 --> 02:54.290] What is this application over here? [02:54.290 --> 02:54.670] It's just VS Code. [02:54.670 --> 02:57.130] It's just VS Code with a terminal on the bottom. [02:57.130 --> 02:58.070] Oh, okay. [02:58.070 --> 02:59.450] So there... [02:59.450 --> 03:02.110] Although, I think I love the shell. [03:02.110 --> 03:02.970] So I'm guessing... [03:04.050 --> 03:05.550] Because it looked like this was a Mac, right? [03:05.550 --> 03:09.230] So it's a Mac that's got a VM probably that they're actually running their VS Code in. [03:09.230 --> 03:11.010] Because I think the... [03:11.010 --> 03:12.770] So they've got their IDA. [03:12.850 --> 03:13.390] Oh, that was... [03:13.390 --> 03:16.870] Did you notice that it was 7.7, I think, was the version of IDA? [03:17.690 --> 03:21.010] Ooh, is that the most recent one that was leaked or what? [03:21.310 --> 03:23.010] No, no, I'm not going to accuse anyone of that. [03:23.010 --> 03:26.590] I'm just saying it's not the latest actual IDA. [03:26.590 --> 03:28.130] So, like, the analysis might be... [03:28.130 --> 03:28.910] Oh, no, voiceover. [03:28.910 --> 03:30.430] Did they hit too many accessibility keys too quickly? [03:30.430 --> 03:32.250] Is that like sticky keys but on Mac? [03:32.250 --> 03:33.010] I think that's my guess. [03:33.010 --> 03:34.090] I think that's what they got. [03:34.090 --> 03:37.230] Oh, I'm really excited to see a little crack me here. [03:37.230 --> 03:40.030] All right, so they're dumping our source code out. [03:40.190 --> 03:41.770] So, okay, that's a very different approach. [03:41.770 --> 03:45.330] Now let's go ahead and actually look over on the other hand at... [03:45.330 --> 03:47.570] If I can hit the right one here. [03:47.890 --> 03:51.290] We've got Macaroni on the other hand still in IDA, right? [03:51.290 --> 03:53.170] So they're still just kind of statically analyzing this. [03:53.170 --> 03:54.810] Is that an SRAN zero? [03:54.870 --> 03:57.930] I don't think that's how you're supposed to seed your random number generator. [03:57.930 --> 03:58.930] So I had a debate. [03:58.930 --> 04:02.170] I had a debate when I made this challenge of how hard I wanted to make it. [04:02.170 --> 04:04.410] And I originally had an SRAN time on it. [04:04.410 --> 04:08.070] And then I thought, no, let's just make it a little bit easier. [04:08.070 --> 04:10.930] During playtesting, it was like, look, we want this to be solved. [04:11.070 --> 04:13.270] So it's a very not random random. [04:13.690 --> 04:14.490] Interesting. [04:14.510 --> 04:17.530] I mean, it looks like there were 40 iterations of RAN. [04:17.530 --> 04:20.610] So at that point, the seed has been very randomized. [04:20.810 --> 04:26.390] But you are going to get the same order with the same count of items here. [04:26.390 --> 04:26.910] Yeah. [04:26.910 --> 04:30.010] So, yeah, they are going to get sort of a fixed order. [04:30.010 --> 04:32.910] But it's not, like, intuitively obvious from static analysis here. [04:32.910 --> 04:33.750] This is interesting. [04:33.850 --> 04:37.790] To figure out this order, you really want to do that dynamically or just kind of run it. [04:37.790 --> 04:39.970] And either with a breakpoint, like, dump them out. [04:40.050 --> 04:43.490] Or, yeah, so actually over here on the other side. [04:43.490 --> 04:47.170] So HypeBoy, again, the first thing that they did, it's really interesting to me. [04:47.170 --> 04:47.910] They heard CrackMe. [04:47.910 --> 04:50.310] So they immediately decompiled, dumped it to text. [04:50.470 --> 04:52.910] And now they're cleaning it up because they want to actually get this buildable. [04:52.910 --> 04:53.750] There we go. [04:53.750 --> 04:54.390] Really? [04:54.530 --> 04:55.710] This is very clean. [04:55.710 --> 04:57.150] I love the way they're doing this. [04:57.150 --> 05:00.390] So all of the functions are very simple mathematical transformations, right? [05:00.390 --> 05:01.410] You can see it right there. [05:01.410 --> 05:04.210] They've got plus, minus, division, multiplication. [05:04.990 --> 05:07.610] And so they're pulling out the constant. [05:07.610 --> 05:10.890] So the plus and minus are just very large constants. [05:11.330 --> 05:15.770] The division is always a smaller number because otherwise you end up with just, like, zeroing out. [05:15.770 --> 05:17.610] You lose all the bits that were kind of there. [05:18.310 --> 05:21.030] Now, did you make this manually or did you obfuscate it? [05:21.030 --> 05:22.010] I had a generator. [05:22.010 --> 05:24.030] So it's pseudo manually generated. [05:24.030 --> 05:27.570] The version that we're running is not, like, auto-generated each time. [05:27.570 --> 05:30.630] There is one fixed copy that it worked on. [05:30.770 --> 05:31.450] And so, okay. [05:31.450 --> 05:31.990] Oh, actually, hold on. [05:31.990 --> 05:32.850] Back on the other side. [05:32.850 --> 05:33.810] Did we miss it? [05:35.470 --> 05:36.190] Simulation manager. [05:36.190 --> 05:36.670] What's that? [05:36.670 --> 05:38.550] Yeah, I don't know, but I saw that. [05:38.550 --> 05:38.970] Okay. [05:38.970 --> 05:41.570] So, again, there's a couple different ways you can solve this. [05:41.570 --> 05:44.050] You could throw it, like, into a solver, like a Z3. [05:44.050 --> 05:47.110] You could throw it into some sort of, like, you know, I'm here, go here. [05:47.110 --> 05:52.290] And, like, one of the tools, like, auto path finds might be able to actually, like, brute force your paths. [05:52.950 --> 05:59.450] So I'm really curious if we're going to see a mix of, like, so they're looking for a congrats. [05:59.450 --> 06:02.510] Are they going to drive it towards execution of the congratulations? [06:02.510 --> 06:03.090] Yeah. [06:03.090 --> 06:10.590] So, you know, my solution, I just pulled out all the constants, pulled out it all, put it all into Z3, and then, you know, let it go. [06:10.590 --> 06:11.130] Yeah. [06:11.870 --> 06:12.270] But... [06:12.270 --> 06:15.090] Do you think we're going to see Z3 here today or any sort of solver? [06:15.090 --> 06:16.170] We haven't yet. [06:16.170 --> 06:16.210] Okay. [06:16.210 --> 06:16.770] So I'm curious. [06:16.770 --> 06:18.250] And we don't necessarily have to either. [06:18.250 --> 06:22.510] And some of these are, you know, trivially reversible transformations, right? [06:22.510 --> 06:22.730] Right. [06:22.730 --> 06:26.350] And so there's definitely going to be alternate approaches. [06:26.350 --> 06:28.670] I kind of would like to see a different one. [06:28.670 --> 06:29.230] Yeah. [06:29.230 --> 06:33.690] But certainly I know it's at least solvable with the Z3 approach. [06:33.690 --> 06:44.210] So with SRAN, way back in the day, I'm pretty sure the entropy or, like, the state space of RAND was, like, 16 bits or 32 bits or something quite small. [06:44.210 --> 06:46.450] Is this a brutable problem? [06:47.370 --> 06:49.650] Is this a 2 to the 32 sort of thing? [06:49.650 --> 06:50.310] It's not. [06:50.310 --> 06:55.230] And the reason why, I think, is because the thing that's being randomized is the order of the functions. [06:55.230 --> 06:57.230] So the functions each have all these different transformations. [06:57.230 --> 06:57.570] I see. [06:57.570 --> 07:01.110] So the only thing that's going to be random here is, like, we're going to call a function 10 first or 20, you know. [07:01.110 --> 07:03.970] So that order is, like, sort of fixed random. [07:03.970 --> 07:07.570] It's not just obvious in the code what orders can be called because that has involved the random. [07:07.570 --> 07:10.170] But you could, again, with GDB, you can dump that out. [07:10.170 --> 07:11.210] You could rewrite. [07:11.210 --> 07:12.770] Actually, you could recompile it. [07:12.770 --> 07:13.030] Right. [07:13.030 --> 07:14.070] The source decompiles cleanly. [07:14.070 --> 07:14.830] Pull it out. [07:14.890 --> 07:15.690] Rerun it. [07:15.710 --> 07:16.890] And then print out the order before you run it. [07:16.890 --> 07:19.510] And we got Z3 already over here on hackaroni. [07:19.510 --> 07:20.650] So we do have a Z3. [07:20.650 --> 07:21.190] So that's exactly. [07:21.190 --> 07:22.930] And they've got, you know, the array here. [07:23.170 --> 07:24.970] Are we pulling out constants? [07:24.970 --> 07:27.030] Or I wonder what we're looking at in that array. [07:27.030 --> 07:28.130] So we've got the 8, 4. [07:28.130 --> 07:28.570] Okay. [07:28.570 --> 07:31.190] That actually, the array is almost certainly going to be the order of the functions. [07:31.190 --> 07:31.330] Right. [07:31.330 --> 07:31.470] Right. [07:31.470 --> 07:34.110] So they're saying that's the order of the functions called. [07:34.930 --> 07:35.930] And now they're going to. [07:35.930 --> 07:37.330] Are they just going to do this manually? [07:37.610 --> 07:38.170] It looks like it. [07:38.170 --> 07:38.390] No way. [07:39.450 --> 07:40.170] No way. [07:40.170 --> 07:40.630] Listen. [07:40.630 --> 07:43.370] The name of this challenge is actually John Henry. [07:43.530 --> 07:43.990] Okay. [07:43.990 --> 07:44.270] Okay. [07:44.270 --> 07:46.450] And this is sort of like the John Henry was the railroad man. [07:46.450 --> 07:47.730] Like, you know, hammering all day. [07:47.870 --> 07:48.230] Yeah. [07:48.230 --> 07:50.710] And, like, is he going to beat the railroad machine or whatever? [07:50.710 --> 07:50.950] Right. [07:50.950 --> 07:51.970] So this is kind of. [07:51.970 --> 07:52.910] And this is fantastic. [07:52.990 --> 07:58.030] Because I really thought, like, are people going to write some sort of, like, fully automated extraction? [07:58.090 --> 07:58.110] Yeah. [07:58.110 --> 08:00.210] Or are they just going to, like, copy-paste values to pull it out? [08:00.210 --> 08:01.350] This is terrifying to me. [08:01.390 --> 08:07.270] Because Z3 is, and Python in general, is not very generous if you make a mistake. [08:07.270 --> 08:07.970] It's not. [08:07.970 --> 08:12.070] If one of those slashes is not a two slash and it's a one slash. [08:12.070 --> 08:12.230] Exactly. [08:12.230 --> 08:13.850] You lost the whole thing. [08:13.850 --> 08:17.690] And it might take a long time to figure out where that very, very small error is. [08:17.690 --> 08:18.050] Yeah. [08:18.050 --> 08:19.150] And spoiler alert. [08:19.150 --> 08:20.310] Minor spoiler alert. [08:20.310 --> 08:25.290] I believe the second hint on this challenge tells them that, like, UDIV is not the same as div. [08:25.310 --> 08:28.430] If you actually look at the division operations in Z3. [08:28.430 --> 08:28.710] Oh, no. [08:28.710 --> 08:31.610] There is a difference in signed and unsigned division. [08:31.610 --> 08:37.610] Oh, and if you're looking through here, it would be very hard to catch the difference between a uint and an int [08:37.610 --> 08:40.250] when it comes to just popping through an IDA. [08:40.250 --> 08:41.790] Like, right there, that's an int. [08:42.150 --> 08:44.330] Well, and that may or may not be right, too. [08:44.330 --> 08:49.870] Because, again, the division operation that you're going to get, like, it's implicit a lot of the time. [08:49.870 --> 08:51.970] And so, yeah, it doesn't stand out at all. [08:51.970 --> 08:53.330] Oh, that's really tricky. [08:53.330 --> 08:55.530] So, it wasn't an intentional part of it. [08:55.530 --> 08:56.090] Yeah. [08:56.090 --> 08:58.350] But it very well could be. [08:58.350 --> 09:02.110] And we did know that might bite people, which is why I said that is the second hint that's queued up. [09:02.110 --> 09:02.610] Yeah. [09:02.610 --> 09:04.850] Specifically says, like, yo, go look at these things. [09:04.850 --> 09:06.370] Because that's the operation that's going to... [09:06.370 --> 09:12.050] And what we'll see is, if they try to do this in Z3 without the correct division... [09:12.050 --> 09:12.330] Right. [09:12.330 --> 09:15.270] It'll just be, it'll just turn away, unable to satisfy, right? [09:15.270 --> 09:15.570] Okay. [09:15.570 --> 09:17.950] So, it just kind of, like, times out, which is frustrating. [09:18.070 --> 09:19.370] But honestly convenient. [09:19.370 --> 09:20.350] It's better than... [09:20.870 --> 09:22.790] I mean, getting that time out is like, yeah. [09:22.790 --> 09:23.610] Finding a false answer. [09:24.230 --> 09:27.570] Seeing unsat is like, okay, I know that something is wrong. [09:27.570 --> 09:28.470] I have to do something. [09:28.470 --> 09:28.630] Yeah, yeah. [09:28.630 --> 09:33.010] Well, it can also, the other failure case, sometimes it can just, like, turn. [09:33.010 --> 09:33.030] Yeah. [09:33.030 --> 09:35.250] And just spin, and you don't know if you did it wrong. [09:35.650 --> 09:38.690] Hopefully they realize, again, this is a speed competition. [09:38.910 --> 09:39.110] Right. [09:39.110 --> 09:41.170] I didn't give them something that would take 10 minutes to run in Z3. [09:41.170 --> 09:42.010] That's not the design. [09:42.010 --> 09:42.890] So, if you hit that... [09:42.890 --> 09:43.270] Yeah. [09:43.410 --> 09:44.270] Something has gone wrong. [09:44.270 --> 09:45.350] So, hopefully they'll be, like... [09:45.350 --> 09:46.890] The nice thing is, once they get it, they can run it. [09:46.890 --> 09:46.930] Yeah. [09:46.930 --> 09:48.210] And then go off and do other things. [09:48.210 --> 09:52.250] That's one of the really interesting parts about a CTF and using a solver is, like, [09:52.250 --> 09:55.630] if I'm working on something in the wild and I'm bringing in a solver, [09:55.630 --> 09:57.850] I don't really know if it's satisfiable or not. [09:57.850 --> 09:58.230] Absolutely, yeah. [09:58.410 --> 10:00.590] And in a CTF, you know it's going to be satisfiable. [10:00.650 --> 10:01.770] It's going to be solvable. [10:01.770 --> 10:03.970] Or maybe the Z3 is the wrong tool. [10:03.970 --> 10:05.710] But, like, you know there is a solution. [10:06.010 --> 10:10.070] And, again, this particular challenge, these live CTF challenges are meant to be fast. [10:10.070 --> 10:10.790] They're meant to be really... [10:10.790 --> 10:11.370] Right. [10:11.570 --> 10:15.210] So, we want to showcase the sort of traditional, basic, like, archetypal... [10:15.810 --> 10:16.210] Yeah. [10:16.230 --> 10:16.950] ...challenges. [10:16.950 --> 10:19.110] So, what would your threshold be? [10:19.110 --> 10:22.190] When you get approached with a challenge like this and you see that there's, like, [10:22.330 --> 10:24.630] a switch statement with a bunch of different functions, [10:24.630 --> 10:28.690] when would you go immediately to automation or some regex or something to process this [10:28.690 --> 10:32.610] versus this very manual approach, which, honestly, I think is very clean [10:32.610 --> 10:35.250] if all the functions are tiny and it's only 20. [10:35.350 --> 10:38.590] But if you get surprised and you get to a later function and it's big, [10:38.590 --> 10:39.750] you might really regret it. [10:39.750 --> 10:41.610] Yeah, 40 of these functions was meant to... [10:41.610 --> 10:43.990] I did it by hand, certainly, but I also had, you know, [10:43.990 --> 10:46.930] the lack of pressure and stress when I was writing my solution. [10:46.930 --> 10:47.810] I wasn't timed. [10:48.210 --> 10:50.930] I designed it so that I thought it would be faster to... [10:50.930 --> 10:53.250] Although, again, I'm a Binja dev, so, of course, in Binja, [10:53.250 --> 10:54.870] it was, like, four lines of Python... [10:54.870 --> 10:55.230] Right. [10:55.230 --> 10:56.650] ...to dump out each function and each operation... [10:56.650 --> 10:58.090] Oh, you wrote a script for it. [10:58.090 --> 10:58.950] So, I wrote a script that... [10:58.950 --> 10:59.090] Okay. [10:59.430 --> 11:01.490] ...dynamically, like, pulled out all those contents. [11:01.490 --> 11:04.590] Have we seen anyone write a script for Ida or Binja or Ghidra? [11:04.610 --> 11:05.050] No. [11:05.050 --> 11:05.310] Okay. [11:05.310 --> 11:06.610] I don't think we've seen, so far, anyways. [11:06.610 --> 11:08.410] Although, I haven't caught all of the matches that have been doing... [11:08.410 --> 11:08.530] Yeah. [11:08.530 --> 11:09.350] ...other things around it. [11:09.350 --> 11:10.450] But, so far... [11:10.450 --> 11:14.710] And I think that's just because most of the people are focusing on the fast... [11:15.990 --> 11:17.050] Yeah, for sure. [11:17.050 --> 11:20.470] It looks like they already have the code extracted in the way that they want. [11:20.470 --> 11:20.610] Yes. [11:20.610 --> 11:21.110] So, now... [11:21.110 --> 11:21.650] They pulled out those... [11:21.650 --> 11:23.990] Because, again, remember, they just dumped the text from Ida... [11:23.990 --> 11:24.090] Right. [11:24.090 --> 11:26.650] ...and then copied and pasted, which I think is definitely a faster approach. [11:26.650 --> 11:26.690] Yeah, which is... [11:26.690 --> 11:30.050] Yeah, I definitely think HypeBoy is ahead at this point. [11:30.330 --> 11:35.510] And I like seeing that Macaroni made that transition into using lambdas. [11:35.510 --> 11:37.970] They were doing, like, def, making the full functions... [11:37.970 --> 11:40.070] ...and then they're, like, lambda, lambda, lambda, lambda. [11:40.070 --> 11:40.430] Yep. [11:40.470 --> 11:43.150] So, now it looks like we have very similar things on both sides, [11:43.150 --> 11:46.270] except Macaroni is still manually extracting those, [11:46.270 --> 11:49.710] and it looks like HypeBoy is already kind of approaching the problem here. [11:49.710 --> 11:50.990] Yeah, so they've got the big vector. [11:50.990 --> 11:52.310] They know the size of that. [11:52.310 --> 11:52.450] Yep. [11:52.450 --> 11:56.690] They have created this value at the end where they know that there's this final check. [11:56.690 --> 11:58.090] It must be equal to this value. [11:58.090 --> 11:58.430] Yeah. [11:58.430 --> 12:00.830] So, it's definitely on track. [12:00.830 --> 12:02.590] The question is going to be, again, on their division. [12:02.590 --> 12:06.170] So, you notice they're actually doing just a single division here... [12:06.170 --> 12:06.450] Right. [12:06.450 --> 12:07.310] ...on their operations. [12:07.310 --> 12:12.590] And this really is going to need to be the UDIV inside. [12:12.590 --> 12:12.610] Right. [12:12.610 --> 12:16.150] If you're going to use E3 on this, which, again, both are so far. [12:16.150 --> 12:18.790] Is there a way that you can set that on the variable and, say, [12:18.790 --> 12:21.690] just make everything unsigned or something on this variable... [12:21.690 --> 12:21.770] That's a good question. [12:21.770 --> 12:25.410] ...where you could just do a one-pass change all of them? [12:25.410 --> 12:28.310] Well, I would probably, honestly, do it with a text replacement at this point, [12:28.310 --> 12:29.530] like