PicoCTF2026 - JITFP

ps aux
# PID 1:  /sbin/docker-init -- /opt/start.sh
# PID 8:  python3 /root/jitfp-service.py   <--- THE DAMN JIT SERVICE

1
#!/usr/bin/env python3
2
"""
3
JITFP Solver - Time-synced sampling.
4
The JIT service patches check function comparison bytes just-in-time,
5
one per second, synced with the binary's check loop.
6
We sample at each second to capture the correct character for each position.
7
"""
8
import os, struct, time, subprocess, sys, select
9

10
dword_4020 = [
11
    30, 22, 11, 32, 25, 4, 9, 7, 19, 23, 5, 26, 18, 27, 16, 1,
12
    8, 15, 2, 14, 3, 13, 24, 21, 12, 17, 6, 10, 29, 28, 20, 31, 0
13
]
14

15
def log(msg):
16
    sys.stderr.write(msg + "\n")
17
    sys.stderr.flush()
18

19
def read_mem(pid, addr, size):
20
    with open(f"/proc/{pid}/mem", "rb") as mem:
21
        mem.seek(addr)
22
        return mem.read(size)
23

24
def get_base(pid):
25
    with open(f"/proc/{pid}/maps", "r") as f:
26
        for line in f:
27
            if "ad7e550b" in line:
28
                return int(line.split("-")[0], 16)
29
    return None
30

31
def read_cmp_byte(pid, func_addr):
32
    """Read the comparison byte from a check function."""
33
    code = read_mem(pid, func_addr, 16)
34
    for j in range(len(code) - 3):
35
        if code[j] == 0x80 and code[j+1] == 0x7d and code[j+2] == 0xfc:
36
            return code[j+3]
37
    return None
38

39
dummy_flag = "picoCTF{MOHAMEDISTHEGOATHEHEHEHE}"
40
log(f"Starting binary with faake flag ({len(dummy_flag)} chars)")
41

42
proc = subprocess.Popen(
43
    ["./ad7e550b", dummy_flag],
44
    stdout=subprocess.PIPE,
45
    stderr=subprocess.PIPE
46
)
47
pid = proc.pid
48
log(f"PID: {pid}")
49

50
time.sleep(0.5)
51

52
base = get_base(pid)
53
if base is None:
54
    log("No base addr!")
55
    proc.kill()
56
    sys.exit(1)
57
log(f"Base: {hex(base)}")
58

59
# First, we need to compoare on-disk vs runtime code
60
log("\n=== Comparing disk vs runtime ===")
61
with open("./ad7e550b", "rb") as f:
62
    disk = f.read()
63

64
# Compare check functions region (0x11D5 - 0x1932)
65
try:
66
    rt_checks = read_mem(pid, base + 0x11D5, 0x1932 - 0x11D5)
67
    disk_checks = disk[0x11D5:0x1932]
68
    check_diffs = [(0x11D5+i, disk_checks[i], rt_checks[i])
69
                   for i in range(len(disk_checks)) if disk_checks[i] != rt_checks[i]]
70
    if check_diffs:
71
        log(f"Check functions: {len(check_diffs)} bytes modified!")
72
        for addr, d, r in check_diffs[:20]:
73
            log(f"  {hex(addr)}: disk=0x{d:02x} runtime=0x{r:02x}")
74
    else:
75
        log("Check functions: identical")
76
except Exception as e:
77
    log(f"Error comparing checks: {e}")
78

79
# Compare main function (0x1982 - 0x1B1B)
80
try:
81
    rt_main = read_mem(pid, base + 0x1982, 0x1B1B - 0x1982)
82
    disk_main = disk[0x1982:0x1B1B]
83
    main_diffs = [(0x1982+i, disk_main[i], rt_main[i])
84
                  for i in range(len(disk_main)) if disk_main[i] != rt_main[i]]
85
    if main_diffs:
86
        log(f"Main function: {len(main_diffs)} bytes modified!")
87
        for addr, d, r in main_diffs[:20]:
88
            log(f"  {hex(addr)}: disk=0x{d:02x} runtime=0x{r:02x}")
89
    else:
90
        log("Main function: identical")
91
except Exception as e:
92
    log(f"Error comparing main: {e}")
93

