This video delves into the intriguing world of the International Obfuscated C Code Contest (IOCCC) by reverse engineering several winning submissions from the 2024 competition. The speaker, a reverse engineer, utilizes the NSA's open-source Ghidra decompiler to analyze the compiled binaries, attempting to predict their functionality and assess the true difficulty of their de-obfuscated form. The process involves an initial source code review and difficulty ranking, followed by Ghidra analysis, a functional prediction, and final execution.
While some programs yielded predictable results like a Rick Roll animation or an ASCII art generator, the video uncovers profound and often surprising levels of obfuscation. Key discoveries include a submission that unexpectedly implements an entire virtual machine capable of running a playable version of Doom, another that utilizes recursive code definition to render complex 3D graphics, and one that functions as a functional, albeit slow, Large Language Model with distinct "personalities." The analysis frequently reveals that initial assessments of difficulty are often incorrect, demonstrating how extreme obfuscation can render code nearly uninterpretable, even for experienced professionals.
Summarizing IOCCC Submissions: A Reverse Engineering Challenge
0:00 The International Obfuscated C Code Contest (IOCCC): Introduces the competition focused on creating C code that is intentionally difficult to read while maintaining its core functionality.
0:31 Reverse Engineering Methodology: The speaker, a reverse engineer, plans to compile winning IOCCC submissions and use Ghidra, an NSA-developed open-source decompiler, to analyze the binaries, predict their functionality and difficulty, and then test the actual program execution.
1:31 Initial Difficulty Rankings: The speaker reviews the source code of eight submissions (Weaver, Kurdikov 3, Endo1, Cable 1, How, Cable 2, Code Meow, Kramer), assigning an initial difficulty rank (1-10) based on visual complexity and predicted Ghidra performance.
3:48 Weaver Submission: The Rick Roll (Initial Rank: 4/10, Final Rank: 4/10):
Ghidra analysis was relatively clear, showing calls for sound and animation.
Prediction: Animation with background sound.
Execution: Played a full-screen Rick Astley "Never Gonna Give You Up" music video.
Key Takeaway: The prediction was accurate, and the code was not overly difficult to analyze in Ghidra.
7:02 Kurdikov 3 Submission: Doom in a VM (Initial Rank: 3/10, Final Rank: 10/10):
Ghidra initially showed very short code with no external function calls, leading to an underestimation of complexity.
Analysis revealed it implemented an entire virtual machine with its own instruction set architecture (ISA).
Execution: Shockingly launched a playable version of Doom.
Key Takeaway: This submission completely stumped the speaker, earning the highest possible difficulty rating for its extreme and unexpected complexity.
10:01 Endo1 Submission: Recursive 3D Rendering (Initial Rank: 7/10, Final Rank: 9/10):
Ghidra analysis was profoundly difficult due to code defining extra code within macros, making it nearly impossible to mark up or understand directly.
Prediction: Unknown functionality.
Execution: Generated complex pixelated 3D images, specifically animated 3D balls.
Key Takeaway: The recursive code definition made analysis extremely challenging, requiring hypothetical scripting to de-obfuscate.
13:06 Cable 1 Submission: The Slow LLM (Initial Rank: 3/10, Final Rank: 5/10):
Initial review led to underestimation, but Ghidra analysis revealed lengthy functions, though presence of strings helped.
Prediction: Runs an entire Large Language Model (LLM) for inference.
Execution: Confirmed to be "chat ioCC," an LLM capable of slow text generation and adopting different "personalities" (e.g., Eeyore, Snoop Dog, Linux).
Key Takeaway: Harder to analyze than initially thought, but strings provided enough clues to understand the complex LLM functionality.
16:48 How Submission: Mini-Vim Editor (Initial Rank: 8/10, Final Rank: 6/10):
Initially rated highly for complexity due to many functions, but Ghidra showed a relatively shorter main logic.
Analysis identified functions for display and continuous user input, suggesting a file editing application.
Execution: Revealed to be a functional text editor, a mini-Vim clone with modified keybindings (e.g., Ctrl+Z to quit).
Key Takeaway: Less challenging than expected due to a more organized structure in the binary, despite the obfuscated source.
Ghidra analysis was lengthy due to numerous if statements, but logic involved parsing command-line string arguments, hashing, and mathematical calculations.
Prediction: Performs mathematical calculations based on input strings.
Execution: Demonstrated as a calculator that interprets numbers spelled out in words (e.g., "two plus two" equals "four").
Key Takeaway: The difficulty matched the initial expectation, with hints in the source code aiding the analysis of its extensive conditional logic.
29:50 Final Reflections: The speaker concludes that while many initial difficulty predictions were accurate, some submissions, like Kurdikov 3 (Doom VM) and Endo1 (3D rendering), proved vastly more complex and surprising than anticipated, showcasing the exceptional creativity and challenge of the IOCCC. Viewers are encouraged to explore the official IOCCC website and YouTube channel for more.