Giver

Platform: CUSTOM | Category: Reversing | Type: Challenge | Difficulty: Easy | OS: N/A | **Author: XESXOR Techniques: static_analysis, string_extraction, control_flow_tracing

Summary

Walkthrough of the CUSTOM Reversing Giver. Task: a small 32-bit Linux ELF validates user input with a direct strcmp and then prints a flag from a referenced global string. Solution: trace main to recover the required input Y3$, then follow pri

Description

Download binary: giver.elf

We are given a 32-bit Linux executable and need to determine which input reaches the success path and what exact flag value is printed.

Analysis

Initial triage shows a simple crackme-style ELF:

• 32-bit i386 ELF
• dynamically linked
• not stripped
• protections: Partial RELRO, Canary, NX, No PIE

Useful symbols and strings are still present, including main, print_flag, get_user_input, and timeout, which makes static analysis straightforward. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

The main function sets alarm(3), prints a banner, reads input with fgets, strips the trailing newline, and compares the result with strcmp against the hardcoded string Y3$.

If the comparison fails, execution goes to the error path. If it succeeds, the binary prints:

 text read-only • copy allowed Copy
[+] So typical...

and then calls print_flag.

print_flag does not build the flag dynamically. Instead, it loads a global pointer from .data at 0x0804a040 and passes it to the format string:

 text read-only • copy allowed Copy
[*] FLAG{%s}

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

The value stored at 0x0804a040 is 0x080488a0. Looking at .rodata at 0x080488a0 reveals the string:

 text read-only • copy allowed Copy
REDACTED

So the binary expects Y3$ as input and prints that referenced string inside the flag format.

Solution

The whole solve is pure static analysis:

1. Inspect main and identify the strcmp target.
2. Recover the accepted input: Y3$.
3. Follow the success branch into print_flag.
4. Resolve the global pointer at 0x0804a040.
5. Read the pointed string at 0x080488a0.
6. Substitute it into FLAG{%s}. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Minimal reproduction script:

 python read-only • copy allowed Copy
#!/usr/bin/env python3

user_input = "Y3$"
flag_value = "REDACTED"

print(f"send: {user_input}")
print(f"FLAG{{{flag_value}}}")

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Key Takeaways / Lessons

• Mastering static_analysis, string_extraction, control_flow_tracing was key to this challenge.
• Always check for common misconfigurations and verify assumptions.

---

Crafted by XESXOR Research • 2026-04-15 • CUSTOM • Giver • Difficulty: Easy