From the east comes a family member
Oriental Relation
Smooth peaches have briefness
Nectarine Transience
Grave messages are the most cheerful
Epitaphs Happiest
To disturb leads to being peaceful
Fluster Restful
Excessive suaveness causes omissions
Oiliness Elisions
Being dismounted results in preparation for burial
Unhorsed Enshroud
Aire and the Leeds & Liverpool Canal.
艾尔和利兹利物浦运河。
George Orwell 1984 real name Eric Blair
Wigan码头
If Paul Weller is recording at 2A
Stanley Road Changeline Bridge No 2A
molesworths friend (his pater is a general) is at 40
Gillibrand Bridge No 40
Blair's road finishes between 50 and 51
Wigan Pier is between Seven Stars Bridge No 50 & Pottery Changeline Bridge No 51
a great physicist is at 164
Newton Bridge No 164
an adjacent equine is at 180
Horse Close Bridge No 180
200 is 2 more than 201
Five Rise Locks Swing Bridge No 200 and Three Rise Locks Swing Bridge No 201
Titus' world heritage site is at 207A
Saltaire Bridge No 207A
where is Lanehouse (it moves)?
Lanehouse Swing Bridge is Bridge 189
英语单词
1 the 126 name
2 of 127 very
3 to 128 through
4 and 129 just
5 a 130 form
6 in 131 much
7 is 132 great
8 it 133 think
9 you 134 say
10 that 135 help
11 he 136 low
12 was 137 line
13 for 138 before
14 on 139 turn
15 are 140 cause
16 with 141 same
17 as 142 mean
18 I 143 differ
19 his 144 move
20 they 145 right
21 be 146 boy
22 at 147 old
23 one 148 too
24 have 149 does
25 this 150 tell
26 from 151 sentence
27 or 152 set
28 had 153 three
29 by 154 want
30 hot 155 air
31 but 156 well
32 some 157 also
33 what 158 play
34 there 159 small
35 we 160 end
36 can 161 put
37 out 162 home
38 other 163 read
39 were 164 hand
40 all 165 port
41 your 166 large
42 when 167 spell
43 up 168 add
44 use 169 even
45 word 170 land
46 how 171 here
47 said 172 must
48 an 173 big
49 each 174 high
50 she 175 such
51 which 176 follow
52 do 177 act
53 their 178 why
54 time 179 ask
55 if 180 men
56 will 181 change
57 way 182 went
58 about 183 light
59 many 184 kind
60 then 185 off
61 them 186 need
62 would 187 house
63 write 188 picture
64 like 189 try
65 so 190 us
66 these 191 again
67 her 192 animal
68 long 193 point
69 make 194 mother
70 thing 195 world
71 see 196 near
72 him 197 build
73 two 198 self
74 has 199 earth
75 look 200 father
76 more 201 head
77 day 202 stand
78 could 203 own
79 go 204 page
80 come 205 should
81 did 206 country
82 my 207 found
83 sound 208 answer
84 no 209 school
85 most 210 grow
86 number 211 study
87 who 212 still
88 over 213 learn
89 know 214 plant
90 water 215 cover
91 than 216 food
92 call 217 sun
93 first 218 four
94 people 219 thought
95 may 220 let
96 down 221 keep
97 side 222 eye
98 been 223 never
99 now 224 last
100 find 225 door
101 any 226 between
102 new 227 city
103 work 228 tree
104 part 229 cross
105 take 230 since
106 get 231 hard
107 place 232 start
108 made 233 might
109 live 234 story
110 where 235 saw
111 after 236 far
112 back 237 sea
113 little 238 draw
114 only 239 left
115 round 240 late
116 man 241 run
117 year 242 don't
118 came 243 while
119 show 244 press
120 every 245 close
121 good 246 night
122 me 247 real
123 give 248 life
124 our 249 few
125 under 250 stop
Rank Word Rank Word
251 open 376 ten
252 seem 377 simple
253 together 378 several
254 next 379 vowel
255 white 380 toward
256 children 381 war
