Angruments

Platform: CUSTOM | Category: Reversing | Type: Challenge | Difficulty: Easy | OS: N/A | **Author: XESXOR Techniques: branch_constraint_solving, rodata_inspection, symbol_inspection

Summary

Walkthrough of the CUSTOM Reversing Angruments. Task: a small non-stripped ELF validates three command-line arguments and asks to concatenate them into the flag. Solution: inspect symbols and disassembly, solve the integer/string constraints static

Overview

Flag is flag{concatenation of arguments}

We are given a Linux x86-64 ELF binary named angruments. The goal is to find the command-line arguments accepted by the program, concatenate them, and wrap the result as the flag.

The binary could not be executed natively in the macOS arm64 environment (exec format error), but it is not stripped and the validation logic is simple enough to solve fully with static analysis.

Recon

Basic file identification shows a dynamically linked 64-bit Linux executable: ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

 bash read-only • copy allowed Copy
$ file angruments
angruments: ELF 64-bit LSB executable, x86-64, dynamically linked, ... not stripped

Since symbols are present, nm immediately identifies the useful functions:

 bash read-only • copy allowed Copy
$ nm angruments
...
00000000004005f6 T check_validity
0000000000400673 T main
...

Useful strings in .rodata can be inspected with:

 bash read-only • copy allowed Copy
$ objdump -s -j .rodata angruments

The relevant constants are:

• spbctf at 0x400774
• well done. at 0x40077b

Static Analysis

Disassembly was enough to understand the data flow: ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

 bash read-only • copy allowed Copy
$ objdump -d -M intel angruments

main reads command-line arguments and calls:

 c read-only • copy allowed Copy
check_validity(argv[1], atoi(argv[2]), atoi(argv[3]));

Let:

• A = argv[1]
• B = atoi(argv[2])
• C = atoi(argv[3])

The check_validity function compares A with the constant string spbctf and applies a few integer checks to B and C.

Constraint Solving

The disassembly gives these constraints:

1. C == 0x539, so C == 1337.
2. 2*B + C > 0x53e, so 2*B + 1337 > 1342, therefore B >= 3 for integer B.
3. B + C <= 0x53c, so B + 1337 <= 1340, therefore B <= 3.
4. Combining the bounds gives B == 3.
5. strcmp(A, "spbctf") == 0, so A == "spbctf". ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Therefore the valid invocation is:

 bash read-only • copy allowed Copy
./angruments spbctf 3 1337

The task statement says the flag is flag{concatenation of arguments}. Concatenating the accepted arguments gives:

 text read-only • copy allowed Copy
spbctf31337

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Key Takeaways / Lessons

• Mastering branch_constraint_solving, rodata_inspection, symbol_inspection was key to this challenge.
• Always check for common misconfigurations and verify assumptions.

---

Crafted by XESXOR Research • 2026-07-01 • CUSTOM • Angruments • Difficulty: Easy