Cookie Consent by

Archives of tag rev

Tag rev

DarkCTF 2020: Rev/strings


363 points

Description:Just manipulation of couple of strings....
Note: Enclose the final output inside darkCTF{} File


I used the ghidra to do the initial analysis. Looks like binary takes the input (do nothing with it;)), then calculate some string (I assumed it's a flag) and exit.

Let's try to debug...

gdb ./strings
break _exit

Then dumped the memory before program exit.

Ok, let’s examine the memory dump…

Oh?! What’s that? Is it a flag? Bingo! ;-)


DarkCTF 2020: Rev/so_much


207 points

strcmp printf File


I've used ghidra to have a look into the decompiled code.

After quick examination I've came to conclusion that the code base on strcmp function. I've decided to override this function with my own implementation.

Prepared below code:

#define _GNU_SOURCE

int strcmp ( char * str1, char * str2 )
return 0;

int main()
return 0;

Compiled it and executed the program with LD_PRELOAD.

gcc -ldl -fpic -nostartfiles -shared mystrcmp.c -o
sudo LD_PRELOAD=./ ./so_much anything