257 begin 382 lay
258 got 383 against
259 walk 384 pattern
260 example 385 slow
261 ease 386 center
262 paper 387 love
263 often 388 person
264 always 389 money
265 music 390 serve
266 those 391 appear
267 both 392 road
268 mark 393 map
269 book 394 science
270 letter 395 rule
271 until 396 govern
272 mile 397 pull
273 river 398 cold
274 car 399 notice
275 feet 400 voice
276 care 401 fall
277 second 402 power
278 group 403 town
279 carry 404 fine
280 took 405 certain
281 rain 406 fly
282 eat 407 unit
283 room 408 lead
284 friend 409 cry
285 began 410 dark
286 idea 411 machine
287 fish 412 note
288 mountain 413 wait
289 north 414 plan
290 once 415 figure
291 base 416 star
292 hear 417 box
293 horse 418 noun
294 cut 419 field
295 sure 420 rest
296 watch 421 correct
297 color 422 able
298 face 423 pound
299 wood 424 done
300 main 425 beauty
301 enough 426 drive
302 plain 427 stood
303 girl 428 contain
304 usual 429 front
305 young 430 teach
306 ready 431 week
307 above 432 final
308 ever 433 gave
309 red 434 green
310 list 435 oh
311 though 436 quick
312 feel 437 develop
313 talk 438 sleep
314 bird 439 warm
315 soon 440 free
316 body 441 minute
317 dog 442 strong
318 family 443 special
319 direct 444 mind
320 pose 445 behind
321 leave 446 clear
322 song 447 tail
323 measure 448 produce
324 state 449 fact
325 product 450 street
326 black 451 inch
327 short 452 lot
328 numeral 453 nothing
329 class 454 course
330 wind 455 stay
331 question 456 wheel
332 happen 457 full
333 complete 458 force
334 ship 459 blue
335 area 460 object
336 half 461 decide
337 rock 462 surface
338 order 463 deep
339 fire 464 moon
340 south 465 island
341 problem 466 foot
342 piece 467 yet
343 told 468 busy
344 knew 469 test
345 pass 470 record
346 farm 471 boat
347 top 472 common
348 whole 473 gold
349 king 474 possible
350 size 475 plane
351 heard 476 age
352 best 477 dry
353 hour 478 wonder
354 better 479 laugh
355 true . 480 thousand
356 during 481 ago
357 hundred 482 ran
358 am 483 check
359 remember 484 game
360 step 485 shape
361 early 486 yes
362 hold 487 hot
363 west 488 miss
364 ground 489 brought
365 interest 490 heat
366 reach 491 snow
367 fast 492 bed
368 five 493 bring
369 sing 494 sit
370 listen 495 perhaps
371 six 496 fill
372 table 497 east
373 travel 498 weight
374 less 499 language
375 morning 500 among
the LXF WXKFt eCeKNRQN Ot WXKFt tODe the VGKSR KXLheR OF Q EOKESe QFR tXKFeR GF OtL QBOL QFR tODe VQL WXLN WXKFOFU the NeQKL QFR the HeGHSe QFNVQN VOthGXt QFN heSH YKGD hOD LG OY he WXKFt thOFUL VOth the YOKeDeF QFR the LXF WXKFt tODe thQt DeQFt thQt eCeKNthOFU WXKFt WN KQN WKQRWXKN
thQt" -----------“Q”猜A
the LXF WXKFt eCeKNRaN Ot WXKFt tODe the VGKSR KXLheR OF a EOKESe aFR tXKFeR GF OtL aBOL aFR tODe VaL WXLN WXKFOFU the NeaKL aFR the HeGHSe aFNVaN VOthGXt aFN heSH YKGD hOD LG OY he WXKFt thOFUL VOth the YOKeDeF aFR the LXF WXKFt tODe that DeaFt that eCeKNthOFU WXKFt WN KaN WKaRWXKN
the LXn WXKnt eCeKNdaN it WXKnt time the VGKSd KXLhed in a EiKESe and tXKned Gn itL aBiL and time VaL WXLN WXKninU the NeaKL and the HeGHSe anNVaN VithGXt anN heSH YKGm him LG iY he WXKnt thinUL Vith the YiKemen and the LXn WXKnt time that meant that eCeKNthinU WXKnt WN KaN WKadWXKN
eCeKNthinU” -------“everything” or that “VithGXt” ----------- “without”
