caught in the act

spbctf

Task: statically-linked x86-64 ELF packed with UPX 3.96 whose header was deliberately tampered so `upx -d` fails with 'header corrupted 3'. Solution: identify the ASCII strings overwriting p_filesize/p_blocksize and u_file_size, then bypass UPX entirely by decompressing the UCL/NRV2E-LE32 blocks directly and reconstruct the flag from movabs stack-string immediates.