「ACTF 2022」Broken QRCode Official Writeup

6 月 25～27 号我们 AAA 战队承办了一场 ACTF 比赛，我出了 Broken QRCode 这一道题目，这里是 writeup

English Writeup

First of all, the challenge has no attachment. Obviously the primary goal is to get the picture. According to the picture uuid recorded by the mirai QQ robot and the official API of QQ images, we can get the url of that picture:

Then the picture:

Then from the “Broken” in the title and the information “The QR code generator has bugs, the qrcode it generated can’t be scanned”, and after a simple analysis, you can see the four identifier bits at the beginning of the QR code, the size, and the padding bits in the middle. They are all exposed, so it can be speculated that there is no mask operation (you can also use the first hint “I broke this QR code by just missing a step” to be sure of this)

Load the picture into qrazybox. Then apply mask and scan it, you can get https://gist.github.com/TonyCrane/88dba1fb35297fef2b195495447a8a93 , which is a hex string of a zip pack. Unpack it, you can get 12 qr codes:

Scanning them, you will get:

After analysis, it can be found that there is an additional data at the end of the first picture:

It is not difficult to find out that this is a bit sequence (including identifier, size, data, padding, ecc) of a qr code content. The data it contains is the last part of flag: 1Ly_kn0w_QRCod3}

Then the first part of the flag will be obtained from these twelve qr codes

Through many tools, you can find errors in all of these qr codes. So you can guess that the ecc hide some changed bits. Then you can try to find out which bits are changed.

The most direct solution is to use the Reed-Solomon codes to find the position of the wrong bits, and then find its place in the qr code. But this is too complicated.

Since the content of each QR code is known, the version, error correction level, mask, and encoding method are all known. Then the qr code is uniquely determined. So as long as a correct QR code is generated, then we can find the changed place by diffing them:

Now we get the first part of the flag. So the flag is ACTF{Y0u_Re41Ly_kn0w_QRCod3}

后记

「ACTF 2022」Broken QRCode Official Writeup

https://blog.tonycrane.cc/p/12a2afd2.html

TonyCrane

2022-06-28

2022-07-28