picoCTF Solutions
picoCTF 2025Reverse EngineeringMedium

Binary Instrumentation 1 picoCTF 2025 Solution

Published: April 2, 2025

Description

A Windows executable announces the flag but first takes a very long sleep. Use Frida to hook and bypass the Sleep call so the binary wakes up immediately and prints the flag.

Read the technique guide

  • Frida and Binary Instrumentation for CTFs: A Beginner's PathA practical Frida walkthrough anchored in picoCTF's binary-instrumentation ladder, from 2025's strings cheats to 2026's send-to-the-void. Install, hook a Win32 export, fix args at runtime, and bridge to stripped Linux ELFs where ASLR moves the address every run.

Setup

Download bininst1.zip

Unzip with the password picoctf to obtain bininst1.exe. The challenge needs a Windows machine (or VM) with Python and Frida installed.

Install Frida tools: pip install frida-tools. You may also need the Visual C++ Redistributable from Microsoft.

Run the binary once to see what it says. It will announce the flag but then sleep for a very long time.

Create a JavaScript Frida script that intercepts the Sleep function in kernel32.dll and returns immediately instead of waiting.

bash
pip install frida-tools
bash
# Run the binary to see the sleep behavior:
bash
bininst1.exe
bash
# The binary says it will print the flag but needs a nap first

Solution

Walk me through it
  1. Step 1Hook Sleep with a Frida script
    Write a Frida JavaScript file that locates Sleep in kernel32.dll and replaces it with a function that just returns immediately. Run the binary under frida to apply the hook.
    js
    // kill_sleep.js
var sleep = Module.getExportByName("kernel32.dll", "Sleep");
Interceptor.replace(sleep, new NativeCallback(function(ms) {
  return;
}, "void", ["uint32"]));
    bash
    frida bininst1.exe -l kill_sleep.js
    Learn more

    Frida is a dynamic binary instrumentation toolkit that lets you inject JavaScript into running processes. It works by attaching to a process (or spawning one) and loading a JavaScript engine into it, giving you full access to the process memory, function hooks, and API interception. Frida is widely used for security research, reverse engineering, and CTF challenges on Windows, macOS, Linux, iOS, and Android.

    Module.getExportByName looks up a named export from a loaded DLL by name. Interceptor.replace replaces the function at that address with a custom NativeCallback written in JavaScript. The callback here accepts the millisecond argument Sleep normally takes and simply returns without doing anything - effectively making Sleep a no-op and letting the binary continue immediately.

    The Windows Sleep function lives in kernel32.dll and pauses the current thread for the specified number of milliseconds. Malware and anti-analysis binaries commonly call Sleep with enormous values (hours or even days) to frustrate dynamic analysis tools that time out after a few seconds. Hooking Sleep is one of the first things analysts do when running a suspicious sample in a sandbox.

  2. Step 2Decode the Base64 output
    With Sleep bypassed, the binary wakes up and prints the flag as a Base64-encoded string. Decode it to recover the picoCTF flag.
    bash
    # The binary prints something like:
    bash
    # Ok, I'm Up! The flag is: cGljb0NURnt3NGtlX20zX3VwX3cxdGhfZnIxZGFfZjI3YS4uLn0=
    bash
    # Decode with:
    bash
    echo 'cGljb0NURnt3NGtlX20zX3VwX3cxdGhfZnIxZGFfZjI3YS4uLn0=' | base64 -d
    Learn more

    Base64 is a reversible encoding that represents binary data using 64 printable ASCII characters. The prefix cGljb0NUR is always the Base64 encoding of picoCTF, so any encoded picoCTF flag starts with it. Spotting this pattern is the fastest way to identify encoded flags in binary output or network captures.

    The binary encodes its output as Base64 to avoid the flag appearing as a plain string in the executable's read-only data section. A naive strings scan of the binary would not immediately reveal the flag, making the Frida instrumentation approach necessary rather than optional.

Flag

picoCTF{w4ke_m3_up_w1th_fr1da_f27a...}

Install Frida, write a one-function kill_sleep.js that replaces Sleep with a no-op, and run the binary under frida to get the Base64 flag output.

Want more picoCTF 2025 writeups?

Browse picoCTF 2025Full library

Useful tools for Reverse Engineering

Related reading

What to try next