the sun burnt everyday it burnt time the world rushed in a circle and turned on its axis and time was busy burning the years and the people anyway without any help from him so if he burnt things with the firemen and the sun burnt time that meant that everything burnt by ray bradbury
5字一组,但内容一样,对着
the sun burnt everyday it burnt time the world rushed in a circle and turned on its axis and time was busy burning the years and the people anyway without any help from him so if he burnt things with the firemen and the sun burnt time that meant that everything burnt by ray bradbury
WIGUW WEYUP UKDGU BMEBP。。。。。。。。。
t he su nburn tev er ydayi。。。。。。。。。
THESE MESSAGES TELL YOU WHAT THE CODEWORD IS. ALL BUT ONE GIVES YOU THREE DIGITS. THE FIRST TWO ARE COORDINATES OF WHERE TO PUT THE THIRD IN A NINE BY NINE GRID. WHEN YOU HAVE ALL SEVENTEEN DIGITS, SOLVE THE SUDOKU. THE EIGHTEENTH ANSWER IS NINE LETTERS WHICH YOU USE TO REPLACE ONE TO NINE IN THE GRID. YOU WILL THEN SEE THE CODEWORD IN THE MIDDLE.
"The author of that favourite novel of yours? Well he shares his surname with another who came from Sheffield and who wrote a novel set in a fictional seaside town that shares its name with a real one in Devon. That town has a castle that isn't a castle, and the architect of that worked with another architect in Plymouth and this second architect died on the same day that an author first gave a lecture on manners. He gave part seven of the series on the same day as someone else became famous for surviving. The husband of the artist who painted this event wrote the biography of a man who was killed in a battle that ended a war. The peace treaty was signed on the same day as two Nobel Laureates were born. The one of these who wasn't a writer was born in a town where a famous conference took place and the man who presided over this had been crowned king only recently in a cathedral that was built by, and is the resting place of, a man who was the son of a king who made a famous gift. When was that?"
中文名称:Songs Of Queen 别名:Gregorian Chants 资源类型:MP3! 发行时间:2000年 专辑歌手:Auscultate 地区:英国 语言:英语 简介: 专辑介绍: 稍微介绍一下这个系列的专集,这一套由Auscultate演唱的Gregorian Chants系列[Gregorian Chants Performed By Avsculate]一共八张(Songs Of The Beatles,Songs Of Celine Dion,Love Songs,Rock Ballads,Songs Of Queen,Songs Of Simon & Garfunkel,Rock Anthems ,Love Ballads)是由Avscvltate吸取流行音乐的元素,结合宗教圣咏的方式,将流行音乐进行重新制作的专集,外面很少见,想来一方面除了有继续延伸或者传播这种古老的音乐方式外,还有渐渐与潮流靠拢的倾向,而作为宗教歌曲的某些特性与newage似乎不谋而合,所以随处可见newage的点点融合在音乐中…… 本张专辑均为皇后乐队的经典名曲。
歌剧院之夜A Night At The Opera
Songs Of Queen
中文名称:Songs Of Queen 别名:Gregorian Chants 资源类型:MP3! 发行时间:2000年 专辑歌手:Auscultate 地区:英国 语言:英语 简介: 专辑介绍: 稍微介绍一下这个系列的专集,这一套由Auscultate演唱的Gregorian Chants系列[Gregorian Chants Performed By Avsculate]一共八张(Songs Of The Beatles,Songs Of Celine Dion,Love Songs,Rock Ballads,Songs Of Queen,Songs Of Simon & Garfunkel,Rock Anthems ,Love Ballads)是由Avscvltate吸取流行音乐的元素,结合宗教圣咏的方式,将流行音乐进行重新制作的专集,外面很少见,想来一方面除了有继续延伸或者传播这种古老的音乐方式外,还有渐渐与潮流靠拢的倾向,而作为宗教歌曲的某些特性与newage似乎不谋而合,所以随处可见newage的点点融合在音乐中…… 本张专辑均为皇后乐队的经典名曲。
歌剧院之夜A Night At The Opera
The Supremacy of THE BOURNE SUPREMACY 《谍影重重II:伯恩的霸权》
英国地名
ANGLESEY
音乐Life of Riley Season 安逸生活
音乐 » A Head of Steam
FRONT of HOUSE Magazine (abbreviated FOH) is a worldwide news service for live audio professionals. Published by Timeless Communications, Corp a Nevada corporation.
