← Back to HWJ CTF

FRAGMENTED MEMORY

The binary constructs the flag at runtime using individual byte assignments instead of storing it as a normal string.

Tools Used

objdumpGhidraIDA Profilestrings

Overview

Reversing a binary where the password/flag is constructed dynamically at runtime through sequential byte assignments rather than static strings.

Reconnaissance

Running strings on auth_bin yields no flag. Disassembling with objdump or Ghidra reveals individual byte assignments to stack locations.

Exploitation Strategy

Locate the function responsible for printing the flag and map out byte assignments (e.g. mov byte ptr [rbp-0x20], 0x68, 0x77, 0x6a...). Converting hex values to ASCII reconstructs the flag.

Solution Code

objdump -Mintel -d auth_bin > disasm.txt
# Inspect byte assignments:
# 0x68 -> 'h', 0x77 -> 'w', 0x6a -> 'j', 0x7b -> '{' ...
# Reconstructed: hwj{n0_5tr1ng5_at_runt1m3}

Flag

hwj{n0_5tr1ng5_at_runt1m3}