Blog Posts

Okay, I have a confession.I used to think multilingual NLP was mostly about getting the language into the tokenizer... Till I worked with Gikuyu, Swahili and isiZulu.During AI-BRIDGE Engineering process, one of the most interesting parts of the Bias Correction Layer was realizing that 'multilingual' does not always mean translating the same strategy multiple times... (It would have made it so easy though, right?... but we can't always have it the easy way).The rule engine had to behave differently because the languages themselves behave differently. And some of those differences were architectural.<h3 id="six-languages-six-different-personalities">Six languages, Six Different Personalities</h3>The active lexicons were not symmetrical.The project contained approximately:<ul><li>432 active Swahili rules</li><li>1,326 active Gikuyu rules</li><li>106 English rules</li><li>145 French rules</li><li>162 Hausa rules</li><li>153 isiZulu rules</li></ul>That asymmetry is be design. It reflects how we had to model the linguistic risks of each language. For example, Swahili had specific handling for possessives, occupational gender markers, Sheng registers, proverbs and role descriptions.Gikuyu leaned heavily into morphology, polarity and long phrase matching.isiZulu used gender linked concordial suffix patternsFrench had inclusive writing, and phrase level alternativesHausa had dedicated neutral context handling around terms that are frequently neutral in real reporting.With all these, The engine ended up becoming a small linguistic policy system.<h2 id="longest-first-matching-sounds-boring-until-it-saves-you">Longest-First matching sounds boring until it saves you</h2>The rule loader sorts biased phrases longest-first. This becomes particularly important for Gikuyu.Suppose the lexicon contains:<pre><code class="hljs">mũtumia wa mũciĩ
mũtumia wa mũciĩ ndangĩhõta
mũtumia wa mũciĩ ndangĩhõta wĩra wa ũtongoria</code></pre><ul><li>Linguistic breakdown:<ul><li><code>mũtumia wa mũciĩ</code> → "Woman of the household / Housewife"</li><li><code>mũtumia wa mũciĩ ndangĩhõta</code> → "A housewife cannot manage..."</li><li><code>mũtumia wa mũciĩ ndangĩhõta wĩra wa ũtongoria</code> → "A housewife cannot manage leadership work"</li></ul></li></ul><ul><li>Why shortest-first fails here: Matching <code>mũtumia wa mũciĩ</code> first triggers a generic gender-role flag or rewrite, destroying the input string before the engine can catch the specific high-severity policy rule targeting leadership discrimination (<code>...ndangĩhõta wĩra wa ũtongoria</code>).</li></ul>The loader therefore treats phrase length as part of the disambiguation strategy. I prepared a simple illustration to help describe this better.<pre><code class="hljs language-mermaid">%%{
 init: {
 'theme': 'base',
 'themeVariables': {
 'background': '#050505',
 'primaryTextColor': '#e0ffff',
 'lineColor': '#00e5ff'
 }
 }
}%%
flowchart TD
 %% Global Link Styling (Cyan, Dashed for the flow effect)
 linkStyle default stroke:#00e5ff,stroke-width:2px,stroke-dasharray: 5 5;

 %% Nodes
 A[(Load lexicon)]
 B(Normalize rows)
 C(Sort by biased phrase length)
 D{{Longest phrase first}}
 E(Regex / literal matching)
 F{Context gating}
 G([Rewrite or warn])

 %% Flow Connections
 A --&gt; B
 B --&gt; C
 C --&gt; D
 D --&gt; E
 E --&gt; F
 F --&gt; G

 %% Neon Cyberpunk Color Palette for Black Backgrounds
 %% Cyan: #00e5ff | Electric Blue: #0077ff | Neon Green: #39ff14 | Purple: #b000ff | Pink: #ff007f
 classDef dataNode fill:#001a1a,stroke:#00e5ff,stroke-width:2px,color:#00e5ff,font-weight:bold;
 classDef processNode fill:#0a0a14,stroke:#0077ff,stroke-width:2px,color:#80bfff;
 classDef matchNode fill:#051a05,stroke:#39ff14,stroke-width:2px,color:#b3ffb3;
 classDef gateNode fill:#1a0a1a,stroke:#b000ff,stroke-width:2px,color:#e6b3ff;
 classDef actionNode fill:#1a000d,stroke:#ff007f,stroke-width:3px,color:#ffb3d9,font-weight:bold;

