Challenge Writeup
The challenge is made up out of 2 files: PixelPoker.exe and
README.txt
The README shortly explains how the game works and we can derive some information from it:
Welcome to PixelPoker ^_^, the pixel game that's sweeping the nation! Your goal is simple: find
the correct pixel and click it
Good luck!
When we launch the game, we are presented with a field that contains pixels. When we move the mouse over
the "playing field", we see the x and y coordinates being updated in the title
bar. Additionally, we can click on each pixel, another number in the title bar is also being updated. In
total we can click 10 pixels before we get a pop-up stating: "Please play again!. So we can
assume that we have to find the correct pixel in order to obtain the flag, and we have a total of 10
tries. We load the game into IDA for further analysis.
As this is still an early level of Flare-On, we start by searching for strings in the binary. We come
across the string "Please play again!", which we saw earlier when clicking on 10 pixels.
Locating the string in the disassembly, it appears close to the end of function sub_4012C0.
We identify that execution flow will end up in that block and show the MessageBox, if the previous
compare operation of the value in eax against 10 is equal. We can assume that this is the
counter that keeps track of how often pixels were clicked. So, we follow the false branch, which is
taken when the compare fails and we haven't yet clicked ten pixels.
The next blocks that follow, are depicted in the screenshot below. We see multiple things happening
here. First of all, note that a string is loaded into register eax. This string contains
FLARE-ON which might be relevant later. Next, we notice that two blocks after each other,
perform a compare statement. We set breakpoints on both of the compare statements and run the debugger.
Once we click on a pixel, the X and Y values representing the location of that
pixel, seem to be used for both compare statements. The X value is compared to
0x5F or integer 95, whilst the Y value is compared to 0x139 or
integer 313.
Based on this information, we can conclude that if we click the pixel at location 95,313,
we will have found the correct pixel. Rerunning the game and clicking that specific pixel, will then
result in the flag: w1nN3r_W!NneR_cHick3n_d1nNer@flare-on.com. And with that, we have
completed the second Flare-On challenge!
