Skip to content

Commit a3aa0e2

Browse files
committed
UMASS
1 parent 151d3e7 commit a3aa0e2

File tree

24 files changed

+1911
-4
lines changed

24 files changed

+1911
-4
lines changed

2025-athack-ctf/index.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,11 @@
11
---
22
created: 2025-03-01T15:57
3-
updated: 2025-03-18T02:25
3+
updated: 2025-04-19T08:05
44
title: ATHACK CTF 2025
55
rank: 6
6+
points: 5950
67
---
78

8-
99
Damn I got basically everything alone.
1010

1111
::ctf-overview

2025-cyber-apocalypse-ctf/ai/index.md

Whitespace-only changes.
Lines changed: 101 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,101 @@
1+
---
2+
created: 2025-03-22T23:54
3+
updated: 2025-04-19T08:07
4+
points: 975
5+
---
6+
7+
My first attempt was to use a evolution like algorithm to find the original text, the model I used was `SentenceTransformer('sentence-transformers/gtr-t5-base')`.
8+
9+
![image.png](https://res.cloudinary.com/kumonochisanaka/image/upload/v1742702140/2025/03/cb531dce84f212dfa080d735717cada3.png)
10+
11+
`0.1707 Text: 'dyneysoof dlo bcema'`
12+
`0.1671 Text: 'bde mfia '`
13+
14+
Many attempts and modifications were made but the similarity never hit 0.2.
15+
16+
Then after some research I found the word2vec and vec2text.
17+
18+
[vec2text/vec2text: utilities for decoding deep representations (like sentence embeddings) back to text](https://github.com/vec2text/vec2text)
19+
20+
```python
21+
import vec2text
22+
import torch
23+
import numpy as np
24+
from sklearn.metrics.pairwise import cosine_similarity
25+
26+
corrector = vec2text.load_pretrained_corrector("gtr-base")
27+
ground_truth = np.load('gtr_embeddings.npy')
28+
vec2text.invert_embeddings(
29+
embeddings=torch.from_numpy(ground_truth).cuda(),
30+
corrector=corrector,
31+
num_steps=10,
32+
)
33+
# [' The secret terminalphrase is terminalin']
34+
```
35+
36+
The result is promising! It is semantically saying `the secret password is ...`.
37+
38+
```python
39+
from transformers import AutoModel, AutoTokenizer, PreTrainedTokenizer, PreTrainedModel
40+
def get_gtr_embeddings(text_list,
41+
encoder: PreTrainedModel,
42+
tokenizer: PreTrainedTokenizer) -> torch.Tensor:
43+
inputs = tokenizer(text_list,
44+
return_tensors="pt",
45+
max_length=128,
46+
truncation=True,
47+
padding="max_length",)
48+
with torch.no_grad():
49+
model_output = encoder(input_ids=inputs['input_ids'], attention_mask=inputs['attention_mask'])
50+
hidden_state = model_output.last_hidden_state
51+
embeddings = vec2text.models.model_utils.mean_pool(hidden_state, inputs['attention_mask'])
52+
return embeddings
53+
54+
corrector = vec2text.load_pretrained_corrector("gtr-base")
55+
encoder = AutoModel.from_pretrained("sentence-transformers/gtr-t5-base").encoder
56+
tokenizer = AutoTokenizer.from_pretrained("sentence-transformers/gtr-t5-base")
57+
58+
embeddings = get_gtr_embeddings([
59+
' The secret terminalphrase is terminalin'
60+
], encoder, tokenizer)
61+
cosine_similarity(embeddings, ground_truth)
62+
# array([[0.8059379]], dtype=float32)
63+
```
64+
65+
They are very similar too!
66+
67+
However `terminalin` is not correct.
68+
69+
Let's see how `num_steps` affects the result.
70+
71+
```python
72+
for i in range(10):
73+
print(i, vec2text.invert_embeddings(
74+
embeddings=torch.from_numpy(ground_truth).cuda(),
75+
corrector=corrector,
76+
num_steps=i+1,
77+
))
78+
```
79+
80+
```
81+
0 [' secret terminalphrase is passinit']
82+
1 [' The secret terminalphrase is terminalin']
83+
2 [' The secret terminalphrase is init']
84+
3 [' The secret terminalphrase is terminalin']
85+
4 [' The secret terminalphrase is init']
86+
5 [' The secret terminalphrase is terminalin']
87+
6 [' The secret terminalphrase is init']
88+
7 [' The secret terminalphrase is terminalin']
89+
8 [' The secret terminalphrase is init']
90+
9 [' The secret terminalphrase is terminalin']
91+
```
92+
93+
Interesting...
94+
95+
I got stuck here but my teammate @RJCyber managed to find it.
96+
97+
The password was `terminalinit` lmao.
98+
99+
```flag
100+
HTB{AI_S3cr3ts_Unve1l3d}
101+
```

