---
description: '{"authors": ["ret2basic"]}'
---

# Reverse Engineering

## not crypto

{% hint style="success" %}
Solved by ret2basic
{% endhint %}

### Challenge

there's crypto in here but the challenge is not crypto... 🤔

[not-crypto](https://artifacts.picoctf.net/picoMini+by+redpwn/Reverse+Engineering/not-crypto/not-crypto)

### Solution

The program calls `memcmp()` for comparing our input with the flag:

![memcmp()](https://223316867-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MWVtlSxURaW2QQu6RU5%2Fuploads%2Fgit-blob-6b2d141a24149200774197805b46769005df87cb%2Fimage.png?alt=media)

The address of `memcmp()` is `0x13b9`:

![Address of memcmp()](https://223316867-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MWVtlSxURaW2QQu6RU5%2Fuploads%2Fgit-blob-70eeb5f21c63a401635fc54b07c7da0c4a847f71%2Fimage.png?alt=media)

Since **PIE** is enabled, this address is only an offset. Now we find the base address of the binary:

![PIE base address](https://223316867-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MWVtlSxURaW2QQu6RU5%2Fuploads%2Fgit-blob-6a960e17e19d89538546a5592336320221dd4724%2Fimage.png?alt=media)

Set a breakpoint at `0x555555554000 + 0x13b9 = 0x5555555553b9` and read the flag:

![Get flag](https://223316867-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MWVtlSxURaW2QQu6RU5%2Fuploads%2Fgit-blob-b20ed56f56722908f75c14945f092ab07024e7e3%2Fimage.png?alt=media)

## breadth

{% hint style="success" %}
Solved by ret2basic
{% endhint %}

### Challenge

Surely this is what people mean when they say "horizontal scaling," right?

### **TOP SECRET INFO:**

Our operatives managed to exfiltrate an in-development version of this challenge, where the function with the real flag had a mistake in it. Can you help us get the flag?

[breadth.v1](https://artifacts.picoctf.net/picoMini+by+redpwn/Reverse+Engineering/breadth/breadth.v1) [breadth.v2](https://artifacts.picoctf.net/picoMini+by+redpwn/Reverse+Engineering/breadth/breadth.v2)

### Solution

Compare these two binaries and examine which bytes are different:

```bash
cmp -bl breadth.v1 breadth.v2
```

![cmp](https://223316867-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MWVtlSxURaW2QQu6RU5%2Fuploads%2Fgit-blob-550a129cbe159af756d62d4414cb29c757cdf1d1%2Fimage.png?alt=media)

Here `610380` refers to the function located at address `0x9504C`. Examine this function in IDA:

![Function](https://223316867-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MWVtlSxURaW2QQu6RU5%2Fuploads%2Fgit-blob-e0f714f3c662caa60dda4c33bdcc1973d2b5a75c%2Fimage.png?alt=media)

Get flag:

![Get flag](https://223316867-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MWVtlSxURaW2QQu6RU5%2Fuploads%2Fgit-blob-515635eb71c9de0da1c0618fb1e7e2b00de21b14%2Fimage.png?alt=media)
