Compiled Writeup

Technical overview for the Compiled TryHackMe room. Room here: [room url]

Ghidra

Open Ghidra and import the binary!

Navigate to the main function, unlike the other rev-engineering project i’ve done, there seems to be no hidden trickery.

This the main function, let me walk through the logic:

We define a int iVar1, and a 32 byte buffer named local_28.

From here, we:

• Ask the user for the password in stdout
• use isoc99_scanf (scanf) to check user input
  • then put the input into local_28
• iVar1 checks if local_28 is equal to the variable __dso_handle
  • iVar1 gets set to 1 if False

Now our logic:

• if iVar1 is False / 1
  • Then prints “Try Again!”

iVar1 = strcmp(local_28,"_init");

this line compares the stuff in local_28 + “_init” together as an entire string

• (this is where I found the flag logic!)

• if True / 0

  • print “correct”

Logic explanation:

For this, I had to trace what scanf did when getting the special token %s.

sscanf manpage:

and what the %s does:

Now, this tells us that:

• scanf matches the literal and discards it, then %s stores everything after it (up to whitespace) in local_28.
• Since local_28 must equal exactly _init, the password is:

"local_28" + “_init”

So, with what we have learned lets try it out:

Nice!

Thank you for reading, this was another interesting box done on my journey of RE improvements.