multi-cursor or something. [12:29.530 --> 12:29.950] Right. Yeah. [12:29.950 --> 12:33.810] Which is an interesting note that that's basically the fact that they did a text replacement. [12:33.810 --> 12:35.770] They took it out of IDA, deleted a bunch of lines... [12:35.770 --> 12:37.610] ...and then manually, like, did multi-cursor to replace it. [12:37.610 --> 12:40.570] I think that's a sort of in-between, like, a full-fledged, [12:40.570 --> 12:42.510] I've written a script to fully automate it... [12:42.510 --> 12:43.010] Right. [12:43.010 --> 12:46.950] ...or I'm doing it line at a time by copying and pasting the way we're seeing with Macaroni. [12:46.950 --> 12:49.330] Now, are they going to have to go in reverse RAND? [12:49.330 --> 12:51.010] Oh, there we go. We just saw the double division. [12:51.010 --> 12:51.530] Oh, there it is. [12:51.530 --> 12:52.270] So, they did just... [12:52.270 --> 12:52.370] Okay. [12:52.370 --> 12:54.230] They did just... It's closer. [12:54.230 --> 12:54.890] It's now... [12:54.890 --> 12:55.290] Yeah. [12:55.290 --> 12:58.150] It's what Macaroni is, but there's still neither one is going to get the right answer [12:58.150 --> 13:02.610] until they can realize that that's not quite the same division. [13:02.610 --> 13:03.010] So, I was... [13:03.010 --> 13:03.090] Right. [13:03.090 --> 13:05.850] I was afraid this is going to be a sticking point for teams... [13:05.850 --> 13:05.950] Yeah. [13:05.950 --> 13:08.630] ...which, again, worst case, they're going to get that hint. [13:08.630 --> 13:12.030] They will get that after 35 minutes into this round. [13:12.030 --> 13:12.410] Right. [13:12.410 --> 13:14.750] They're going to get notice of that. [13:14.970 --> 13:17.630] Huh. That's really tricky. [13:18.390 --> 13:18.830] So... [13:18.830 --> 13:20.450] Oh, no. Wait a minute. This is interesting. [13:20.550 --> 13:23.790] So, it looks like they're commenting out the actual Z3 components now. [13:23.790 --> 13:24.310] Okay. [13:24.310 --> 13:26.090] Are we trying to brute force? [13:27.370 --> 13:28.430] That's a good question. [13:28.430 --> 13:30.810] Brute forcing a 64-bit value is going to be... [13:31.330 --> 13:32.110] Impossible. [13:32.110 --> 13:33.110] ...a little tricky. Yeah. [13:33.110 --> 13:34.050] I don't think they have the compute... [13:34.050 --> 13:35.210] Especially in Python. [13:35.210 --> 13:35.730] Yeah. [13:35.730 --> 13:39.650] I don't think a 32-bit is going to be possible with arrays and stuff in Python, [13:39.650 --> 13:42.190] especially with, like, dynamic dispatch of functions. [13:42.190 --> 13:42.790] So, the arrays... [13:42.790 --> 13:45.070] Yeah, the array, look up for your functions. [13:45.090 --> 13:45.270] Yeah. [13:45.330 --> 13:47.650] Well, the function order... [13:47.650 --> 13:48.490] Yeah, yeah, yeah. [13:48.650 --> 13:51.730] What you really should do at that point is just put them all into the same function... [13:51.730 --> 13:51.870] Right. [13:51.870 --> 13:53.270] ...not call them as functions and do them... [13:53.270 --> 13:53.510] Right. [13:53.510 --> 13:54.490] ...do them straight through. [13:54.490 --> 13:54.830] Yeah. [13:54.830 --> 13:55.390] That would be the... [13:55.390 --> 13:56.530] If you really wanted to brute force it. [13:56.530 --> 13:59.050] So, let's see, though. [13:59.050 --> 14:00.950] Do you know if there are many solutions? [14:00.950 --> 14:01.050] There are. [14:01.050 --> 14:01.650] Like, are there many... [14:01.650 --> 14:02.730] There are multiple solutions. [14:02.730 --> 14:06.470] Because you say it's 64-bit, but what's the actual space? [14:06.470 --> 14:07.370] I don't know. [14:07.370 --> 14:08.290] Actually, that's a great point. [14:08.290 --> 14:10.430] Like, what if there's a very convenient one, very shallow? [14:10.430 --> 14:11.470] It's possible. [14:11.470 --> 14:14.590] And what I simply did was when I tested it, I got a single solution. [14:14.590 --> 14:15.150] I tested it. [14:15.150 --> 14:15.790] It worked. [14:15.850 --> 14:18.590] And then I went and tried a few other ones. [14:18.590 --> 14:18.970] Yeah. [14:18.970 --> 14:22.090] I would, you know, specify not that, not that, just to get a few more. [14:22.090 --> 14:22.550] Right. [14:22.550 --> 14:26.270] So, I know there's more than one, but I never actually characterized and tried to figure it out. [14:26.270 --> 14:27.630] That would be really fun. [14:27.670 --> 14:31.330] So, it is possible that there's maybe a lot of this and actually just random... [14:31.330 --> 14:32.270] I don't think there are. [14:32.270 --> 14:33.050] Okay. [14:33.190 --> 14:35.210] In fact, earlier versions there were. [14:35.210 --> 14:37.410] So, again, remember I mentioned that I tweaked those constants? [14:37.550 --> 14:37.590] Yeah. [14:37.590 --> 14:40.070] So that, like, the plus and minus are just large random constants, [14:40.070 --> 14:41.750] and then there's a much smaller on the division. [14:41.750 --> 14:44.530] Because if you have a very, very large division, you'll end up with, like, zero or one. [14:44.530 --> 14:46.130] Right. Exactly. Yeah. I see. [14:46.130 --> 14:48.710] And then everything on throughout it, you've sort of lost all those bits in there. [14:48.710 --> 14:52.110] So, by having the smaller, less than a byte-sized division... [14:52.110 --> 14:52.470] Yeah. [14:52.470 --> 14:54.990] I think you're keeping most of the bits of entropy up in there, [14:54.990 --> 14:56.750] or at least most of the bits are kind of floating through. [14:56.750 --> 15:00.170] I think it really depends on what ends at the end of that expression [15:00.170 --> 15:02.690] and where everything wraps up. [15:02.690 --> 15:04.750] So, if someone was watching from home right now [15:04.750 --> 15:07.110] and was interested in tackling this problem, [15:07.110 --> 15:08.930] is there a way for them to get those challenges? [15:08.970 --> 15:09.670] Not yet. [15:09.670 --> 15:10.350] Not yet. Okay. [15:10.350 --> 15:13.030] We will be publishing at the end of the competition, [15:13.030 --> 15:15.030] assuming we're still awake and concurrent. [15:15.030 --> 15:15.210] Okay. [15:15.210 --> 15:18.090] We have a GitHub. We'll be putting all of the challenges. [15:18.250 --> 15:18.670] Perfect. [15:18.670 --> 15:20.270] We have thought about trying to do it kind of live [15:20.270 --> 15:23.330] so people can play along as soon as the round ends. [15:23.330 --> 15:27.850] But, you know, even throughout, you know, it wouldn't be a huge deal [15:27.850 --> 15:30.770] because the teams could certainly like remotely connect to another team's box [15:30.770 --> 15:31.510] and pull the binaries off. [15:31.510 --> 15:32.310] It's a secret. [15:32.310 --> 15:34.370] Once the binary is out, the binary is out. [15:34.370 --> 15:35.190] Exactly, yeah. [15:35.190 --> 15:36.410] That would be fun for us. [15:36.410 --> 15:37.290] Okay, here we go. [15:37.290 --> 15:39.130] Crypto.util.number. [15:39.930 --> 15:40.590] Interesting. [15:40.590 --> 15:43.890] I'm very curious about this alternate approach that we're seeing. [15:43.890 --> 15:47.050] So, I haven't had much time to look at the IDA disassembly. [15:47.050 --> 15:49.110] What does the random factor? [15:49.110 --> 15:51.390] And I guess since it's seeded with the same thing, [15:51.390 --> 15:53.450] you always get the same ordering of the functions. [15:53.450 --> 15:53.870] Exactly. [15:53.870 --> 15:57.090] So, what is the controlled value? [15:57.090 --> 16:00.610] Like the scanf that prompted for that LLU. [16:00.610 --> 16:04.150] You were asked to put the very first value in that is multiplied or added, [16:04.150 --> 16:05.850] like that goes through all these transformations. [16:05.850 --> 16:06.910] I see, okay. [16:06.910 --> 16:08.410] So, you give it that single 64-bit value. [16:08.410 --> 16:08.770] Okay. [16:08.770 --> 16:11.010] And then it's going to call function 8, function 4, [16:11.010 --> 16:12.690] whatever the order of the function is. [16:12.830 --> 16:15.290] So, that random is just a very slight option. [16:15.290 --> 16:18.070] And again, this is one of those things where the challenge could have been easier or harder [16:18.070 --> 16:20.350] based on how we tuned that. [16:20.510 --> 16:22.990] But, you know, we could have, for example, like made every five minutes [16:23.230 --> 16:24.410] a different random order. [16:24.410 --> 16:24.950] Yes, yes. [16:24.950 --> 16:26.770] So, you have to get your solution under that time, [16:26.770 --> 16:29.210] and that would sort of hint that you knew it would be solvable in less than that. [16:29.210 --> 16:29.830] Huh. [16:30.130 --> 16:31.990] This is going to be really interesting. [16:32.110 --> 16:35.030] So, switching back over, it looks like, yeah, where are we on macaroni? [16:35.350 --> 16:36.890] They've got their mixture. [16:36.890 --> 16:37.930] We've got Python errors right now. [16:37.930 --> 16:38.630] Oh, no, yeah. [16:38.630 --> 16:39.550] I have seen a couple of... [16:39.550 --> 16:40.430] Which is not a good sign. [16:40.430 --> 16:41.110] What is this? [16:41.970 --> 16:44.890] Unsupported operand type for bitvectoref and int. [16:44.890 --> 16:48.550] Oh, you're going to need to convert those raw constants, aren't you? [16:48.550 --> 16:49.950] No, you shouldn't have to if you... [16:50.670 --> 16:54.210] There's like two different bitvector things in Z3, [16:54.210 --> 16:57.090] and I think one of them you can just do straight up like Python things, [16:57.090 --> 16:57.850] and one you can't. [16:57.850 --> 16:59.750] I never remember which is which. [16:59.870 --> 17:03.090] The other one is, again, that... [17:03.090 --> 17:04.350] What happened here? [17:04.350 --> 17:04.790] Oh, yeah. [17:04.790 --> 17:06.830] So, again, we're trying to do kind of text replacements. [17:06.890 --> 17:08.690] Oh, now we're back to signed division. [17:08.690 --> 17:12.390] We're back to floating point division in Python, [17:12.390 --> 17:14.310] which is just not even close to right. [17:14.310 --> 17:16.230] Is that allowed on Bitvex at all? [17:16.230 --> 17:17.250] Do you get an error when you do that? [17:17.250 --> 17:18.150] They're going to get that error, yeah. [17:18.150 --> 17:18.570] Okay. [17:18.570 --> 17:19.990] That's exactly what they're going to run. [17:20.190 --> 17:21.290] Oh, it's solving. [17:21.630 --> 17:22.290] Is it? [17:22.290 --> 17:23.290] Did they actually get that? [17:23.290 --> 17:25.030] It said it's solving. [17:26.950 --> 17:27.670] I don't... [17:27.670 --> 17:28.490] It does say it's solving. [17:28.490 --> 17:28.730] Okay. [17:28.730 --> 17:29.530] Oh, again. [17:29.570 --> 17:31.830] So, if it's working, it's... [17:31.830 --> 17:33.530] Again, I don't think they're going to get the right answer. [17:33.530 --> 17:34.190] I think it's going to run. [17:34.190 --> 17:36.670] I think they're going to run into that situation where it's just going to, [17:36.670 --> 17:39.190] like, spin forever because they don't have the right division. [17:39.210 --> 17:40.190] I could be wrong. [17:40.270 --> 17:41.130] I'm not an expert in Z3. [17:41.130 --> 17:44.370] Well, with that SRAN, the functions aren't running 0 through 20 in order, [17:44.370 --> 17:44.670] are they? [17:44.670 --> 17:44.950] No, they're not. [17:44.950 --> 17:45.310] They're not. [17:45.310 --> 17:48.350] And it looks like this is kind of assuming that they are? [17:48.350 --> 17:50.210] Well, so they have the R at the beginning. [17:50.210 --> 17:52.630] Oh, did they run through and get the values? [17:52.630 --> 17:54.210] Let's keep an eye out on whether the... [17:54.210 --> 17:54.710] Oh, here we go. [17:54.710 --> 17:54.890] Hold on. [17:54.890 --> 17:55.190] What did they... [17:55.190 --> 17:57.110] Oh, they just changed... [17:57.110 --> 17:58.410] Oh, so I think they're inverting. [17:58.410 --> 17:58.610] Yeah. [17:58.610 --> 18:00.810] So, now they're just trying to invert all the operations. [18:00.810 --> 18:02.730] And this is something that I didn't actually try, [18:02.730 --> 18:04.330] but it might be a valid solution. [18:04.470 --> 18:07.690] You may very well literally just be able to, like, invert all the operations. [18:08.290 --> 18:10.570] Although, you'll notice they didn't change the order. [18:10.730 --> 18:12.370] So, if you're dividing one way, do you multiply... [18:12.370 --> 18:13.170] It's actually in my head. [18:13.170 --> 18:13.690] Like, does it... [18:13.690 --> 18:14.650] Maybe it doesn't matter? [18:14.650 --> 18:15.430] Or, like, I forget the... [18:15.430 --> 18:19.870] I don't know if it works directly like that, but I'm also not some math genius. [18:19.870 --> 18:21.970] Oh, I did just see Macaroni do a really smart thing. [18:21.970 --> 18:23.710] Oh, and actually, we just saw the same thing from Hypeboy. [18:23.850 --> 18:25.650] Checking the scoreboard. [18:25.650 --> 18:25.750] Checking for hints. [18:25.750 --> 18:28.290] Because the hints do come in at 20 minutes and ends. [18:28.290 --> 18:30.150] I think we're not quite there yet, but we may be close. [18:30.150 --> 18:31.190] Very close, yeah. [18:31.190 --> 18:31.910] So, that was really... [18:31.910 --> 18:35.230] You can tell, I think, in the beginning rounds, teams were still figuring that out. [18:35.230 --> 18:35.650] Yeah. [18:35.730 --> 18:40.210] It is cool to see that they're remembering that. [18:40.210 --> 18:43.150] And, again, if we talk about, like, the hints, [18:43.150 --> 18:44.610] the first hint, I don't think we'll tell them anything. [18:44.610 --> 18:48.190] It's just kind of more of a generic, like, you know, use the solve or something like that. [18:48.470 --> 18:50.450] I forget the exact details of the hint, [18:50.450 --> 18:54.750] but that second hint is going to be the one that gives them, like, hey, division's important. [18:54.750 --> 18:55.590] Look at UDIV. [18:55.590 --> 18:55.910] Right. [18:55.910 --> 18:59.930] Because, again, I think that's going to be something that's going to block them. [18:59.930 --> 19:03.670] So, that would give them, like, 15 more minutes to solve that before we run into a serious situation. [19:03.670 --> 19:06.950] Yeah, now it looks like we're doing some Vim Regex replacement here [19:06.950 --> 19:09.990] to, I guess, do some sort of transform on the code. [19:10.050 --> 19:11.150] But this is kind of scary. [19:11.150 --> 19:15.010] I wonder if there is a saved copy of the original form of these operators. [19:15.010 --> 19:18.530] Because if there isn't, are you just relying on your undo buffer? [19:18.530 --> 19:20.670] What if you lose those? [19:20.950 --> 19:23.630] Because Macaroni did all of these manually. [19:23.630 --> 19:27.970] So, if they lose this, that's another 10 minutes of data entry, basically. [19:27.970 --> 19:32.790] And I think they opened themselves up to just copy pasta errors or to, like, typos way more than what we saw. [19:32.790 --> 19:33.670] That's very dangerous. [19:33.670 --> 19:37.870] Especially, like, when you're copying from Ida, you have, like, the C syntax, right? [19:37.870 --> 19:39.470] You have the ULL and stuff. [19:39.470 --> 19:42.010] So, you have to, like, make sure you're not copying the U. [19:42.010 --> 19:47.850] And it's very easy to grab the U, double backspace, remove one digit, and then you're just toast. [19:47.850 --> 19:51.110] So, let's see. We're looking into... [19:51.110 --> 19:55.630] Okay, so now they're just taking each of the functions. [19:56.690 --> 20:03.630] Oh, are they going to transform it so they get the order and they just have everything in order? [20:03.850 --> 20:07.790] Because it looks like they're going to try and do some sort of a transform on the code itself. [20:11.470 --> 20:14.990] Oh, they're trying to use Python to do the regex. [20:14.990 --> 20:16.250] And now you've got two problems, right? [20:16.250 --> 20:16.930] Yeah. [20:16.930 --> 20:20.590] When you use a regex, now you have two problems. [20:20.590 --> 20:22.470] If you think your problem is solved with a regex expression. [20:22.830 --> 20:23.830] So, they're changing... [20:23.830 --> 20:27.290] This is really scary. [20:27.430 --> 20:32.310] Like, when I see this, I see very high chance of risk. [20:33.170 --> 20:33.870] Ooh. [20:33.870 --> 20:34.970] That's not what they wanted. [20:34.970 --> 20:36.250] I don't think that's what they wanted at all. [20:36.250 --> 20:37.950] Multiply, minus, plus... [20:37.950 --> 20:40.090] Divide. I mean... [20:40.090 --> 20:44.350] Oh, wait, hold on. Are they doing a single, like, character right now? [20:44.490 --> 20:46.250] That's just... [20:46.250 --> 20:48.390] This is an interesting approach. [20:48.390 --> 20:49.530] I'm not sure what's going on with that. [20:49.530 --> 20:50.550] I'm not sure either. [20:50.550 --> 20:51.550] Let's go ahead and take a look back at... [20:51.550 --> 20:52.750] Not us. [20:52.750 --> 20:54.530] Let's go ahead and take a look back at Hypeware, rather. [20:54.530 --> 20:55.110] Alright. [20:56.090 --> 20:56.870] Oh, we're in it. [20:56.870 --> 20:58.290] Okay, init debugger. [20:58.350 --> 20:59.070] Interesting. [20:59.090 --> 21:01.210] So, like I said, I kind of expected... [21:01.210 --> 21:03.990] I wondered if people were going to pull the debugger to get the array order out. [21:03.990 --> 21:05.310] And is this 64-bit? [21:05.310 --> 21:05.670] It is. [21:05.930 --> 21:07.310] 64-bit x86. [21:07.310 --> 21:08.310] Yep, exactly. [21:08.310 --> 21:13.270] Oh, we're looking at this straight assembly, which is always a sign that maybe you're not confident [21:13.270 --> 21:16.610] in the information that you're getting directly from the decompiler. [21:16.610 --> 21:19.490] Well, and again, that's actually really wise on that division in particular. [21:19.490 --> 21:19.730] Right. [21:19.730 --> 21:21.650] Because that might be a way... [21:21.650 --> 21:25.550] It jogs your memory, and you don't just think about the abstraction level at the C layer. [21:25.550 --> 21:25.590] Exactly, yeah. [21:25.590 --> 21:28.030] But you start thinking about what's actually happening. [21:28.030 --> 21:29.090] Okay, so where are they breakpointing? [21:29.090 --> 21:31.190] They're breakpointing on... [21:31.190 --> 21:32.910] Yeah, this is really interesting. [21:32.910 --> 21:38.190] I'm kind of surprised no one has a symbolic engine that allows them to just run this very simple main function [21:38.190 --> 21:40.150] and just get the symbolic expression. [21:40.150 --> 21:41.050] I wondered about that. [21:41.050 --> 21:45.270] We did think somebody could just auto-pwn this with the right automation. [21:45.270 --> 21:51.450] Yeah, I think it'd be a one-minute solve because I didn't see any modulo operators, so it should be quite easy. [21:51.450 --> 