31337

Platform: spbctf | Category: pwn | Type: Challenge | Difficulty: Medium | OS: Linux | Author: XESXOR | Date: 2026-03-10 | Status: Solved Techniques: binary_patching, nop_padding, return_value_modification

Summary

Task: make an obfuscated VM calculation return the magic number 31337 so the binary prints the flag. Solution: patch the return value of the calculation function to mov eax, 0x7a69 (31337) with NOP padding, satisfying both the comparison and the verification in the flag printer.

31337 — SPB CTF Pwn Season

Description

"Похоже, оно никак не может правильно посчитать и набрать 31337. Помогите." (It can't properly count and reach 31337. Help it.)

Binary: mc3 — ELF 64-bit x86-64, not stripped

Analysis

The binary runs a VM-based calculation via obfuscated_calculate_something that returns a value, then compares it to 31337 (0x7a69). If equal, it prints the flag.

Challenge: Simply patching the comparison jump doesn't work because obfuscated_give_flag also verifies that the value is actually 31337. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Solution

We patched the return value of obfuscated_calculate_something to always return 31337. The original assembly:

 asm read-only • copy allowed Copy
mov rax, [rbp-0x3c8]
mov eax, [rax]

Was patched to:

 asm read-only • copy allowed Copy
mov eax, 0x7a69    ; 31337 in hex
nop
nop
nop
nop

This ensures both the comparison and the verification in obfuscated_give_flag receive the expected value.

 bash read-only • copy allowed Copy
# Using radare2 to patch
r2 -w mc3
[0x00401000]> s <return_address>
[0x00401xxx]> wa mov eax, 0x7a69; nop; nop; nop; nop
[0x00401xxx]> q
./mc3

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