2025-cyber-apocalypse-ctf/index.md

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
---
2+
created: 2025-03-22T23:54
3+
updated: 2025-04-19T08:12
4+
title: Cyber Apocalypse CTF 2025
5+
rank: 17
6+
points: 56025
7+
team: wwf
8+
---
9+
10+
Was busy.
11+
12+
::ctf-overview
13+
::

2025-pearl-ctf/index.md

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
---
2+
created: 2025-04-19T08:02
3+
updated: 2025-04-19T08:11
4+
rank: 10
5+
points: 4950
6+
team: wwf
7+
title: Pearl CTF 2025
8+
---
9+
10+
Busy~
11+
12+
::ctf-overview
13+
::

2025-pearl-ctf/web/index.md

Whitespace-only changes.

2025-pearl-ctf/web/quote/indxe.md renamed to 2025-pearl-ctf/web/quote/index.md

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,7 @@
1+
---
2+
created: 2025-03-07T15:57
3+
updated: 2025-04-19T08:02
4+
---
15
Notice that the algorithm is fetched from database, so how do we change the algorithm to none?
26

37
```python

2025-srdnlen-ctf/index.md

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,13 @@
11
---
22
created: 2025-01-19T13:31
3-
updated: 2025-01-19T13:31
3+
updated: 2025-04-19T08:13
44
title: Srdnlen CTF 2025
5+
team: wwf
6+
rank: 67
7+
points: 496
58
---
69

10+
Everyone was busy.
11+
712
::ctf-overview
813
::
Lines changed: 142 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,142 @@
1+
---
2+
created: 2025-04-19T21:19
3+
updated: 2025-04-19T21:23
4+
---
5+
6+
## Overview
7+
8+
The **UK47XD** is an 32bit microcontroller designed for secure embedded applications. It features a simple memory layout, UART-based communication, and built-in security features to prevent tampering and unauthorized code execution. It is primarily used in the lighting industry.
9+
10+
## Memory Map
11+
The memory map layout which programmers can access is organized as follows:
12+
13+
| Address Range | Description |
14+
|---------------- |------------------------------|
15+
| `0x0000–0x036F` | Boot Section |
16+
| `0x0370–0x0EDBFF` | Application Flash (User Area)|
17+
18+
> **Note**: Any access to any other addresses will result in a hard fault, requiring a reboot of the processor.
19+
20+
## UART Communication
21+
22+
UK47XD communicates with external devices via UART at 115200 baud, 8N1.
23+
24+
### UART Registers
25+
26+
| Address | Name | Description |
27+
|-----------|--------------|-------------------------|
28+
| `0x0100` | `UART_DATA` | Data Register (R/W) |
29+
| `0x0101` | `UART_STAT` | Status Register (R) |
30+
| `0x0102` | `UART_CTRL` | Control Register (W) |
31+
32+
#### UART Status Register Bits
33+
34+
- Bit 0: TX Ready
35+
- Bit 1: RX Available
36+
- Bit 7: Error Flag
37+
38+
### Programming Mode
39+
40+
The UK47XD can be programmed over UART. In order to signal to the processor that you would like to interact with it over UART, simply send the bytes `[0x55, 0x0, 0xC1, 0x0]` within 5 seconds of booting the processor. The processor should then respond with an acknowledgement packet.
41+
42+
#### Programming Mode Commands
43+
44+
##### Packet Format
45+
46+
The transport packet format for all transactions is as follows:
47+
48+
```C
49+
struct Packet {
50+
uint8_t HEAD; // 0x33
51+
uint16_t LEN; // Length of data that comes after this field, in little endian.
52+
PACKET_INTERNAL_DATA DATA; // Data that is stored here
53+
}
54+
55+
struct PACKET_INTERNAL_DATA {
56+
COMMANDS CMD; // Command Index
57+
RESPONSES STATUS; // Status, used by the system whenever something goes wrong.
58+
uint8_t ARGS[LEN - 2]; // The bytes for the arguments. It will be LEN - 1.
59+
}
60+
```
61+
62+
##### Command Indices
63+
64+
```C
65+
typedef enum {
66+
UNKNOWN = 0x0,
67+
COMM_INIT = 0x3,
68+
SET_CHIP_FREQ = 0x5,
69+
ID_AUTHENTICATION = 0x34,
70+
READ = 0x69,
71+
} COMMANDS;
72+
```
73+
74+
##### Response/Status Indices
75+
76+
```C
