reverse::engineering

# File type
file challenge
# ELF 64-bit, x86-64 → Linux binary
# PE32+                → Windows binary
# Mach-O               → macOS
# Java class           → javap / jadx
# Python bytecode .pyc → uncompyle6

# Strings — flag or hints often visible
strings challenge | grep -i "flag\|picoCTF\|pass\|key\|correct\|wrong"
strings -el challenge  # wide strings (Unicode)

# Quick run (sandbox if suspicious)
chmod +x challenge && ./challenge
# ltrace to see library calls
ltrace ./challenge
strace ./challenge

# ELF header info
readelf -h challenge      # header
readelf -S challenge      # sections
readelf -s challenge      # symbol table
readelf --all challenge

# Dynamic symbols / imports
objdump -d challenge      # disassemble
objdump -T challenge      # dynamic symbols
nm challenge              # symbol table
ldd challenge             # linked libraries

# Check security mitigations
checksec challenge
# NX, PIE, RELRO, stack canary, FORTIFY

# Disassemble all
objdump -d challenge
objdump -d -M intel challenge  # Intel syntax

# Specific function
objdump -d challenge | grep -A 30 "<main>"

# Data section (look for encoded strings)
objdump -s -j .data challenge
objdump -s -j .rodata challenge

# Hex dump
xxd challenge | head -40
hexdump -C challenge | head

# 1. Import binary → Auto-analyze (accept defaults)

# 2. Find main / interesting functions
#    Window → Functions → search "main", "check", "verify"

# 3. Rename variables for readability
#    Right-click → Rename Variable (L key)

# 4. Re-type variables for better decompilation
#    Right-click → Retype Variable

# 5. Find strings and cross-reference
#    Search → For Strings
#    Right-click string → References → Show References

# 6. Patch bytes (disable checks)
#    Right-click instruction → Patch Instruction

# Headless Ghidra (CLI)
analyzeHeadless /tmp/proj myproj \
  -import challenge -postScript PrintAST.java

# Start
gdb ./challenge
gdb -q ./challenge        # quiet
r < input.txt             # run with input
r arg1 arg2               # with args

# Breakpoints
b main                    # break at main
b *0x401234               # break at address
b strcmp                  # break at function
info break
delete 1

# Step / continue
c                         # continue
n                         # next (step over)
s                         # step (step into)
ni                        # next instruction
si                        # step instruction
finish                    # run to end of function

# Registers
info registers
p $rax                    # print register
p/x $rsp                  # hex format

# Memory
x/20x $rsp                # 20 hex words at rsp
x/s 0x404060              # string at address
x/20i $rip                # disassemble 20 instr

# pwndbg-specific (if installed)
context                   # full context view
telescope $rsp            # smart stack view
search -s "flag"          # search memory
vmmap                     # memory map

# Modify values
set $rax = 0
set *(int*)0x404060 = 1
patch byte 0x401234 0x90  # NOP an instruction

# Break on strcmp to see what's being compared
b strcmp
r
# When hit: rdi = string1, rsi = string2
x/s $rdi
x/s $rsi

# Patch a conditional jump → always true
# Find: jne 0x40xxxx
set *(unsigned char*)0x401234 = 0x74  # jne → je
# Or NOP it (0x90)

# Trace all calls
set pagination off
catch syscall
commands
  backtrace
  continue
end

# Record & replay (rr)
rr record ./challenge
rr replay

# Trace all library calls (strcmp, malloc, etc.)
ltrace ./challenge
ltrace -s 100 ./challenge    # longer strings
ltrace -e strcmp ./challenge # only strcmp
ltrace -f ./challenge        # follow forks

# When binary checks your input vs flag:
# strcmp("your_input", "picoCTF{...}") = ...
# The flag appears in plaintext!

# With arguments
ltrace ./challenge myinput
echo "myinput" | ltrace ./challenge

# Trace all syscalls
strace ./challenge
strace -s 200 ./challenge    # longer strings
strace -e read,write ./challenge
strace -e openat ./challenge # files opened

# Useful: see what files are read/written
# openat(AT_FDCWD, "/flag", O_RDONLY) ← path!

# Attach to running process
strace -p <pid>

# Detect packer
strings packed | grep -i "UPX\|packed\|compress"
detect-it-easy challenge     # die / diec
exeinfo challenge

# UPX unpack
upx -d challenge -o unpacked

# Run packed binary, dump from memory
# Set breakpoint at OEP (original entry point)
# Then dump with: dump binary memory out.bin start end

# Python: deobfuscate XOR loop
python3 -c "
data = [0x41, 0x62, 0x23, ...]  # from .data section
key = 0x42
print(bytes(b ^ key for b in data))
"