1

I'm new to binary exploitation and CTF challenges. I need to solve a CTF challenge and find the flag. All the program does is display "Flag length is: 32". I've tried to analyze the file using IDA pro.

I think that the flag value is in rcx register, but I don't know how to extract it. Could you please help me solve the challenge or give me resources to learn?

Here is the main fucntion's code (C and assembler):

C:

int __cdecl main(int argc, const char **argv, const char **envp)
{
  size_t v3; // rax

  char Str[40]; // [rsp+20h] [rbp-30h] BYREF

  int j; // [rsp+48h] [rbp-8h]

  int i; // [rsp+4Ch] [rbp-4h]


  _main();

  for ( i = 0; i <= 33; ++i )

    Str[i] = 0;

  for ( j = 0; j <= 31; ++j )

    Str[j] = buff[j + 15] ^ 0x3A;

  v3 = strlen(Str);

  printf("Flag length is: %d\n", v3);

  return 0;

}

Assembler:

int __cdecl main(int argc, const char **argv, const char **envp)

                 public main

 main            proc near               ; CODE XREF: __tmainCRTStartup+243↑p



 Str             = byte ptr -30h

 var_8           = dword ptr -8

 var_4           = dword ptr -4



                 push    rbp

                 mov     rbp, rsp

                 sub     rsp, 50h

 ; 7:   _main();

                 call    __main

 ; 8:   for ( i = 0; i <= 33; ++i )

                 mov     [rbp+var_4], 0

                 jmp     short loc_4015D4

 ; ---------------------------------------------------------------------------

 ; 9:     Str[i] = 0;



 loc_4015C6:                             ; CODE XREF: main+28↓j

                 mov     eax, [rbp+var_4]

                 cdqe

                 mov     [rbp+rax+Str], 0

                 add     [rbp+var_4], 1



 loc_4015D4:                             ; CODE XREF: main+14↑j
                 cmp     [rbp+var_4], 21h ; '!'

                 jle     short loc_4015C6


 ; 10:   for ( j = 0; j <= 31; ++j )

                 mov     [rbp+var_8], 0

                 jmp     short loc_401609

 ; ---------------------------------------------------------------------------

 ; 11:     Str[j] = buff[j + 15] ^ 0x3A;



 loc_4015E3:                             ; CODE XREF: main+5D↓j

                 mov     eax, [rbp+var_8]

                 add     eax, 0Fh

                 movsxd  rdx, eax

                 lea     rax, buff

                 movzx   eax, byte ptr [rdx+rax]

                 xor     eax, 3Ah

                 mov     edx, eax

                 mov     eax, [rbp+var_8]

                 cdqe

                 mov     [rbp+rax+Str], dl

                 add     [rbp+var_8], 1



 loc_401609:                             ; CODE XREF: main+31↑j

                 cmp     [rbp+var_8], 1Fh

                 jle     short loc_4015E3

 ; 12:   v3 = strlen(Str);

                 lea     rax, [rbp+Str]

                 mov     rcx, rax        ; Str

                 call    strlen

 ; 13:   printf("Flag length is: %d\n", v3);

                 mov     rdx, rax

                 lea     rcx, Format     ; "Flag length is: %d\n"

                 call    printf

 ; 14:   return 0;

                 mov     eax, 0

                 add     rsp, 50h

                 pop     rbp

                 retn

 main            endp

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.