[WRITE UP] - BYU CTF 2025

1
#include <stdlib.h>
2
#include <stdio.h>
3
#include <time.h>
4
#include <unistd.h>
5

6
__attribute__((constructor)) void flush_buf() {
7
    setbuf(stdin, NULL);
8
    setbuf(stdout, NULL);
9
    setbuf(stderr, NULL);
10
}
11

12
typedef struct {
13
    long uid;
14
    char username[8];
15
    long keycard;
16
} user_t;
17

18
typedef struct {
19
    long mfg_date;
20
    char first[8];
21
    char last[8];
22
} nametag_t;
23

24
long UID = 0x1;
25
char filename[] = "flag.txt";
26
user_t* curr_user = NULL;
27
nametag_t* curr_nametag = NULL;
28

29
void init() {
30
    setvbuf(stdout, NULL, _IONBF, 0);
31
    setvbuf(stdin, NULL, _IONBF, 0);
32
}
33

34

35
void register_user() {
36
    printf("WELCOME!! We're so excited to have you here! Tell us your username / tag and we'll get you set up with access to the facilities!\n");
37
    curr_user = (user_t*)malloc(sizeof(user_t)); // 0x18 bytes
38
    curr_user->uid = UID++;
39
    printf("Please go ahead an type your username now: \n");
40
    read(0, curr_user->username, 8);
41
}
42

43
void log_out() {
44
    free(curr_user);
45
    curr_user = NULL;
46

47
    if (curr_nametag != NULL) {
48
        free(curr_nametag);
49
        curr_nametag = NULL;
50
    }
51
}
52

53
int print_menu() {
54
    int choice;
55
    printf("What would you like to do now?\n");
56
    printf("1. Register a new user\n");
57
    printf("2. Learn about the Time Keepers\n");
58
    printf("3. Collect gear\n");
59
    printf("4. Elevate to super user\n");
60
    printf("5. Change characters\n");
61
    printf("6. Leave\n");
62
    // 7 is try to free loki but it's not technically an option, you have to be rebellious to get there
63
    scanf("%d", &choice);
64
    if (choice < 1 || choice > 7) {
65
        printf("Invalid choice. You broke the simulation\n");
66
        return 0;
67
    }
68
    return choice;
69
}
70

71
int main(void) {
72
    init();
73
    srand(time(NULL)); int gear;
74
    printf("Hello! My name is Miss Minutes, and I'll be your helper here at the TVA!!\nHow about we get you oriented first!\nThe only rule is that we under no circumstances can free Loki... he's locked up for a reason!\n");
75

76
    int input = 1;
77
    while (input) {
78
        switch (input) {
79
            case 1: // register a new user
80
                register_user();
81
                break;
82
            case 2:
83
                printf("The Time Keepers are the three beings who created the TVA and the Sacred Timeline. They are powerful beings who exist at the end of time and are responsible for maintaining the flow of time.\n");
84
                break;
85
            case 3: // collect gear
86
                if (curr_user == NULL) {
87
                    printf("You must register a user first!\n");
88
                    break;
89
                }
90
                gear = rand() % 5 + 1;
91
                if (curr_nametag != NULL) {
92
                    free(curr_nametag);
93
                }
94
                switch (gear) {
95
                    case 1:
96
                        printf("You have received a Time Twister! This powerful device allows you to manipulate time and space.\n");
97
                        break;
98
                    case 2:
99
                        printf("You have received a Name Tag! Please input your first and last name:\n");
100
                        curr_nametag = (nametag_t*)malloc(sizeof(nametag_t));
101
                        curr_nametag->mfg_date = (long)time(NULL);
102
                        read(0, curr_nametag->first, 8);
103
                        read(0, curr_nametag->last, 8);
104
                        break;
105
                    case 3:
106
                        printf("You have received a Time Stick! This device allows you to reset the flow of time in a specific area.\n");
107
                        break;
108
                    case 4:
109
                        printf("You have received a Time Loop! This device allows you to trap someone in a time loop.\n");
110
                        break;
111
                    case 5:
112
                        printf("You have received a Time Bomb! This device allows you to create a temporal explosion.\n");
113
                        break;
114
                }
115
                break;
116
            case 4:
117
                if (curr_user == NULL) {
118
                    printf("You must register a user first!\n");
119
                    break;
120
                }
121
                if (curr_user->uid >= 0x600000) {
122
                    printf("Well, everything here checks out! Go ahead and take this key card!\n");
123
                    curr_user->keycard = 0x1337;
124
                } else {
125
                    printf("Unfortunately, it doesn't look like you have all the qualifications to get your own key card! Stay close to Miss Minutes and she should be able to get you anywhere you need to go...\n");
126
                }
127
                break;
128
            case 5:
129
                if (curr_user == NULL) {
130
                    printf("You must register a user first!\n");
131
                    break;
132
                }
133
                log_out();
134
                printf("You have been logged out.\n");
135
                printf(". "); sleep(1);
136
                printf(". "); sleep(1);
137
                printf(". \n"); sleep(1);
138
                register_user();
139
                break;
140
            case 6:
141
                input = 0;
142
                break;
143
            case 7:
144
                if (curr_user == NULL) {
145
                    printf("You must register a user first!\n");
146
                    break;
147
                }
148

