🔬

Reverse Engineering

RE challenges ask you to understand programs without access to source code. You'll read assembly, decompile binaries, trace execution, defeat anti-debugging, and ultimately extract flags hidden in logic.

What is it?

Reverse engineering (RE) is the process of analysing a compiled program — without its source code — to understand what it does. Security engineers use RE to analyse malware, audit closed-source software, and find vulnerabilities in firmware.

It requires knowledge of CPU architectures (x86, ARM), calling conventions, compilation artifacts, and common obfuscation techniques. The goal is to reconstruct intent from raw bytes and machine instructions.

How it works in a CTF

In a CTF, you receive a compiled binary (ELF, PE, APK, or firmware image) and must figure out the correct input that causes it to print the flag, or locate a hard-coded secret inside it. No source code is provided.

Common workflow: run file + strings + checksec → open in Ghidra/IDA → identify the validation function → trace the logic → derive the required input or patch the binary.

Example challenge types

Find the hardcoded flag in stringsKeygen / serial crackmeObfuscated logic (XOR decode loop)Anti-debug bypass (ptrace check)Packed binary (UPX unpack)Custom bytecode VM interpreterLicense key validation reversalGo / Rust binary decompilationARM firmware flag extractionDynamic analysis with GDBSelf-modifying codeC++ vtable tracing

Sample Challenge

KeyCheck

Reverse Engineering Easy 150 pts

You are given a Linux ELF binary that asks for a password and prints "Access granted — here is your flag" if correct, otherwise "Wrong!". The binary is stripped (no function names) and was compiled with -O2.

keychecker

How to solve it

Run strings keychecker | grep -i flag — nothing obvious. Run file and checksec to understand the binary.
Open in Ghidra. Find main via the entry-point symbol. Decompile it.
Identify a strcmp() call comparing your input to a hard-coded string — Ghidra shows the string in the decompilation view.
The comparison string is the password. Run the binary and enter it to confirm the flag is printed.

FLAG{gh1dra_str1ng_1s_all_u_n33d}