CTF reverse analysis process
An executable program (Windows graphical interface program, linux static compiler program) has a huge amount of assembly code.
Analysis steps :
1. Locate the key code that really needs to be analyzed.
2. Need to analyze the algorithm used by the key code
3. Clarify the program function
4. Write the corresponding script and solve the flag
Key code positioning
1. String positioning method:
OD string search
2. Function positioning method:
2.1. Window (API): GetWindowText, GetDlgltemText, MessageBox, Send, Recv, LoadLibray, VirtualAlloc...
2.2. Linux (static compilation): Function library signature, syscall...
3.3.Andiord: Import key functions of the package, OKHTTP class, Crypto class...
Sort out program functions
1. Improve code readability
2. Sort out program logic
3. Identify each algorithm (forward implementation, reverse deduction)
3.1. Encryption, compression
3.2. Conventional algorithm
3.3. Custom algorithm
Flag solution
1. Memory acquisition method
2 . Algorithm inverse transformation
2. Linear transformation
3. Constraint solution
5. Channel measurement solution