21:52.210] Exactly, exactly. [21:52.230 --> 21:55.890] And yeah, that's kind of interesting. [21:56.990 --> 22:00.490] Do you know how long it takes for Z3 to solve this when you have the right expression? [22:00.490 --> 22:04.650] So at least on my hardware, it took, I think, less than a minute. [22:04.650 --> 22:10.290] In fact, at one point, I had made it up to 50 functions, and it was starting to take three or four minutes to solve. [22:10.290 --> 22:13.610] So I intentionally dropped it back down to 40 because I wanted it to be less than a minute. [22:13.610 --> 22:15.550] I wanted it to be fairly clear. [22:15.590 --> 22:20.130] I didn't want people guessing, like, well, is it taking too long because I've done something wrong or because... [22:20.130 --> 22:20.330] Yeah. [22:20.390 --> 22:25.710] So the correct solution should take about a minute to run, which I think is hopefully right. [22:25.710 --> 22:29.390] Did you symbolically simplify the expression or mathematically simplify it? [22:29.390 --> 22:33.490] No, no, no. I literally just copied and pasted, put in all those constraints, and let it go. [22:33.490 --> 22:34.310] Yeah, okay. [22:34.310 --> 22:38.710] So there's a chance that someone could probably get it even faster if they reduced... [22:38.710 --> 22:44.730] Because right now they're doing this whole lambda function thing, which will be a pretty bloated expression, and I'm sure it reduces down. [22:44.730 --> 22:45.050] Oh, yeah, yeah. [22:45.050 --> 22:50.010] But that's always a tough thing in C3 is, like, is it faster to do a simplification pass? [22:50.010 --> 22:59.130] Or I've had it where, like, doing a couple functions, simplifying, adding a couple more functions, simplifying has been faster than putting the whole thing in. [22:59.130 --> 23:00.530] But I've also had the opposite. [23:00.630 --> 23:05.390] I'm sure if you've worked a lot more with it, you kind of have a good feel for which way to do that. [23:05.390 --> 23:05.810] I have not, ironically. [23:05.810 --> 23:07.750] So for me, this was actually one of the very first... [23:07.750 --> 23:14.810] I mean, I've done a couple other challenges involving Z3 over the years, but actually partly I wrote this as an excuse to explore this more and to try it out. [23:14.810 --> 23:15.250] Yeah. [23:15.410 --> 23:24.090] And also because, like, as I said earlier, the goal of a lot of these live CTF challenges are, like, what's the core element behind some of these common challenges that we run into? [23:24.090 --> 23:24.490] Yeah. [23:24.490 --> 23:29.290] And so I thought, like, just, oh, like a basic crack me where you use Z3, you pull out some formula, and you run it through. [23:29.290 --> 23:35.950] And again, knowing that, like, okay, with these transformations, there's probably other approaches, which I think they've both abandoned Z3. [23:35.970 --> 23:39.390] It seems to me, like, that neither one is really using a Z3. [23:39.390 --> 23:39.830] Yeah. [23:39.830 --> 23:42.090] So we're not seeing Z3 at all. [23:42.090 --> 23:42.530] Yeah. [23:42.530 --> 23:47.810] They're really actually just trying to, like, do the bit shifting and inversion. [23:47.810 --> 23:48.230] Right. [23:48.230 --> 23:50.490] Which quite possibly worked. [23:50.490 --> 23:51.190] You haven't tried it. [23:51.190 --> 23:51.850] I haven't tried it. [23:51.850 --> 23:53.070] So it might run, it might not. [23:53.070 --> 23:53.190] Yeah. [23:53.190 --> 23:54.530] There may be other reasons why it wouldn't. [23:54.530 --> 23:56.290] That could be quite difficult. [23:56.290 --> 24:01.510] I think it really depends on, like, how these operators overflow and everything. [24:01.510 --> 24:02.610] I don't necessarily know. [24:02.610 --> 24:04.870] Making sure that you model things the same way. [24:04.870 --> 24:05.630] Yes. [24:05.630 --> 24:05.830] Exactly. [24:05.830 --> 24:06.530] Yeah. [24:07.310 --> 24:08.030] Huh. [24:08.030 --> 24:10.610] So I am going to be very curious. [24:10.990 --> 24:11.790] What do we have over here? [24:11.790 --> 24:15.750] Why do we have multiple things on Hype Boy? [24:15.750 --> 24:19.530] So base is not invertible for the given modulus. [24:19.530 --> 24:22.170] So whatever inversion function they're trying to do. [24:22.370 --> 24:23.410] Wow. [24:24.850 --> 24:25.590] That's interesting. [24:25.590 --> 24:26.550] I've never actually seen that. [24:26.550 --> 24:31.270] Apparently the Cryptolibrary has, like, an inversion where you can say just invert this math operation. [24:31.350 --> 24:31.830] Yeah. [24:32.470 --> 24:33.130] Or, no, no, no. [24:33.130 --> 24:34.250] Is that bit inversion? [24:34.550 --> 24:37.730] I'm not sure what that inverse function is, actually. [24:38.050 --> 24:38.410] Right. [24:38.410 --> 24:39.550] I'll definitely be looking that one up. [24:39.550 --> 24:40.750] I see the shift in mask. [24:40.750 --> 24:43.870] It looks like it's trying to make sure that those are 64-bit values. [24:43.870 --> 24:44.070] Right. [24:44.070 --> 24:46.270] But shouldn't Bitvex handle that for you? [24:46.270 --> 24:47.710] Again, they're not using Bitvex at all, right? [24:47.710 --> 24:50.470] They've switched over to a pure, like, basic math. [24:50.470 --> 24:52.970] Which, again, might be possible. [24:52.970 --> 24:54.070] I just don't know. [24:54.070 --> 24:59.870] If I were to ever approach a bit problem, I would never use Python for it when it comes to this. [24:59.870 --> 25:00.550] It's not well-studied. [25:00.550 --> 25:00.630] Right. [25:00.630 --> 25:01.670] It really isn't. [25:01.670 --> 25:02.070] Yeah. [25:03.690 --> 25:05.690] But it's hard to switch over. [25:06.170 --> 25:06.830] Yes. [25:06.910 --> 25:10.750] And it's really fascinating to me, too, that both of them started with a solver. [25:10.750 --> 25:13.230] Both of them just decided to bail on it when they're like, wait a minute. [25:13.230 --> 25:14.870] The solver is not the right approach. [25:14.870 --> 25:16.510] But it still could be. [25:16.510 --> 25:16.750] Yeah. [25:16.750 --> 25:18.070] Again, it is absolutely doable. [25:18.070 --> 25:21.690] So they're going to get that hint at 35 minutes to use a solver. [25:21.690 --> 25:26.950] Well, they're going to get the hints that's going to tell them to particularly use Z3's UDIF. [25:26.950 --> 25:30.250] In fact, actually, I'm going to go put the mic down, and I'm going to go ask what the hint is, [25:30.250 --> 25:31.770] because I don't remember what it was. [25:31.770 --> 25:32.270] All right. [25:32.270 --> 25:33.990] I'll come back, and I'll let everybody know. [25:34.010 --> 25:34.810] Sounds good. [25:34.810 --> 25:35.390] Yeah. [25:36.610 --> 25:37.350] All right. [25:37.350 --> 25:37.890] Yeah. [25:38.270 --> 25:43.090] Hypeboy's really got kind of all of this weird bit operation going on. [25:43.090 --> 25:49.030] They're trying to mask everything down to get to that, you know, 64-bit bitwise operations, [25:49.030 --> 25:53.230] which in the big space of Python, it's kind of hard to get that. [25:53.730 --> 25:54.930] Did you get our info? [25:54.930 --> 25:56.410] I did indeed confirm. [25:56.410 --> 25:57.030] All right. [25:57.030 --> 26:00.490] As I thought, it specifically says use Z3 UDIF. [26:00.490 --> 26:02.010] So it's pretty, like, clear. [26:03.790 --> 26:07.270] But again, they might not be wrong. [26:07.270 --> 26:09.510] I'm not going to say this isn't solvable this way. [26:09.510 --> 26:14.630] I just feel like there's a lot of, like, easy ways to mess it up and to try to get your exact... [26:14.630 --> 26:15.390] Yeah. [26:15.810 --> 26:16.830] It's interesting. [26:16.830 --> 26:17.630] What was that over there? [26:17.630 --> 26:20.750] Oh, we've got on macaroni. [26:21.690 --> 26:22.110] Yeah. [26:22.110 --> 26:23.810] We have the list of all the functions. [26:23.950 --> 26:25.310] We apply the... [26:25.310 --> 26:30.550] They're applying the transform onto those functions to, I guess, order them in the right way. [26:30.550 --> 26:32.370] But we have two F13s, I just noticed. [26:32.370 --> 26:33.110] I don't know what they were... [26:33.110 --> 26:34.390] They, like, duplicated it. [26:34.390 --> 26:34.930] Oh, 14. [26:34.930 --> 26:35.130] Were they... [26:35.130 --> 26:35.850] Oh, no. [26:35.850 --> 26:37.150] Did they add them all by one again? [26:37.150 --> 26:37.990] Oh, no. [26:37.990 --> 26:39.750] The copy pasta risk is real. [26:40.010 --> 26:40.730] Yeah. [26:40.990 --> 26:43.090] Because, yeah, X over 49. [26:43.090 --> 26:46.670] So they did a little bit of macro to, like, to increase the digit. [26:46.670 --> 26:47.890] Is that control A or something? [26:47.890 --> 26:48.470] I forget the exact... [26:48.470 --> 26:52.630] There's a key to, like, literally increase the number that I'm currently selected is a hot key in there. [26:52.630 --> 26:53.170] Yeah. [26:53.170 --> 26:54.650] And then they macro'd that. [26:54.970 --> 26:55.330] So, again... [26:55.330 --> 26:58.030] And then they're going to go manually fix up this. [26:58.030 --> 26:59.730] And that's... [26:59.730 --> 27:01.430] Was that 13 or 14? [27:01.430 --> 27:02.710] This is really scary. [27:02.710 --> 27:04.130] But they're back to bit back. [27:04.130 --> 27:05.630] So we are seeing... [27:05.630 --> 27:05.690] Yeah. [27:05.690 --> 27:07.830] And they added F40 to it. [27:07.830 --> 27:10.810] So it really comes down to if they have these expressions