Okay, so it wants us to crash the service, no problem I already had a crashing input string for that service already from a previous challenge. Send your crash string as base64, followed by a newline I started by connecting to the challenge service: The first challenge, 334 cuts, didn’t offer much in terms of direction. For the first time in its history, DEFCON CTF is abandoning the attack-defense model. This year the finals will be based on DECREE so the winning CGC robot can ‘play’ against the human competitors. Several required CGC-style “Proof of Vulnerability” exploits. A full third of the challenges were DECREE-based.

This year’s qualifying challenges were heavily focused on preparing competitors for the Cyber Grand Challenge (CGC). None of these are nearly as attractive as Binary Ninja. Reverse the binaries by hand effectively impossible given the number of binaries.

Develop a Cyber Reasoning System an unrealistic option for most participants.Use IDA and IDAPython a more expensive and unpleasant proposition.Without Binary Ninja, I would have had to:

Since the original point of CTF competitions was to help people improve, I limited my options to what most participants could use. This brought a welcome distraction from the slew of stack-based buffer overflows and unhardened heap exploitation that have come to characterize DEFCON’s CTF. It’s comparatively simple to query blocks of code, functions, trace execution flow, query register states, and many other tasks that seem herculean within IDA. It does analysis on its own intermediate language (IL), which is exposed through Python and C++ APIs. If you’re wondering how to remain competitive in a post-DARPA DEFCON CTF, I highly recommend you take a look at Binary Ninja.īefore I share how I slashed through the three challenges - 334 cuts, 666 cuts, and 1,000 cuts - I have to acknowledge the tool that made my work possible.Ĭompared to my experience with IDA, which is held together with duct tape and prayers, Binary Ninja’s workflow is a pleasure. Using Vector35’s Binary Ninja, a promising new interactive static analysis and reverse engineering platform, I wrote a script that generated “exploits” for 2,000 unique binaries in this year’s DEFCON CTF qualifying round.

Binary Ninja 3.3.3996 instal the new