Let's get dynamic


Can you tell what this file is reading? chall.S


  1. First, compile the program: gcc -g chall.S -o chall. The -g flag compiles with debugging symbols.

  2. If we run the program and enter some text, we get Correct! You entered the flag., which doesn't seem correct.

  3. I decompiled the chall binary using Ghidra to look at a c representation. There is a memcmp instruction which looks like it compares our input to the flag.

  4. We can run the binary in gdb with gdb chall to debug it. I placed a breakpoint at the memcmp statement with b memcmp and then ran the program with r. We reach the breakpoint and now we can look at the source index and destination index registers, which are rsi and rdi respectively. We can view the source index as a string like so: printf "%s\n", $rsi, which prints the flag.

  5. GDB output:

    $ gdb chall
    Reading symbols from chall...
    (gdb) b memcmp
    Breakpoint 1 at 0x1060
    (gdb) r
    Starting program: ./chall 
    Breakpoint 1, __memcmp_avx2_movbe () at ../sysdeps/x86_64/multiarch/memcmp-avx2-movbe.S:59
    59      ../sysdeps/x86_64/multiarch/memcmp-avx2-movbe.S: No such file or directory.
    (gdb) printf "%s\n", $rsi



Last updated