 %% Assigning Classes
 class A dataNode;
 class B,C processNode;
 class D,E matchNode;
 class F gateNode;
 class G actionNode;</code></pre>This is one of those engineering choices that looked trivial during code review and became extremely important once real text arrived.<h3 id="swahili-required-more-than-word-matching">Swahili required more than word matching</h3>Some of the most interesting rules were not obvious gendered nouns. We realzed that possessive words such as: <code>yake, wake, zake</code> can be completely neutral depending on what they refer to.<code>Nyumba yake</code> is not the same linguistic problem as <code>daktari wake</code>So the context checker introduced a human-referent gate and an inanimate-noun gate.That is the kind of logic that almost disappeared when we tried to treat different languages as a bag of strings.😅😅😅<h2 id="and-then-there-was-counter-stereotype-context">And then there was counter-stereotype context</h2>This is where things became even more interesting. A phrase may contain the same gendered term, but the surrounding sentence may be challenging the stereotype rather than expressing it (aha!... you see where I'm going with this?)For example, a sentence may contain the same gendered term but the surrounding sentence may be challenging the stereotype rather than expressing it.A sentence may mention women in a sentence about women succeeding in an occupation. A context-blind replacement system could correct the sentence that was already doing the correcting.That is why the context checker contained dedicated logic for counter stereotypes, advocacy language, celebration, biographies, statistics and other situations.So rather than our rule-engine asking itself <code>Does this word occur?</code> instead, it asks itself <code>should this word be changed in this context?</code><h2 id="the-deeper-engineering-lesson">The deeper engineering lesson</h2>Low resource language engineering forces you to stop hiding behind averages.When the conventional English tools we are used to are slightly wrong, someone may call it a quality issue. But when an African language system is wrong, the engineering mistake can be much harder to diagnose because there may be less training data ...(I'll definitely talk about this and other challenges we faced in a dedicated post).. ,fewer benchmarks, fewer reviewers and more morphological complexity.That makes explicit policy very valuable.You need to know:<pre><code class="hljs">Which rules are deterministic?
Which are warnings?
which contexts suppress edits?
Which substitutions are allowed?
Which languages require human review?
Which metrics actually reflect runtime behaviour?</code></pre>This level of explicitness is what makes AI-BRIDGE debuggable.<pre><code class="hljs language-mermaid">%%{
 init: {
 'theme': 'base',
 'themeVariables': {
 'background': '#050505',
 'primaryTextColor': '#e0ffff',
 'lineColor': '#00e5ff',
 'edgeLabelBackground': '#0a0a14'
 }
 }
}%%
flowchart LR
 %% Global Link Styling (Cyan, Dashed for the flow effect)
 linkStyle default stroke:#00e5ff,stroke-width:2px,stroke-dasharray: 5 5;

 %% Nodes with Semantic Shapes
 A([Matched phrase])
 B{What is around it?}

 C([Do not rewrite])
 D([Usually preserve])
 E([Usually preserve])
 F([Preserve / suppress])
 G([Rewrite])
 H([Warn / review])

 %% Flow Connections
 A --&gt; B
 B --&gt;|Name / biography| C
 B --&gt;|Quotation| D
 B --&gt;|Statistics| E
 B --&gt;|Counter-stereotype| F
 B --&gt;|Known harmful stereotype| G
 B --&gt;|Ambiguous| H

 %% Neon Cyberpunk Color Palette
 %% Cyan (Input) | Purple (Decision) | Neon Green (Preserve) | Pink (Rewrite) | Yellow (Warn)
 classDef startNode fill:#001a1a,stroke:#00e5ff,stroke-width:2px,color:#00e5ff,font-weight:bold;
 classDef gateNode fill:#1a0a1a,stroke:#b000ff,stroke-width:2px,color:#e6b3ff;
 classDef safeNode fill:#051a05,stroke:#39ff14,stroke-width:2px,color:#b3ffb3;
 classDef actionNode fill:#1a000d,stroke:#ff007f,stroke-width:3px,color:#ffb3d9,font-weight:bold;
 classDef warnNode fill:#1a1500,stroke:#ffcc00,stroke-width:2px,color:#ffe680;

 %% Assigning Classes
 class A startNode;
 class B gateNode;
 class C,D,E,F safeNode;
 class G actionNode;
 class H warnNode;</code></pre>Alright, we have come to the end of this article.Adios! See you on the next one!

