Recent content on delroth's homepage
It all begins with one scary email late at night just before I had to go to sleep: From: abuse@hetzner.com Date: 2024-10-29 01:03:00 CET Subject: AbuseInfo: Potential Security issue: AS24940: 195.201.9.37 We have received an abuse report from abuse@watchdogcyberdefense.com for your IP address 195.201.9.37. We are automatically forwarding this report on to you, for your information. You do not need…
At the last NixCon in Darmstadt and later in private followup conversations I had the opportunity to talk with a lot of amazing fellow NixOS contributors about NixOS security, and how we could improve it in the future. This article is my personal wishlist of what I think should be worked on in the near-term to mid-term future. It’s not really a roadmap, because I don’t think it has any…
This blog post is a copy of an article I posted on the /r/emulation subreddit regarding the recent Dolphin / Valve / Nintendo “drama”. You can read it with comments over there. On /r/emulation 8 days ago /u/b0b_d0e (with a “Citra Developer” flair) mentioned: That’s right, you know how on all these other emulators like citra, ryu, yuzu, cemu etc they all say…
Been a while since I last took the time to solve a CTF challenge. I did not take part in the Boston Key Party CTF, but a friend of mine told me that I might be interested in this crackme. hypercube.dol is a GameCube binary that computes a value using terribly unoptimized code. The goal of the challenge is to understand the code and “optimize” the slow parts. Kind of like the “supercomputer”…
Since the release of Dolphin 3.5 half a year ago, audio processing in Dolphin has changed a lot. In Dolphin versions up to 3.5, a lot of games required low-level emulation of the DSP code in order to not crash or get audio output. This low-level emulation (called DSP LLE) is unfortunately a lot slower than high-level emulation (DSP HLE): while low-level emulation emulates extremely accurately the…
The Nuit du Hack CTF 2013 Quals round was taking place yesterday. As usual, I’ll be posting a few writeups about fun exercises and/or solutions from this CTF. If you want more, my teammate w4kfu should be posting some writeups as well on his blog soon. TL;DR: auth( '' . __class__ . __class__( 'haxx2' ,(),{ '__getitem__' : lambda self, * a: '' , '__len__' :( lambda l:l( 'function' )( l(…
MysteryBox was a remote server disassembling and running its input data for an unknown RISC-like CPU. As far as I know the unknown CPU is not a “real” CPU but a VM made solely for this challenge. Here is an example of how to interact with the remote MysteryBox service: $ perl -e 'print '\x00\x00\x00\x00'' | nc mysterybox.2013.ghostintheshellcode.com 4242 09007800 ldb sp, sp, sp Caught…
rtfm-67cc5dcb69df4244bcf2d573481e6d6a06b861a3: ELF 32-bit LSB executable rtfm-e24f03bb1204f8e3d40fae8ac135187a11b0ba5c: data rtfm is a binary processing ASCII input files and outputting seemingly compressed versions of these files: testing on a few long text files shows that the size of the output file is smaller than the input file. The second file from this challenge is a file compressed by rtfm…
hackthegibson: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked (uses shared libs), for GNU/Linux 2.6.15, BuildID[sha1]=0xb8515e4280130d84d4b4e1fd492da1b099ec0eb6, stripped hackthegibson is a 64-bit ELF for Linux using OpenSSL ( libcrypto ) and FFTW to analyze the spectrum of samples coming from /dev/dsp . The program does not take a key as an input, only sound data. That…
For the last two weeks, I’ve been working on enhancements and bug fixes related to audio processing in the Dolphin Emulator (the only Gamecube/Wii emulator that allows playing commercial games at the moment). Through this project I have learned a lot about how audio processing works in a Gamecube. Very little documentation is available on that subject, so I think writing an article…
I really enjoy reverse engineering stuff. I also really like playing video games. Sometimes, I get bored and start wondering how the video game I’m playing works internally. Last year, this led me to analyze Tales of Symphonia 2 , a Wii RPG. This game uses a custom virtual machine with some really interesting features (including cooperative multithreading) in order to describe cutscenes,…
This article was co-authored with Samuel Chevet . During the Nuit du Hack 2012 Prequals contest, we often had to remote exploit some services running in a custom VM (which was recently released on GitHub ). After injecting a shellcode in the services (through a remote stack buffer overflow) we were able to run VM code, which can execute interesting syscalls: read , write , open , exit , and a lot…
Once upon a time, Stefan Esser from the Hitmen programmed an IDA loader plugin to be able to analyze DOL files, which is the executable format used for Gamecube and Wii. Builds are published for versions up to 5.2, but nothing more recent. Fortunately they also released the source to their plugin, which allowed me (with some very minor modifications to the code to use linput_t instead of C FILE…
Recently Stripe (a startup trying to improve online payments for web developers) put online a fun CTF challenge with simple security exercises. Now that the challenge is done and the CTF is offline, I wanted to share my solutions with people who were interested in this CTF but were not able to solve it before the time limit. Unfortunately I don’t have the original source code of the…
What I mean by reading a Wii disc is simple: from a Wii DVD image, being able to get metadata about the game, like its name or its unique ID, but also being able to read the filesystem on the disc to access the game executable and data. We’ll do this in three parts: first, we’ll decrypt the disc clusters to be able to access the raw partition data, then we’ll parse the filesystem…
Most games nowadays avoid hardcoding behavior in the main program code. It makes the development process a lot easier by allowing people with less programming experience than the core engine developers to contribute by writing scripts which defines how conversations happen in the game, how menus work, how cinematic scenes go, etc. Scripts are usually written in a higher level language than the…
As in the other binary l33tness problems, only a single file was provided in the problem description: b300_b258110ad2d6100c4b8: gzip compressed data Decompressing this gives us a tar archive containing these files: ./0/ ./0/heap-dump-tm1306902723-pid12959.hprof ./0/classes.dex ./1/ ./1/1306902613084.jpgs ./1/1306903692478.jpgs ./2/ ./2/1306902613084.jpgs ./2/1306903692478.jpgs The binary is…
gb100 took a lot of time to pwn for us as we ran out of ideas really fast and it was mostly guessing. Anyway, this is a small writeup about this really simple problem from the DEFCON 19 CTF. The description of this problem contained only a host:port which we had to connect to. For the first 4 to 6 hours of the contest the server simply closed any incoming connection on the specified port, which…
Eri HaKawai is a new exploit for PAL Wiis, which works for all currently released System Menu versions (<= 4.3). It works by using a bug in the savegame loading code of Tales of Symphonia: Dawn of the New World, the sequel to the Gamecube game Tales of Symphonia. I’m releasing it in a source format (no binary data.bin ) under the GPLv2. You’ll need a Broadway cross-compilation…
This last Christmas I was happy to get gifted a brand new Nintendo Wii (“25 years of Mario” version) from someone in my family. Quickly my interests shifted from “playing games on the system” to trying to understand how the console works, and whether I could potentially run my own code on it. This led to an article on this blog about the Wii DVD file format , but also a lot…
In short I’m delroth, or Pierre Bourdon . Originally from France, currently living in Zürich, Switzerland. I’m an open source developer, mainly contributing to NixOS these days. In the past, I was a core developer for the Dolphin Emulator , and I was the main infrastructure maintainer as well as treasurer for the project. In my working life, I’ve worked for around 10 years as a…