94
# Compare permutation table
95
try:
96
    rt_perm = read_mem(pid, base + 0x4020, 33 * 4)
97
    disk_perm = disk[0x3020:0x3020 + 33*4]  # file offset = VA - 0x1000 for data segment
98
    # Actually data is at file offset 0x3000 for VA 0x4000, so 0x4020 -> file 0x3020
99
    if rt_perm != disk_perm:
100
        log("Permutation table: MODIFIED!")
101
        for i in range(33):
102
            rv = struct.unpack("<I", rt_perm[i*4:(i+1)*4])[0]
103
            dv = struct.unpack("<I", disk_perm[i*4:(i+1)*4])[0]
104
            if rv != dv:
105
                log(f"  [{i}] disk={dv} runtime={rv}")
106
    else:
107
        log("Permutation table: identical")
108
except Exception as e:
109
    log(f"Error comparing perm: {e}")
110

111
log("\n=== Initial function pointer table ===")
112
table_data = read_mem(pid, base + 0x4120, 33 * 8)
113
initial_ptrs = []
114
for i in range(33):
115
    ptr = struct.unpack("<Q", table_data[i*8:(i+1)*8])[0]
116
    initial_ptrs.append(ptr)
117
    if ptr:
118
        off = ptr - base
119
        cb = read_cmp_byte(pid, ptr)
120
        log(f"  [{i:2d}] off={hex(off)} cmp={hex(cb) if cb else '?'} ('{chr(cb) if cb else '?'}')")
121
    else:
122
        log(f"  [{i:2d}] NULL")
123

124
# Now do time-synced sampling over the execution
125
# The binary timeline:
126
# t~0: banner prints (32 '=' + 'v\n')
127
# t~1: sleep(1) ends, check j=0
128
# t~2: sleep(1) ends, check j=1
129
# ...
130
# t~33: sleep(1) ends, check j=32
131
# t~34: null check
132

133
log("\n=== Time-synced sampling (every 0.5s for 40s) ===")
134
start_time = time.time()
135
samples = []
136

137
for tick in range(80):
138
    t = time.time() - start_time
139

140
    try:
141
        os.kill(pid, 0)
142
    except ProcessLookupError:
143
        log(f"  Process exited at t={t:.1f}")
144
        break
145

146
    try:
147
        # Read table
148
        td = read_mem(pid, base + 0x4120, 33 * 8)
149
        ptrs = []
150
        for i in range(33):
151
            ptrs.append(struct.unpack("<Q", td[i*8:(i+1)*8])[0])
152

153
        # Read comparison bytes from each function
154
        cmp_bytes = []
155
        for i in range(33):
156
            if ptrs[i]:
157
                cb = read_cmp_byte(pid, ptrs[i])
158
                cmp_bytes.append(cb)
159
            else:
160
                cmp_bytes.append(None)
161

162
        samples.append((t, ptrs, cmp_bytes))
163

164
        # Log changes from initial state
165
        changes = []
166
        for i in range(33):
167
            if ptrs[i] != initial_ptrs[i]:
168
                changes.append(f"tbl[{i}]")
169
            if cmp_bytes[i] and initial_ptrs[i]:
170
                init_cb = read_cmp_byte(pid, initial_ptrs[i]) if tick == 0 else None
171
                # Just track the current comparison byte
172

173
        # Build current flag from this snapshot
174
        flag_now = []
175
        for j in range(33):
176
            idx = dword_4020[j]
177
            if idx < len(ptrs) and ptrs[idx]:
178
                cb = cmp_bytes[idx]
179
                if cb:
180
                    flag_now.append(chr(cb))
181
                else:
182
                    flag_now.append("?")
183
            else:
184
                flag_now.append("?")
185

186
        flag_str = "".join(flag_now)
187
        if tick % 2 == 0:
188
            log(f"  t={t:5.1f} flag={flag_str}")
189
    except Exception as e:
190
        log(f"  t={t:.1f} error: {e}")
191

192
    time.sleep(0.5)
193

194
log("\n=== Flag reconstruction ===")
195
final_flag = []
196
for j in range(33):
197
    target_time = j + 1.5
198
    best_sample = None
199
    best_dt = float('inf')
200
    for t, ptrs, cmp_bytes in samples:
201
        dt = abs(t - target_time)
202
        if dt < best_dt:
203
            best_dt = dt
204
            best_sample = (t, ptrs, cmp_bytes)
205

206
    if best_sample:
207
        t, ptrs, cmp_bytes = best_sample
208
        idx = dword_4020[j]
209
        cb = cmp_bytes[idx] if idx < len(cmp_bytes) else None
210
        ch = chr(cb) if cb else '?'
211
        final_flag.append(ch)
212
        log(f"  flag[{j:2d}]: '{ch}' (from sample at t={t:.1f}, target t={target_time:.1f})")
213
    else:
214
        final_flag.append("?")
215

216
flag_result = "".join(final_flag)
217
log(f"\nFinal flag: {flag_result}")
218
print(flag_result)
219

220
proc.kill()
221
proc.wait()