A Regex is not a linguist: What building African Language Correction Model Taught Me About Context

I guess you thought I disappeared for another year after my last blog post, Well.. I guess we are doing this for real 😅😅😅Incase you missed it, you can read it here. <a target="_blank" rel="noopener noreferrer nofollow" class="text-primary underline hover:text-primary/80" href="https://www.ndegwaofficial.tech/posts/the-hidden-difficulty-of-making-ai-fair-in-african-languages">https://www.ndegwaofficial.tech/posts/the-hidden-difficulty-of-making-ai-fair-in-african-languages</a>Let's be honest, In the current hype cycle, the default solution to any text problem is to blindly throw a massive Large Language Model at it and hope for the best. (I know because I do it too.. haha!). But if you've ever tried to build production-grade content moderation or gender-inclusive rewriting for morphologically rich African languages, you already know how it goes. It fails epically!<h3 id="enter-the-ai-bridge-project-and-primarily-the-bias-correction-layer">Enter the AI-BRIDGE project and primarily... the Bias Correction Layer.</h3>PS: AI-BRIDGE Stands for Bias Reduction and Inclusive Data Generation Engine(Sincere apologies to any civil and structural engineer who might have been following upto this point expecting me to unveil some concrete structure that has AI Capabilities)The Bias Correction Layer we built for the AI-BRIDGE is an explainable, multilingual gender-inclusive rewriting service designed for six languages: Swahili (SW), English (EN), French (FR), Gikuyu (KI), Hausa (HA), and isiZulu (ZU). But what makes it brilliant is not just its language coverage, it's the architecture. It proves that:<blockquote>The best AI Solutions aren't just massive neural networks, they are carefully orchestrated ecosystems.</blockquote><h2 id="the-problem-with-pure-ml">The Problem with "Pure ML"</h2>When dealing with nuanced languages like Gikuyu or Swahili, context is everything. You can't just auto-replace a gendered term. if you do, you might accidentally butcher a proverb or ruin the noun-class agreement of an entire sentence. Pure ML is a black box. If it makes a mistake, it's incredibly hard to explain why it changed "Daktari wa Kiume"(Male Doctor) to something completely nonsensical.Our Correction Layer in AI-BRIDGE, solves this by being a decision support system. Its strongest differentiator is the combination of language-specific rule packs, context suppression, semantic-preservation checks and edit-level explanations... (I already talked about these on the previous blog post)<h2 id="real-world-use-cases">Real World Use Cases</h2>So, where does a system like this actually create value? Well, you can get as wild as your imaginations can,(These are the perks of having this as an Open Source Platform... My fellow software engineers can go all Wild N Out) .... but off the top of my head, I think of 3 very plausible candidates:<ol><li>Newsroom CMS Assistant: Editors can draft articles, and AI-BRIDGE can flag sentences for review before publication. Crucially, it has "Context Gates" that preserve direct quotations, proper names and statistical reporting thus ensuring journalistic integrity remains untouched</li><li>HR &amp; Recruitment Tooling: Imagine an ATS webhook that checks job descriptions as they are drafted. it doesn't just auto-correct. it also gives you explainable replacements and severity flags and I believe this would help companies write more inclusive ads without risking legal compliance issues.</li><li>Education and Curriculum Authoring: A plug-in fo Learning Management Systems to check lesson text. It understands family role and capability categories and it would also export corrections for teachers to review.</li></ol>To make this tangible, I have illustrated how a clean, non-intrusive CMS integration with AI-Bridge would look like... Notice how the human alway stays in the loop:<pre><code class="hljs language-ascii">┌──────────────┐ ┌─────────────────┐ ┌───────────────┐ ┌──────────────┐
│ Author / CMS │ │ Partner adapter │ │ AI-BRIDGE API │ │ Human editor │
└───────┬──────┘ └────────┬────────┘ └──────┬────────┘ └───────┬──────┘
 │ │ │ │
 │ Draft paragraph + language + doc ID │ │
 ├────────────────────►│ │ │
 │ │ │ │
 │ │ Split sentences; minimize PII │
 │ ├──┐ │ │
 │ │ │ │ │
 │ │◄─┘ │ │
 │ ┌─[loop each sentence (bounded concurrency)]─────┐
 │ │ │ │ │ │
 │ │ │ POST /rewrite/async │ │ │
 │ │ ├────────────────────►│ │ │
 │ │ │ │ │ │
 │ │ │ job_id │ │ │
 │ │ │◄┈┈┈┈┈┈┈┈┈┈┈┈┈┈┈┈┈┈┈┈┤ │ │
 │ │ │ │ │ │
 │ │ │ GET /rewrite/status/{job_id} │ │
 │ │ ├────────────────────►│ │ │
 │ │ │ │ │ │
 │ │ │ rewrite, edits, reason, source, needs_review │
 │ │ │◄┈┈┈┈┈┈┈┈┈┈┈┈┈┈┈┈┈┈┈┈┤ │ │
 │ │ │ │ │ │
 │ └────────────────────────────────────────────────┘
 │ │ │ │
 │ Highlighted suggestions; no auto-publish │ │
 │◄┈┈┈┈┈┈┈┈┈┈┈┈┈┈┈┈┈┈┈┈┤ │ │
 ┌─[alt replace edit with no review flag]─────────────────────────────┐
 │ │ │ │ │ │
 │ │ Optional accept/reject │ │ │
 │ ├───────────────────────────────────────────────────────────────►│ │
 ├┈[warn, ML, preserved, or context-suppressed result]┈┈┈┈┈┈┈┈┈┈┈┈┈┈┈┈┤
 │ │ │ │ │ │
 │ │ Required adjudication │ │ │
 │ ├───────────────────────────────────────────────────────────────►│ │
 │ │ │ │ │ │
 └────────────────────────────────────────────────────────────────────┘
 │ │ │ │
 │ │ Decision and amended final copy │
 │ │◄─────────────────────────────────────────┤
 │ │ │ │</code></pre>This post goes to show the vast and endless possibilities by AI-BRIDGE. Any Developers reading this are free to replicate this architecture or use cases, for their projects.As usual, I've reached my most dreaded part... I still can't figure out how to properly end a blog post... Do we all stand and clap?See you on my next post!

