Posted on by and filed under Tracer FIRE 5 2013.

This is a fun challenge in which you’re given the following base64 encoded data:

AQACgCAgICAgXAogICAgIFwgICAgICBcICAgXyAuLC0nICAgICAgICAgIGAtLiwgXywgIDsgICAg
ICAvCmpyZWkgIClfXC0uXy0uXygoXyggICAgICAgICAgICAgICAgKV8pKV8sLV8sLS9fKAoKClRo
ZSBhbnN3ZXIgZm9yIHRoaXMgWAEACoCI4paI4paI4paI4paI4paIICDilojiloggICAg4paI4paI
ICDilojilojiloAgICDilojiloggIOKWiOKWiOKWgCAg4paA4paI4paIICAg4paI4paI4paAICAg
ICAgIOKWiOKWiOKWhCDilojiloggICAgICAgICAgICAg4paI4iYBAASAICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICDiloTiloQgICAg4paE4paEICAgICDilojiloggICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAog4paI4paIICAgIOKWiOI8
AQAIgCDilojiloggIOKWiOKWiOKWhOKWiOKWiOKWiOKWiOKWhCAgIOKWhOKWiOKWiOKWiOKWhOKW
iOKWiCAgIOKWiOKWiOKWhOKWiOKWiOKWiOKWiCAg4paA4paI4paIICDilojilojiloggICAgICAg
ICAgICDilojiloggICAg4paIhAEADIDilojilojilojilojilojilojilojiloggICAgIOKWiOKW
iCAgICAg4paI4paI4paAICDiloDilojiloggIOKWiOKWiOKWgCAg4paA4paI4paIICDilojiloji
loAgIOKWgOKWiOKWiCAg4paI4paI4paE4paE4paE4paEIOKWgJgBABWAloDiloAgIOKWiOKWiCDi
loDiloDiloAgICAg4paI4paIIOKWgOKWgOKWgCAgICAgIOKWgOKWgOKWgOKWgCAgICAg4paA4paA
4paA4paA4paA4paAICAKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICDiloDilojilogw
AQAXUSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg4paI4paIICAgICAgICDilojilogg
ICAgICAgICAgICAgICAgICAgICAgICAgICAKCnQBAA6AIOKWiOKWiCAg4paI4paIICAgIOKWiOKW
iCAg4paI4paIICAgIOKWiOKWiCAg4paI4paIICAgIOKWiOKWiCAgIOKWiOKWiCAgICAgICAgIOKW
iOKWiOKWiOKWiOKWgCAgICAgICAgICAgICDilojiloggICAg4paI4paIICAgICCYAQABgCAgIC8g
ICAgICAgICAgICAgICAgXCAgICAgICAgICAgICAKCiAgICAgICwtJycnJyctLjotXi0uXyAgICAg
ICAgICAgIF8sLV4tOywtJycnJyctLgogICAgIC8gICAgICAnICAoIGAgIF9cICAgICAgICAgIC9f
ICBgICkgIGAg5AEAFICA4paAIOKWgOKWgCAg4paA4paAICAgIOKWgOKWgCAgIOKWhOKWgOKWgOKW
gCDilojiloggICDiloDiloAgICAgICAgICAg4paI4paIICAgICAgICAgICAgICAg4paA4paAICAg
IOKWgOKWgCAg4paA4paA4paA4paA4paA4paA4k4BAAmA4paIICAg4paI4paI4paI4paIICAgICDi
lojilojiloTilojilojilojiloQgICDilojilojiloTilojilojilojiloQgICAg4paE4paI4paI
4paI4paI4paEICAg4paE4paE4paI4paI4paI4paI4paI4paEIAog4paI4paI4pbeAQAFgJaIICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICDilojiloggICAg4paI4paIICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgXgEAE4AgIOKWgOKWgOKWgOKWgCDiloDiloAgIOKWgOKWgCAgICDiloDiloAgICDi
loTiloDiloDiloAg4paI4paIICAg4paA4paAICAgICAgICAgIOKWiOKWiCAgICAgICAgICAgICAg
IOKWgOKWgCAgICDiloDiloAgICDiloDiloDilswBABGAiOKWiCAg4paI4paIICAgIOKWiOKWiCAg
4paA4paI4paI4paE4paE4paI4paI4paIICAg4paI4paIICAgICAgICAgIOKWiOKWiOKWiCAgICAg
ICAgICAgICAg4paI4paIICAgIOKWiOKWiCAg4paE4paE4paE4paI4paI4paE4pYAAQAQgIjilogg
IOKWiOKWiCAgICDilojiloggIOKWgOKWiOKWiOKWhOKWhOKWiOKWiOKWiCAgIOKWiOKWiCAgICAg
ICAgICDilojilojiloggICAgICAgICAgICAgIOKWiOKWiCAgICDilojiloggIOKWiOKWiOKWhOKW
hOKWhOKWiOKWBAEADYAgCiDilojiloggICAg4paI4paIICDilojiloggICAg4paI4paIICDiloji
loggICAg4paI4paIICDilojiloggICAg4paI4paIICAg4paI4paIICAgICAgICAg4paI4paI4paI
4paI4paAICAgICAgICAgICAgIOKWiOKWiCAgIIIEABgAAQAPgOKWiOKWiCAgICAg4paI4paIICAg
IOKWiOKWiCAg4paI4paIICAgIOKWiOKWiCAg4paI4paIICAgIOKWiOKWiCAgIOKWgOKWgOKWgOKW
gOKWiOKWiOKWhCAKIOKWiOKWiCAgICDilojiloggIOKWiOKWiOKWhOKWhOKWhOKWiOKWUgEABoAg
ICAgICAgICAgICAgIOKWiOKWiCAgICDilojiloggICAgIOKWgOKWgCAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgCiDilojiloggICAg4paI4paIICDilojiloggICAg
4paI4paIICDilojilnIBAAuAlojilojilojilojilojilojiloggIOKWiOKWiCAgICDilojilogg
IOKWiOKWiOKWgCAgIOKWiOKWiCAg4paI4paI4paAICDiloDilojiloggICDilojilojiloAgICAg
ICAg4paI4paI4paEIOKWiOKWiCAgICAgICAgICAgICDaAQASgITiloQgIOKWiOKWiOKWiOKWhOKW
hOKWiOKWiOKWgCAg4paI4paI4paI4paE4paE4paI4paI4paAICDiloDilojilojiloTiloTiloji
lojiloAgIOKWiOKWhOKWhOKWhOKWhOKWhOKWiOKWiCAKIOKWgOKWgCAgICDiloDiloAg/gEAAIAg
ICAgICAgICAgICAgICAgIEknTSBBIENBVCAgICAgICAgICAgICAgICAgICAgICAgCgogICAgICAg
ICAgICAgICAgICAgIC8gICAgICAgICAgSSdNIEEgRE9HCiAgICAgICAgICAgICAgICAgICAvCiAg
ICAgICAgICAgICAgILQBABaA4paI4paI4paA4paAICAgICAgICAgICAgIOKWiOKWiOKWiCAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg4paA4paI4paI4paI4paI
4paA4paAICAgICAgICAgICAgIOKWiOKWiOKWiCAgICB4AQAHgIjiloTilojilojilojilojiloQg
ICDiloTilojilojilojiloTilojiloggICDilojilojiloTilojilojilojiloggIOKWgOKWiOKW
iCAg4paI4paI4paIICAgICAgICAgICAg4paI4paIICAgIOKWiOKWiCAg4paI4paIICAgTAEAA4Bw
dXp6bGUgaXM6Cgog4paE4paEICAgIOKWhOKWhCAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg4paE4paEICAgIOKWhOKWhCAgICAgICAg
ICAgICAgICAgICAgIFQ=