right. [27:10.810 --> 27:13.290] And I don't think they do with the single div. [27:13.750 --> 27:14.070] Yeah. [27:14.130 --> 27:15.010] That's what they're going to run to. [27:15.010 --> 27:18.330] But the good news is, then, if they do get that hint and kind of come back to it... [27:18.330 --> 27:18.610] Yeah. [27:18.610 --> 27:21.930] They might be better prepared for it than the approach we're seeing from BitBoy. [27:21.930 --> 27:27.170] I think that the timing of when that hint comes in could be a really, really big deciding factor. [27:27.170 --> 27:28.010] And it's like any minute now. [27:28.010 --> 27:28.390] The first hint's gone out. [27:28.390 --> 27:30.510] But, again, the first hint wasn't very useful. [27:30.510 --> 27:31.190] I don't even... [27:31.190 --> 27:32.890] Was it 20 minutes and 35 minutes? [27:32.890 --> 27:34.150] 20 minutes and 35 minutes. [27:34.150 --> 27:34.450] Okay. [27:34.450 --> 27:39.390] So we've still got another maybe 10 minutes, I think, before, give or take, before the next hint goes out. [27:39.570 --> 27:40.290] Oof. [27:40.610 --> 27:43.170] It was about five minutes ago that we saw the first hint go. [27:43.170 --> 27:43.770] Yeah. [27:43.770 --> 27:46.490] They could definitely do it. [27:46.490 --> 27:50.950] And I am glad that, you know, in our playtesting, like I said, this division bit us as well. [27:50.950 --> 27:54.130] So we at least knew that was going to be a gotcha. [27:54.130 --> 27:56.630] I know where Macaroni is in their headspace right now. [27:56.630 --> 27:57.890] I see exactly what's going on. [27:57.890 --> 28:02.470] They're looking at, around this F13 through 15, they're looking at Ida. [28:02.650 --> 28:07.410] They're concerned that they have something wrong. [28:07.530 --> 28:08.430] And it's just... [28:08.430 --> 28:10.290] Oh, hey, they're going to use dog bolts. [28:10.290 --> 28:10.690] Yeah. [28:10.690 --> 28:11.930] So they want a second opinion, too. [28:11.930 --> 28:12.230] Right. [28:12.230 --> 28:13.890] And this is, I mean, this is terrifying. [28:14.270 --> 28:20.690] It's basically like, is it time to just give up and just basically try from scratch with a new approach? [28:20.690 --> 28:26.450] Or do you go and you try and manually verify that you have the right implementations of these operations? [28:26.450 --> 28:28.250] And I don't know. [28:28.250 --> 28:30.130] That's really, really, really tough. [28:30.390 --> 28:35.150] Especially in a speed competition, right, where like literally every second kind of counts and you're just nervous. [28:35.150 --> 28:37.410] Are we going to see a script by any chance? [28:37.450 --> 28:38.870] Oh, a database snapshot. [28:38.870 --> 28:39.530] Nice. [28:39.530 --> 28:40.170] Okay. [28:40.970 --> 28:41.550] Decompiler Explorer. [28:41.550 --> 28:42.790] It's just dogbolt.org. [28:42.790 --> 28:43.670] It's all you got to do. [28:43.730 --> 28:46.670] I stole that name from somebody else on Twitter when we created this. [28:46.670 --> 28:50.010] So this is actually a joint project from a couple of folks. [28:50.010 --> 28:54.770] So Ilfax from Hexrays and Vector35, makers of Binary Ninja, we both pay for the hosting. [28:54.830 --> 28:57.550] And Vector35, we wrote most of the actual interface. [28:57.870 --> 29:00.090] Some of the Angular folks have some code that are part of it, too. [29:00.330 --> 29:00.810] OpenAI? [29:00.950 --> 29:03.010] Did I see a chat GPT? [29:03.010 --> 29:03.650] We are seeing a chat GPT. [29:03.650 --> 29:03.770] Wow. [29:03.770 --> 29:06.290] They almost did it quickly, like they were embarrassed, though, to show it. [29:06.290 --> 29:12.890] Can you rewrite those functions? [29:14.090 --> 29:14.370] Okay. [29:14.370 --> 29:17.450] So they're going to use this as a smarter text replacement, maybe? [29:18.030 --> 29:18.690] I'm curious. [29:18.690 --> 29:20.490] I am kind of excited. [29:20.490 --> 29:27.990] Now, would you trust the result of chat GPT to the level of a solver being able to reason about it? [29:27.990 --> 29:35.170] I think if all they're going to ask it to do is to do a bunch of formatting and to paste in a bunch of output, I feel like that's a fair thing. [29:35.170 --> 29:40.090] Fun note, by the way, the binary ninja that's running a dog bolt is not the latest dev version. [29:40.190 --> 29:44.870] So it actually, I think on these operations it's all fine, but for some of the... [29:44.870 --> 29:46.310] Oh, and Anger and Ghidorah are still... [29:46.830 --> 29:47.710] They'll get there. [29:47.710 --> 29:48.550] They'll come through. [29:48.550 --> 29:50.450] How big would you say this binary was? [29:50.450 --> 29:51.750] Oh, it's not very large. [29:51.750 --> 29:56.030] I could pull it up separately, but it's not super big. [29:56.230 --> 29:59.490] In fact, usually IDA comes back faster on Decompiler Explorer. [29:59.490 --> 30:01.550] In this particular one, it's... [30:01.550 --> 30:02.750] Let's see. [30:03.230 --> 30:04.290] No way. [30:04.290 --> 30:05.650] That looks very good. [30:05.650 --> 30:07.770] Your text processing, again... [30:07.770 --> 30:08.410] That looks... [30:08.410 --> 30:09.450] It's not terrible. [30:09.450 --> 30:10.690] Very good. [30:11.270 --> 30:12.330] No way. [30:12.330 --> 30:16.170] Yeah, but I think it's good for that. [30:17.230 --> 30:18.650] I mean, that... [30:18.650 --> 30:19.510] That's pretty good. [30:19.510 --> 30:22.250] I didn't really see anything that looked off in there. [30:22.250 --> 30:24.350] But the problem is you don't know. [30:24.350 --> 30:24.970] Yeah. [30:25.310 --> 30:27.390] Oh, did they have to teach you about division? [30:27.390 --> 30:28.410] Oh, no. [30:28.410 --> 30:30.450] Oh, no. [30:31.270 --> 30:32.590] Oh, no. [30:32.590 --> 30:33.390] Everyone's like... [30:33.850 --> 30:34.250] Macaroni. [30:34.250 --> 30:34.770] No. [30:35.390 --> 30:37.870] Poking around the same thing. [30:39.170 --> 30:42.350] And they have F40, which shouldn't be in there. [30:42.450 --> 30:43.150] It's not. [30:43.150 --> 30:44.310] There is no F40. [30:44.310 --> 30:47.870] Yeah, so there are only 40 total functions starting at function 0 to function 39. [30:48.170 --> 30:50.790] Now, are they going to go and just change it to a double div? [30:50.790 --> 30:51.570] What's the order, though? [30:51.570 --> 30:52.010] Hold on. [30:52.010 --> 30:52.530] Oh, no. [30:52.530 --> 30:53.010] Okay, no. [30:53.070 --> 30:54.430] They're doing the transform. [30:54.430 --> 30:55.410] They do look up their array. [30:55.410 --> 30:57.630] I think the way they do this is pretty good. [30:57.630 --> 30:58.110] That part's fine. [30:58.110 --> 30:58.470] Right. [30:58.470 --> 30:58.550] Absolutely. [30:58.550 --> 31:02.610] Do you think if they had the double div operator, this is just already basically solved? [31:02.610 --> 31:03.430] No, no, no. [31:03.430 --> 31:07.010] Because, again, the double div is still signed, I think. [31:07.010 --> 31:09.310] Can you write the inverse of those functions? [31:11.810 --> 31:12.950] I don't... yeah. [31:12.950 --> 31:16.630] See, now, at a certain point, you're going a step too far. [31:16.630 --> 31:17.230] Right. [31:17.330 --> 31:18.590] It's going to start hallucinating on you. [31:18.590 --> 31:20.070] I don't know if this is it or not. [31:20.090 --> 31:23.070] Oh, and you notice their solver just said something about a stat in the background. [31:23.070 --> 31:24.750] So that, actually, I'm a big fan of. [31:24.750 --> 31:29.690] If they're running a different copy of the script with the solver while they go out and try to do the inversion, that's good for them. [31:29.690 --> 31:31.330] Two different approaches at the same time. [31:31.390 --> 31:32.410] That's a good way to go. [31:32.410 --> 31:33.370] Great use of time. [31:33.370 --> 31:35.410] Hard to keep both that in your head, but... [31:35.410 --> 31:37.830] Yes, and make sure you don't invert one thing from the other. [31:37.830 --> 31:39.790] Are those the inverse? [31:41.470 --> 31:47.770] Or did it just do a dumb inversion where it did a negation or something? [31:48.130 --> 31:51.890] And what are they going to... oh, they're doing all... so here's their division. [31:51.890 --> 31:53.470] They're going to get rid of their division again. [31:53.590 --> 31:55.170] But, again, that's not quite what they want. [31:55.170 --> 31:58.750] But they're going to be well situated when that thing comes through. [31:58.750 --> 32:01.170] And HypeBoy just checked on that hint. [32:01.170 --> 32:03.850] And just as a... okay, so they're still looking for the hint. [32:03.850 --> 32:06.790] They know it's not too far out, but we do have a few more minutes. [32:06.850 --> 32:09.970] Let's actually go ahead and follow up with what HypeBoy's been doing to catch up with them. [32:09.970 --> 32:12.390] Because I still see... I don't think they're... yeah, still no Z3. [32:12.470 --> 32:14.890] All their Z3 solver stuff is still coming out. [32:14.890 --> 32:20.630] So they're still leaning into that inversion approach of really just trying to invert the operations. [32:20.630 --> 32:21.030] Right. [32:21.030 --> 32:22.050] To see if they can get that value. [32:22.050 --> 32:26.010] And I guess the goal is to just run through and just run it through backwards? [32:26.070 --> 32:27.250] Yeah, you'll just get a constant out. [32:27.250 --> 32:31.150] If you could perfectly model the