Why Slapping an LLM on African Languages Doesn't Work (And How AI-BRIDGE Fixes It)

Damn... It's been close to two years since I last updated this blog. If there was an award for the longest digital silence, my golden trophy would already be covered in dust... SMHAnyway, let's begin. Together with an amazing team of 16 engineers, we have been working on a very interesting project. (or atleast I think so)... The AI-BRIDGE Project is an Open-Source research and engineering initiative by Afrilabs and supported by Gates Foundation. Its core goal is to evaluate and mitigate gender bias acoss African native Languages.When working on this project, I have uncovered a lot of insights that I deemed worth sharing, and one of them is what I'll be delving into today. -&gt; The Hidden Difficulty of Making AI Fair in African LanguagesOne of the biggest misconceptions about AI Fairness is that you can solve it by putting a Larger Language Model behing an API endpoint. Working on the AI-BRIDGE Project fundamentally challenged this assumption.When developers talk about gender bias correction in English, the mental model is often simple string substitution or zero-shot prompt engineering: replace "chairman" with "chairperson". (Sounds easy right?... LOL)... The problem is when you scale this across languages like Swahili, Gikuyu, Hausa, isZulu, e.t.c language-specific syntax, morphology and semantics break simple models.Consider the engineering challenges that emerge in real world texts:<ul><li>Contextual Ambiguity: A term can expess a stereotype in one sentence, yet be a legitimate historical quote, named entity or statistical metric in another.</li><li>Morphological Complexity: In agglutinative (I know, I know... what a word!) languages like Zulu, bias markers are embedded within concordial prefixes and suffixes (wesifazane, owesifazane) rather than standalone tokens.</li><li>Semantic Drift: Replacing a term to remove bias can alter the factual meaning of the sentence if not bounded by semantic validation.</li></ul>In the Bias Correction layer of the AI-Bridge Project, we built a multi-tiered architecture combining deterministic language lexicons, context gating, composite semantic preservation checks, and neural ML Fallbacks.<pre><code class="hljs language-ascii">Input Text
 │
 ▼
[Deterministic Lexicon &amp; Rules Engine] ──(Gated by 12 Context Conditions)
 │
 ▼
[Semantic Preservation Gate] ───────────(Evaluates Lexical Drift)
 │
 ▼
[ML Detection &amp; Seq2Seq Fallback] ──────(Fired Only When Lexicon Is Silent)
 │
 ▼
[Audit &amp; Human-in-the-Loop Review] ────(Graceful Low-Confidence Fallback)</code></pre>My primary takeaway for building this system was:<blockquote>Responsible AI for low resource languages is not a single model problem, but a systems architecture problem. A robust AI System is defined as much by when it chooses not to rewrite a sentence, as when it does.</blockquote>