Opening this file in a text editor will make it very clear that the text is not in the correct order, and because it features the character █ many times it’s probably ASCII art. There is some odd “garbage” data scattered about that led us to open it in a hex editor.

We notice the first four bytes of the file are this “garbage” unprintable character data. So, we look for anything similar, and we find a pattern.

01 00 02 80 01 00 0A 80 01 00 04 80 01 00 08 80 01 00 0C 80 01 00 15 80

We look at the value that is changing first, and it seems to be pretty clear that it indicates the order of each block of data following it. The size of the block of data is determined by the fourth byte, as we confirmed by copypasting the bytes afterwards into a hex editor. This showed us immediately that the pasted block was 80 bytes long.

Naturally, we write something quickly in python and output the result to a file..

(BinaryReader from http://pypi.python.org/pypi/binstream)

import struct
import binascii
from operator import itemgetter
import sys

class datStore:
	def __init__(self, pos, dat):
		self.pos = pos
		self.dat = dat

br = BinaryReader('base64.bin')

datList = []
while 1:
	try:

		garb1 = br.read('uint8')
		garb2 = br.read('uint8')
		pos = br.read('uint8')
		size = br.read('uint8')

		print hex(pos) + " " + hex(size)
		tempdat = []
		for _ in xrange(size+1):
			tempdat.append(br.read('uint8'))

		datList.append(datStore(pos, tempdat))

	except BinaryReaderEOFException:
	    break

datList = sorted(datList, key=lambda der: der.pos)

for obj in datList:
	print sys.stdout.write(str(bytearray(obj.dat)))

resulting in