Category: Misc Points: 476 Description:

As you float into interstellar space, you cast your gaze onto the pointers of your instrument... Update: Pls do The Evilness first. That challenge is really much easier than y'alls think. Final Hint: IEEE-754 Non-standard flag format: [0-9]+ len(flag) < 16. `nc ctf.pwn.sg 11006` Creator - prokarius (@prokarius)

## Write-up

This was the second installment of @prokarius' Choose Your Own Adventure. Just like the previous one, this is just as irritating. We start off by connecting to the port.

root@ctf:~# nc ctf.pwn.sg 11006 Your position: 0 As you float, the pointer on your instrument reads 1068077148. Where would you like to float? 1 to float backwards. 2 to float forwards. 9 to float into the void. (Quit)

Seems fairly basic, further investigation leads us to know that no matter what, we can only move forward and backwards a total of 11 times, meaning only 11 "pointers" are ever returned. Let's start off by gathering all the pointers we have.

1068077148 1805536572 1005526689 1727990831 1301214146 428181300 1107313295 2147483648 993912976 778615823 1090848777

Now the hint tells us to cast the numbers we are given into floats, how are we going to do that? Well, we can use Java to do that!

``````public class CYOA {
public static void main(String[] args) {
long[] array = {1068077148L, 1805536572L, 1005526689L, 1727990831L, 1301214146L, 428181300L, 1107313295L, 2147483648L, 993912976L, 778615823L, 1090848777L};

for (long pointer : array) {
System.out.println(Float.intBitsToFloat((int)pointer));
}
}
}
``````

Running it, gives us another set of numbers!

``````root@ctf:~/downloads# javac CYOA.java && java CYOA
1.324718
3.8275E26
0.0072973524
6.022141E23
2.99792448E8
1.3806486E-23
32.065
-0.0
0.002897773
5.2917722E-11
8.314462
``````

What now? Well, it's a @prokarius challenge, so the next step would be to figure out if those numbers mean anything. SPOILER, they do! They are all constants! How does that help us though? Let's try replacing them with the different symbols used to replace them in Physics!

``````1.324718 - Perrin Numbers / p
3.8275E26 - Solar Luminosity / l
0.007297 - Sommerfeld's Constant / a
6.022141E23 - Avogardro's Constant / n
2.99792448E8 - Speed Of Light Constant / c
1.3806486E-23 - Boltzmann constant / k
32.064999 - Sulphur Atomic Weight Constant / s
-0.000000 - Signed Zero Constant / 0
0.002898 -> Wien's Displacement Law Constant / b
5.2917722E-11 -> Bohr's Radius Constant / a
8.314462 -> Universal Gas Constant  r
``````

That all comes down to forming `plancks0bar`, let's see if we can find the value of planck's bar! According to https://physics.info/constants, `h bar = 1.05457182E−34`. Unfortunately, that's not the flag... maybe convert it back to an integer?

``````public class CYOA {
public static void main(String[] args) {
long[] array = {1068077148L, 1805536572L, 1005526689L, 1727990831L, 1301214146L, 428181300L, 1107313295L, 2147483648L, 993912976L, 778615823L, 1090848777L};

// for (long pointer : array) {
//     System.out.println(Float.intBitsToFloat((int)pointer));
// }

System.out.println(Float.floatToIntBits((float)1.05457182E-34));
}
}
``````

Let's try running it!

``````root@ctf:~/downloads# javac CYOA.java && java CYOA
[...]
118238520
``````

Therefore, the flag is `118238520`.