2007 Global Software Reverse Engineering Challenge

Do you enjoy reverse engineering and solving crackmes? Would you like to get paid to do it? If so, this challenge is for you.

Read on for more information, and register to participate using the login link at the top of the page.

Page Outline:

Purpose
Contest Overview

Phase 1: Hacker Challenge I (Results!)
Phase 2: Market
Phase 3: Hacker Challenge II (Results!)

Contest Timeline
Payment Note

Purpose

We are a U.S. company performing security testing and security metric research. The purpose of this challenge is to evaluate the effectiveness of software protections. The results of this effort will be used to improve our protection measures.

Contest Overview

There will be three distinct, yet related, phases to this contest. The first phase will be a hacker challenge, for which anyone can register to participate. The second stage of the contest will be a market (based on the Phase 1 challenge). Participation in this second phase will be by invitation only, based on performance in the first phase. The third phase of the contest will be a more challenging hacker challenge; this phase may or may not be invitation-only. There are opportunities to earn money in all three phases of the contest. Read on for more details.

All file downloads and uploads necessary for the contest will be possible after the participant has logged in. The market will also be visible, at the appropriate time, after logging in.

Phase 1: Hacker Challenge I

Phase 1 Objectives

This activity involves security testing. All software and software protections were developed exclusively for use in this effort. No commercial protections were used in the development of this test.

Participants will receive a protected Windows binary that produces certain output when run. The goal of the contest is to achieve the following two objectives:

Objective 1: Reverse engineer the mathematical formula that results in the value "10.9319" of the output.
Objective 2: Remove the limitation on an input data field of the code so that values greater than 210.5 are treated the same as values less than 210.5.

Success in this phase of the contest occurs when a participant achieves both objectives; this will be possible only if the software protections that are present are defeated.

Phase 1 Rules

A protected piece of software will be available, to be downloaded from this site, to all registered participants. When the participant achieves the above two objectives, he or she should upload:

A simple plain-text file that contains the formula that achieves Objective 1.
The altered code that achieves Objective 2.

The participant must also submit a full report describing the defeat, via upload to this site. A report template is provided. All reports must be written in English. Only one submission per individual or group will be accepted.

Phase 1 Payment

All payments are in U.S. dollars, and will be made anonymously via PayPal.

A partial break of the protection, accompanied by a report deemed to be of sufficient quality, will be compensated with $200. Participants who qualify for this compensation will also be rewarded with an invitation to participate in a market, in which additional money can be earned. To earn the $200 and market-invitation, the report must carefully explain how the attempted defeat was implemented, and what stopped you from a full break of the protection.
The first three successful defeats of the protections will be compensated with payments of $4,000 for first place, $2,000 for second place, and $1,000 for third place. An invitation to participate in Phase 2 of the contest will also be extended to these participants. These payments and market-invitations assume that an associated report of sufficient quality is submitted subsequently.
All successful defeats received after the first three will be compensated with $500. An invitation to participate in Phase 2 of the contest will also be extended to these participants. These payments and market-invitations assume that an associated report of sufficient quality is submitted subsequently.
The reports deemed to be among the top three in quality, for a partial or complete defeat, will be awarded bonus payments of $4,000 for first place, $2,000 for second place, and $1,000 for third place.

To participate and receive a $200 payment, all that is required is an e-mail address and a pseudonym.

Phase 2: Market

Phase 2 Objectives

An online information market will be conducted that asks participants (multiple-choice) questions about the protected software from Phase 1 of the contest. To assist in answering the market questions, the protection map for this software will be posted on this site before the market opens.

The objective of this phase of the contest is to answer the market questions to predict the results of an attacker's actions. To accomplish this, you will be provided with a "portfolio" of assets. Initially, your portfolio will consist of your assets being distributed equally among all of the answers to each question. You will then re-allocate your assets among the answers to each question to try to maximize the value of your portfolio. (Note that your re-allocation of assets will indirectly answer the market questions for you.) After the market closes, the true value of your re-allocated portfolio will be computed based on the correct answers to the questions. Specifically, the value of your portfolio will be the sum of the assets that you had placed in each of the correct answers.

Phase 2 Rules

The second phase of the contest involves a market related to the protected software from Phase 1 of the contest. Participation in this second phase will be invitation-only, based on the Phase 1 report. Specifically, participants who submitted a Phase 1 report of sufficient quality will be invited to participate in the market. (Note that completely defeating the protections in Phase 1 is not a prerequisite for being invited to participate in the Phase 2 market.) Market questions will be directly related to the protected software of Phase 1.

