Here comes the third year of small file competition organized by a group of security researcher or reverse engineer:

tmpout.sh/bggp/3/

Unlike the prior contests in 2020 and 2021, this year's contest will involve a lot of creative thinking.




Now I will become more like ethical hacker...




I don't dare to try the last two scenario. If I were able to create EXE that crashes Windows, I will be in the tech news headline tomorrow. Smile

This contest runs from June 17th 2022 to August 19th 2022 (New York time)

@angch, I see you followed @binarygolf on Twitter. Nice to see you there! This year contest is more challenging, isn't it?

Meh. It's just a fuzzing challenge. Boring.

Start here: Divide by zero.

Edit: Wait. Re-reading instructions.

This post has been edited by angch: Jun 18 2022, 01:39 PM

Find bug, become white hat hacker, haha.

Like just now, I almost crash DependencyWalker 2.20 using a special EXE, but after 40 seconds not responding, it comes alive again, so sad, I did not succeed to make it crash.

Interesting challenge. I joined their Discord out of curiosity and there are some really interesting conversations.

Someone managed to crash something, ended up with eip and edx with 33333333

Hope to see your name in final result of BGGP #3.

I guess Windows 11 is too strong to break, not easy to find way to crash their apps.

Like @netspooky said, someone managed to crash media player with 1-byte file, but I already tried that before, with 0-byte or 1-byte DOCX, WAV, MP3, Microsoft's apps handle them very steady and properly.

Looks like I must find not well-known app to crash. What do you think, @junyian and @angch?

I’m equally clueless. Haha. It’s not as if I purposely find apps to crash every now and then. When I first read the intro to the competition, my first thought is to browse CVEs. But man, even that is so tedious.

Looks like I have no luck in crashing random media player.



Me trying to fool "aplay" to play 0-byte and 1-byte MP3/WAV.

Why aren't you using honggfuzz like mentioned in the challenge? Much easier.

aplay is gonna be tough. Unless detects it as a .wav file, it just memcpy to the kernel, and for wav, it just uses the length to chunk read/write the file.

https://github.com/bear24rw/alsa-utils/blob...r/aplay/aplay.c

Nice you found the source code online. I didn't read the entire source file of "aplay", though I see it handles quite well, I think the key method to make them crash is "unhandled exception" (as pointed out by the challenge intro).

Umm.... what about you, any progress so far?

(Chuckle) At first I thought it is a Chinese brand (because of "hong"), that's why I didn't bother to look further.

This post has been edited by FlierMate1: Jun 24 2022, 05:18 PM

Look! My second attempt. This time with DOS emulator (DOSBox).

I downloaded Enhanced DEBUG from the Internet (since DOSBox does not include DEBUG.COM/EXE) and assemble a small COM program.



It is 5 bytes executable. Upon running BOOT.COM, this is the result in DOSBox! (Sadly, not considered "crash")

Crashing DOS is like shooting fish in a barrel. C'mon lar. One 0xCC should be enough to trigger the non-existent debugger.

Edit. I was bored. 5 minute hack, fully recorded. Who needs DOSbox.

https://www.youtube.com/watch?v=rD17005enXM

This post has been edited by angch: Jun 25 2022, 01:48 PM

Woohoo! Great findings, angch!

Yours is PCE, my DOSBox also hang, but no crash message.


I like your discovery. From my understanding, "int 3" is to set breakpoint in debugger.

But the result is not consistent, if you save the 1-byte "0xcc" as a COM executable, next time restart the emulator and run the COM program again, DOSBox won't hang anymore, instead, it shows "list of mounted drives".


---

BUT... but, if I create two small program, run the first and then the second program:




(On separate program)

Then, DOSBox will "exit to error":



JMP 0 is equivalent to: JMP absolute address 0x0000ff00

This post has been edited by FlierMate1: Jun 25 2022, 07:29 PM

Depends on where the address at int 3 is pointing to.

or do a 0xeb 0xfe
JMP 100

2 byte infinite loop.

Not quite crashing the *caller*, mind you, which I interpret as not a valid entry to the competition.

This post has been edited by angch: Jun 25 2022, 03:21 PM

[ Entry Template ]

Please fill out this template for your submission.

---BEGIN BGGP3 ENTRY---
Name or handle:
Contact Info:
Website, twitter, other online presence:
Target Software and Version:
Description of Target Software's Environment (Platform/OS, Setup Instructions, etc.):
Target File Type:
SHA256 Hash:
Brief Description of Crash:
Was this a new crash, or a known bug?
Link to PoC video, screenshot, or console output, if any:
Link to writeup, if any:
CVE or other acknowledgement, if any:
File contents (base64 encoded please):
---END BGGP3 ENTRY---

Your entry's score will be associated with a specific software, and if necessary, software
version. Please only submit one entry per software.

We may contact you for questions on reproducibility, so please include your contact information
in your submission.

All entries should be sent via email to bggp [ AT ] tmpout.sh

More info at https://tmpout.sh/bggp/3/