inverse of those operations, yeah, that would happen. [32:31.150 --> 32:34.170] It's just... yeah, just tricky to do. [32:34.170 --> 32:36.590] And there's a lot of ways to get that wrong. [32:37.470 --> 32:38.270] So we'll see. [32:38.270 --> 32:40.210] And with the Z3, there's basically only one way to get it wrong. [32:40.210 --> 32:41.390] And it's literally just the division. [32:41.390 --> 32:42.790] It's just the division that makes it tricky. [32:42.790 --> 32:46.390] I see the double division went back in over on macaroni. [32:46.390 --> 32:48.410] So did they get an unsat? [32:48.410 --> 32:49.930] So we've got a... yeah, sat assertion error. [32:49.930 --> 32:52.130] Okay, so they know that it was unsat. [32:52.310 --> 32:52.970] Okay. [32:52.970 --> 32:55.090] And then they're changing it again with the double division. [32:55.090 --> 32:58.950] So again, I'm actually... did they miss a zero when they copied that? [32:59.950 --> 33:01.850] It was on which side of it was it? [33:02.050 --> 33:05.630] Is that highlighted all the way to the other zero on macaroni? [33:05.630 --> 33:06.690] Zero, zero, L, L. [33:08.010 --> 33:10.010] Also, let's see. [33:10.010 --> 33:11.710] Where is their final comparison? [33:11.950 --> 33:14.230] So the array... order the arrays. [33:16.490 --> 33:18.590] Unlocking in 227 seconds. [33:18.590 --> 33:20.010] Oh, I didn't even notice that before. [33:20.010 --> 33:20.490] It does give them the... [33:20.490 --> 33:20.970] Yeah, yeah. [33:20.970 --> 33:21.890] That's great. [33:21.890 --> 33:22.690] It does let them know... [33:22.690 --> 33:23.650] I think I saw Glenn... [33:23.650 --> 33:24.850] They do have the right value. [33:24.850 --> 33:25.350] Okay. [33:25.350 --> 33:27.370] So the value is correct at 100 at the end. [33:27.810 --> 33:28.450] Interesting. [33:29.170 --> 33:30.670] They really need those double divisions. [33:30.670 --> 33:34.750] For context, when I wrote this, I literally just had a debug version of it. [33:34.750 --> 33:36.950] I put in the input value I wanted to be the answer, [33:36.950 --> 33:38.670] and then I just checked the value at the end, [33:38.670 --> 33:40.170] and then I hard-coded it back in and recompiled it, right? [33:40.170 --> 33:40.570] Yeah. [33:40.570 --> 33:42.270] So it's really easy to find the solution. [33:42.270 --> 33:44.050] Now, I did still have to write the Z-theory. [33:44.050 --> 33:45.090] I did still have to prove it was solvable, [33:45.090 --> 33:47.510] and that's also how I could find over multiple solutions, [33:47.510 --> 33:51.110] but it's kind of easy on a forward operation. [33:51.110 --> 33:51.430] Okay, hold on. [33:51.430 --> 33:51.850] What are we doing here? [33:51.850 --> 33:52.730] Out equals... [33:52.730 --> 33:53.590] Zmod. [33:53.810 --> 33:54.450] Zmod. [33:55.250 --> 33:55.950] Oh, no. [33:56.650 --> 33:57.570] Yeah, okay. [33:57.570 --> 34:00.050] So they're essentially doing now what we saw before. [34:00.050 --> 34:01.930] They're trying to constrain. [34:01.990 --> 34:03.210] We're going to use SageMath. [34:03.730 --> 34:04.430] Really? [34:04.430 --> 34:07.570] So are they going to do the sort of inversion approach that we've seen? [34:07.570 --> 34:08.290] Yeah. [34:08.410 --> 34:12.230] But they're going to use Sage to try to do these inversions [34:12.230 --> 34:15.890] and try to model the way that the opcodes are going to behave, [34:15.890 --> 34:17.510] but invert them. [34:17.590 --> 34:18.090] Right. [34:18.870 --> 34:22.590] Yeah, so I was a little skeptical of some of these inversion attempts, [34:22.590 --> 34:24.350] but I actually really like that... [34:24.350 --> 34:25.930] Inverse of that doesn't exist. [34:25.930 --> 34:30.550] I really like the HypeBoy approach here where they're still got their solvers kind of running. [34:30.550 --> 34:30.570] Right. [34:30.570 --> 34:37.390] So run a solver, but then let it go and see if you get an answer while you go off and try other things. [34:37.390 --> 34:38.830] Was that HypeBoy or Macaroni? [34:38.830 --> 34:39.670] I'm sorry, thank you. [34:39.710 --> 34:40.430] Macaroni. [34:40.730 --> 34:41.090] Yeah. [34:41.230 --> 34:44.650] HypeBoy still seems that we can double check on them over there. [34:45.010 --> 34:46.510] They have a whole new Python script? [34:46.530 --> 34:47.850] They're back to Z3. [34:47.870 --> 34:48.550] Hold on, did they? [34:48.550 --> 34:48.610] Yeah. [34:48.610 --> 34:50.130] Okay, they didn't see the hint yet, though. [34:50.130 --> 34:52.390] So how do you do the unsigned divide in Z3? [34:52.390 --> 34:53.590] It's just a function called UDIV. [34:53.590 --> 34:55.910] It's literally a built-in operation called UDIV. [34:55.910 --> 34:58.790] Which is why we tell them the exact function name in that hint. [34:58.790 --> 34:59.110] Right. [34:59.110 --> 35:02.390] Because I think that will be the last stumbling block that either one can do. [35:02.390 --> 35:04.290] The other thing is I'm keeping an eye on our alerts. [35:04.290 --> 35:05.830] I don't think I've seen the others. [35:05.830 --> 35:13.170] So remember, as a reminder to our viewers, you can go over to the other streams and you can watch the two other players that have been doing this. [35:13.170 --> 35:15.950] So we've got Maple Mallards and Straw Hats. [35:16.070 --> 35:16.930] And I haven't seen the alerts. [35:16.930 --> 35:17.530] They're still working away. [35:17.530 --> 35:19.250] I think they're still working away as well. [35:19.250 --> 35:22.550] So my bet is I really wasn't trying to troll everyone. [35:22.570 --> 35:24.030] It's kind of interesting. [35:24.030 --> 35:28.890] I've used Z3 for one time, and it was for a MapleStory hacking thing. [35:28.890 --> 35:30.290] It's a long story. [35:30.750 --> 35:32.810] It's a long MapleStory, maybe? [35:33.270 --> 35:34.130] Gosh. [35:34.170 --> 35:34.330] Sorry. [35:36.930 --> 35:41.990] And I've already had it drilled into me to make sure that I'm doing the right div operator. [35:42.090 --> 35:43.070] And I've used it once. [35:43.070 --> 35:47.850] So you would think that people who have done this a lot would probably immediately be going to that. [35:47.850 --> 35:53.570] Now, maybe it's because they saw int64 and IDA or something, and they're just taking that. [35:53.570 --> 35:54.570] Immediately jump from there. [35:54.570 --> 35:56.210] Yeah, that's entirely possible. [35:56.450 --> 35:58.750] Yeah, that's really tricky. [35:58.810 --> 36:02.230] Is it all of the functions are unsigned, or is it just one of them is unsigned? [36:02.230 --> 36:05.290] Because if you did that, that's just rude. [36:05.990 --> 36:09.150] So the values themselves are all unsigned values. [36:09.150 --> 36:10.950] And in source, you don't differentiate. [36:10.950 --> 36:12.530] You just div, multiply, whatever. [36:12.530 --> 36:16.610] And it just happens to be if you have unsigned values, it's going to be an unsigned div. [36:16.610 --> 36:22.270] But again, in decompilation, you just see division, multiplication, and subtraction. [36:22.710 --> 36:24.510] Does Binja differentiate those? [36:24.510 --> 36:27.230] Binja does actually show you in high-level IL. [36:27.590 --> 36:29.290] It does U slash or whatever? [36:29.290 --> 36:30.070] It can do U, yeah. [36:30.070 --> 36:36.690] So Binja will actually tell you if it knows the operation signedness of your comparison or whatever it is, which is not valid C. [36:36.690 --> 36:43.090] It's one of our arguments about why ILs are better than just pseudo C or C output, because you can actually do hinting as to what type of thing it is. [36:43.090 --> 36:44.470] To me, that's mandatory. [36:44.470 --> 36:50.590] Whenever I have printed out any of my ILs, it's always on all of the operations that are signed or unsigned. [36:50.590 --> 36:51.610] It is explicit. [36:51.610 --> 36:52.970] S or U. [36:52.970 --> 36:55.090] It's just so important. [36:55.090 --> 36:57.470] It's the difference of having a no day and not. [36:57.470 --> 37:02.570] Or in this case, spending an extra 15, 20 minutes getting your solver to work. [37:02.570 --> 37:03.670] Okay, actually, let's go back. [37:03.670 --> 37:06.750] We've got... I'm seeing in HypeBoy, we now... [37:06.750 --> 37:07.990] Oh, is that it? [37:07.990 --> 37:09.330] They've got a V4. [37:09.430 --> 37:10.710] Hold on, hold on. [37:11.110 --> 37:11.630] They're running it. [37:11.630 --> 37:12.290] They've got a value. [37:12.290 --> 37:13.370] Okay, yeah, yeah, they've got a value. [37:13.370 --> 37:14.350] They're running it. [37:14.650 --> 37:15.390] Oh, no. [37:15.770 --> 37:16.370] Now, let's see. [37:16.370 --> 37:17.470] Are they checking the input? [37:17.470 --> 37:18.570] Does it check? [37:18.570 --> 37:20.010] Are they doing the inversion thing? [37:20.010 --> 37:20.930] Well, they're putting it... [37:20.930 --> 37:22.090] What format is the input? [37:22.090 --> 37:23.810] Is it hexadecimal or is it... [37:23.810 --> 37:27.850] It was LLU, so it should be an unsigned 64-bit int. [37:27.910 --> 37:29.910] That actually tricked someone up yesterday. [37:29.910 --> 37:32.070] For about 20 or 25 minutes... [37:32.070 --> 37:32.590] Oh, no. [37:32.590 --> 37:36.470] ...one of the teams, I think, didn't know that it was hex. [37:36.470 --> 37:37.230] Yeah, yeah, yeah. [37:37.790 --> 37:38.190] And... [37:38.190 --> 37:38.970] I don't see... [37:38.970 --> 37:40.370] They