The Hidden Difficulty of Making AI Fair in African Languages

Post 3 already and I still can't find a proper intro...

Oh God, Winter is here.

Yes. The challenge creator goes by that name and indeed, when you are not shivering from the cold heart break his challenges will give you, you are contemplating on throwing your laptop in the freezer because it seems to be going bad.

This challenge is a Windows CTF challenge. The goal is to get the flag from the shared memory.

Aight! Let's Begin!

## Understanding The Question 
This is The Question.

![alter-text](/images/post/Shared/Question.png)
*Screenshot of the "Shared" challenge question*

We can see the Code :
```
#define SHARED_MEMORY_NAME "Local\\FlagSharedMemory" 
#define FLAG_SIZE 64
```

We have also been given a .zip file which contains a program "Shared.exe"

### What does it mean?

Well The ``` SHARED_MEMORY NAME ``` sets the name of a shared memory region to ``` Local\\FlagSharedMemory ``` 

This shows that this is where the flag we need to retrieve is stored by the program.

The ``` FLAG_SIZE 64 ``` is self explanatory, it sets the size of the shared memory to 64 bytes.

So, What Next?

Logically, Our first course of action will be running the Shared.exe and see the program in action

Since I use Linux, I will use Wine to run the program.

Wine adds a compatibility layer to allow Linux and MACOS Users run windows Programs

![alter-text](/images/post/Shared/runshared.png)
*Running Shared.exe with Wine*

After running the program, it prints the text
``` Flag decrypted and stored in shared memory. Waiting... ```

This Means 2 Things:
1. We can reverse engineer the program to see how it decrypts the flag, then get the encrypted flag and attempt to decrypt it ourselves or
2. We can access the already decrypted flag that has been dumped on the Shared Memory.

We will go with method 2. Why? Well... It's Easier, and also, Based on the hints the challenge creator gave, it seems like the challenge creator wants to test our ability to gain access to shared memory.

## Accessing Shared Memory

I decided to use C to write a small program to help me get access to the flag stored in the shared memory.

![alter-text](/images/post/Shared/shared_c.png)
*C Program to retrieve flag*

Let me explain why I used that Logic.

From our provided hints, we saw that the shared memory object is ``` SHARED_MEMORY_NAME. ``` 

Therefore, I used the ``` hMapFile = OpenFileMappingA(FILE_MAP_ALL_ACCESS, FALSE, SHARED_MEMORY_NAME); ``` to open the shared memory object with full acsesss permissions. The `FALSE` Parameter simply means that we are not creating a shared memory, but opening an already existing one.

What follows is basic error handling

Then I mapped the shared memory object into the current process's (This C program) memory space using the `MapViewOfFile` function.

Those are the most important bits of our program.

So, Let's compile our program. 

Compiling with the conventional GCC on linux will result in errors because our program calls Windows APIs with the `#include <windows.h>`. So I used `x86_64-w64-mingw32-gcc` Compiler accompanied with the `-luser32` flag to tell the linker to include the "User32 library" which will provide access to the windows functions


![alter-text](/images/post/Shared/compiling.png)
*Compiling the Program*

After Successfully Compiling, I ran the program with Wine and it printed the flag

![alter-text](/images/post/Shared/flag.png)
*Retrieving The Flag*


Here is the Flag:
```flag{so_we_can_actually_share_memory_like_this}```

So. Once again, We've reached my most dreaded moment. 
I've ran out of creative ways to end these things. So, I'll just say that this was a fun challenge and I'm glad I could solve it. 

