SECUINSIDE CTF Quals 2014 – Reversing 100 yayaya

Thu 05 June 2014 CTF ctf / secuinside-ctf / reversing / flash / swf / crossbridge / imagemagick / python

The task

This task contains an SWF file with Crossbridge embedded. Additionally there is an ELF file inside that SWF. At the first look I thought that this is really an RE job. But I was wrong (thanks to nurfed — it's his solution). There is no RE, and even a Flash decompiler was not needed. The entire work comprises capturing Flash movie frames with random color blocks.

Some random frame from the Flash movie:

Capturing frames

These color blocks appeared at some interval, and the solution was to capture these frames and then combine them together. For screen capture I chose pyscreenshot:

import pyscreenshot as ImageGrab
import time

print 'z'
for z in range(2000):
    im = ImageGrab.grab(bbox=(269, 100, 469, 300))
    im.save('e:\\sc\\im_{}.png'.format(z))
    time.sleep(0.1)

Combining the frames

I decided to use PIL to combine screenshots, but nurfed (thanks again) chose an easier way — ImageMagick. So simple:

convert -evaluate-sequence add "e:\sc\im_*.png" out.png

The flag

And we get the final image:

Flag is GANADAHAAH.