haven't checked the... [37:40.870 --> 37:43.430] Okay, so then copy-paste errors. [37:44.370 --> 37:45.990] Okay, now, are they going to check that scan out? [37:45.990 --> 37:46.630] Please go check... [37:46.630 --> 37:47.270] Yes, no, no, no. [37:47.330 --> 37:48.570] Go check the scan out. [37:48.810 --> 37:50.030] Go look for that input. [37:50.090 --> 37:51.090] It was LLU. [37:51.090 --> 37:52.230] I do remember that. [37:52.630 --> 37:53.070] Okay, so... [37:53.070 --> 37:54.610] That was, like, the very first thing that I picked out. [37:54.610 --> 37:55.550] You didn't notice this one was LLU. [37:55.550 --> 37:57.630] I should remember, but I wrote this two weeks ago, [37:57.630 --> 37:58.850] so, like, I don't even remember my own... [37:58.850 --> 38:00.170] Yeah, that was, like, the first thing... [38:00.170 --> 38:01.030] I actually switched it back and forth. [38:01.030 --> 38:03.390] A couple times, I was doing hexadecimal. [38:03.390 --> 38:04.170] A couple times, I was doing... [38:04.170 --> 38:04.490] Yeah. [38:05.470 --> 38:06.510] ...doing integer values. [38:07.430 --> 38:07.810] CPyNamespace. [38:07.890 --> 38:08.450] Okay. [38:08.450 --> 38:09.450] So, they should have... [38:12.270 --> 38:13.210] Oh, fantastic. [38:13.290 --> 38:14.510] Okay, so I just got a little introduction. [38:14.510 --> 38:15.510] Was that a love letter? [38:15.550 --> 38:16.250] It was. [38:16.250 --> 38:17.030] They're telling me how much... [38:17.030 --> 38:18.770] No, they're telling me that Straw Hat won. [38:18.770 --> 38:21.470] So, Straw Hat has beaten Maple Mallard... [38:21.470 --> 38:21.670] Okay. [38:21.670 --> 38:22.430] ...in our uncasted one. [38:22.430 --> 38:23.890] So, if you were watching that stream, [38:23.890 --> 38:24.630] and you've joined us now, [38:24.630 --> 38:25.590] you may have already seen the end of it. [38:25.590 --> 38:26.010] Wow. [38:26.010 --> 38:28.270] Straw Hat won their version, [38:28.270 --> 38:29.410] and they, again, got a different number [38:29.410 --> 38:30.470] than the expected solution, [38:30.470 --> 38:31.490] but I'm not at all surprised. [38:31.870 --> 38:32.350] Z3UDIV. [38:32.730 --> 38:33.310] Okay. [38:33.310 --> 38:34.370] He finally popped it up. [38:34.470 --> 38:35.370] Oh, and UDIV is not defined. [38:35.370 --> 38:36.590] We are seeing it on both of them. [38:36.590 --> 38:36.810] Yep. [38:36.810 --> 38:37.390] We're seeing... [38:37.390 --> 38:38.970] Okay, so both have the hints. [38:39.190 --> 38:39.570] Yeah. [38:39.570 --> 38:40.870] This should be it. [38:40.870 --> 38:41.410] Honestly? [38:41.410 --> 38:43.670] So, at this point, it's a race to see... [38:43.670 --> 38:43.890] I... [38:43.890 --> 38:44.890] ...who can fix their implementation. [38:44.890 --> 38:46.650] I'm putting my money on Macaroni, [38:46.650 --> 38:49.070] because if they go back to chat GPT [38:49.070 --> 38:50.190] to do that transform, [38:50.190 --> 38:51.210] to do the UDIV, [38:51.210 --> 38:52.730] they're going to get the result very fast. [38:52.730 --> 38:52.930] There's always complications, though. [38:52.930 --> 38:53.110] Watch. [38:53.110 --> 38:53.850] They're just doing a... [38:53.850 --> 38:54.270] Manual. [38:54.270 --> 38:55.390] ...event macro, [38:55.390 --> 38:56.050] and they're doing it, [38:56.050 --> 38:57.090] and they're almost done. [38:57.090 --> 38:58.450] It's kind of interesting that we've... [38:58.450 --> 38:58.990] Uh-oh, uh-oh. [38:59.770 --> 39:00.330] We've got a... [39:00.330 --> 39:00.870] Oh, here it is. [39:00.870 --> 39:01.110] Here it is. [39:01.110 --> 39:01.470] Hypoidoh. [39:01.510 --> 39:03.030] Hypoidoh is coming through. [39:03.030 --> 39:04.210] They've got a value. [39:04.210 --> 39:04.990] They've got a value. [39:04.990 --> 39:06.070] It shows correct. [39:06.070 --> 39:07.030] And now they just have to... [39:07.750 --> 39:08.630] Get it in there. [39:08.630 --> 39:09.390] Submitter 12. [39:09.530 --> 39:10.130] They've got it. [39:10.130 --> 39:10.790] I think they've got it. [39:10.790 --> 39:11.410] Here it is. [39:11.410 --> 39:12.930] And that's going to be... [39:12.930 --> 39:13.650] That is it. [39:13.650 --> 39:14.570] That is it. [39:14.850 --> 39:15.090] Congratulations. [39:15.090 --> 39:15.670] Oh, no. [39:15.670 --> 39:17.390] And we just had one so close. [39:18.010 --> 39:19.210] Macaroni was just behind it. [39:19.210 --> 39:20.290] That hit was exactly... [39:20.290 --> 39:20.630] Yeah. [39:20.630 --> 39:21.170] ...all they needed. [39:21.410 --> 39:21.570] Wow. [39:21.570 --> 39:22.950] That was so close. [39:22.950 --> 39:25.410] We thought that might do it, sure enough. [39:25.410 --> 39:27.870] It was kind of crazy that Macaroni [39:28.250 --> 39:32.210] did the manual copy-pasting from IDA initially, [39:32.210 --> 39:36.090] but also used the most automated chat GPT approach. [39:36.130 --> 39:36.170] Chat GPT. [39:36.170 --> 39:37.330] So it was just two complete... [39:38.130 --> 39:38.810] Ends of the spectrum. [39:38.810 --> 39:39.230] Yeah. [39:39.230 --> 39:39.830] Yeah, yeah, yeah. [39:39.830 --> 39:40.550] We saw both. [39:40.550 --> 39:41.050] But that was... [39:41.050 --> 39:41.170] Oh. [39:41.170 --> 39:42.450] Yeah, and it was exactly the hit. [39:42.450 --> 39:43.170] It was the UDIF. [39:43.170 --> 39:44.030] They just needed the UDIF. [39:44.030 --> 39:44.150] No way. [39:44.150 --> 39:46.710] They both got it within just seconds of each other. [39:46.710 --> 39:46.970] Wow. [39:46.970 --> 39:48.670] It is interesting, though, to note that I think, [39:48.670 --> 39:50.730] as we saw, Straw Hat actually won theirs. [39:50.730 --> 39:52.110] Before, I think that hit may have come out. [39:52.110 --> 39:53.310] That hit just came out. [39:53.310 --> 39:53.690] Yeah. [39:53.690 --> 39:55.630] They all fixed it and were able to solve it. [39:55.630 --> 39:57.310] But I'm going to go back and watch the VOD now [39:57.310 --> 39:58.330] and see what Straw Hat did. [39:58.330 --> 39:58.850] Right. [39:58.850 --> 40:00.850] Because I think their solution may not even [40:00.850 --> 40:02.610] have been exactly the same. [40:02.870 --> 40:05.770] Honestly, I think, in my head, one of the approaches [40:05.770 --> 40:08.790] that maybe would have come up to me is just [40:08.790 --> 40:10.870] randomly try both signed and unsigned. [40:10.870 --> 40:13.330] Like, make a generic function. [40:13.330 --> 40:13.570] Right. [40:13.570 --> 40:14.630] Because how many divs were there? [40:14.630 --> 40:15.170] Five? [40:15.250 --> 40:15.870] What is that? [40:15.870 --> 40:18.390] Two to the five different combos and just try [40:18.390 --> 40:19.670] all possible combos. [40:19.670 --> 40:21.050] And you know it's at least the same one for each [40:21.050 --> 40:21.710] of your divisions, right? [40:21.710 --> 40:21.910] Right. [40:21.910 --> 40:22.930] So you don't have to, like, do it. [40:22.930 --> 40:24.490] You can just do it five times, essentially, [40:24.490 --> 40:25.770] which makes it a lot easier. [40:25.770 --> 40:26.090] Yeah. [40:26.190 --> 40:27.490] So, ah, that was fantastic. [40:27.490 --> 40:27.730] All right. [40:27.730 --> 40:29.250] Well, I'm excited because we haven't had to use [40:29.250 --> 40:30.650] another sudden death, which is always good. [40:30.650 --> 40:31.230] Yeah. [40:31.310 --> 40:32.330] We had a good round. [40:32.330 --> 40:34.330] Everyone, we've got two victors. [40:34.410 --> 40:36.870] Congratulations to Hypeboy and to Straw Hat [40:36.870 --> 40:37.790] for their wins. [40:37.850 --> 40:41.030] But, honestly, Macaroni and PPP that lost, [40:41.030 --> 40:42.990] they're playing into the lower bracket now. [40:42.990 --> 40:44.490] They can still be back in the finals. [40:44.490 --> 40:44.990] For sure. [40:45.030 --> 40:45.950] Yeah, absolutely. [40:45.990 --> 40:47.370] Now, I don't want to put you on the spot, [40:47.370 --> 40:49.190] but who do we have coming up next? [40:49.310 --> 40:50.570] Ah, let me pull up that. [40:50.570 --> 40:52.650] I've got the chart right here. [40:52.650 --> 40:53.950] So, actually, we can, I think we could, [40:53.950 --> 40:55.770] well, I won't do the bracket on stream. [40:56.250 --> 40:58.250] Next up, we're going to do a couple more [40:58.250 --> 40:59.390] from the lower bracket, actually. [40:59.390 --> 40:59.630] Okay. [40:59.630 --> 41:02.390] So, I think we're going to pull in, [41:02.810 --> 41:04.690] the next two are going to be, [41:04.690 --> 41:07.130] actually, the two from this that lost [41:07.130 --> 41:08.250] are going to be right back around. [41:08.250 --> 41:08.990] So, they're going to be coming in [41:08.990 --> 41:10.470] for Macaroni versus Shellfish. [41:10.470 --> 41:10.810] Okay. [41:10.810 --> 41:12.990] And Maple Mallard versus Norse Code. [41:13.150 --> 41:13.710] All right. [41:13.710 --> 41:16.030] So, again, even those lower bracket matches [41:16.030 --> 41:18.450] are going to be fierce and great competitors. [41:18.450 --> 41:20.030] Perfect. Sounds good. [41:20.030 --> 41:20.890] Awesome. Look forward to it. [41:20.890 --> 41:22.010] Thanks, everybody, for joining us. [41:22.010 --> 41:24.490] We'll see you just in about 15 minutes [41:24.490 --> 41:26.210] as we reset, get the new teams in here, [41:26.210 --> 41:26.970] and we'll be back. [41:26.970 --> 41:27.490] Cheers. [41:27.490 --> 41:28.110] Take care. [41:34.420 --> 41:35.820] ♪♪♪