This binary was from a CTF challenge.

I found 2 way to solve this, one is run & debug the bin, set a break point and see result in flag after the bin running, another is trying to understand the function.

There are some parts that i dont understand even when i solved this challenge :

Why my IDA reverse the string (v6 should be "Bkav" and v7 + v8 should be "Security"

As you see, it pass the char* v6 ("Bkav") into the func01 and func02, but when i do the same thing, it give wrong flag. But when i try to pass the "BkavSecurity" in to func01 and func02, it give me right flag. Quite confuse about this.

enter image description here

You can find file here : https://www.sendspace.com/file/g7w8nz

  • 2
    please give this question a more meaningful title May 13, 2018 at 12:56
  • You're passing a flag? Where? It's not clear to me what you're asking here.
    – 0xC0000022L
    May 14, 2018 at 8:29

2 Answers 2


Remember that what you're passing is an address. And the address of v6 and since v6,v7 and v8 are adjacent to each other so any method that works on char * will read from one to the other until it reaches byte 0.

Letter |  Address | Variable
   B   | ebp-7e5h | -> v6 (4 bytes)
   k   | ebp-7e4h | 
   a   | ebp-7e3h | 
   v   | ebp-7e2h | 
   S   | ebp-7e1h | -> v7 (4 bytes)
   e   | ebp-7e0h |
   c   | ebp-7dfh |
   u   | ebp-7deh |
   r   | ebp-7ddh | -> v8 (4 bytes)
   i   | ebp-7dch |
   t   | ebp-7dbh |
   y   | ebp-7dah |
  \0   | ebp-7d9h | -> v9 (1 byte)

well you can create a stackvar K on all the four instructions and convert those stack variables to an array of proper length

then you can see ida showing you the offsets from base the screen shot is from ida free 5 on a 32 bit machine (it doesn't decompile )

but in your case i think decompilation would be more better ( this construct is an inlined/unrolled strcpy(src,dest)

enter image description here

Not the answer you're looking for? Browse other questions tagged or ask your own question.