Reverse picoCTF 2023 Solution

Description

1. Step 1Triage with file and checksec
   file confirms it is an ELF you can inspect, and checksec tells you which mitigations are present. Both run in a fraction of a second and decide your next move.
   bash

   file ret

   Copied!

   bash

   checksec --file=ret

   Copied!
   Learn more

   Leading with file and checksec is the habit that prevents wasted effort. file ret reports architecture, bitness, dynamic vs static, and stripped vs not. If file says "data" instead of ELF, the challenge is probably a packaged blob (zip, tar, custom container) and you are about to waste 10 minutes on the wrong tool. checksec --file=ret lists ASLR, stack canaries, NX, PIE, RELRO; even when the challenge is just static recovery, knowing the mitigations is useful for the follow-on challenges.

2. Step 2Filter strings with -n 8 and grep
   strings -n 8 drops short noise like 4-byte symbol fragments. Most flags are at least 12 characters, so an 8-character cutoff keeps real candidates without hiding anything useful.
   bash

   strings ret | wc -l

   Copied!

   bash

   strings -n 8 ret | wc -l

   Copied!

   bash

   strings -n 8 ret | grep pico

   Copied!
   Learn more

   Static analysis examines a binary without executing it. The cheapest static tool is strings, which extracts printable runs from a binary file. C string literals live in .rodata verbatim, so any hard-coded password, URL, error message, or flag shows up directly in strings output.

   A stripped binary has had its symbol table and debug info removed (via strip or -s). Stripping hides function names and variable names, but it does not affect string literals stored in the data section. That is why strings still works: the flag is a string constant the linker placed in .rodata regardless of whether the binary is stripped.

   The -n flag sets the minimum string length (default 4). The before/after counts make the noise reduction concrete: at the default the output is filled with 4-byte fragments from compiler-generated tables; at -n 8 only meaningful runs survive, and the flag jumps straight to your eye. -e l handles 16-bit little-endian (Windows binaries); -e b handles big-endian.

3. Step 3Decision tree if strings is empty
   When strings | grep pico returns nothing, the flag is built at runtime. Use ltrace to catch the comparison, or gdb to break before the strcmp.
   bash

   ltrace -e strcmp ./ret

   Copied!

   bash

   ltrace ./ret

   Copied!
   Learn more

   When strings shows nothing useful, the binary is constructing the flag dynamically: XOR-decoding it from another buffer, building it character-by-character on the stack, or comparing against a hash. Real flags still have to exist in memory at the moment of comparison.

   ltrace intercepts library calls and prints arguments. ltrace -e strcmp ./ret filters down to strcmp calls; on a typical "guess the password" binary you will see strcmp("your_input", "real_flag") printed plainly. That is the entire reversal effort, eliminated by knowing which library function the binary uses to compare.

   When ltrace cannot see the comparison (statically linked binary, custom comparison loop, or stripped symbols), drop into gdb: break on the call to strcmp or the inline comparison address, run the program with a placeholder input, and read the second argument register on x86_64 (x/s $rsi). Ghidra is the heaviest tool but gives you a decompiled C view of the flag-building logic when the others fall short.

Flag

No reversing tools beyond strings are required for this warm-up.