String

Platform: spbctf | Category: pwn | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2026-03-10 | Status: Solved Techniques: library_call_tracing, ltrace_interception, runtime_analysis

Summary

Task: find what string is stored at memory address 0x61ebce in an obfuscated binary. Solution: run the binary under ltrace to intercept the strcpy call that copies the answer string to the target address.

String — SPB CTF Pwn Season

Description

"Какая строчка в памяти по адресу 0x61ebce?" (What string is in memory at address 0x61ebce?)

Binary: mc2 — ELF 64-bit x86-64, not stripped

Analysis

The binary contains an obfuscated VM implemented in the obfuscated_prepare_memory function that initializes memory regions during startup. Rather than reverse engineering the entire VM, dynamic analysis with ltrace was used to intercept library calls.

Solution

By running the binary under ltrace, we captured the call:

strcpy(0x61ebce, "REDACTED")

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

This revealed that the string stored at the requested memory address 0x61ebce is REDACTED.

 bash read-only • copy allowed Copy
ltrace ./mc2 2>&1 | grep strcpy
# Output: strcpy(0x61ebce, "REDACTED")

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