evandrix

CSAW RED 2019 Quals - task `wizbaby` (450pt) https://red.csaw.io/challenges#wizbaby `nc rev.chal.csaw.io 1000` binary [ab79788118283db8513ac3e257a6377c-wizbaby.gz](https://github.com/gereeter/hsdecomp/files/3677899/ab79788118283db8513ac3e257a6377c-wizbaby.gz) mirror https://red.csaw.io/files/ab79788118283db8513ac3e257a6377c/wizbaby

fails on CSAW CTF'19 Quals > wizkid

2

https://ctf.csaw.io/challenges > No rust or go binaries this time ;) > nc rev.chal.csaw.io 1002 https://ctf.csaw.io/files/8f347a362c16c610a9594104c8d43540/wizkid mirror https://www.ninefile.com/mv6826fi7dvc.html ``` $ python3 -u runner.py wizkid Error in processing case at c4no_info Error:...

[err] `AttributeError: 'module' object has no attribute 'parse'` when trying to install plugin

1

___Stack trace___ ``` reloading plugin StringEncode.string_encode Traceback (most recent call last): File "/opt/sublime_text/sublime_plugin.py", line 109, in reload_plugin m = importlib.import_module(modulename) File "./python3.3/importlib/__init__.py", line 90, in import_module File "", line 1584,...

Failed to patch

2

managed to build and install successfully, but tried running https://gist.github.com/pvieito/c0c9b8fd73255b57927b273d329c5800, and it failed: ``` $ sudo python amfid_patch.py PID: 173 ASRL Offset: 0x10ff5f000 Patch Address: 0x10ff6247d Memory not accessible probably...

why assume the analyst is female? "Through the use of VMI the analyst still has full control of the VM, which allows _**her**_ to pause the VM at any point...

couldn't leave a comment on the blogpost https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/blackbyte-ransomware-pt-2-code-obfuscation-analysis, so thought here is the next best place: > For anyone interested, a decompiled source of BlackByte that we have partially de-obfuscated...

line 242: ~~`To kill this script hit CRTL-C`~~ line 242: `To kill this script hit CTRL-C`