MC 3 (Dynamic Analysis)

Platform: CUSTOM | Category: Reversing | Type: Challenge | Difficulty: Medium | OS: N/A | **Author: XESXOR Techniques: custom_vm_analysis, data_section_analysis, pattern_extraction

Summary

Walkthrough of the CUSTOM Reversing MC 3 (Dynamic Analysis). Language: C. Binary only. "The app is writing flag somewhere... and it's statically linked."

Description

Language: C. Binary only. "The app is writing flag somewhere... and it's statically linked."

ELF 64-bit, statically linked, stripped, 751KB.

Analysis

The binary contains a custom VM interpreter. The VM bytecode is stored in the .data section. The flag is constructed byte-by-byte in VM memory.

Each flag character is stored after the pattern 0x0d 0xa7 0x1f in the data section.

Solution

Extract all printable ASCII characters following the pattern 0x0d 0xa7 0x1f in the .data section of the binary. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Key Takeaways / Lessons

• Mastering custom_vm_analysis, data_section_analysis, pattern_extraction was key to this challenge.
• Always check for common misconfigurations and verify assumptions.

---

Crafted by XESXOR Research • 2026-03-09 • CUSTOM • MC 3 (Dynamic Analysis) • Difficulty: Medium