TE
TechEcho
Home24h TopNewestBestAskShowJobs
GitHubTwitter
Home

TechEcho

A tech news platform built with Next.js, providing global tech news and discussions.

GitHubTwitter

Home

HomeNewestBestAskShowJobs

Resources

HackerNews APIOriginal HackerNewsNext.js

© 2025 TechEcho. All rights reserved.

An extra bit of analysis for Clemency

27 pointsby withzombiesalmost 8 years ago

2 comments

withzombiesalmost 8 years ago
For this year&#x27;s DEFCON CTF, the organizers decided to break all existing tooling by making a custom architecture with 9-bit bytes, 27-bit words, and middle-endian integers.<p>I was able to make a [Binary Ninja](<a href="https:&#x2F;&#x2F;binary.ninja" rel="nofollow">https:&#x2F;&#x2F;binary.ninja</a>) architecture plugin on the flight to Vegas, but unfortunately I had to expand everything to 16-bit bytes to be able to handle addressing. This made control flow graph recovery possible, but I had to choose between accurate data references or accurate immediates. I ended up going with accurate immediates and letting my data references fall into the middle of functions (because instruction addresses were all 2x).<p>The 27-bit words and middle-endianness wasn&#x27;t a huge issue, but the 9-bit bytes really really sucked. We had IO buffering issues on every exploit we wrote and analyzing PCAPs was a huge pain.
tyomaalmost 8 years ago
Its great that the CTF organizers fielded a neutral architecture that no one would be familiar with. This helps put everyone on a more even footing and tests their knowledge of their tools and reverse engineering instead of knowledge of architecture internals
评论 #14901491 未加载
评论 #14904105 未加载