# m0rph: tracing an obfuscated ELF flag checker

> The m0rph investigation examines an obfuscated x86-64 ELF CTF flag checker with readelf, strings, Cutter and Radare2. Its write-up traces indirect CALL RAX execution into allocated memory and describes recovering expected characters by breaking at the call and inspecting RDI during each loop iteration.

- Type: Case study
- Targets: Binary
- Category: Native analysis tools
- Relationship: Learning resource
- Sources reviewed: 2026-11-06
- Added to the catalog: 2026-11-06
- Original resource: <https://github.com/UmbertoDellaMonica/m0rph-CTF-CyberChallenge.IT>
- Primary source: <https://github.com/UmbertoDellaMonica/m0rph-CTF-CyberChallenge.IT/blob/064dbf1bcedd39a0360a311daaa86c32b525a7db/README.md>
- Catalog page: <https://awesomerea.org/resources/m0rph-ctf-analysis-case/>
- Record JSON: <https://awesomerea.org/resources/m0rph-ctf-analysis-case/record.json>
- Chinese version: [简体中文](https://awesomerea.org/zh/resources/m0rph-ctf-analysis-case/index.md)

## Requirements & limits

- **Prerequisites:** The m0rph x86-64 ELF challenge binary and a Linux analysis environment are needed to repeat the investigation.
- **Prerequisites:** Radare2, Cutter and standard Linux inspection utilities are used in the described workflow.
- **License:** MIT license.

## Primary sources

1. <https://github.com/UmbertoDellaMonica/m0rph-CTF-CyberChallenge.IT/blob/064dbf1bcedd39a0360a311daaa86c32b525a7db/README.md>

## More in Native binaries

- [CPQ IO Scheduler: reconstructing Xiaomi's block scheduler](https://awesomerea.org/resources/cpq-iosched-case/index.md) · Case study
- [Malware Analysis: njRAT and Casdet behavior investigation](https://awesomerea.org/resources/malware-analysis-njrat-casdet-case/index.md) · Case study
- [Ghidra](https://awesomerea.org/resources/ghidra/index.md) · Tool
- [radare2](https://awesomerea.org/resources/radare2/index.md) · Tool
- [Cutter](https://awesomerea.org/resources/cutter/index.md) · Tool
- [Qiling](https://awesomerea.org/resources/qiling/index.md) · Tool

## About this entry

The description was reviewed against primary sources.
Original editorial content: MIT. Linked projects, papers and assets retain their own rights and licenses.