Case study
m0rph: tracing an obfuscated ELF flag checker
The m0rph investigation examines an obfuscated x86-64 ELF CTF flag checker with readelf, strings, Cutter and Radare2. Its write-up traces indirect CALL RAX execution into allocated memory and describes recovering expected characters by breaking at the call and inspecting RDI during each loop iteration.
- Targets
- Binary
- Category
- Native analysis tools
- Relationship
- Learning resource
- Sources reviewed
Requirements & limits
- Prerequisites: The m0rph x86-64 ELF challenge binary and a Linux analysis environment are needed to repeat the investigation.
- Prerequisites: Radare2, Cutter and standard Linux inspection utilities are used in the described workflow.
- License: MIT license.
About this entry
The description was reviewed against primary sources.
Primary sources
- README.md GitHub · UmbertoDellaMonica/m0rph-CTF-CyberChallenge.IT · Revision 064dbf1
More in Native binaries
- CPQ IO Scheduler: reconstructing Xiaomi's block scheduler · Case study
- Malware Analysis: njRAT and Casdet behavior investigation · Case study
- Ghidra · Tool
- radare2 · Tool
- Cutter · Tool
- Qiling · Tool
All 250 entries in Native binariesNative binaries case studies (7)