I have a binary that I'm attempting to reverse engineer to find a flag. From using ghidra I have found that the flag is stored in the program at a point called "check" and then run through memfrob to compare to the string that the user inputs.
I'm trying to either debug the binary to run until the point after the memfrob was called and the value is stored in a register to view its value or take the value from the assembly that I found and run that through memfrob in my own C script.
I'm having trouble finding an explanation on how to do it the first way and when I try to run memfrob on my own in C it tells me "implicit declaration of function 'memfrob'" but I am including string.h.
#include <string.h>
int main(void)
{
char check[20] = {0x5f,
0x40,
0x5a,
0x15,
0x75,
0x45,
0x62,
0x53,
0x75,
0x46,
0x52,
0x43,
0x5f,
0x75,
0x50,
0x52,
0x75,
0x5f,
0x5c,
0x4f};
for (int i = 0; i < 20; i++)
{
printf("%x",check);
}
memfrob(&check,0x14);
return 0;
}
I'm not sure what the correct way to go about this is, but so far I've had no success with either.
I have also tried running it through things like CyberChef to decrypt the XOR42 from memfrob but that also ended up giving me nothing useful