reverseeasy
i64
hackerlab
Task: only an IDA Pro .i64 database for a PE64 executable is provided, and the visible main function is a fake checker that always prints Nop :(. Solution: recover mapped bytes from the database, follow the hidden _cexit trampoline into a decoder stub, and subtract 0x34 from the embedded bytes to reveal the flag.
$ ls tags/ techniques/
ida_database_analysismapped_byte_recoveryhidden_code_discoverybytewise_subtraction_decoding
🔒
Permission denied (requires tier.pro)
Sign in to access full writeups
Create a free account with GitHub to get started.
$ssh [email protected]