RSFPWS - Teleport (RACTF 2021) Writeup

RSFPWS - Teleport

RSFPWS - Intercepted と同じゲームのプログラムと、そのゲームで用いるサーバのIPアドレスとポート番号が与えられた。
ゲームは一人称視点で移動ができるもので、その中に以下のような中に入るとflagが得られるという箱があった。
この箱には当たり判定があり、普通には入れないようだった。

A game program (same as one for RSFPWS - Intercepted) and a pair of an IP address and a port number for the game was given.
In the game, we can move around in first-persom view. There was a box which is said that entering inside the box will lead to getting the flag.
The box had solid walls and I couldn't enter inside that in a straightforward way.

与えられたゲームのデータをよく見ると、RARPG_Data/level0というファイルがあり、これがマップを表していそうだった。
このファイルをバイナリエディタで開くと、前半部分にCubeやHint Text (2)などの物の名前と考えられるデータがあった。
このあたりには名前の他にもデータがあり、実験の結果適当なデータを書き換えることでマップ上の物を消せることを発見した。
そのなかでも特に、0x2b58 番目のバイト (0-origin) を 0x57 から 0x58 に書き換えることで、箱の側面の壁を消して入れる状態にできることを発見した。

Looking at the game data closely, I found a file RARPG_Data/level0, which seemed to be the map data.
Viewing the file with a binary editor, I found strings that seemed to be names of objects like Cube and Hint Text (2) in the former part.
There are several other data around the strings. After some experiments, I found that some objects in the game disappears when I modify appropriate data.
Specifically, I found that changing the 0x2b58-th byte (the first byte is 0th) from 0x57 to 0x58 removes the side wall of the box and enables me to enter the box.

該当部分付近のデータ The data around the point

00002b00 fa 00 00 00 00 00 00 00 0b 00 00 00 04 00 00 00 |................| 00002b10 43 75 62 65 00 00 01 00 02 00 00 00 00 00 00 00 |Cube............| 00002b20 56 00 00 00 00 00 00 00 00 00 00 00 fb 00 00 00 |V...............| 00002b30 00 00 00 00 00 00 00 00 09 00 00 00 55 49 4d 61 |............UIMa| 00002b40 6e 61 67 65 72 00 00 00 00 00 01 00 00 00 00 00 |nager...........| 00002b50 04 00 00 00 00 00 00 00 57 00 00 00 00 00 00 00 |........W.......| 00002b60 00 00 00 00 91 00 00 00 00 00 00 00 00 00 00 00 |................| 00002b70 77 00 00 00 00 00 00 00 00 00 00 00 ab 00 00 00 |w...............| 00002b80 00 00 00 00 0b 00 00 00 08 00 00 00 43 75 62 65 |............Cube| 00002b90 20 28 33 29 00 00 01 00 04 00 00 00 00 00 00 00 | (3)............| 00002ba0 58 00 00 00 00 00 00 00 00 00 00 00 92 00 00 00 |X...............| 00002bb0 00 00 00 00 00 00 00 00 78 00 00 00 00 00 00 00 |........x.......| 00002bc0 00 00 00 00 ac 00 00 00 00 00 00 00 0b 00 00 00 |................| 00002bd0 08 00 00 00 43 75 62 65 20 28 34 29 00 00 01 00 |....Cube (4)....| 00002be0 04 00 00 00 00 00 00 00 d5 00 00 00 00 00 00 00 |................| 00002bf0 00 00 00 00 c2 00 00 00 00 00 00 00 00 00 00 00 |................|

この状態で箱に入り、後ろの方に行くと、flagが表示された。

After that, I entered the box and moved back, finding the flag displayed.

この状態でCheat Engineでゲームにアタッチして Memory Viewer を開き、 Unicode の Text ractf{を検索すると、メモリ上にflagの文字列データが見つかった。
該当のデータをコピーし、CyberChefで処理することで、flagの文字列データが得られた。

After that, I attached Cheat Engine to the game and opened the Memory Viewer. I searched for Unicode Text ractf{, finding the string data of the flag on the memory.
I copied the data and processed via CyberChef to obtain the string data of the flag.

ractf{T3l3port1ng_iS_fuN!}