← Back to HWJ CTF

ASSEMBLE IT FIRST...

The binary stores the flag as immediate byte values in code assembly instructions.

Tools Used

objdumpGhidrafilestrings

Overview

The binary stores the flag as immediate byte values inside assembly instructions instead of printable strings in data sections.

Reconnaissance

Inspecting the binary with strings reveals nothing useful. Disassembling the flag printing function reveals raw byte constants in assembly.

Exploitation Strategy

Extract the sequence of hex bytes: 68 77 6A 7B 72 75 6E 5F 6D 65 5F 66 69 72 73 74 7D and convert directly to ASCII.

Solution Code

objdump -Mintel -d challenge
# Extracted assembly hex bytes:
# 68 77 6A 7B 72 75 6E 5F 6D 65 5F 66 69 72 73 74 7D
# ASCII: hwj{run_me_first}

Flag

hwj{run_me_first}