Tim Koch – Seven Ate Nine (3:03)
“Banshee”在爱尔兰盖尔语中被称为“bean sidhe”,意思是“拥有超能力的女人”。她拥有露出的牙齿,红色的眼睛,只有一个鼻孔。脚部长有青蛙般的蹼,外貌令人不安的雌性妖精。 她不会做甚么大奸大恶的事情,她的眼睛红肿是因为知道有人死了所以才哭至红肿的。但是人类以为她的存在是代表不吉利,固对她仍存在着恐惧。 Banshee只针对五个主要家族:奥尼尔、奥布莱恩、奥康诺、奥格拉迪斯、卡瓦奈(the O'Neills, the O'Briens, the O'Connors, the O'Gradys and the Kavanaghs)及与这五个大家族有联姻关系的其他家族。 Banshee通常以下面3种形象中的一种出现在世人面前:年轻的女子、神情庄严的妇人、或邋遢的老巫婆,象征凯尔特神话中拥有3种不同样貌的战争与死亡女神,即Badhbh(又做“Badb”),Macha和Mor-Rioghain(又做“Morrigan”)。Banshee一般穿着灰色斗篷或缠绕的碎布、抑或死者的尸布;她也会以一名洗衣妇的形象出现,在河边清洗染满鲜血的被预言将死之人的衣物。在爱尔兰,相传她会以一名穿著绿色长裙的妙龄少女出现。在沼地出现时,会以恐怖的哭声告诉人类死亡的来临。 Banshee是一群无配偶的孤独生物,她们都是以个体而非团体生活。当多个Banshee聚集在一起恸哭则代表某位拥有崇高或神圣地位的人类即将离去。
9) Georgia, first in itinerary for US Emperor, "The Little Boot." (5)
美利坚合众国皇帝和墨西哥摄政王,诺顿一世陛下(约书亚·亚伯拉罕·诺顿,1819-1880).
http://zh.wikipedia.org/wiki/%E8%AF%BA%E9%A1%BF%E4%B8%80%E4%B8%96
还把美国当殖民地。。。。。。。。。。。真要英国文化才行。。。。。
My beginning (or end if you prefer) is nowhere in particular, one greater than my parent. Splitting the great from the little I skirt somewhere where Alain De Botton would not like to live. Before I can reach an intelligent plant I lose my identity, and eleven. Ninety degrees later I recover and visit a tautological attic, then meet an orthogonal nine hundred and ninety three greater. A transition indicates that going consistently northeast leads to passing from east to south just before the origin of an eponymous bishop who made a Thatcherian mistake for which he paid even more dearly. Just after this I finish (or start, if you prefer) when three greater, though lesser, subsumes me.
CM3 1GS: Great and Little Leighs, Chelmsford District, Essex County, England (英格兰 埃塞克斯郡 切姆斯福德区 Great and Little Leighs)
Address: Great and Little Leighs, Chelmsford District, Essex County, England
(地址: 英格兰 埃塞克斯郡 切姆斯福德区 Great and Little Leighs)
Postcode (邮编): CM3 1GS
Latitude (纬度): 51.8271
Longitude (经度): 0.5048
Accuracy (精度): 6
阿兰·德波顿(Alain de Botton),作家,生于1969年,毕业于剑桥大学,现住伦敦。著有小说《爱情笔记》、《爱上浪漫》及散文作品《拥抱逝水年华》、《哲学的慰藉》等。
Great Notley, or formerly Great Notley Garden Village is a suburban development, mostly by Countryside Properties on the fringe of Braintree, Essex in England with an approximate population of 5,500. It became an independent civil parish on 1 April 2000 as a result of The Great Notley Parish Council Order 2000.
