> For the complete documentation index, see [llms.txt](https://sayonara.gitbook.io/writeups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://sayonara.gitbook.io/writeups/ctf/ensa-sics-ctf-2023/reverse-engineering-challenges/end14n_x0r.md).

# End14n\_X0R

## <mark style="color:red;">Downloading Challenge Files</mark>

here is the executable file to download

{% file src="/files/gzgl6thwf0CA6wO3NH1t" %}

## <mark style="color:red;">Basic EXE Reconnaissance</mark>

the executable is 64 bit that means that addresses will be 8 bytes and the exe is stripped that means we can view the function names

<div align="left"><figure><img src="https://1410593648-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYI2noEqPw69jd0hR7Prp%2Fuploads%2FHYroxk9G2CsjzKr9917F%2Fimage.png?alt=media&amp;token=11e67539-150d-4adc-9512-65499cf068a0" alt=""><figcaption></figcaption></figure></div>

## <mark style="color:red;">Reverse Engineering</mark>

as we have done in the S31r14l\_Br34k3r challenge open ghidra and import the R3v\_m3 binary into ghidra to analyze it after doing this open the functions and take a look at the exe functions

<div align="left"><figure><img src="https://1410593648-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYI2noEqPw69jd0hR7Prp%2Fuploads%2Fjn7HYgzx8o41c7oUAeJt%2Fimage.png?alt=media&amp;token=7060a253-5ee5-4e46-b8fc-384d497af762" alt=""><figcaption></figcaption></figure></div>

let's open the main function and this function takes the password from the user input and passes it into the check\_password() function and if it meets the checks and the password is correct then the secret flag will be revealed

<div align="left"><figure><img src="https://1410593648-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYI2noEqPw69jd0hR7Prp%2Fuploads%2FN6FhLAFB6K5JvFp9b7Zd%2Fimage.png?alt=media&amp;token=dc8407d6-245f-4eec-83c1-e75bca27b070" alt=""><figcaption></figcaption></figure></div>

to be honest i have found a lazy win which is patching the binary and removing the check\_password() function so any password will be correct and that will lead into printing the secret flag

to do this we will use pwntools to overwrite the check\_password() function assembly code with the instruction of ret => return&#x20;

and that will make the check\_password() return as soon it's called and it will not affect the password

```python
from pwn import * 
exe = 'END14n_XOR'
elf = context.binary = ELF(exe, checksec=False)

elf.asm(elf.symbols.check_password, 'ret')

elf.save('END14n_XOR_Patched')
```

so now the patched executable will be saved into the END14n\_XOR\_Patched executable&#x20;

let's run this python script to generate this patched exe

<div align="left"><figure><img src="https://1410593648-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYI2noEqPw69jd0hR7Prp%2Fuploads%2Fq2gEymsVOTN81mB5NyQm%2Fimage.png?alt=media&amp;token=9b91a259-c87a-4d68-8cb4-53c59c7d72a5" alt=""><figcaption></figcaption></figure></div>

now let's make it executable

<div align="left"><figure><img src="https://1410593648-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYI2noEqPw69jd0hR7Prp%2Fuploads%2FIHn8WZZea8nQLLXzruz2%2Fimage.png?alt=media&amp;token=a7fc3dce-aa1c-43a8-a6dd-a499d04c5bf7" alt=""><figcaption></figcaption></figure></div>

and now let's run the normal executable and the patched executable

<div align="left"><figure><img src="https://1410593648-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYI2noEqPw69jd0hR7Prp%2Fuploads%2FKjVRzNjJH2IheFb6DWSw%2Fimage.png?alt=media&amp;token=a32271fa-26a3-410f-b8cb-4f4718ced3e0" alt=""><figcaption></figcaption></figure></div>

## <mark style="color:red;">Flag</mark>

DEFENSYS{R3v3rs1ng\_4nd\_X0r1ng\_M4k3s\_4\_r34lly\_G00d\_M4tch\_:)}

Greetings from [<mark style="color:blue;">**Sayonara**</mark>](https://github.com/ismail-arame/)