Reverse engineering binary file to find flag

Question

The binary is from here: https://files.fm/u/qtqmhhdd

I've been attempting this a couple of days. It's an ELF-64 bit file and I've gdb and IDA to see how it works for a while. You can run the file by

./reverse1.bin TEST (outputs a fail message)

In gdb it runs a _Z5checkPc function and you can use "disas check". It uses the flag from address 0x601038 which is

 synt{0p5r7996pnq3qn36377036onor7342s41pq30r3n3q0p46n283862718o7n6s78n}

But I don't see it where it actually gets used in the code.

From the check function it seems to does a bunch of operations (or, add, ...) to your arg. I thought it would do a compare to see determine if it "fails" or "success" at 0x00000000004005b0 but that is not right, strangely.

Any insights on what to do?

Answer 1

Since this is a reversing challenge, I won't jump the gun right away and give you some tips which may help for this and future Challenges.

The check function (_Z5checkPc is a mangled name) looks like this:

You already found the data the input value is compared to. But you failed to understand that there is no direct comparison here.

1. We have a loop over a string value. That means it is highly probable each character is processed sequentially.
2. Values are modified in an (obfuscated) way, before they are compared -> there is some kind of coding here!

Although there is dead code included in the function, you'll have to identify the modification which is taking place directly before the comparison (what is compared to what? how are these values calculated?).

I strongly encourage you to ask follow up questions if there is anything in particular you don't understand. For minor questions or discussions, you can also drop by in the chat.

Answer 2

Actually, you got the flag!

Do a ROT13 on

synt{0p5r7996pnq3qn36377036onor7342s41pq30r3n3q0p46n283862718o7n6s78n} 

to get

flag{0c5e7996cad3da36377036babe7342f41cd30e3a3d0c46a283862718b7a6f78a}