Мипсаинатор (Mipsainator)

Platform: hackerlab | Category: Reversing | Type: Challenge | Difficulty: Medium | OS: Linux | Author: XESXOR | Date: 2025-12-27 | Status: Solved Techniques: Big-endian architecture handling, ELF symbol analysis for function identification, MIPS32 disassembly with Capstone, Multi-stage encryption reversal (XOR + Caesar + reverse)

Summary

Task: MIPS32 big-endian binary with multi-stage flag encryption. Solution: Reverse the encryption chain (XOR 0x12 → Caesar -10 → string reversal) using Capstone disassembly to identify the algorithm.

Мипсаинатор — hackerlab

Description

"Я разработал свою новейшую систему проверки флага под названием "Мипсаинатор"! А самое главное - я взял одну интересную архитектуру, чтобы этим ревёрсерам было сложнее изучать моё творение"

Analysis

1. Initial Examination

 bash read-only • copy allowed Copy
$ file mipsainator
mipsainator: ELF 32-bit MSB executable, MIPS, MIPS32 rel2 version 1 (SYSV), 
dynamically linked, interpreter /lib/ld.so.1, for GNU/Linux 3.2.0, 
BuildID[sha1]=..., not stripped

Key characteristics:

• MIPS32 architecture (Big-Endian, MSB)
• Not stripped — symbols preserved, which simplifies analysis
• Dynamically linked ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

2. Symbol Analysis

The binary contains symbols with descriptive names:

• main (0x400cb4) — main logic
• plaki_plaki (0x4008a0) — string processing function
• prodam_garazh (0x400998) — encryption function
• good (0x412038) — encrypted flag (45 bytes)

3. Encryption Algorithm

Disassembly with Capstone revealed the following algorithm:

1. Length check: input string must be 0x2d (45) characters (including newline)
2. plaki_plaki: string reversal (reverses character order)
3. prodam_garazh(10): Caesar cipher with shift 10
4. XOR 0x12: each byte is XORed with 0x12
5. Comparison: result is compared with the good array ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

4. Encrypted Data

The good array at address 0x412038 (45 bytes):

6f636a41767120707d564a614d71234d5d7077567f207661407f70524d514823454d7d4076695b5e5d5c4b5f12

Solution

To decrypt, we apply operations in reverse order:

1. XOR with 0x12 (XOR is self-inverse)
2. Reverse Caesar cipher (shift -10)
3. Reverse the string

 python read-only • copy allowed Copy
#!/usr/bin/env python3
"""
Mipsainator solver
MIPS32 reverse engineering challenge

Encryption: reverse -> caesar(10) -> xor(0x12)
Decryption: xor(0x12) -> caesar(-10) -> reverse
"""
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

# Encrypted flag from 'good' array at 0x412038
good = bytes.fromhex('6f636a41767120707d564a614d71234d5d7077567f207661407f70524d514823454d7d4076695b5e5d5c4b5f12')

def reverse_caesar(data, shift):
    """Reverse Caesar cipher for letters only"""
    result = []
    for b in data:
        if 0x41 <= b <= 0x5A:  # A-Z (uppercase)
            result.append((b - 0x41 - shift) % 26 + 0x41)
        elif 0x61 <= b <= 0x7A:  # a-z (lowercase)
            result.append((b - 0x61 - shift) % 26 + 0x61)
        else:
            result.append(b)  # Non-letters unchanged
    return bytes(result)
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

# Step 1: XOR with 0x12 (skip last byte - newline)
step1 = bytes([b ^ 0x12 for b in good[:-1]])
print(f"After XOR:    {step1}")

# Step 2: Reverse Caesar cipher with shift 10
step2 = reverse_caesar(step1, 10)
print(f"After Caesar: {step2}")

# Step 3: Reverse the string
flag = step2[::-1].decode()
print(f"\nFlag: {flag}")

Output

After XOR:    b'}qxSdb2b\x1foDxS_c1_Oc\x1fbe\x1fDm2bsR_Cc\x1fZO_Ode\x1fIM{N'
After Caesar: b'}gnItr2r\x1feTnI_y1_Ey\x1frk\x1fTc2riH_Sy\x1fPE_Etk\x1fYC{D'
Flag: CODEBY{REDACTED}

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Notes

MIPS Specifics

• Big-Endian (MSB): bytes are in reverse order compared to x86
• MIPS32 rel2: second revision of MIPS32, supports additional instructions
• Capstone: excellent tool for MIPS disassembly

Encryption Algorithm

• String reversal: simple operation, but complicates analysis
• Caesar cipher: classic shift cipher, works only with letters
• XOR: byte-wise operation, self-inverse (encrypt = decrypt)

Tools for MIPS

 python read-only • copy allowed Copy
# Capstone for MIPS disassembly
from capstone import Cs, CS_ARCH_MIPS, CS_MODE_MIPS32, CS_MODE_BIG_ENDIAN
md = Cs(CS_ARCH_MIPS, CS_MODE_MIPS32 | CS_MODE_BIG_ENDIAN)
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

# pwntools for ELF handling
from pwn import ELF
elf = ELF('./mipsainator')

Function Names

• plaki_plaki — likely a reference to the "plaki-plaki" meme (crying)
• prodam_garazh — "selling garage" (classic Russian classified ad)
• Humorous names — a characteristic feature of CTF challenges ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