1

I was given two DLL files (link) . The task is to get the flag from them. First what I've done - opened the first file (called original) in IDA and found the function called _GetFlag. enter image description here

As I understood, I need to call that function from the DLL library somehow (that's the first question - I don't have any info about the function except its name, so I'd like to know how exactly I can call it). However, as wee see, even if I knew how to call it, we can't get the flag from original DLL, it says Sry, flag is in the patched version.

Ok, I opened patched DLL in IDA. First what we see that the file can be opened only as a binary: enter image description here

As always, I opened the Strings window and we see the string "0day is bring your own header day! Flag is: %s" . It looks like a key for solution.

enter image description here

However, I don't exactly know what to do after that. I'd really appreciate if somebody would explain me how to solve this.

  • This might give you a hint imgur.com/FELroA0 The patched file has been changed to not look like a dll. Patch the bytes properly so that it is a valid dll. – sudhackar Oct 26 '17 at 5:51
  • @sudhackar thank you for your answer - I thought about it. Indeed, after I patched file signatures to MZ and PE it looks like a valid DLL. I see a functions like genFlag and getFlag - this is exactly what I need to call. What's the proper way to do that if we have only DLL file, in your opinion? – kekyc Oct 26 '17 at 14:58
  • @kekyc: try LoadLibrary & GetProcAddress – Paweł Łukasik Oct 26 '17 at 15:11
  • @PawełŁukasik Yep, it worked perfectly. Thank you! – kekyc Oct 26 '17 at 15:49
4

Once you have patched the malformed bytes to make the patched DLL proper, you can use something like this to call the GetFlag function.

#include <Windows.h>

typedef DWORD (__cdecl *_GetFlag)();
_GetFlag GetFlag;
HMODULE hDll = NULL;

NTSTATUS main(int argc, char **argv) {
    hDll = LoadLibrary("my_head_flew_away_patched.dll");
    GetFlag = (_GetFlag)GetProcAddress(hDll, "GetFlag");
    GetFlag();
}
  • You late just for ~2-3 minutes I did it myself using the same method. But thank you, anyway! – kekyc Oct 26 '17 at 15:52
  • If you look at the time of the gist, it is about the same time as the earlier comment. I didn't want to spoil it for you. That's exactly what I wanted. – sudhackar Oct 26 '17 at 16:41
  • Of course, I understand that. – kekyc Oct 26 '17 at 17:01

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.