Challenge Writeup

The challenge is made up out of 2 files: PixelPoker.exe and README.txt The README shortly explains how the game works and we can derive some information from it:

When we launch the game, we are presented with a field that contains pixels. When we move the mouse over the "playing field", we see the x and y coordinates being updated in the title bar. Additionally, we can click on each pixel, another number in the title bar is also being updated. In total we can click 10 pixels before we get a pop-up stating: "Please play again!. So we can assume that we have to find the correct pixel in order to obtain the flag, and we have a total of 10 tries. We load the game into IDA for further analysis.

As this is still an early level of Flare-On, we start by searching for strings in the binary. We come across the string "Please play again!", which we saw earlier when clicking on 10 pixels. Locating the string in the disassembly, it appears close to the end of function sub_4012C0. We identify that execution flow will end up in that block and show the MessageBox, if the previous compare operation of the value in eax against 10 is equal. We can assume that this is the counter that keeps track of how often pixels were clicked. So, we follow the false branch, which is taken when the compare fails and we haven't yet clicked ten pixels.

The next blocks that follow, are depicted in the screenshot below. We see multiple things happening here. First of all, note that a string is loaded into register eax. This string contains "FLARE-On" which might be relevant later. Next, we notice that two blocks after each other, perform a compare statement. We set breakpoints on both of the compare statements and run the debugger. Once we click on a pixel, the X and Y values representing the location of that pixel, seem to be used for both compare statements. The X value is compared to 0x5F or integer 95, whilst the Y value is compared to 0x139 or integer 313.



Based on this information, we can conclude that if we click the pixel at location 95,313, we will have found the correct pixel. Rerunning the game and clicking that specific pixel, will then result in the flag:

w1nN3r_W!NneR_cHick3n_d1nNer@flare-on.com

And with that, we have completed the second Flare-On challenge!