Challenge
| Link | Difficulty | Status |
|---|---|---|
| https://play.picoctf.org/practice/challenge/480?category=1&originalEvent=74&page=1 |  |  |
Note
Description
Can you win in a convincing manner against this chess bot? He won’t go easy on you! You can find the challenge here.
Solution
The challenge page has a chess board which you can actually play.
Looking at the scripts that are loaded, we can see that it uses stockfish1 wasm module as the chess engine. Stockfish is an opensource chess engine. In this particular application each move you make is evaluated by the chess engine and the opponent move is made.
Looking at the network tab we can see that it establishes a websocket connection and keeps sending messages for each move we make and we get a response back for the messages.
Looking at the code there are two kinds of messages that are sent to the server.
stockfish.onmessage = function (event) {
var message;
if (event.data.startsWith("bestmove")) {
var bestMove = event.data.split(" ")[1];
var srcSq = bestMove.slice(0, 2);
var dstSq = bestMove.slice(2, 4);
var promotion = bestMove.slice(4);
game.move({ from: srcSq, to: dstSq, promotion: promotion });
board.position(game.fen());
} else if (event.data.startsWith(`info depth ${DEPTH}`)) {
var splitString = event.data.split(" ");
if (event.data.includes("mate")) {
message = "mate " + parseInt(splitString[9]);
} else {
message = "eval " + parseInt(splitString[9]);
}
sendMessage(message);
}The two messages are
eval <number>mate <number>
Debugging the code to understand better reveals that. We receive a info string which is parsed and we are extracting the score in case of mate and otherwise.
Check the score documentation here https://gist.github.com/aliostad/f4470274f39d29b788c1b09519e67372#file-stockfish-interface-txt-L274
* score
* cp <x>
the score from the engine's point of view in centipawns.
* mate <y>
mate in y moves, not plies.
If the engine is getting mated use negative values for y.
I tried mate first, when mate is followed by a positive number then it means that there is possibility that the engine will checkmate us and if followed by a negative number it’s vice versa.
That didn’t work. I tried using cp and it is defined as below.
In chess, a “centipawn” (cP) is a unit of measure representing a small fraction of a pawn's value, used to evaluate positions and assess the strength of moves, with 100 centipawns equaling one pawn
The negative and positive rule applies here as well. Let us try to send a large score from our side.
I remember reading somewhere that 1500 is a good enough score for a win but that clearly didn’t work.
I left the challenge until the last day but on the last day gave it another try and tried to send an even bigger number which let to the opponent resigning and revealing the flag.