149
                // Uninitialized memory read
150
                if (curr_user->keycard == 0x1337) {
151
                    printf("You have freed Loki! In gratitude, he offers you a flag!\n");
152
                    FILE* flag = fopen(filename, "r");
153
                    if (flag == NULL) {
154
                        printf("Flag file not found. Please contact an admin.\n");
155
                        return EXIT_FAILURE;
156
                    } else {
157
                        char ch;
158
                        while ((ch = fgetc(flag)) != EOF) {
159
                            printf("%c", ch);
160
                        }
161
                    }
162
                    fclose(flag);
163
                    exit(0);
164
                    break;
165
                } else {
166
                    printf("EMERGENCY EMERGENCY UNAUTHORIZED USER HAS TRIED TO FREE LOKI!\n");
167
                    printf("Time police rush to the room where you stand in shock. They rush you away, take your gear, and kick you back to your own timeline.\n");
168
                    log_out();
169
                    input = 0;
170
                    break;
171
                }
172
        }
173

174
        if (input != 0) {
175
            input = print_menu();
176
        }
177
    }
178
    return input;
179
}

1
#include <stdio.h>
2
#include <stdlib.h>
3
#include <string.h>
4
#include <stdbool.h>
5
#include <ctype.h>
6
#include <pthread.h>
7
#include <unistd.h>
8

9
enum {
10
    TYPE_FLOAT = 0,
11
    TYPE_INT,
12
    TYPE_STRING,
13
    TYPE_BOOL,
14
};
15

16
struct str_object {
17
    char *value;
18
    unsigned int type;
19
    unsigned int refcount;
20
};
21

22
struct int_object {
23
    unsigned long value;
24
    unsigned int type;
25
    unsigned int refcount;
26
};
27

28
struct float_object {
29
    double value;
30
    unsigned int type;
31
    unsigned int refcount;
32
};
33

34
struct bool_object {
35
    unsigned long value;
36
    unsigned int type;
37
    unsigned int refcount;
38
};
39

40
void* objects[100];
41

42
__attribute__((constructor)) void flush_buf() {
43
    setbuf(stdin, NULL);
44
    setbuf(stdout, NULL);
45
    setbuf(stderr, NULL);
46
}
47

48
void win() {
49
    system("/bin/sh");
50
    exit(0);
51
}
52

53
int create_string_obj(char *value) {
54
    struct str_object* obj = (struct str_object*)objects[0];
55
    unsigned int i = 0;
56

57
    // if the object already exists, just increase the refcount
58
    while (obj != NULL) {
59
        if ((obj->type == TYPE_STRING) && (strcmp(obj->value, value) == 0)) {
60
            printf("Added refcount to %s\n", obj->value);
61
            obj->refcount++;
62
            return 0;
63
        }
64
        if (i >= 99) {
65
            puts("object array is full");
66
            return -1;
67
        }
68
        i++;
69
        obj = (struct str_object*)objects[i];
70
    }
71

72
    // otherwise, create a new object
73
    obj = (struct str_object*)malloc(sizeof(struct str_object));
74
    if (obj == NULL) {
75
        puts("malloc failed");
76
        exit(1);
77
    }
78
    obj->value = strdup(value);
79
    if (obj->value == NULL) {
80
        puts("strdup failed");
81
        exit(1);
82
    }
83
    obj->type = TYPE_STRING;
84
    obj->refcount = 1;
85
    objects[i] = obj;
86
    return 0;
87
}
88

89
int create_int_obj(unsigned long value) {
90
    struct int_object* obj = (struct int_object*)objects[0];
91
    unsigned int i = 0;
92

