I was given two DLL files (link) . The task is to get the flag from them. First what I've done - opened the first file (called original) in IDA and found the function called _GetFlag. enter image description here

As I understood, I need to call that function from the DLL library somehow (that's the first question - I don't have any info about the function except its name, so I'd like to know how exactly I can call it). However, as wee see, even if I knew how to call it, we can't get the flag from original DLL, it says Sry, flag is in the patched version.

Ok, I opened patched DLL in IDA. First what we see that the file can be opened only as a binary: enter image description here

As always, I opened the Strings window and we see the string "0day is bring your own header day! Flag is: %s" . It looks like a key for solution.

enter image description here

However, I don't exactly know what to do after that. I'd really appreciate if somebody would explain me how to solve this.

  • This might give you a hint imgur.com/FELroA0 The patched file has been changed to not look like a dll. Patch the bytes properly so that it is a valid dll.
    – sudhackar
    Oct 26, 2017 at 5:51
  • @sudhackar thank you for your answer - I thought about it. Indeed, after I patched file signatures to MZ and PE it looks like a valid DLL. I see a functions like genFlag and getFlag - this is exactly what I need to call. What's the proper way to do that if we have only DLL file, in your opinion?
    – kekyc
    Oct 26, 2017 at 14:58
  • @kekyc: try LoadLibrary & GetProcAddress Oct 26, 2017 at 15:11
  • @PawełŁukasik Yep, it worked perfectly. Thank you!
    – kekyc
    Oct 26, 2017 at 15:49

1 Answer 1


Once you have patched the malformed bytes to make the patched DLL proper, you can use something like this to call the GetFlag function.

#include <Windows.h>

typedef DWORD (__cdecl *_GetFlag)();
_GetFlag GetFlag;

NTSTATUS main(int argc, char **argv) {
    hDll = LoadLibrary("my_head_flew_away_patched.dll");
    GetFlag = (_GetFlag)GetProcAddress(hDll, "GetFlag");
  • You late just for ~2-3 minutes I did it myself using the same method. But thank you, anyway!
    – kekyc
    Oct 26, 2017 at 15:52
  • 1
    If you look at the time of the gist, it is about the same time as the earlier comment. I didn't want to spoil it for you. That's exactly what I wanted.
    – sudhackar
    Oct 26, 2017 at 16:41
  • Of course, I understand that.
    – kekyc
    Oct 26, 2017 at 17:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.