Scripting radare2 with python for dynamic analysis - TUMCTF 2016 Zwiebel part 2

In part 1 we reverse engineered the algorithm, now we implement a radare2 script in python to recover the flag and defeat the encrypted code.

-=[ 🔴 Stuff I use ]=-

-=[ ❤️ Support ]=-

-=[ 🐕 Social ]=-

-=[ 📄 P.S. ]=-

All links with "*" are affiliate links.
LiveOverflow / Security Flag GmbH is part of the Amazon Affiliate Partner Programm.

#ReverseEngineering #Radare2 #CTF

[halemm]

the way the decryption key appear is superb!

[whiskas-]

Lol, that ending was so h4x0r, haha, very cool

[BGroothedde]

Haha if you would see the reveal of the flag in a movie you'd say "that doesn't happen in real life!", nice work man!

[splendicious]

This was one of the most entertaining/informative video's I have ever watched on reverse engineering topics!
like + sub <3

[SecondLight]

Didn't realise how powerful radare2 python script could be. I love it. Amazing video :)

[TonelessR]

Hey I'm not much of a comment person but I have to commend you for your videos! As someone who knows a bit about this stuff, but am waaaay behind, this was very interesting, informative and easy to understand. :) Hope I get to a point where I can think of this stuff by myself, it's really inspiring. Keep it up you're a huge help, and I'll be sure to watch every video. Cheers!

[Friedtunafish]

This is the best channel on Youtube. Please continue making new videos!

[typedeaf]

That was I will have to watch this about 0xc more times before it sinks in. Got stuck on a couple RE challenges that had multiple sections of decrypt loops and I just gave up after a while, doing it manually. I had no idea that scripting it was even an options. Makes so much more sense!

[Evergreenscoderzone]

Hey! Great stuff you're doing. I like the way how you present things, I have a lot to learn from you for my channel.
What I like the most in this video is that you explain assembler in a very digestible way, almost like the guys in "hardware/software interface course" on coursera half a dozen years ago.

Keep going!

[biehdc]

can you please make more radare2 videos? there are not a lot of good tutorials

[FetchDEX]

since only one instruction was stepped at 2:57, you could have also used s+4 / s+8 (depending on the binary format)

[Occcc]

This is such a sweet technique, had a lot of fun watching this !

[freestylesoccer]

This is by far one of the best Channels i have ever watched,
Thank you for the great effort you put.
I'm trying to get better in reverse engineering, i'm using radare2 and IDA Pro
The thing is for other fields like Binary Exploitation, Networking, Linux, Crypto ...
There are very good resources out there, but I haven't found good ones for Reverse engineering, like a Platform or series of Crackme's that goes from Easy to Hard.
( i found Avatao, i liked it but only about 20% of crackme's are free :( )
Can you suggest me some good resources if you have ?
Also i don't want to start Binary Exp until i'm good enough in Reverse Engineering, is it good thinking or i'm wrong and i should start ?
And Thanks

[arthur]

Damn, that one wasn't easy, but the way it works is so cool !

[xTatticadanito]

Awesome videos, I've always been interested in RE stuff, I understood everything you said in these 2 video but i never studied RE seriously because I think that I will never be able to do stuff like this.

P.S. Sorry for my not perfect englando.

[ponysopher]

Why does performing a bitwise OR on the AND value and the int of 0x20 yield the right byte at any particular offset?

[shans]

Mind=blown
Loved the way you made it look so easy...

[JaKeL]

I gotta say that's pretty damn cool +subbed

[sanzidulislam]

I am trying to solve "easy as gdb" problem from picoCTF using r2pipe...it appears that i have to bruteforce my input...so then, how can i handle bruteforcing input..

[문석철-xw]

I have one question, regarding and al, 0x20. Why python code is flag[offset] | and_value? it is "and" operator but in python it is "or" operator. Could any of you explain my question?