CSAW 2011 OpenGL

In this challenge, you get a Windows binary, when you start it it only display a white windows

The first surprise is that there is absolutely no packing or obfuscation of the binary, it decompiles cleanly in IDA.

What we see is that it’s a classic OpenGL application with OpenGL init and a frame loop. I used to be a demoscene coder that wrote his own 3D engine so this looked very familiar.

We will first use glIntercept to get a log file with all the OpenGL calls and their parameters: http://glintercept.nutty.org/

glIntercept comes with a replacement DLL that will be loaded by the binary when initializing OpenGL.

In the log file produced we can see a few interestings things:

The background color is black.

But our draw color is black also, black on black = … black

At the end of the frame drawing, we draw a huge rectangle all over the screen in white.

So we know that we have to do, for a start, 2 things:

• Change the default draw color to white so we can see something
• Remove the huge rectangle from the view so we can see something also

Change the default color to white:

Jump over the huge rectangle:

At this point we see now a black background, “KEY” written in white lines and many letters written in vectors randomly moving on the screen. We are on the right way.

Now we need to remove the randomness in the key letters placement and put them next to each others so we can read the flag.

Since the positionning sub is the same for all the letter, I choose to use the space previously allocated to the rand() calculation to write my new opcodes.

Also to avoid having to patch all the other sub functions drawing letter that do a glPopMatrix, we will just put a glPushMatrix at the end of the positioning function, this way the result is neutral.

New opcodes added to positioning sub:

And we are done. The resulting application will looks like this:

Key is “sc4#3sr1u30*0”

This challenge was really fun to do and original.