See you on Shared2 which actually made me cry!!!

**REMEMBER**: *__Bsides Nairobi Challenge is happening this November and would really use you financial donations to help make the
event a success. You can donate here: [Bsides Nairobi 2024](https://paydexp.com/contribution/bsides-2024-conference)__*

'Shared' CTF Challenge by Winter (BSIDES Nairobi 2024)

This is actually my first ever blog post. So do I start with the National Anthem or how do these things even work. Just Assume I said
some really cool stuff.... Thanks!

Let's Begin!
This challenge we are about to walk through was written by Vold3m0rt in the OSINT Category for the BSIDES Nairobi CTF 2024.
The challenge creator has a habit of making grown men cry with his seemingly simple OSINT challenges, that often prove otherwise.

So how did I solve it?

## Understanding The Question
This is The Question.
![alter-text](/images/post/Time_Will_Tell/Question.png)
*Screenshot of the challenge question*

It seems to be some kind of poem that reads:

>  In fleeting moments, time's song rings, With echoes of the past, the future sings. Who charted days in a sunlit shell? Can you discover who first learned to tell?

Let's disect this poem and understand it

> In fleeting moments, time's song rings, With echoes of the past, the future sings.

This part indicates that the  challenge is about time or It's about something that has to do with time. 
Let's move to the next part and see if we can get more clues

>  Who charted days in a sunlit shell? Can you discover who first learned to tell?

The phrase "Who charted days in a sunlit shell" seems to be a metaphor for the earlier methods of counting days(time) using sundials

"Can you discover who first learned to tell?" This Mean we are looking for who were the first people to use sundials

Let's do a simple google search
![alter-text](/images/post/Time_Will_Tell/Google-Search.png)
*Screenshot of the Google Search*

We will go to the first link  and see if we can find the answer from Wikipedia
![alter-text](/images/post/Time_Will_Tell/Answer-wikipedia.png)
*Screenshot of the Wikipedia*

As we can see, The earliest sundial's were found in 2 Places:
1. Ancient Egypt
2. Ancient Babylonian Astronomy

Let's see what the question expects as the answer
![alter-text](/images/post/Time_Will_Tell/Format.png)
*Something Something*

The Question expects 2 words in Camel Case
So the answer is: Ancient Egypt

Thank You for reading! Assume I am writing a very emotional goodbye, but I know I'll see you on my next post. Adios!

Oh! One Sec. **Bsides Nairobi Challenge is happening this november and would really use you financial donations to help make the
event a success. You can donate here: [Bsides Nairobi 2024](https://paydexp.com/contribution/bsides-2024-conference)**

Time Will Tell CTF Challenge by v0ld3m0rt (BSides Nairobi 2024)


Damn! We are already on Post 2?😱😱😱

I guess I'm really doing this huh?😏😏😏

Aight! Let's Begin!

## Understanding The Question 
This is The Question.

![alter-text](/images/post/Buds/Question.png)
*Screenshot of the "Buds" challenge question*

We can see the text :
> Please cover my ears with buds and help me read the flag!

So this challenge has something to do with music

But we are also given a zip file which upon downloading and extracting we see:

![alter-text](/images/post/Buds/ls.png)
*ls command on the extracted folder*

We can see the zip file contains a file called 'buds' 

Let's identify what type of file this is
![alter-text](/images/post/Buds/binwalk.png)
*binwalk command on "buds" file*

The binwalk tool tells us that "buds" file is an ELF format meaning it is an Executable and Linkable File Format
This tells us 2 things:
1. We can interact with it by executing/running it
2. That  it is a binary file which we can reverse engineer and get the source code.

### Let's start with 1

We first give executing permissions on the file, then we proceed to interact with  the program and see
what it does.