93
    // if the object already exists, just increase the refcount
94
    while (obj != NULL) {
95
        if ((obj->type == TYPE_INT) && (obj->value == value)) {
96
            printf("Added refcount to %lu\n", obj->value);
97
            obj->refcount++;
98
            return 0;
99
        }
100
        if (i >= 99) {
101
            puts("object array is full");
102
            return -1;
103
        }
104
        i++;
105
        obj = (struct int_object*)objects[i];
106
    }
107

108
    // otherwise, create a new object
109
    obj = (struct int_object*)malloc(sizeof(struct int_object));
110
    if (obj == NULL) {
111
        puts("malloc failed");
112
        exit(1);
113
    }
114
    obj->value = value;
115
    obj->type = TYPE_INT;
116
    obj->refcount = 1;
117
    objects[i] = obj;
118
    return 0;
119
}
120

121
int create_float_obj(double value) {
122
    struct float_object* obj = (struct float_object*)objects[0];
123
    unsigned int i = 0;
124

125
    // if the object already exists, just increase the refcount
126
    while (obj != NULL) {
127
        if ((obj->type == TYPE_FLOAT) && (obj->value == value)) {
128
            printf("Added refcount to %lf\n", obj->value);
129
            obj->refcount++;
130
            return 0;
131
        }
132
        if (i >= 99) {
133
            puts("object array is full");
134
            return -1;
135
        }
136
        i++;
137
        obj = (struct float_object*)objects[i];
138
    }
139

140
    // otherwise, create a new object
141
    obj = (struct float_object*)malloc(sizeof(struct float_object));
142
    if (obj == NULL) {
143
        puts("malloc failed");
144
        exit(1);
145
    }
146
    obj->value = value;
147
    obj->type = TYPE_FLOAT;
148
    obj->refcount = 1;
149
    objects[i] = obj;
150
    return 0;
151
}
152

153
int create_bool_obj(unsigned long value) {
154
    struct bool_object* obj = (struct bool_object*)objects[0];
155
    unsigned int i = 0;
156

157
    // if the object already exists, just increase the refcount
158
    while (obj != NULL) {
159
        if ((obj->type == TYPE_BOOL) && (obj->value == value)) {
160
            printf("Added refcount to %lu\n", obj->value);
161
            obj->refcount++;
162
            return 0;
163
        }
164
        if (i >= 99) {
165
            puts("object array is full");
166
            return -1;
167
        }
168
        i++;
169
        obj = (struct bool_object*)objects[i];
170
    }
171

172
    // otherwise, create a new object
173
    obj = (struct bool_object*)malloc(sizeof(struct bool_object));
174
    if (obj == NULL) {
175
        puts("malloc failed");
176
        exit(1);
177
    }
178
    obj->value = value;
179
    obj->type = TYPE_BOOL;
180
    obj->refcount = 1;
181
    objects[i] = obj;
182
    return 0;
183
}
184

185
void clear_objects() {
186
    for (unsigned int i = 0; i < 100; i++) {
187
        if (objects[i] != NULL) {
188
            // set refcount to 0 for the garbage collector to free
189
            struct str_object* obj = (struct str_object*)objects[i];
190
            obj->refcount = 0;
191
        }
192
    }
193
}
194

195
void parse_tcl() {
196
    char buf[0x100];
197
    bool valid = true;
198
    bool started = false;
199

200
    while (1) {
201
        // clear the buffer
202
        memset(buf, 0, sizeof(buf));
203

204
        // we use fgets because it breaks on \n, which means the config line is done
205
        fgets(buf, sizeof(buf), stdin);
206

207
        // remove the newline character
208
        size_t len = strlen(buf);
209
        if (len > 0 && buf[len - 1] == '\n') {
210
            buf[len - 1] = '\0';
211
        }
212
        // check for empty line
213
        if (strlen(buf) == 0) {
214
            continue;
215
        }
216

217
        if (started == false) {
218
            // check for the start of the config
219
            if (strcmp(buf, "#START") != 0) {
220
                puts("You need to start with #START");
221
                continue;
222
            }
223
            started = true;
224
            continue;
225
        }
226

227
        if (strcmp(buf, "#END") == 0) {
228
            break;
229
        }
230

231
        // check for ' = '
232
        char * delim = strstr(buf, " = ");
233
        if (delim == NULL) {
234
            puts("Invalid line, no ' = ' found");
235
            valid = false;
236
            continue;
237
        }
238
        *delim = '\0'; // replace ' = ' with '\0' to split the string
239
        delim += 3; // move past the ' = '
240
        // at this point, buf contains the key name and delim points to the value
241

242
        // ensure first character is not a digit
243
        if (isdigit(buf[0])) {
244
            puts("Key name cannot start with a digit");
245
            valid = false;
246
            continue;
247
        }
248

