Mic Check 10

Platform: CUSTOM | Category: Reversing | Type: Challenge | Difficulty: Easy | OS: N/A | **Author: XESXOR Techniques: binary_patching, function_redirection, entry_point_modification

Summary

Walkthrough of the CUSTOM Reversing Mic Check 10. "Вызовите функцию, которая выдаст вам флаг" (Call the function that will give you the flag)

Description

"Вызовите функцию, которая выдаст вам флаг" (Call the function that will give you the flag)

A simple reverse engineering challenge where the goal is to call a hidden function that prints the flag. The main function doesn't accept any input, so traditional exploitation isn't possible — binary patching is required.

Binary Analysis

File: ELF 64-bit LSB executable, x86-64, dynamically linked, not stripped

Key strings found:

• "Nope, no flag for you using this function"
• "Go to another function" ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Symbols (via nm):

Vulnerability / Challenge

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

This isn't a traditional exploitation challenge:

1. main() simply prints a message and returns — no user input, no buffer overflow
2. The flag-printing function yes_print_the_flag exists but is never called
3. The challenge is to redirect execution to the hidden function

Disassembly of main (0x400500):

• Prints "Nope, no flag for you using this function"
• Prints "Go to another function"
• Returns without any interaction

Disassembly of yes_print_the_flag (0x4004f0):

• Calls obfuscated_print_flag which contains Tigress-obfuscated code
• The obfuscated code constructs and prints the flag character by character ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Solution

Since there's no user input to exploit, the approach is to patch the binary to redirect execution from main to yes_print_the_flag.

Method 1: Binary Patching (Used)

Patch the beginning of main to jump to yes_print_the_flag:

 python read-only • copy allowed Copy
#!/usr/bin/env python3
"""
Patch mc1 binary to redirect main -> yes_print_the_flag
"""

# Read original binary
with open('mc1', 'rb') as f:
    data = bytearray(f.read())

# Addresses from nm:
# main:               0x400500
# yes_print_the_flag: 0x4004f0
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

# Calculate file offset for main (assuming standard ELF layout)
# main is at 0x400500, text section typically starts at 0x400000
main_offset = 0x500  # Offset in file

# Patch: Replace first bytes of main with JMP to yes_print_the_flag
# JMP rel32: E9 xx xx xx xx
# Relative offset = target - (current + 5)
# 0x4004f0 - (0x400500 + 5) = -0x15 = 0xFFFFFFEB (signed)

# JMP -0x15 = E9 EB FF FF FF
patch = bytes([0xE9, 0xEB, 0xFF, 0xFF, 0xFF])
data[main_offset:main_offset+5] = patch

# Write patched binary
with open('mc1_patched', 'wb') as f:
    f.write(data)
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

# Make executable
import os
os.chmod('mc1_patched', 0o755)

Method 2: GDB (Alternative)

 bash read-only • copy allowed Copy
gdb ./mc1
(gdb) break main
(gdb) run
(gdb) call yes_print_the_flag()

Method 3: Python ctypes (Alternative)

 python read-only • copy allowed Copy
#!/usr/bin/env python3
import ctypes

lib = ctypes.CDLL('./mc1')
lib.yes_print_the_flag()

Method 4: Change ELF Entry Point (Alternative)

Modify the ELF header's e_entry field to point to yes_print_the_flag instead of _start.

Running the Patched Binary

 bash read-only • copy allowed Copy
chmod +x mc1_patched
./mc1_patched
spbctf{REDACTED}

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Lessons Learned

• Not all pwn challenges require exploitation — sometimes binary patching is the intended solution
• Always check symbols with nm — even if main is useless, there might be hidden functions
• The flag confirms the approach: REDACTED — literally "jump to the needed function"
• Multiple approaches exist: GDB, ctypes, patching, entry point modification — choose the simplest
• Tigress obfuscation splits functions into many small pieces (_7_obfuscated_print_flag_*) making static analysis harder, but doesn't prevent calling the function ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Key Takeaways / Lessons

• Mastering binary_patching, function_redirection, entry_point_modification was key to this challenge.
• Always check for common misconfigurations and verify assumptions.

---

Crafted by XESXOR Research • 2026-03-10 • CUSTOM • Mic Check 10 • Difficulty: Easy