![alter-text](/images/post/Buds/test1.png)
*executing the buds program*

Well! pretty disappointing, but still useful. 
The program asks us for a song name and seems to check for a specific song
So what next?

### Method 2

We will need to call upon the mighty dragons From NSA, and see if they can help us out.

Yeah, that's right We will use Ghidra to disassemble our buds file and hopefully get the  source code.

So I fired up Ghidra, created a project and imported the buds file.

After analysis, this was the source code for our point of interest: (The Main Function)

![alter-text](/images/post/Buds/sourcecode.png)
*source code of the buds program*

### Understanding the source code

The program seems to prompt the user for a song name, then checks if it matches a specific hardcoded string and then generates a "lovely.wav" file if the song entered does not match.

Pretty weird right? Like who does that??????

Okay, Let's move on


The first point of interest is this weird string just before the printf statement 
``  local_18 = "l~WadpxWl~WadggWqnoWl~W`pa~rfW{z|{"; ``

We see this is what the  program checks for, and if it doesn't match, it generates a lovely.wav file. But not that simple.

It reads the input into `local_128` and removes the newline character
It then performs an XOR operation with the byte 8 of each character of the input string
Then Reverses the XORed string and compares it to the hardcoded weird string 
``l~WadpxWl~WadggWqnoWl~W`pa~rfW{z|{``

If the input matches the string, it prints "You have it!"

### Deciphering the String

I wrote a python script that helped me perform the XOR Operation with the byte 8, on the weird string


![alter-text](/images/post/Buds/xor.png)
*Python Script to XOR String*

First I reversed the string then XORed each charachter to get the original input

Running the script returned this:


![alter-text](/images/post/Buds/runxor.png)
*running the Python Script*

Pretty weird right?... It shows some kind of flag but we are definitely sure that this is not the expected flag.
Why?... Well, unless we started listening to K-POP music. It's not even remotely related to a song. 

`flag{strs_nzvixh_vd_gfy_ooli_vd_pxli_vd}`

Remember this part of the question?.... That's right 
Atleast we know we are on the right direction

![alter-text](/images/post/Buds/hint.png)
*hint*

I tried deciphering the string `strs_nzvixh_vd_gfy_ooli_vd_pxli_vd` with ROT but it didn't work 

![alter-text](/images/post/Buds/rotdecipher.png)
*ROT Decipher Script*

The Output was:


![alter-text](/images/post/Buds/runROT.png)
*running the ROT Deciphering Script*


So The next course of action was deciphering with Atbash

### Atbash Deciphering
Atbash is a simple substitution cipher that replaces each letter with the letter at the opposite end of the alphabet

E.g A becomes Z and B becomes Y... You gerrit? If you don't gerrit well....

I wrote a simple Atbash Deciphering Script

![alter-text](/images/post/Buds/at.png)
*Atbash Deciphering*

and upon running it, I got the output:


![alter-text](/images/post/Buds/atbash.png)
*hint*

So we got this text:
`hgih_maercs_ew_tub_llor_ew_kcor_ew`

Let's Write it from the right to left
`we_rock_we_roll_but_we_scream_high`

Voila!... This actually makes sense!
And this is our flag:
`flag{we_rock_we_roll_but_we_scream_high}`

So, I guess that's it. I really don't know how to end this things. Amen?... Adios?
Adios seems good.

So, Adios Muchachos!

**REMEMBER**: *__Bsides Nairobi Challenge is happening this november and would really use you financial donations to help make the
event a success. You can donate here: [Bsides Nairobi 2024](https://paydexp.com/contribution/bsides-2024-conference)__*


Buds CTF Challenge BSIDES Nairobi 2024

Damn! We are already on Post 2?😱😱😱

I guess I'm really doing this huh?😏😏😏

Aight! Let's Begin!

## Understanding The Question 
This is The Question.

![alter-text](/images/post/Buds/Question.png)
*Screenshot of the "Buds" challenge question*

We can see the text :
> Please cover my ears with buds and help me read the flag!