249
        // check character set in keyname
250
        for (char *p = buf; *p != '\0'; p++) {
251
            if (!isalnum(*p) && *p != '_') {
252
                puts("Key name can only contain alphanumeric characters and underscores");
253
                valid = false;
254
                continue;
255
            }
256
        }
257

258
        // create an object to store key name
259
        if (create_string_obj(buf) != 0) {
260
            puts("create_string_obj failed");
261
            valid = false;
262
            continue;
263
        }
264

265
        // CHECK THE VALUE NOW
266

267
        // inspecting the first character of the value will tell us what type it is
268
        if (isdigit(delim[0])) {
269
            // it's an int or float
270
            char *endptr;
271
            unsigned long value = strtoul(delim, &endptr, 10);
272
            if (*endptr == '.') {
273
                // it's a float
274
                double fvalue = strtod(delim, NULL);
275
                if (create_float_obj(fvalue) != 0) {
276
                    puts("create_float_obj failed");
277
                    valid = false;
278
                    continue;
279
                }
280
            } else {
281
                // it's an int
282
                if (create_int_obj(value) != 0) {
283
                    puts("create_int_obj failed");
284
                    valid = false;
285
                    continue;
286
                }
287
            }
288
        }
289

290
        else if (delim[0] == 't' || delim[0] == 'f') {
291
            if (strcmp(delim, "true") != 0 && strcmp(delim, "false") != 0) {
292
                puts("Invalid boolean value");
293
                valid = false;
294
                continue;
295
            }
296

297
            // it's a bool
298
            unsigned long value = (delim[0] == 't') ? 1 : 0;
299
            if (create_bool_obj(value) != 0) {
300
                puts("create_bool_obj failed");
301
                valid = false;
302
                continue;
303
            }
304
        }
305

306
        else if (delim[0] == '"') {
307
            // it's a string
308
            delim++; // move past the opening quote
309
            char *end = strchr(delim, '"');
310
            if (end == NULL) {
311
                puts("Invalid string value, no closing quote found");
312
                valid = false;
313
                continue;
314
            }
315
            *end = '\0'; // replace closing quote with null terminator
316
            if (create_string_obj(delim) != 0) {
317
                puts("create_string_obj failed");
318
                valid = false;
319
                continue;
320
            }
321
        }
322

323
        else {
324
            // invalid value type
325
            puts("Invalid value type");
326
            valid = false;
327
            continue;
328
        }
329
    }
330

331
    // check if the config is valid
332
    if (valid) {
333
        puts("Config is valid");
334
    } else {
335
        puts("Config is invalid");
336
    }
337

338
    // set the refcount of all objects to 0
339
    clear_objects();
340
}
341

342
void gc() {
343
    unsigned int indexes[100];
344
    unsigned int count = 0;
345

346
    while (1) {
347
        memset(indexes, 0, sizeof(indexes));
348
        count = 0;
349
        sleep(5);
350

351
        // store the indexes of all objects with refcount 0
352
        for (unsigned int i = 0; i < 100; i++) {
353
            if (objects[i] != NULL) {
354
                struct str_object* obj = (struct str_object*)objects[i];
355
                if (obj->refcount == 0) {
356
                    indexes[count++] = i;
357
                }
358
            }
359
        }
360

361
        // free them
362
        for (unsigned int i = 0; i < count; i++) {
363
            struct str_object* obj = (struct str_object*)objects[indexes[i]];
364
            if (obj != NULL) {
365
                if (obj->type == TYPE_STRING)
366
                    free(obj->value);
367
                free(obj);         // Use-After-Free
368
                usleep(5 * 1000); // sleep for 5 milliseconds - we don't want to hog the CPU!
369
            }
370
        }
371

372
        // set the object pointer to NULL
373
        for (unsigned int i = 0; i < count; i++) {
374
            struct str_object* obj = (struct str_object*)objects[indexes[i]];
375
            // double check refcount is 0 before setting to NULL
376
            if (obj != NULL && obj->refcount == 0) {
377
                objects[indexes[i]] = NULL;
378
            }
379
        }
380
    }
381
}
382

383
int main() {
384
    alarm(60); // set a timeout for the program
385
    printf("%p\n", &alarm);
386

387
    // spawn garbage collector
388
    pthread_t tid;
389
    pthread_create(&tid, NULL, (void*)gc, NULL);
390

391
    while (1) {
392
        puts("Enter your TCL file contents below:");
393
        puts("=========================================");
394
        parse_tcl();
395
    }
396

397
    return 0;
398
}