$ cat writeup.md…
$ cat writeup.md…
hackthebox
Task: ELF binary with anti-decompilation protection using ud2 instructions. Solution: Bypass ud2+SIGILL technique by static analysis of disassembly, extract password chunks from .rodata section.
$ cat /etc/rate-limit
Rate limit reached (20 reads/hour per IP). Showing preview only — full content returns at the next hour roll-over.
"After struggling to secure our secret strings for a long time, we finally figured out the solution to our problem: Make decompilation harder. It should now be impossible to figure out how our programs work!"
The behindthescenes binary is an ELF 64-bit file that uses an anti-decompilation technique to protect the password verification logic.
$ file behindthescenes behindthescenes: ELF 64-bit LSB pie executable, x86-64, dynamically linked, not stripped $ strings behindthescenes ./challenge <password> > HTB{%s}
The binary takes a password as an argument and outputs the flag in the format HTB{password}.
The key protection mechanism uses the ud2 instruction (undefined instruction, opcode 0f 0b):
main, a signal handler for SIGILL is registered (segill_sigaction)ud2 instructions that trigger an "illegal instruction" exception; Typical pattern in the code: mov rdi, [rbp-0x10] ud2 ; <- decompiler thinks this crashes add rdi, 0x3 ; <- this code is not analyzed
The logic extracted from the disassembler (objdump -d):
argc == 2 (argument required)== 12 charactersstrncmp:...
$ grep --similar