Binary Instrumentation 1 picoCTF 2025 Solution

Description

1. Step 1Hook Sleep with a Frida script

   Observation

   The binary announces it will print the flag and then sleeps for a very long time. Replace the Sleep call in kernel32.dll with Frida and execution reaches the output immediately.

   Write a Frida JavaScript file that locates Sleep in kernel32.dll and replaces it with a function that just returns immediately. Run the binary under frida to apply the hook.

   js

   // kill_sleep.js
   var sleep = Module.getExportByName("kernel32.dll", "Sleep");
   Interceptor.replace(sleep, new NativeCallback(function(ms) {
     return;
   }, "void", ["uint32"]));

   Copied!

   bash

   frida bininst1.exe -l kill_sleep.js

   Copied!

   What didn't work first

   Tried: Using Interceptor.attach instead of Interceptor.replace to hook Sleep.

   Interceptor.attach lets you run code on entry and exit but does not prevent the original function from executing, so the binary still sleeps. Interceptor.replace swaps the entire function pointer with your NativeCallback, ensuring Sleep never actually waits.

   Tried: Attaching Frida to the already-running bininst1.exe process with frida -n bininst1.exe -l kill_sleep.js after the binary has started.

   Sleep is called very early. Attach by name and the thread is already deep inside the wait, so the hook lands too late. Spawn the binary through Frida instead and the hook is in place before any of its code runs.

   Learn more

   Frida is a dynamic binary instrumentation toolkit that lets you inject JavaScript into running processes. It works by attaching to a process (or spawning one) and loading a JavaScript engine into it, giving you full access to the process memory, function hooks, and API interception. Frida is widely used for security research, reverse engineering, and CTF challenges on Windows, macOS, Linux, iOS, and Android.

   Module.getExportByName looks up a named export from a loaded DLL by name. Interceptor.replace replaces the function at that address with a custom NativeCallback written in JavaScript. The callback here accepts the millisecond argument Sleep normally takes and simply returns without doing anything - effectively making Sleep a no-op and letting the binary continue immediately.

   The Windows Sleep function lives in kernel32.dll and pauses the current thread for the specified number of milliseconds. Malware and anti-analysis binaries commonly call Sleep with enormous values (hours or even days) to frustrate dynamic analysis tools that time out after a few seconds. Hooking Sleep is one of the first things analysts do when running a suspicious sample in a sandbox.

2. Step 2Decode the Base64 output

   Observation

   The output starts with cGljb0NURn, the Base64 encoding of the literal picoCTF{ prefix. One decode gives the plaintext.

   With Sleep bypassed, the binary wakes up and prints the flag as a Base64-encoded string. Decode it to recover the picoCTF flag.

   bash

   # The binary prints something like:

   Copied!

   bash

   # Ok, I'm Up! The flag is: cGljb0NURnt3NGtlX20zX3VwX3cxdGhfZnIxZGFfZjI3YS4uLn0=

   Copied!

   bash

   # Decode with:

   Copied!

   bash

   echo 'cGljb0NURnt3NGtlX20zX3VwX3cxdGhfZnIxZGFfZjI3YS4uLn0=' | base64 -d

   Copied!

   Expected output

   picoCTF{w4ke_m3_up_w1th_fr1da_f27a...}

   What didn't work first

   Tried: Running strings on bininst1.exe to find the flag without using Frida.

   The flag is Base64-encoded in the program's logic rather than sitting as a literal in read-only data. strings would only show the encoded form if it were a literal, and even then Base64 text is easy to skim past. The binary has to run past the hook to emit it.

   Tried: Piping the binary's output through CyberChef using 'From Base64' with the URL-safe alphabet.

   The output uses the standard Base64 alphabet, which is also CyberChef's default, so it works. Pick the URL-safe alphabet by mistake and the bytes come out corrupted. The command-line decoder always uses the standard one.

   Learn more

   Base64 is a reversible encoding that represents binary data using 64 printable ASCII characters. Because it encodes three input bytes at a time, a fixed prefix produces a fixed output prefix: picoCTF{ always encodes to cGljb0NURn, so any encoded picoCTF flag starts with those characters. Spotting this pattern is the fastest way to identify encoded flags in binary output or network captures.

   The binary encodes its output as Base64 to avoid the flag appearing as a plain string in the executable's read-only data section. A naive strings scan of the binary would not immediately reveal the flag, making the Frida instrumentation approach necessary rather than optional.

Flag

Install Frida, write a one-function kill_sleep.js that replaces Sleep with a no-op, and run the binary under frida to get the Base64 flag output.