← Back to HWJ CTF

BINARY PATCHING

Bypass failing license verification by analyzing XOR-encoded flag bytes key in Ghidra.

Tools Used

GhidraobjdumpgdbPython

Overview

The binary always fails its license verification function validate_license(). The flag is stored XOR-encoded with key 0x68.

Reconnaissance

Decompiling in Ghidra shows validate_license() always returns failure, while print_flag() XOR-decodes an array of bytes with 0x68.

Exploitation Strategy

Extract encoded byte values from Ghidra and write a short Python script to XOR each byte with 0x68.

Solution Code

enc = [ /* encoded bytes from Ghidra */ ]
print(''.join(chr(x ^ 0x68) for x in enc))
# Output: hwj{b1n4ry_p4tch1ng_1s_sur53ry}

Flag

hwj{b1n4ry_p4tch1ng_1s_sur53ry}