reversePromedium

Deceptive Checker

miptctf

Task: Stripped statically linked ELF binary with flag checker containing deception. Solution: Identified self-modifying code in .init_array that patches CALL instruction at runtime, bypassing fake checker to find real validation function.

$ ls tags/ techniques/
strippedelfx86_64rwxself_modifying_codeflag_checkerdecoymprotectstatic_linkedinit_arrayanti_reversing
static_binary_analysisinit_array_analysisself_modifying_code_detectionmprotect_rwx_identificationdecoy_function_identification
🔒

Permission denied (requires tier.pro)

Sign in to access full writeups

Sign in with GitHub to continue. No email required.

$sign in

$ grep --similar

Similar writeups