Neoma Fong neomafo88

• Investigation Log

Connected to IDA session, captured module hashes, enumerated exports (DllEntryPoint, Crash) to frame analysis scope.
Decompiled Crash → LaunchConfiguredIec104Sessions:0x100014e0, observed config parsing call and thread fan-out via CreateThread (0x10001547), then traced worker entry StartAddress to identify IEC‑104 workflow.
Analyzed ParseIec104ConfigFile:0x10001610; confirmed _wfopen (0x10001674) and _fgets usage, mapped keywords target_ip, target_port, sequence, stop_comm_service, command_type, operation, shift, range, uselog at refs 0x100017B0–0x10002004 to per-session structure fields.
Inspected RunIec104SessionWorker:0x10002FE0; documented service-kill logic (OpenProcess 0x1000303D / TerminateProcess 0x10003046), IEC-104 connect (Iec104Connect 0x10003079), handshake (SendStartupSequence 0x1000309D), sequence dispatch (range 0x1000315D, shift 0x100031AE) and command emission (IssueSingleCommand calls at 0x1000331A/0x1000335E/0x100034E6/0x10003507).
Reverse engineere

Step 1: Reviewed DriverEntry (0x140001000) to record the device pair \Device\KApcHelper1 / \DosDevices\KApcHelperLink1, blanket dispatch table, and registration of ProcessCreateNotifyHandler plus a dummy thread notify hook.
Step 2: Traced the init path into ResolveKernelApis (0x140001244) and LocateThreadFlagSetterPattern (0x1400014B0) to understand which kernel services and hidden thread helpers the driver depends on.
Step 3: Decompiled DeviceControlDispatcher (0x140001B70) to map IOCTLs, uncover the handshake scheme, and note how every command is obfuscated by the HandshakeSeed.
Step 4: Followed the command flow into HandleHandshakeSeed (0x140001124) to confirm token generation/validation and the use of HandshakeValidated as a global gate.

In-memory loader decrypts and manually maps an embedded payload before handing execution to its DllMain.

Investigation Log

Step 1: Confirmed IDA attachment to pikabot.exe and enumerated entry points (start at 0x49f3a2, TLS callback at 0x519630) to understand initial execution vectors.
Step 2: Reviewed CRT startup at 0x49f22b and wWinMain_ManualLoaderEntry (0x519b8f) to see the real work funneled into ManualMapEmbeddedDll.
Step 3: Checked TlsCallback_ProcessDetach (0x519630) and its thunk TlsCallback_CleanupThunk →

Flare-On 12 Write-up

1 - Drill Baby Drill!

We are given a game written in Python. Once again, the source code is given because this is the first and easiest challenge, so let's dig into it directly.

Pycomment (misc, 2 solves)

In this writeup, I will share how I solved "Pycomment" from KalmarCTF 2025. It was one of the tougher pyjails this year and makes use of two really unique ideas.

Thanks for the challenge, @ChattyPlatinumCool 😛

Description

Can you please help us comment our code? And please don't attack us.

	for (const key of Object.keys(window)) {
	const value = window[key];
	const type = (value != null && typeof value.toString === 'function')
	? value.toString()
	: Object.prototype.toString.call(value);

	if(type instanceof Promise){
	console.log(`${key}: ${await window[key].toString()}`);
	}

	#!/bin/bash

	# MacBook Lid Angle Sensor Diagnostic Script
	# This script helps identify the lid angle sensor on different MacBook models

	echo "=============================================="
	echo "MacBook Lid Angle Sensor Diagnostic Tool"
	echo "=============================================="
	echo ""

	import os
	import sys
	import shutil
	import zipfile
	import platform
	import tempfile

	MAX_BACKUPS = 5
	PATCHES = {
	"chrome/devtools/modules/devtools/server/actors/thread.js": {

	#Extract function name from log calls
	#
	logger = "LogFuncRename"

	def log_func_rename(log_function, name_index):
	func_votes = defaultdict(lambda: defaultdict(lambda: 0))
	for call_site in log_function.caller_sites:
	if not isinstance(call_site.hlil.operands[0], HighLevelILConstPtr):
	continue
	if call_site.hlil.operands[0].constant != log_function.start:

	function hookNative() {

	const jniOnLoad = moduleHandle.findExportByName("JNI_OnLoad");
	if (!jniOnLoad) {
	console.log("[-] JNI_OnLoad not found!");
	return;
	}

	console.log("[+] JNI_OnLoad founded:", jniOnLoad);