Once you get a good command-line solution, this can usefully form the basis of automated testing

As Jordan says, the key here is to run ndisasm over the file, and notice the ‘mov byte’ invocations. Collecting them with grep is simple, and then cut can be used to grab just the bytes themselves out.

ndisasm -u picture-puzzle.bmp | grep ‘mov byte’ | cut -d, -f2

This produces the bytes we want, one per line. To make printf’s job easier, we need to replace ‘^0x’ with ‘\x…’ (using single quotes here to make the \ safe from the shell, but still doubling it because of sed), and also replace ‘x0$’ (the null) with ‘x0a’ (LF)

… | sed -e ’s/^0x/\\x/; s/x0$/x0a/’

The tr command is a great way to strip out all the newlines, and make this one single line for the printf command … which wraps around the whole commandline using the $() operator from bash (easier to read than the traditional shell ` backticks)

printf $(ndisadm …|tr -d ‘\n’)

Oh noes! An alphabet substitution … quickly fixed with the caesar program, which will do a quick letter frequency count to determine the correct rotation to use … in this case, it’s 13 of course.

printf $(ndisasm -u picture-puzzle.bmp | grep ‘mov byte’ | cut -d, -f2 |
sed -e ’s/^0x/\\x/; s/x0$/x0a/’ | tr -d ‘\n’ ) | caesar

Hello from BMP shellcode!
hfre32
ZrffntrObkN

I’ll shut up now.

However, that was clearly the easy part. I’m still trying to figure out how to trim it down to that particular string from the whole hex dump. Mind you, I don’t have nearly the skills Jordan clearly does.

I’m very interested in learning about these analyses that you describe in your various posts.

Are there useful tools (such as the shellcode wrapper or debugger that Jordan mentions) available as freeware for Windows?

Thanks!

FYI if anybody tries to copy/paste: the smart quotes from WordPress will likely get in the way.

Also, my method is certainly not the recommended way to actually learn from the challenge. Dump into a shellcode wrapper or debugger for maximum enjoyment.

Look through file, observe some shellcode sequences, dump the whole thing straight into ndisasm:

ndisasm -u picture-puzzle.bmp

Notice all the bytes being directly written to a local, so grep out the interesting bytes:

dd if=picture-puzzle.bmp bs=1 2>/dev/null|ndisasm -u -|grep ‘mov byte’|sed ’s/[^,]*,0/\\/g’|tr -d ‘\n’

Run through printf after changing null bytes to newlines:

printf ‘\x55\x72\x79\x79\x62\x20\x73\x65\x62\x7a\x20\x4f\x5a\x43\x20\x66\x75\x72\x79\x79\x70\x62\x71\x72\x21\x0a\x75\x73\x65\x72\x33\x32\x0a\x4d\x65\x73\x73\x61\x67\x65\x42\x6f\x78\x41\x0a’

Uryyb sebz OZC furyypbqr!
user32
MessageBoxA

Looks like alphabetic substitution on the interesting string, notice no obvious operations in the shellcode to deobfuscate it, take a wild shot on rot13, get lucky, and done.