← Back to Writeups
CUSTOMEasyReversing

Gnalre

XESXOR9/10/20261 min read
#reversing#custom#easy#erlang_process_analysis#message_passing_trace

Gnalre

Platform: rev-kids20.forkbomb.ru | Category: Reversing | Type: Challenge | Difficulty: Easy | OS: NA | Author: XESXOR | Date: 2026-03-09 | Status: Solved Techniques: erlang_process_analysis, message_passing_trace

Summary

Language: Erlang. Source code provided. Concurrent Erlang program with message passing. "The flag is what ping() function returns."

Gnalre — Reverse Kids 2.0

Description

Language: Erlang. Source code provided. Concurrent Erlang program with message passing. "The flag is what ping() function returns."

Analysis

erlang
ping() ->
    Worker = spawn(task, redacted_atom, []),
    Worker ! {self(), ping},
    receive
        redacted_atom -> redacted_atom
    end.

redacted_atom() ->
    receive
        {Ping, ping} ->
            Str1 = "This is a flag",
            Str2 = right(Str1, 4, $.),    % "flag"
            Str3 = sub_string(Str1, 5, 7), % " is"
            Galf = concat(Str2, Str3),     % "flag is"
            Ping ! redacted_atom,
            Ping ! Galf
    end.

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

The REDACTED process sends two messages: the atom REDACTED and the string "flag is". The ping process only receives the first message (REDACTED) and returns it.

Solution

The ping() function returns the atom REDACTED — this is the flag.

Trap: the string "flag is" is computed and sent, but ping() doesn't receive it — it remains in the mailbox. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