1

The binary is from here: https://files.fm/u/qtqmhhdd

I've been attempting this a couple of days. Its an ELF-64 bit file and I've gdb and IDA to see how it works for a while. You can run the file by

./reverse1.bin TEST (outputs a fail message)

In gdb it runs a _Z5checkPc function and you can use "disas check". It uses the flag from address 0x601038 which is

 synt{0p5r7996pnq3qn36377036onor7342s41pq30r3n3q0p46n283862718o7n6s78n}

But I don't see it where it actually get used in the code. From the check function it seems to does a bunch of operations (or, add,...) to your arg. I thought it would do a compare to see determine if it "fails" or "success" at 0x00000000004005b0 but that is not right strangely. Any insights on what to do?

3

Since this is a reversing challenge, I won't jump the gun right away and give you some tips which may help for this and future Challenges.

The check function (_Z5checkPc is a mangled name) looks like this: Ida representation

You already found the data the input value is compared to. But you failed to understand that there is no direct comparison here.

  1. We have a loop over a string value. That means it is highly probable each character is processed sequentially.
  2. Values are modified in an (obfuscated) way, before they are compared -> there is some kind of coding here!

Although there is dead code included in the function, you'll have to identify the modification which is taking place directly before the comparison (what is compared to what? how are these values calculated?).

I strongly encourage you to ask follow up questions if there is anything in particular you don't understand. For minor questions or discussions, you can also drop by in the chat.

This site is temporarily in read only mode and not accepting new answers.

Not the answer you're looking for? Browse other questions tagged .