Are you ready to code to the XTRM?
The following zip file contains a large amount of C code that has been through a scaffolding of two obfuscation processes. Most of it is generated by the YAFL compiler. The YAFL compiler uses an obfuscation mode, which increases the complexity and redundancy of the generated code. This was done to make reverse engineering it more difficult, so this code is executable but not maintainable. The rest of the code is hand-written C.
All this code, the output of the YAFL compiler as well as runtime modules, then went through a lexical obfuscation process. The resulting code is still valid and it comes with two makefiles: makefile.win and makefile.linux that can be used to rebuild a binary on Windows and Linux. However, even a superficial glance at the code will convince any reader that it is unreadable and not maintainable:
Your task is to develop a deobfuscating facility to be applied to this code, so that it can be read, understood and even superficially maintained by a human developer:
- You must create a fully automatic process that treats the entire portfolio.
- You are free to use any tool, language or library, as long as it is freely available.
- The solution does not have to be universal in the sense of applying to any C source code portfolio, but it should be usable for any equivalent, C-generated software system that has gone through the same obfuscation process.
All submissions must include:
- A working implementation.
- A 2 to 4-page document describing the approach and justifying the choices that have been made.
- Secondary information can be provided as an appendix.
Submissions will be evaluated by a panel of academic and industrial experts and a Winner will be chosen based on:
- Originality and creativity of the solution.
- The level of deobfuscation that has been achieved.
- Quality of the implementation.
- Quality of the attached document.
- The level of compilability, executability and functional equivalence of the deobfuscated code.
- The ease with which the obsfuscated code can be understood.
This Contest is open only to those who send a submission via the online form at https://www.raincodelabs.com/xtrm/ and are university students in computer science, registered in a Bangalore University or recently graduated IT professionals living in Karnataka. Graduation year must be no earlier than 2017. The Contest is only open to legal residents of India, and is void where prohibited by law. Employees of Raincode Labs and other companies associated with the promotion of the Contest, its affiliates, subsidiaries, advertising and promotion agencies, and suppliers, and immediate family members (spouse, parents, siblings, and children) and/or those living in the same household of Employees are not eligible to participate in the Contest. The Contest is subject to all federal, state, local, municipal laws and regulations.
Contest Period – start and end date
Entries will be accepted online starting on Monday, March 2, 2020, 9:00 am (IST) and ending at Tuesday, March 31, 2020 at 6:00 pm (IST). Entries that are submitted before or after the Contest Period will be disqualified.
The Contest must be entered by sending a submission using the online form provided at https://www.raincodelabs.com/xtrm/. The submission must meet all Contest requirements to be eligible to win a prize. Incomplete entries or ones which are not in alignment with the rules, requirements, and specifications will be disqualified by Raincode Labs. You may enter the Contest only once and you need to provide any and all information that might be necessary. Any attempt to circumvent the rules will result in immediate disqualification from the Contest. Participants must accurately complete all required fields in the web form and provide all necessary information, or the entry will be characterized as incomplete and will not qualify.
By participating in the Contest, each Participant guarantees that they are the exclusive author of their submission and have the right to share any and all materials and content submitted to enter the Contest. Any evidence of fraud, misrepresentation, or any other form of malfeasance will result in immediate disqualification and phone call to your mother informing her of your shameful behavior.
Disclaimer of Responsibility
Raincode Labs is not responsible for problems with Contest entries, including but not limited to, entries which are lost, late, misdirected, damaged, incomplete, illegible, or cannot be completed due to electronic or technical difficulties, even if the problem is the result of the sole or partial negligence of Raincode Labs.
Winner of the Contest (hereinafter “Winner”) will receive a prize which is determined by Raincode Labs. The prize cannot be redeemed for cash or substituted for another prize and is non-transferable. Prize-related expenses including all federal, state, and local taxes represent the sole financial responsibility of the Winner. The prize is given with no written, express, or implied warranty. Any prize not claimed within 90 days will be forfeited by the winner and remain the property of Raincode Labs. Acceptance of the prize gives Raincode Labs permission to use the Winner’s personal details and submission for advertising purposes without further compensation, unless it is prohibited by law.
Winner Selection and Notification
Winner will be selected by a panel of academic and industrial experts under the supervision of Raincode Labs. The prizes will be announced during the xtrm.tech event, held in Bangalore on April 24th, 2020. Raincode Labs is not responsible if the Winner fails to receive the notice about the prize due to any security settings or provision of incorrect contact information. If the Winner fails to respond within the required time period, the prize may be forfeited, and an alternate Winner may be selected based on the judging criteria. Acceptance of the prize given in this Contest is in accordance with any and all federal, state, and local laws and regulations. If the Winner is disqualified for any reason, Raincode Labs is not obliged to provide an alternate prize or extend the Contest Period in any way, and all privileges as Winner will be terminated immediately. Participants who provide false, fraudulent or deceptive entries or who engage in false, fraudulent or deceptive acts in connection with the Contest will be disqualified and subject to criminal prosecution in their jurisdiction. Raincode Labs reserves the right to cancel the contest without prejudice if the number of contest submissions does not meet or exceed 100.
How to Claim the Prize
The Winner(s) must be present in person at the Bangalore event to claim their prize. Following the event, Raincode Labs has 30 days to release the prize to the Winner. Winners are required to provide (1) a valid government-issued photo identification showing proof of age and (2) a valid taxpayer identification number or social security number. The social security number will be used for tax-reporting purposes. Raincode Labs reserves the right to deny awarding the prize if the winner fails to provide satisfactory identification.
Terms & General Conditions
Raincode Labs reserves the right to cancel, terminate, modify or suspend the Contest should a virus, bug, non-authorized human intervention, fraud, or any other cause affect the administration, security, fairness, or proper conduct of the Contest. If such case occurs, Raincode Labs may select the Winner(s) from all eligible entries. Any attempt by an entrant to deliberately damage the Winner selection process and the legitimate operation of the Contest may be a violation of criminal and civil laws.
Limitation of Liability
By entering the Contest, You agree to release and hold harmless Raincode Labs and its subsidiaries, affiliates, advertising and promotion agencies, partners, representatives, agents, successors, assigns, employees, officers, and directors from any liability, illness, injury, death, loss, litigation, claim, or damage that may occur, directly or indirectly, whether caused by negligence or not, from:
(i) such entrant’s participation in the Contest and/or his/her acceptance, possession, use, or misuse of any prize or any portion thereof;
(ii) technical failures of any kind, including but not limited to the malfunction of any computer, cable, network, hardware, software, or other mechanical equipment;
(iii) the unavailability or inaccessibility of any transmissions, telephone, or Internet service;
(iv) unauthorized human intervention in any part of the entry process or the Contest;
(v) electronic or human error in the administration of the Contest or the processing of entries.
Disputes and Arbitration
THIS CONTEST IS GOVERNED BY THE LAWS OF INDIA, WITHOUT RESPECT TO CONFLICT OF LAW DOCTRINES. As a condition of participating in this Contest, the participant agrees that any and all disputes that cannot be resolved between the parties, and causes of action arising out of or connected with this Contest, shall be resolved individually, without resort to any form of class action, exclusively before a court located in your jurisdiction.