INTEGRALS
Part one: 143, 189, 429
Part two: 859, 265
Part three: 451, 756, 912
Part four: 448, 131, 813
Part five: 324, 242, 692
Part six: 781, 774, 675
Is there another GCHQ Code Challenge?
Update: The answer is Yes, sort of.
Last week GCHQ issued a 'code challenge' as a way of attracting candidates via a web site called Can You Crack It?. I did the challenge, which actually consists of three parts and has more to do with assembly language and reverse engineering skills than cryptography (in fact, the only time you come across a cryptographic function, you can completely ignore it).
The cat is completely out of the bag now because some spoilsport published complete details on the web showing how to break it, but I think there may be one more mystery worth investigating.
Part 2 of the challenge involves writing a virtual machine that executes some code to decrypt an in memory buffer containing an HTTP command. Here's a dump of the memory of the virtual machine after execution:
The decrypted program decrypts the memory at 0x1C0 to reveal the HTTP command that is used to execute part 3 of the GCHQ challenge.
But what about all the rest of the unused memory? No other part of the GCHQ challenge wastes bytes, they are all used for something, but here there's a ton of memory that's filled with data and that isn't referred to anywhere else.
Is this a hidden fourth part of the GCHQ challenge? Perhaps even the real challenge?
If you look into the first block of data that's been decrypted there are two intriguing pieces of additional information. At 0x132 there are three bytes: 75 10 01. Those three bytes are actually valid code in the virtual machine. They mean
75 10 add ds, 0x10
01 jmpr r1
This seems like perfectly reasonable code. It moves the data segment forward by 0x10 and then jumps to R1. At the end of execution of the original program the data segment is at 0x1c. Thus moving it forward puts it at 0x2c (i.e. the block starting at 0x02c0 above). An alternative explanation is that based on the initial conditions of the VM that data segment would now be 0x20 (i.e. pointing immediately after the decrypted HTTP command at 0x0200).
Also at the end of running the program R1 contains 0x08. Doing the jump would drop straight into the decryption loop just past the initialization and into the XOR portion. That could be totally valid. The jump would take the instruction pointer to:
10:08 movm r0, [ds:r2]
10:0a xor r0, r3
10:0c movm [ds:r2], r0
10:0e add r2, 01
10:10 add r3, 03
10:12 cmp r2, 00
10:14 jmpe r3
10:15 cmp r0, 00
10:17 movr r0, 1b
10:19 jmpe r0
10:1a jmpr r1
The only other clue is that there's the byte 0xCC in the decrypted memory.
And one more thing. Notice the 10:14 jmpe r3. That never gets taken because r2 is never 00. But if you investigate the circumstances under which r2 would be 00 you find that it's when r3 would be 0x32 (i.e. when that jump would take you right to the 75 10 01 sequence that's been decrypted).
I haven't had enough free time to investigate this further. Perhaps it's a red herring, but it looks awfully suspicious. Especially given that the main loop will take that jump instruction when it's completely exhaused 0x100 bytes of data. This little 'subroutine' then moves the data segment on by 0x10 (i.e. 0x100 bytes) and the decryption will continue until a 00 byte is written. So it looks valid and is designed to cope with not having hit a 00 before the end of a segment.
PS It's been pointed out to me that the Can You Crack It? web site has been altered since the beginning to add the words "The challenge continues".
Labels: security
If you enjoyed this blog post, you might enjoy my travel book for people interested in science and technology: The Geek Atlas. Signed copies of The Geek Atlas are available. Looking for a new job? Try UseTheSource.
posted by John Graham-Cumming at 06:13 Permalink
1 Comments:
Phlash said...
Hi John,
According to my understanding, the code at offset 0x132 is already used as part of the 2nd decryption loop:
[entry to here by long jump to 0x10:0, thus cs==0x10]
0x100: movr r2,#0
0x102: add r5,#12 <-- move ds to encrypted block
0x104: movr r1,#8 <-- preload r1 with return address
0x106: movr r3,#50 <-- preload XOR value *and jump address*
0x108: movm r0,[ds:r2] <-- return from jump here
0x10A: xor r0,r3
0x10C: movm [ds:r2],r0
0x10E: add r2,#1 <-- increment pointer
0x110: add r3,#3 <-- increment XOR
0x112: cmp r2,#0 <-- rollover?
