forensics + rev done

hacksvctf-2025/bin/elves-are-fun.md

@@ -0,0 +1,5 @@
+**Flag:** `hacks{1140+frame_dummy}`
+
+- The name in the table was `frame_dummy`.
+- The `.bss` section begins at offset `1140` as found through IDA.
+

hacksvctf-2025/forensics/chill-guy.md

@@ -0,0 +1,5 @@
+**Flag:** `Hacks{4re_y0u_4_ch1ll_guy}`
+
+Fix the header of the file `randomfile` to make it a proper JPEG, then run `stegseek randomfile.jpg` with the wordlist `rockyou.txt` to get the password. Use the password to extract the flag.
+
+

hacksvctf-2025/forensics/hidden.md

@@ -0,0 +1,9 @@
+First we run `binwalk -eaM` on `flag_1_1` to find a ppt with 3 images.
+
+In `image3.png` we find a hidden message in the metadata.
+
+```
+Artist                          : #                                                                                                        #
+```
+
+We convert the `0x20` to `0` and `0xe28083` to `1` to get the flag.

hacksvctf-2025/forensics/shark-bites-packets.md

@@ -0,0 +1,4 @@
+**Flag:** `hacks{sh4rk_b1t3$_p4ck37$}`
+
+We exported the HTTP data through Wireshark, and found the flag split across two images, namely `object482.random_page%2f4540` and `object489.random_page%2f5892`.
+

hacksvctf-2025/forensics/whats-a-macro.md

@@ -0,0 +1,16 @@
+**Flag:** `hacks{y0u_f0unD_M3}`
+
+Unzipping the `.pptm` file, we find a bunch of "macros" in a folder all containing "Not the flag!" but one
+
+```bash
+.../file.pptm/ppt/slideMasters/_rels $ fd . -t f -X du -b | grep -v '^12'
+57      ./maliciousMacroDetails752/macro.vba
+```
+
+The flag is there, hex encoded.
+
+```bash
+.../file.pptm/ppt/slideMasters/_rels $ cat ./maliciousMacroDetails752/macro.vba | unhex
+hacks{y0u_f0unD_M3}
+```
+

hacksvctf-2025/rev/100-percent-discount.md

@@ -0,0 +1,41 @@
+Used strings command on the file and found this 
+
+```
+   1197 BKIAYQ^CH
+   11a1 XONuELuRH
+   11b4 EXYW
+   2008 Oh no, you found this: %s
+```
+
+Opened the file on ghidra and found the function that used this string 
+
+```c 
+void zxc(void)
+
+{
+  size_t sVar1;
+  char f [128];
+  char x [20];
+  int k;
+  int i;
+  
+  builtin_strncpy(x,"BKIAYQ^CXONuELuREXYW",20);
+  i = 0;
+  while( true ) {
+    sVar1 = strlen(x);
+    if (sVar1 <= (ulong)(long)i) break;
+    f[i] = x[i] ^ 42;
+    i = i + 1;
+  }
+  sVar1 = strlen(x);
+  f[sVar1] = '\0';
+  printf("Oh no, you found this: %s\n",f);
+  return;
+}
+```
+
+Simple XOR operation so i used CodeChef to reverse it 
+
+`hacks{tired_of_xors}`
+
+

hacksvctf-2025/rev/basic-rev-200.md

@@ -0,0 +1,40 @@
+We just have to reverse this 
+```c 
+  for (local_10 = 0; local_10 < 8; local_10 = local_10 + 1) {
+    local_9 = flag.txt[local_10];
+    fputc((int)local_9,local_28);
+  }
+  for (local_14 = 8; (int)local_14 < 23; local_14 = local_14 + 1) {
+    if ((local_14 & 1) == 0) {
+      local_9 = flag.txt[(int)local_14] + 5;
+    }
+    else {
+      local_9 = flag.txt[(int)local_14] + -2;
+    }
+    fputc((int)local_9,local_28);
+  }
+```
+
+
+```python
+rev_content = "_hacks_{w1{1wq8]8lle<,T}"   #cat rev_this
+
+flag = list(rev_content[:8])  # First 8 characters are unchanged
+
+for i in range(8, 23):
+    if i < len(rev_content):
+        c = rev_content[i]
+        if i % 2 == 0:
+            flag_char = chr(ord(rev_content[i]) - 5)
+        else:
+            flag_char = chr(ord(rev_content[i]) + 2)
+        flag.append(flag_char)
+
+if len(rev_content) > 23:
+    flag.append(rev_content[23])
+
+flag = ''.join(flag)
+print(flag)
+```
+
+The flag `_hacks_{r3v3rs3_3ng7.O}`

hacksvctf-2025/rev/question-encrypted.md

@@ -0,0 +1,40 @@
+```
+31c050682a6f2e6768292b2b456829452f72686e452e726869617d2968727b7971b9180000008
+d342489e7ac341aaae2fab804000000bb0100000089e1ba18000000cd80b80100000031dbcd80
+```
+
+This looks like a shellcode so I put this into a bin file and used ndiasm to disassemble this 
+
+```
+❯ ndisasm -b 32 ./shellcode.bin
+00000000  31C0              xor eax,eax
+00000002  50                push eax
+00000003  682A6F2E67        push dword 0x672e6f2a
+00000008  68292B2B45        push dword 0x452b2b29
+0000000D  6829452F72        push dword 0x722f4529
+00000012  686E452E72        push dword 0x722e456e
+00000017  6869617D29        push dword 0x297d6169
+0000001C  68727B7971        push dword 0x71797b72
+00000021  B918000000        mov ecx,0x18
+00000026  8D3424            lea esi,[esp]
+00000029  89E7              mov edi,esp
+0000002B  AC                lodsb
+0000002C  341A              xor al,0x1a
+0000002E  AA                stosb
+0000002F  E2FA              loop 0x2b
+00000031  B804000000        mov eax,0x4
+00000036  BB01000000        mov ebx,0x1
+0000003B  89E1              mov ecx,esp
+0000003D  BA18000000        mov edx,0x18
+00000042  CD80              int 0x80
+00000044  B801000000        mov eax,0x1
+00000049  31DB              xor ebx,ebx
+0000004B  CD80              int 0x80
+❯
+```
+
+This is just a xor operation with key 0x1a
+
+I used cyberchef to reverse it 
+
+`hacks{g33_5h311_0u4}`

uiuCTF/README.md

@@ -1,4 +0,0 @@
-# OFFICIAL FOLDER FOR UIU WRITEUPS  
-
-Add all writeups for challenges in this repo.
-