unpackme-upx picoCTF Reverse Engineering writeup

Can you get the flag? Reverse engineer this binary.

Hint:

What is UPX?

Solution

First I was trying to see upx and i downloaded it

sudo apt install upx

check out this link to learn more about upx

https://upx.github.io/

It is free open source executable packer and decompresser tool and as the hint for this challenge says we have to check upx and how it works.

Step-1:

Lets decompress our packed executable file

Step-2:

Now we can disassemble or de-compile. we can do what ever we want to the binary

Personally, I use radare2 for disassemble

Now Lets Disassemble the program

So here is our disassembled code

at 0x00401e9c the program print what is my favorite .....

at 0x00401ec0 it takes input using scanf function

at 0x00401ec8 the program is trying to compare the integer we input and this hex 0xb83cb

Step-3:

Lets try to convert it to decimal the hex

Now lets try this integer as an input

Flag:

picoCTF{up><_m3_f7w_5769b54e}

Conclusion:

The whole point in this challenge to learn about upx and how to compress and decompress binaries

Malware Developmet