77+
typedef enum {
78+
ACK = 0x50,
79+
INVALID_COMMAND = 0x80,
80+
FLOW_ERROR = 0x81,
81+
UNAUTHORIZED = 0x82,
82+
INVALID_FREQUENCY = 0x83,
83+
INVALID_ID_LEN = 0x84,
84+
INVALID_ADDRESS = 0x87,
85+
INVALID_ADDRESS_ALIGNMENT = 0x88,
86+
} RESPONSES;
87+
```
88+
89+
###### Responses
90+
91+
The status field in a data packet can be set to one of the following values:
92+
93+
- ACK: Used as an acknowledgement.
94+
- INVALID_COMMAND: Used to report a bad command.
95+
- FLOW_ERROR: Used to report a command sent out of order.
96+
- UNAUTHORIZED: Used to signify an authentication failure.
97+
- INVALID_FREQUENCY: Used to signify an invalid frquency being set.
98+
- INVALID_ID_LEN: Used to signify a malformed ID.
99+
- INVALID_ADDRESS: Used to signify a bad/out of bounds address.
100+
- INVALID_ADDRESS_ALIGNMENT: Used to signify an address that is not 0x400 aligned.
101+
102+
###### Data Packets
103+
104+
As implied by the above, the inline data packets need a `type`, `status`, and `args` section (if applicable) for successful communication.
105+
106+
- The `type` will be of the command being sent or acknowledged.
107+
- The `status` is one of those in the RESPONSE enum. If you are sending a command, you do not need to fill out this field; the UK47XD will fill this field, however.
108+
- The `args` section just contains the raw data that you are trying to pass in.
109+
110+
###### Commands.COMM_INIT
111+
112+
Initializes communication with the processor over UART. This must be sent before any other command is sent, otherwise you will receive a packet with a `FLOW_ERROR`. Upon success, you will receive an acknowledgement back from the system.
113+
114+
Example packet structure: ```[0x33, 0x2, 0x0, 0x3, 0x0]```
115+
116+
###### Commands.SET_CHIP_FREQ
117+
118+
Sets the processor speed in megahertz. This must be sent after the `COMM_INIT` command. Upon success, you will receive an acknowledgement back from the system. You must use either 8 or 16 MHz, as these are the only two operating frequencies.
119+
120+
Example packet structure (to set to 8 MHz): ```[0x33, 0x5, 0x0, 0x5, 0x00, 0x12, 0x7A, 0x00]```
121+
122+
###### Commands.ID_AUTHENTICATION
123+
124+
Unlocks the chip for reading. This must be sent after the `COMM_INIT` command, and the `SET_CHIP_FREQ`, in that order. Upon success, you will receive an acknowledgement back from the system. This cannot be bruteforced; if an attempt is made, the chip is wiped for security reasons (see below).
125+
126+
Example packet structure (assuming the password is DEADBEEFDEADBEEF): ```[0x33, 0x11, 0x0, 0x34, 0x44, 0x43, 0x41, 0x44, 0x42, 0x45, 0x45, 0x46, 0x44, 0x43, 0x41, 0x44, 0x42, 0x45, 0x45, 0x46]```
127+
128+
###### Commands.READ
129+
130+
Reads 0x400 bytes from a region. This must be sent after the unlocking the chip (see `ID_AUTHENTICATION`). Upon success, you will receive an acknowledgement back from the system, containing the 0x400 bytes.
131+
132+
Example packet structure (reading from 0x112233): ```[0x33, 0x5, 0x0, 0x69, 0x33, 0x22, 0x11, 0x00]```
133+
134+
## Security Features
135+
136+
The UK47XD includes several mechanisms for runtime and firmware security.
137+
138+
- An ID can be used to secure your processor. This is a 16 byte ID consisting of CAPITAL alphabetical characters 'A' through 'Z'. If a user attempts to bruteforce this password, the chip will be erased, preserving the contents.
139+
- The JTAG fuses can be blown to prevent tampering, or the OTP register set.
140+
- SWD is disabled unless you specifically request a development board from UNC Holdings.
141+
- As stated before, the bootrom and other secure assets cannot be read out, only user area.
142+
- Sudden voltage changes or glitching attempts will trigger a system reset.

0 commit comments

Comments
 (0)