Memdump

Platform: spbctf | Category: Misc | Type: Challenge | Difficulty: Easy | OS: NA | Author: XESXOR | Date: 2026-03-09 | Status: Solved Techniques: memory_parsing, signed_integer_arithmetic

Summary

Task: Parse a hex memory dump containing 32-bit integers and compute their sum. Solution: Interpret bytes as little-endian signed integers using two's complement for negative numbers.

Memdump - Forensics Kids 2.0

Description

Вот кусок памяти с массивом 32-битных чисел:

7c00: 69 7A 00 00 00 07 03 00 80 B2 FF FF 00 00 00 00
7c10: 7F 96 98 00

Напишите сумму в виде числа. (учтите, что сумма не может быть длиннее 32 бит — не влезет. Как хранятся отрицательные числа?)

Analysis

Task about understanding number representation in x86 memory:

1. Little-endian byte order - on x86 architecture bytes are stored in reverse order (least significant byte at lowest address)
2. Two's complement - negative numbers are represented in two's complement form
3. 32-bit signed integers - each number occupies 4 bytes ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

The memory dump contains 5 consecutive 32-bit numbers:

• Address 0x7c00: 69 7A 00 00
• Address 0x7c04: 00 07 03 00
• Address 0x7c08: 80 B2 FF FF
• Address 0x7c0c: 00 00 00 00
• Address 0x7c10: 7F 96 98 00

Solution

Step 1: Parsing little-endian numbers

Interpret each 4 bytes as a signed 32-bit little-endian integer:

Step 2: Understanding negative numbers (Two's Complement)

The number 0xFFFFB280 is a negative number in two's complement:

• Most significant bit = 1, meaning the number is negative
• To get the absolute value: invert bits and add 1
• ~0xFFFFB280 + 1 = 0x00004D80 = 19840
• Result: -19840

Step 3: Computing the sum

31337 + 198400 + (-19840) + 0 + 9999999 = REDACTED

Solve Script

 python read-only • copy allowed Copy
#!/usr/bin/env python3
import struct

# Memory dump
memory = bytes([
    0x69, 0x7A, 0x00, 0x00,  # 31337
    0x00, 0x07, 0x03, 0x00,  # 198400
    0x80, 0xB2, 0xFF, 0xFF,  # -19840 (two's complement)
    0x00, 0x00, 0x00, 0x00,  # 0
    0x7F, 0x96, 0x98, 0x00   # 9999999
])
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

# Parse as 5 signed 32-bit little-endian integers
numbers = struct.unpack('<5i', memory)

print("Parsed numbers:")
for i, num in enumerate(numbers):
    print(f"  [{i}] {num} (0x{num & 0xFFFFFFFF:08X})")

total = sum(numbers)
print(f"\nSum: {' + '.join(map(str, numbers))} = {total}")

Output:

Parsed numbers:
  [0] 31337 (0x00007A69)
  [1] 198400 (0x00030700)
  [2] -19840 (0xFFFFB280)
  [3] 0 (0x00000000)
  [4] 9999999 (0x0098967F)

Sum: 31337 + 198400 + -19840 + 0 + 9999999 = REDACTED

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