Challenge SokobanHTB

This challenge consists of a Sokoban game where one of the cubes required to solve the puzzle is spawned outside of the playable map and the solution consists of using PINCE for dynamic memory analysis to modify X-axis coordinates, teleport the player out of bounds to locate the missing cube, teleport it back inside the map, and solve the puzzle to obtain the flag.

The initial reconnaissance starts by executing the provided game using Wine. Upon launching the game, it is observed that while three cubes are required to solve the puzzle, only two are present within the map boundaries. This suggests that the third cube is spawned outside the playable area, requiring memory manipulation to bring it into the map.

$ cd out/build/x64-release/SokobanHTB
$ wine SokobanHTB.exe
libEGL warning: pci id for fd 34: 10de:25a0, driver (null)
pci id for fd 35: 10de:25a0, driver (null)
libEGL warning: egl: failed to create dri2 screen

To locate the player's coordinates, dynamic memory analysis is performed using PINCE. An initial scan is executed to search for an unknown value of type Int32 while attached to the SokobanHTB.exe process.

0x7ba73000
0x7ba73004
0x7ba73008
0x7ba7300c
...
0x7ba73f9c

The memory addresses are filtered to pinpoint the player's X-axis position. The player character is moved to the right to perform an "Increased" scan, and then to the left for a "Decreased" scan. This iterative process isolates 14 potential memory addresses that correlate with the horizontal movement.

0x7ffffe20fe10
0x7ffffe20fe24
...
0x7ffffe20fa48
...
0x7ffffe10e1d0

By freezing the first seven addresses and attempting to move the player, it is observed that the movement remains unaffected, leading to their discard. The process is repeated with the remaining addresses until freezing 0x7ffffe20fa48 blocks horizontal movement, confirming it as the player's X-axis coordinate. The data type is changed to Float32 to obtain a clear representation of the value.

Address           Type       Value
0x7ffffe20fa48    Float32    448.0

With the player's X-axis memory address identified, the value is manually modified to 640.0, effectively teleporting the player out of bounds.

Address           Type       Value
0x7ffffe20fa48    Float32    640.0

Exploring the unplayable area reveals the missing cube located at position 1024 on the X-axis. An "Exact Value" scan is executed in PINCE searching for a Float32 value of 1024.0. The cube is then pushed one position to the left, and a "Decreased By" scan is performed using 64.0 as the parameter. This isolates two potential memory addresses for the cube.

0x7ffffe8522b0
0x7ffffe8522f4

Freezing the address 0x7ffffe8522f4 prevents the cube from being pushed, validating it as the correct memory address.

Address           Type       Value
0x7ffffe8522f4    Float32    960.0

To bring the cube into the playable area, its X-axis coordinate value is changed to 640.0, teleporting it inside the map.

Address           Type       Value
0x7ffffe8522f4    Float32    640.0

The player is returned to the map by resetting their coordinate to 512.0, ensuring alignment on the same Y-axis as the newly placed cube. All three cubes are now pushed onto the designated symbols, completing the Sokoban puzzle and revealing the flag.

HTB{FLAG}