Compiled — TryHackMe

Compiled

Hello everyone. I have written this walkthrough to help you to complete this room.

Overview:

The Compiled room on TryHackMe is an introductory reverse engineering and binary analysis challenge designed to test basic static analysis skills beyond simple string extraction.

Task 1:

Only one task is to find the flag. Let’s start.

First, Download the task file and get started. The binary can also be found in the AttackBox inside the /root/Rooms/Compiled/ directory.

Note: The binary will not execute if using the AttackBox. However, you can still solve the challenge.

I am using AttackBox here.

AttackBox

We locate the file. Try to run the file. But as mentioned in the task, it’s not running inside the AttackBox.

File Run

Let’s use the “Strings” function to find anything useful from the file.

Strings

Nothing useful here.

As the task asks us for the password, which is also the Answer for the room. Thus, I put the file into a decompiler, in this case Ghidra.

For those who don’t know how to use it, here are the basic steps to load the file inside "Ghidra." I am using AttackBox here, so “Ghidra” is already installed.

If you are using your own machine, then you have to install it on your machine.

Get Subrat Keshari Sahu’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

To Get Started and Load a File:

• Open Ghidra.
• Go to File > New Project, select Non-Shared Project, choose a folder, and name your project.
• Drag and drop your target binary into the project window, or use File > Import File.
• Double-click the imported file to open the CodeBrowser tool.
• Click "Yes" when prompted to analyze the file, and accept the default analysis options.

Navigating and Decompiling Code:

• Look at the Symbol Tree or Program Tree panel on the left side of the Code Browser.
• Expand Functions or search for entry points like main.
• Double-click a function name to load both the assembly listing and the high-level code.
• View the Decompiler window (usually on the right) to read Ghidra’s C-like pseudocode translation of the assembly instructions.

Ghidra

Let’s breakdown what this code does:

• Ask for the password, receive it in the format "DoYouEven%sCTF," then store it in the variable "local_28."
• Compare the password string with "__dso_handle," then store the result in ‘iVar1’
• If password strings equal to "__dso_handle," it will print “Try again!” and end the program
• Compare the password string with "_init," then store the result in 'iVar1.'
• If password strings equal "_init," it means the password is correct.

This means the correct password is a string, which makes ‘local_28’ have the value '_init.' Knowing this, the last problem is how the line "__isoc99_scanf(“DoYouEven%sCTF”,local_28);" receives input. Let’s first see how it works. It captures everything between “DoYouEven” and the first occurrence of “CTF,” including any characters that are not whitespace.

Example:

• Password: DoYouEven_CTF tttt
  input: _CTF
• Password: DoYouEvenanytext
  input: anytext
• Password: DoYouEven-CTF t
  input: -CTF

Therefore, the solution is quite simple in order to make local_28 equal to '_init.'

Hope it will be useful to you. Thank you for using my walkthrough to complete this room. If you have any doubt, ask me below.