0x114: jmpe [r3] <-- when r2==0, r3==50, thus cs:50 == 0x132 :)
0x115: cmp r0,#0 <-- terminate at zero decrypted value
0x117: movr r0,#27
0x119: jmpe [r0]
0x11A: jmp [r1]
0x11B: hlt
...
0x132: add r5,#16
0x134: jmp [r1]
of course it terminates early (at the first decrypted zero value), but what woudl happen if we let it continue to the end of mem[] array?
camoList VPN: supports all websites and programs, unlimited bandwidth, no ads, no logs, and much more!
Shortcuts Facebook YouTube Twitter MySpaceMySpace mobile Yahoo! Mail Google MSNAIMYahooGoogle TalkMySpace IMICQ
GCHQ CanYouCrackIt Solution explained
Sunday, 4 December 2011How to solve the GCHQ challenge
Tweet
NEWS AGENCIES: Click here for press release text.
Below are three videos demonstrating how to solve the GCHQ challenge by Dr Gareth Owen at the School of Engineering, University of Greenwich, England.
Stage 1 is arguably the most difficult, followed by stage 3 and finally stage 2 as the easiest.
Stage 1
To enlarge videos, click play and then press the Youtube button at bottom of video.
Files to download:
p1-complete.asm (this one prints the decrypted data to the screen - no need to use debugger)
Stage 2
Files to download:
PHP VM Implementation (by me)
Explanation of VM code (by me)
Conversion of VM code to C (by me)
There isn't anything further hidden in Stage 2 - GCHQ have confirmed to me. Despite the appearance in the second decrypter (the erroneous jmp); allegedly this is a left over relic because they simplified the puzzle for fear it was too difficult.
Stage 3
GCHQ kindly wrote to me to say the fscanf bug was deliberate - so that you could override the crypt check; seems I took a short cut!
Files to download:
C representation of executable
Press release text
Please feel free to use or modify the following text in your story.
The British spy agency GCHQ recently published a puzzle on www.canyoucrackit.co.uk, just a few days later Dr Gareth Owen, an academic at the University of Greenwich in England has posted a full video explanation of the puzzle. The puzzle has three stages and is not at all simple — likely to challenge even the best computer science graduates.
The first stage is to convert the code on the screen to computer code, which turns out to be a decryption algorithm. The data to be decrypted is hidden in the image on the web site (the image of the numbers).
The second stage asks you to build a virtual computer to run a series of codes - which when run produce the link to the third stage.
The third stage gives you a program to run which requires a licence key - the problem is finding the licence key which requires decoding the program and seeing how it works. Then you have to find three hidden numbers from the first two stages and plug them in to get the web address for the final answer.
There has been some speculation that there is a fourth stage hidden in stage 2, although GCHQ have contacted Gareth and guaranteed there isn't.
Click here for solution videos
Posted by Dr Gareth Owen at 03:32 Email ThisBlogThis!Share to TwitterShare to Facebook23 comments:
radical said...
This post has been removed by the author.
4 December 2011 11:39
radical said...
The password that generates the hash for stage3 is:
cyberwin
Quite simple to find with John the Ripper given the weak DES hashing algorithm used. Hence you can construct the license.txt file:
"gchqcyberwin" followed by the dwords from the previos stages.
Obviously this is not really needed, but it's nice to know :)
4 December 2011 11:42
dougie said...
Such a shame it's written in the wrong assembler language for me. S/370 would have been much more fun.
I must get round to learning 586/686 assembler some time.
Thanks for the explanation.
4 December 2011 12:41
Ralph Corderoy said...
I'm more at home with ARM than x86 but are you sure the "sub esp, 0x100 ; 4096 bytes" is correct? Is it not gaining 256 bytes ready for the following loop to fill with [0, 255]?
4 December 2011 17:10
David Glance said...
Hi Gareth,
Great explanation and videos. Are you getting your undergrads to do this exercise? I was wondering how many of them would understand it all?
4 December 2011 22:54
Dr Gareth Owen said...
Ralph you're correct - someone else spotted the mistake too and I've amended the video.
David - I won't be giving it to the undergrads no as we don't teach low level assembly in our department but I'll no doubt show them the videos.
5 December 2011 00:06
J. Sadir Vanderloot said...
What an amazing presentation, thank you very much.
5 December 2011 05:25
kwdiaper said...
This was pretty epic, I would think a lot of computer science students would find this extremely challenging, however it's a good eye opening puzzle. I have to say I would of taken a long time to even clue into the fact that the 0xEF was a jump instruction but after you pointed it out it made sense.
5 December 2011 07:17
Dr Atomic said...
Man, u r 7337 haxx0r!
5 December 2011 15:10
mesh3altest said...
it's all about assembly?
i wonder what exactly your resources in order to understand all this stuffs, another meaning, what books you read to understand x86 assembly? could you recommend some?
Thanks for the great demonstration
5 December 2011 15:51
jitsuki said...
Well done and thanks for the brilliant explanation. However, like you say, a rather disappointing end for quite a lot of work!
6 December 2011 04:56
shep said...
Dr Owen,
As a CIT undergrad in the US, I found this extremely challenging compared to traditional war-games such as smash the stack, over the wire, etc... Thanks for the contribution!
6 December 2011 06:56
Edi MacCohen said...
Nicely presented exposition of the challenge.
The problem with the challenge itself is that it contains no real fundamental test of the would-be solver's raw logico-algorithmic thinking capacity or originality. Instead, it concentrates on a mechanical familiarity with interrelationships of various mid-to-low-level hardware and software frameworks. In that sense, it is more of an orienteering challenge than of cryptanalytic insightfulness.
6 December 2011 08:33
Anon79EzapU9 said...
Hello Gareth!
How many more students do you think these videos have recruited? If this doesn't act as a good advert for you department ( http://www.gre.ac.uk/schools/engineering/departments/c_and_c ) what does?
6 December 2011 09:47
Summerm00n said...
All that brain power and the salary is £31k!!
6 December 2011 09:54
b198111a-204b-11e1-87bc-000bcdcb2996 said...
Thank you for the videos. I work in IT but never finished my degree this just motivated me in to getting it done so i would be able to do alot of this sort of thing my self as i find it very intresting
6 December 2011 12:49
Joe said...
Excellent videos. The skills that you've demonstrated are sadly very rare these days - I know many IT professionals who wouldn't have a clue what you did here, and (correct me if i wrong) i doubt they even teach this stuff any more at University.
Sadly computers have become like cars - 99% of users have no idea about the inner workings, yet they drive them every day :(
6 December 2011 14:23
Phil Rogers said...
That was an amazing piece of detective work!
As I'm unfamiliar with that particular machine code, I wouldn't have recognised it as code.
Nor would I have recognised the BASE64 encoding.
Well done.
6 December 2011 14:41
Etienne de L'Amour said...
Thanks Gareth, Bit disappointed at the challenge, in a way. Was hoping it might offer a number of different routes, with differing resultant keywords, to make it more inter-disciplinary and to sort out the high fliers from the 99.9% of candidates who -- like me -- were "also rans". Was hoping that the exe itself would manipulate the "supposed" keyword sent in the clear ... Nada.
7 December 2011 01:33
Dr Gareth Owen said...
Etienne, there's speculation there's more to the puzzle than meets the eye :-)
7 December 2011 03:54
Etienne de L'Amour said...
Hope so, Gareth. I don't know why I hadn't even thought of writing my own VM in php or js, and not at all happy about using other folks' code. Will have a go in php and see if I can get a better understanding of what's going on. Regards ~ ET.
7 December 2011 04:05
Tim S said...
Great work, and a very clear and entertaining explanation of the solution. Many thanks for sharing it Gareth.
7 December 2011 04:25
jojoid said...
Your PHP vm does not calculate instruction length correctly for untaken jmpes -- you were lucky the code only uses short ones.
8 December 2011 04:07
Post a Comment
Home
Subscribe to: Post Comments (Atom) Followers
Blog Archive
▼ 2011 (1)
▼ December (1)
How to solve the GCHQ challenge
About Me
Dr Gareth Owen
View my complete profile