MC 3 (Dynamic Analysis)

Platform: rev-kids20.forkbomb.ru | Category: Reversing | Type: Challenge | Difficulty: Medium | OS: NA | Author: XESXOR | Date: 2026-03-09 | Status: Solved Techniques: custom_vm_analysis, data_section_analysis, pattern_extraction

Summary

Language: C. Binary only. "The app is writing flag somewhere... and it's statically linked."

MC 3 (Dynamic Analysis) — Reverse Kids 2.0

Description

Language: C. Binary only. "The app is writing flag somewhere... and it's statically linked."

ELF 64-bit, statically linked, stripped, 751KB.

Analysis

The binary contains a custom VM interpreter. The VM bytecode is stored in the .data section. The flag is constructed byte-by-byte in VM memory.

Each flag character is stored after the pattern 0x0d 0xa7 0x1f in the data section.

Solution

Extract all printable ASCII characters following the pattern 0x0d 0xa7 0x1f in the .data section of the binary. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