Behind the Scenes

Personal Rating: Easy

I got a program file.

With 'strings' there was nothing useful to be seen.

In Ghidra I opened the main function. There was a loop that only throws exceptions at the end. But clearly there was more code to be seen on the left after the main. Clicking on the InvalidInstructionException, i saw the UD2 Assembler call. I googled it and knew it was a type of exception. I selected all code after that and decompiled it with “d”. Then I saw the stringcompares, containing the flag.In Ghidra I opened the main function. There was a loop that only throws exceptions at the end. But clearly there was more code to be seen on the left after the main. Clicking on the InvalidInstructionException, i saw the UD2 Assembler call. I googled it and knew it was a type of exception. I selected all code after that and decompiled it with “d”. Then I saw the stringcompares, containing the flag.

There you can see that stringcompares are done and the Password, which is the flag, is asked in packs of 3 chars: