RE - Hidden in Plain Sight

Points unknown

Description

Can you find the flag hidden In Plain Sight?

Downloads

58MB

Spin.zip

archive

Solution

We are given a 32-bit PE binary. Running it gives us a console menu.

After some exploration, it seems like the only useful function is '3) Obtaining A Flag'. Let's take a quick look in Ghidra.

It seems like we almost have the flag (in plain sight) but not really. We can only recover a partial flag: SBCTF{rana_Hominis} Now, time to run it in our favourite debugger and set a breakpoint right before the flag check (0x671F7E).

We will input the partial flag we have and start stepping through the instructions. At 0x671FD5 - 0x671FD8 we can tell that there's actually another character before 'r' and the character can be calculated as such, 0x1513 / 0x53 = 0x41 which is the character 'A'.

Now let's restart the program with our new found character. We can confirm that it is correct if the debugger don't jump out of the flag check early.

Indeed the character 'A' was missing, now if we continue to step through the instructions, at 0x672012 we realise that we are short of another character. Stepping through the instructions, we can find out that what the program does is that it subtracts the first missing character (in this case we found out that it is 'A') from the next missing character and checks if its equal to 0x24 (ascii for '$'). So to reverse the equation, we can simplify it as missing character = 0x24 + 0x41 which is 0x65 (ascii for 'e'). Now we have the complete flag!

Flag: SBCTF{Aranea_Hominis}