The following assumption should be noted when answering the market questions. It is assumed that the attacker of the software possesses a skill level of an intermediate hacker. The questions should be answered (i.e., assets should be re-allocated) to predict the results of such an attacker's actions. That is, a given market participant's answers should not reflect what he/she thinks the answers would be for himself/herself if he/she were the attacker. A third-party of the prescribed skill level will provide "truth" for the answers to the questions; this truth will determine the market participant's performance in the market and the bonus (payment) that he/she receives from participation in it.

Phase 2 Payment

All payments are in U.S. dollars, and will be made anonymously via PayPal.

The total payout of the market phase of the contest will be at least $10,000. The payment each participant receives will be proportional to the final value of his/her portfolio after the market closes. Note that you cannot lose any money from participation in the market. Every active market participant is guaranteed payment of at least $100.

Phase 3: Hacker Challenge II

Phase 3 Objectives

This activity involves security testing. All software and software protections were developed exclusively for use in this effort. No commercial protections were used in the development of this test.

Participants will receive a protected Windows binary that produces certain output when run. The goal of the contest is to achieve the following two objectives:

Objective 1: Reverse engineer the mathematical formula that results in the value "-59.0079" of the output.
Objective 2: Remove the limitation on an input data field of the code so that values of 200 or greater are treated the same as values less than 200.

Success in this phase of the contest occurs when a participant achieves both objectives; this will be possible only if the software protections that are present are defeated.

Phase 3 Rules

A protected piece of software will be available, to be downloaded from this site, to all registered participants. When the participant achieves the above two objectives, he or she should zip up the following into a single file and upload it to our website:

A simple plain-text file that contains the formula that achieves Objective 1.
The altered code that achieves Objective 2.

The participant must also submit a report describing the defeat, via upload to this site. A report template for phase 3 is provided. All reports must be written in English. Only one submission per individual or group will be accepted.

Phase 3 Payment

Payment for Phase 3 will be similar to that of Phase 1. Prizes will be awarded for the three participants that achieve the objectives the fastest. The first place finisher will receive $4,000; second place: $2,000 and third place will receive $1,000. There will not be prizes for the three best reports; however, all participants are required to submit a basic report describing what actions were taken to defeat the protections and a breakdown of the time required.

In addition to the prizes for the three fastest defeats, we will also be dividing $7,000 among the other participants that completely defeat the protections. If there are 8 or fewer finishers, then we will redivide the money to ensure that the top three prize winners are awarded at least as much as the remaining finishers.

Contest Timeline

Monday, August 27, 2007 at 14:00 GMT: The protected piece of software (for Phase 1) is available on this website to all registered participants [Phase 1 begins].
Between August 27, 2007 and September 10, 2007: Participants submit solution when the two objectives (for Phase 1) have been achieved.
Monday, September 10, 2007 (14:00 GMT): Deadline for participants to submit a full report (for Phase 1) detailing the defeat attempt [Phase 1 ends].
Tuesday, September 11, 2007 (14:00 GMT): Protection map of the protected software is posted.
Wednesday, September 12, 2007: Invitations to participate in the market (Phase 2) are e-mailed to participants who submitted a report of sufficient quality in Phase 1.
Monday, September 17, 2007 (14:00 GMT): Market opens [Phase 2 begins].
Wednesday, September 19, 2007 (14:00 GMT): Market closes [Phase 2 ends].
Saturday, September 29, 2007: Participants are paid for Phases 1 and 2.
Monday, November 26, 2007 (15:00 GMT): Phase 3 will begin - protected code posted.
Monday, December 10, 2007 (15:00 GMT): Deadline for phase 3 submission (solution and brief report)

Payment Note

This activity is being administered by a company based in the United States. Consequently, we are required to address tax issues. All individuals who are paid $600 or more will have to do one of two things:

If the individual is a non-U.S. citizen and if the work is performed outside the U.S., all that is required is an e-mail message stating this (in that message we will require only your name and the country in which the work was performed). In this case, no taxes are withheld and no further information is required.
If the individual is a U.S. citizen or resident, a Form W-9 must be filled out and uploaded to this site before receiving payment.

These tax issues will be addressed only after it is determined which individuals are to be paid $600 or more. At this point in time, no information is required beyond an e-mail address and a pseudonym.

If you are ready to register to participate in this contest, click on the login link at the top of this page.

If you still have some questions, try consulting the FAQ link, also at the top of this page.