[ehsankia]

Haha, I was gonna try exactly that, but I got too lazy trying to install pypy3 on my shitty centos box. My other option was to translate it into real assembly, but that also seemed like more work that I wanted to put into it.

[tntn]

> My other option was to translate it into real assembly

I wrote a compiler from emoji-code to amd64 (mostly because I'm more interested in compilers than reversing). It runs quite fast - prints the whole domain in ~1 min. I'd highly recommend it to people who are into assembly, it was a fun exercise.

[archgoon]

How did you implement the JUMP_TOP instruction? You need to jump to the x86_64 instructions that correspond to the given emoji index; did you implement a jump table?

[tntn]

Yeah, I put labels corresponding to the original IP throughout and used a jump table.

[archgoon]

That's pretty cool! I just transliterated the instructions into C macros; but i didn't bother with the jump tables. The nice thing with this approach is that you can mix vm instructions with c code freely; and get gdb support. I needed that because speeding up via C wasnt enough to decode the full URL and I still needed to do additional reversing.

Was your method fast enough to get all three parts of the URL?

[tntn]

It produces the full domain name (up to .com) in ~ 1 minute. If there is more to the url (a path, ?= parameters, etc) after the domain name, then no.

[aereal]

would you mind sharing this? I'd love to check it out :)

[tntn]

https://pastebin.com/eEuJcy18

[aereal]

I guessed the URL, but found nothing on it.

I'm guessing the flag may be in the rest of the message to be decoded.

[dvno42]

Check the pngs across the domain. There is something special in at least one of them.

[aereal]

Already checked them out, for EXIF data, visually and also inverted colors. What I am missing?

I scrapped and downloaded around 55 pngs.

[ehsankia]

Yeah, I found 55 profiles/pngs. Tried ordering the profiles by the image # (from 2 to 56). Noticed the profile names are also a variation of two emojis, so tried looking into binary/morse, but nothing.

As the comment above implies, it seems like my approach was wrong and the answer is in one of the images I guess

[dvno42]

I might be going the wrong way with that then. Using stegoveritas I noticed that PNG has a bunch of "ISO-8859 text, with very long lines, with no line terminators" files which isn't normal for PNGs.

[aereal]

If you'd like to whine a bit with me, join me at: ##ctfcompetition @ freenode, I'm currently under the nick caulifl0wer

[aereal]

I checked the pictures a lot of times, maybe I'm missing something.