During this weekend’s ASIS CTF, I solved the “Odrerre” challenge. This challenge was relatively straightforward compared to other challenges such as “3Magic” and “binarycloud”, but it’s worth documenting nonetheless.

This challenge started off with a broken PNG file:

hopefully this renders properly…

A quick inspection in 010 editor appears to reveal no obvious errors: none of the headers are out of place, a PNG template reports all good:

inside 010 editor

The only thing of interest is the IDAT chunks. IDAT chunks contain zlib-compressed data, which represents the actual pixels of the image. If you get more of the blocks in the right order, more and more pieces of the image appear – in this case, the first chunk seems to have been given to us as a freebie.

Half an hour of (manually) fiddling with the order of the IDAT blocks in 010 editor later, and you get the output image and a complete flag:

tada!

This was solved in time for the CTF, so we scored some internet points for this.

Following the CTF, I engaged in some discussion with a fellow explorer of the internet around other ways we might be able to do this. Specifically, the idea came up that we might be able to optimise our solve, by using measuring the ability of zlib to decompress a given order of images. The train of thought went something like this:

• Most naive solution: brute force all the orders of IDAT chunks
• Less naive solution: brute force each “depth” of chunk, by trying each possible chunk and checking for the zlib decompress error. “-5” was better than “-3”
• Less naive solution: for a given depth x with possible chunks idats_remaining, we feed zlib increasing data from each remaining idat to try. Let’s say idat_a gives a “-5” error when you hit 0x100 bytes, idat_b gives a “-5” error when you hit 0x140 bytes: idat_b would be rated “more optimal” than idat_a

After some brief experimentation in Python, it looks like the zlib interface simply isn’t granular enough to provide the result we need, and this will need some digging through zlib’s source code to identify exactly where decompression fails (but this will doubtless be useful in spotting anomalies in other PNG images).

In other news, I bought myself some SDR equipment to play around with, and after a bit of wrestling with the build process, gqrx and friends work inside a VM on my laptop:

good times.

Fuck yes, time to play with cool technology stuff.