So this challenge has something to do with music

But we are also given a zip file which upon downloading and extracting we see:

![alter-text](/images/post/Buds/ls.png)
*ls command on the extracted folder*

We can see the zip file contains a file called 'buds' 

Let's identify what type of file this is
![alter-text](/images/post/Buds/binwalk.png)
*binwalk command on "buds" file*

The binwalk tool tells us that "buds" file is an ELF format meaning it is an Executable and Linkable File Format
This tells us 2 things:
1. We can interact with it by executing/running it
2. That  it is a binary file which we can reverse engineer and get the source code.

### Let's start with 1

We first give executing permissions on the file, then we proceed to interact with  the program and see
what it does.

![alter-text](/images/post/Buds/test1.png)
*executing the buds program*

Well! pretty disappointing, but still useful. 
The program asks us for a song name and seems to check for a specific song
So what next?

### Method 2

We will need to call upon the mighty dragons From NSA, and see if they can help us out.

Yeah, that's right We will use Ghidra to disassemble our buds file and hopefully get the  source code.

So I fired up Ghidra, created a project and imported the buds file.

After analysis, this was the source code for our point of interest: (The Main Function)

![alter-text](/images/post/Buds/sourcecode.png)
*source code of the buds program*

### Understanding the source code

The program seems to prompt the user for a song name, then checks if it matches a specific hardcoded string and then generates a "lovely.wav" file if the song entered does not match.

Pretty weird right? Like who does that??????

Okay, Let's move on


The first point of interest is this weird string just before the printf statement 
``  local_18 = "l~WadpxWl~WadggWqnoWl~W`pa~rfW{z|{"; ``

We see this is what the  program checks for, and if it doesn't match, it generates a lovely.wav file. But not that simple.

It reads the input into `local_128` and removes the newline character
It then performs an XOR operation with the byte 8 of each character of the input string
Then Reverses the XORed string and compares it to the hardcoded weird string 
``l~WadpxWl~WadggWqnoWl~W`pa~rfW{z|{``

If the input matches the string, it prints "You have it!"

### Deciphering the String

I wrote a python script that helped me perform the XOR Operation with the byte 8, on the weird string


![alter-text](/images/post/Buds/xor.png)
*Python Script to XOR String*

First I reversed the string then XORed each charachter to get the original input

Running the script returned this:


![alter-text](/images/post/Buds/runxor.png)
*running the Python Script*

Pretty weird right?... It shows some kind of flag but we are definitely sure that this is not the expected flag.
Why?... Well, unless we started listening to K-POP music. It's not even remotely related to a song. 

`flag{strs_nzvixh_vd_gfy_ooli_vd_pxli_vd}`

Remember this part of the question?.... That's right 
Atleast we know we are on the right direction

![alter-text](/images/post/Buds/hint.png)
*hint*

I tried deciphering the string `strs_nzvixh_vd_gfy_ooli_vd_pxli_vd` with ROT but it didn't work 

![alter-text](/images/post/Buds/rotdecipher.png)
*ROT Decipher Script*

The Output was:


![alter-text](/images/post/Buds/runROT.png)
*running the ROT Deciphering Script*


So The next course of action was deciphering with Atbash

### Atbash Deciphering
Atbash is a simple substitution cipher that replaces each letter with the letter at the opposite end of the alphabet

E.g A becomes Z and B becomes Y... You gerrit? If you don't gerrit well....

I wrote a simple Atbash Deciphering Script

![alter-text](/images/post/Buds/at.png)
*Atbash Deciphering*

and upon running it, I got the output:


![alter-text](/images/post/Buds/atbash.png)
*hint*

So we got this text:
`hgih_maercs_ew_tub_llor_ew_kcor_ew`

Let's Write it from the right to left
`we_rock_we_roll_but_we_scream_high`

Voila!... This actually makes sense!
And this is our flag:
`flag{we_rock_we_roll_but_we_scream_high}`

So, I guess that's it. I really don't know how to end this things. Amen?... Adios?
Adios seems good.

So, Adios Muchachos!

**REMEMBER**: *__Bsides Nairobi Challenge is happening this november and would really use you financial donations to help make the
event a success. You can donate here: [Bsides Nairobi 2024](https://paydexp.com/contribution/bsides-2024-conference)__*