BM03 - 250pts

Briefing

Download the file and find a way to get the flag. Contents: flag
Challenge Files:

Solution

  1. 1.
    Decompiling the binary shows an output() function and a line in output() that stops printing the flag if the rows argument is less than 6.
    output function:
    1
    void output(int rows,int cols)
    2
    3
    {
    4
    long lVar1;
    5
    undefined8 *puVar2;
    6
    undefined8 *puVar3;
    7
    long in_FS_OFFSET;
    8
    int i;
    9
    int j;
    10
    int flag [6] [85];
    11
    char flagChars [11];
    12
    long local_10;
    13
    14
    local_10 = *(long *)(in_FS_OFFSET + 0x28);
    15
    lVar1 = 0xff;
    16
    puVar2 = &DAT_00100a00;
    17
    puVar3 = (undefined8 *)flag;
    18
    while (lVar1 != 0) {
    19
    lVar1 = lVar1 + -1;
    20
    *puVar3 = *puVar2;
    21
    puVar2 = puVar2 + 1;
    22
    puVar3 = puVar3 + 1;
    23
    }
    24
    flagChars[0] = ' ';
    25
    flagChars[1] = '_';
    26
    flagChars[2] = '/';
    27
    flagChars[3] = '\\';
    28
    flagChars[4] = '(';
    29
    flagChars[5] = ')';
    30
    flagChars[6] = '`';
    31
    flagChars[7] = ',';
    32
    flagChars[8] = '|';
    33
    flagChars[9] = '.';
    34
    flagChars[10] = '\0';
    35
    i = 0;
    36
    while (i < rows) {
    37
    j = 0;
    38
    while (j < cols) {
    39
    putchar((int)flagChars[flag[(long)i * 0x55 + (long)j] / 100]);
    40
    j = j + 1;
    41
    }
    42
    putchar(10);
    43
    i = i + 1;
    44
    }
    45
    if (rows < 6) {
    46
    puts("\x1b[31m Error displaying rest of flag\x1b[0m");
    47
    }
    48
    if (local_10 != *(long *)(in_FS_OFFSET + 0x28)) {
    49
    /* WARNING: Subroutine does not return */
    50
    __stack_chk_fail();
    51
    }
    52
    return;
    53
    }
    Copied!
  2. 2.
    Launch the program in GDB then do the following:
    1. 1.
      Breakpoint at output: b output
    2. 2.
      Call output but will the rows argument set to 6: call output(6,0x55)
    3. 3.
      Continue past the breakpoint: c
    4. 4.
      The flag is printed:
      1
      __ __ _ ____ __
      2
      ____/ /___ / /_ __ __ ____ _ ____ _ (_)____ ____ _ / __// /_ _ __
      3
      / __ // _ \ / __ \ / / / // __ `// __ `// // __ \ / __ `/ / /_ / __/| | /| / /
      4
      / /_/ // __// /_/ // /_/ // /_/ // /_/ // // / / // /_/ / / __// /_ | |/ |/ /
      5
      \__,_/ \___//_.___/ \__,_/ \__, / \__, //_//_/ /_/ \__, /______/_/ \__/ |__/|__/
      6
      /____/ /____/ /____//_____/
      Copied!

Flag

debugging_ftw
Copy link