Rangoon [RE][EASY] Writeup

---

Challenge Description

This is the third in a series of introductory Reversing Challenges; Reyjkavik, Riyadh and Rangoon.
These are designed for people new to Reversing. A little gdb, C and Assembler knowledge should be enough to solve this challenge.
Good Luck!

Note that once you solve the challenge, you can use the flag to decrypt the source file used to create the challenge if you are interested in seeing the original C program.

The LiveOverflow channel on YouTube has some great tutorials on reversing, this video has almost everything you need to solve this challenge: https://www.youtube.com/watch?v=VroEiMOJPm8

---

SOLUTION

Analysed using Cutter

1. Load The Binary in Cutter

While Analysing the program we can see that
the input String data has been structured as

./Rangoon <puVar4>

In In Cutter’s main Decompiled code block

puVar4 = (uint8_t *)argv[1]; # String Input

2 . Debug the program with Random buffer length
For this case we are using AAA

3 . Pass the String Length Check and Starting String Identification

Pass if len(puVar4) >= len(puVar13)
which means that the buffer string should start with CTFlearn{
and must have a the buffer string length must be equals or greater than CTFlearn{
to pass the length check

puVar13 = (uint8_t *)"CTFlearn{";
bVar14 = *puVar11 < *puVar13;

4 . Pass the Check for endian character

Check if the supplied buffer string has 0x7d or } at the end.

iVar9 = strlen(puVar4);
if (puVar4[iVar9 + -1] == 0x7d)

5 . Getting character from Particular Index of the suplied Buffer String

Get the character from mentioned string
Here character from Index 17 is stored in uVar2
and character from Index 22 is stored in uVar3
for further checks later on

uVar2 = puVar4[0x11]; # puVar4[17]
uVar3 = puVar4[0x16]; # puVar4[22]

6 . Pass the Comparison checks for uVar2 and uVar3 with 0x5f or _

If puVar4[17]=puVar4[22]=0x5f then
character comparison check will Pass

iVar7 = __stpcpy_chk(uVar10 + 0x55bdbf8310e8, 
                                     *(undefined8 *)(iVar5 + (uint64_t)((uVar2 == 0x5f) + 2) * 8), 
                                     (int64_t)puVar12 - (uVar10 + 0x55bdbf8310e8));

iVar7 = __stpcpy_chk(iVar7 + 1, *(undefined8 *)(iVar5 + ((uint64_t)(uVar3 == 0x5f) * 5 + 3) * 8), 
                                     (int64_t)r9 - iVar7);

Which means that the buffer string can now be structured as
CTFlearn{<part1>_<part2>_<part3>}
where <part1> , <part2> and <part3> are string to be put to generate the FLAG

7 . Pass BUFFER STRING Length Check

BUFFER STRING length check will pass if len(puVar4) == 28
which means the FLAG length is 28

iVar9 = strlen(puVar4);
iVar8 = __stpcpy_chk(iVar7 + 1, *(undefined8 *)(iVar5 + ((uint64_t)(iVar8 == 0x1c) * 3 + 9) * 8), 0x557d5494b1df - iVar7);

8 . Suppling structured BUFFER STRING to get the FLAG

From the Above Discussion we can structure a BUFFER STRING
to Pass in debugging process can be
CTFlearn{AAAAAAAA_AAAA_AAAA}

9 . Getting the FLAG in the Register

Set A Breakpoint at strcmp

argc = strcmp(puVar4, rbp);

Suppling the Above string can get our FLAG in rdp register in HexDump

---

FLAG : CTFlearn{Princess_Maha_Devi}

---

This is how, I solved this challenge.

Thankyou, for reading my writeup :)
Hope, I would see you in my next writeup.

Support Me if you want to.