ghidra - All things reversed

All things reversed

ghidra

A collection of 11 posts

HITCON 2022 - Checker

HITCON 2022 - Checker

just a deep and normal checker We have two files in this task: a Windows executable named checker.exe and a .sys file—a driver file named checker_drv.sys. Loading the first one into Ghidra, does not show much code that we can work with. There's a line that

Flare-On 8 - Antioch

Flare-On 8 - Antioch

To solve this challenge, you’ll need to …AAARGH This challenge was really AAARGH for me. In retrospect I wonder why I didn't see what I was supposed to see and due to that lost almost a week on this fairly easy challenge. But let's start from the beginning. We

Flare-On 8 - known

Flare-On 8 - known

We need your help with a ransomware infection that tied up some of our critical files. Good luck. With the second challenge, it's a bit step up in the difficulty. We are given an EXE with some files (different types; images images and text) that has been encrypted. Opening file

Flare-On 8 - credchecker

The first task in this year competition. It is a single HTML file. Inside we can find a simple check for credentials. function checkCreds() { if (username.value == "Admin" && atob(password.value) == "goldenticket") { var key = atob(encoded_key); var flag = ""; for (let i = 0; i < key.length; i++) { flag += String.fromCharCode(

Don't trust the decompilers

Don't trust the decompilers

Decompilers can be your greatest ally or your greatest enemy. Basing the analysis only by the result of only one tool can fail you greatly. See for yourself. Prefer to watch? Check out this video. Recently, I was solving one of the challenge from ångstromCTF 2021 and after opening the

Automating Ghidra - part 3

Automating Ghidra - part 3

In the third installment of this series (if you haven't read/seen here's - part 1 & part 2) we will be reconstructing program flow. This is useful for tasks such as Towel's armageddon. Note: If you prefer watching, have a look at my YouTube channel. The difficulty of this crackme

Automating Ghidra - part 2

Automating Ghidra - part 2

In the last Automating Ghidra post we looked at how we can script Ghidra to do some mundane operations on the Memory Map of our binary. This time we will automate renaming labels for the data based on the values. During ASIS CTF 2020 a task was present that posses

Automating ghidra

Automating ghidra

Ghidra is an awesome RE tool that quickly took off after its initial launch in 2019. It can display not only the disassembly of our binary but also have a decompiler that allows us to see a bit higher level code. You can also extend it by using python or

TAMUCtf - leaning tower

TAMUCtf - leaning tower

There were multiple things wrong with this CTF but this one challenge was an interesting one. Windows binary, no noticeable entry point and no messages on screen. It's time to use our tools to dissect this one. Prefer watching? As usually, if possible, starting this task from running the binary

Core Dumb - HitCon 2019

Core Dumb - HitCon 2019

Note: challenge was solved together with Disconnected. Damn it my flag checker is so buggy it destroyed the program itself 😱 All I left is a core dump file :( Could you help me recover the flag ? Q_Q Let's start by checking the file that we are given in this challenge:

Oldschool - CONFidence Teaser 2019

Oldschool - CONFidence Teaser 2019

Gynvael did a survey lately to see what kind of assembly is taught in Polish universities, and if any of them is still teaching the old 8086. Let us extend this question to the CTF scene! This challenge is a clear reference to Gynvael's survey which is obvious from the