QQQ

Platform: spbctf | Category: pwn | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2026-03-11 | Status: Solved Techniques: disassembly_analysis, instruction_tracing, memory_write_identification

Summary

Task: find the address of the instruction that writes a value to a specific memory buffer in a VM-like binary. Solution: use static disassembly analysis (objdump) to trace store instructions and identify the "mov dword ptr [rax], ecx" at address REDACTED that writes to the target buffer.

QQQ — SPB CTF Pwn Season

Description

"Найдите адрес инструкции, которая записывает значение в память"
(Find the address of the instruction that writes a value to memory)

Binary: mc9 — ELF 64-bit x86-64, not stripped, with debug_info (local only)
Points: 10

Analysis

The task asks to find the address of the instruction that writes a specific value to memory (the themem array at 0x602870). This is a static analysis challenge — no server, just binary analysis.

The binary contains VM-like code that processes data and writes results to a memory buffer. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Solution

Using objdump disassembly, we traced the VM-like code that processes data. The instruction at REDACTED is:

 asm read-only • copy allowed Copy
mov dword ptr [rax], ecx

This is the store instruction that writes computed values into the themem buffer.

Analysis Commands

 bash read-only • copy allowed Copy
objdump -d mc9 | grep -A5 -B5 "themem"
# or
r2 -A mc9 -c "pdf @ main" | grep "mov.*\[.*\]"

Look for:

1. References to the target memory address (0x602870)
2. Store instructions (mov [reg], reg pattern)
3. Instructions in loops that write to memory ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