Advent of CTF 2025: Day 4 - The Elf's Wager

Day 4 of Advent of CTF 2025 brings us into the world of reverse engineering with a challenging authentication module that requires pure static analysis skills. No debuggers allowed!

Challenge Overview

Category: Reverse Engineering
Difficulty: Intermediate-Advanced
Tools Used: Ghidra, objdump, strings
Constraints: Static analysis only - no debuggers permitted

Challenge Narrative

The break room buzzes with energy as Jingle McSnark presents his weekly puzzle to the SOC team. This time, it’s a mainframe authentication module that he claims is unbreakable. With the Krampus Syndicate probing their systems, understanding how authentication works at the North Pole has never been more critical.

Jingle slides over a USB drive shaped like a tiny Christmas tree, challenging us to prove our reverse engineering skills against his “unbreakable” binary.

Initial Analysis

File Type Identification

file day4

Output:

day4: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=b12ceece7b0740e07024986b701c0b5d81aa17f3, for GNU/Linux 3.2.0, stripped

Key observations:

• 64-bit ELF executable
• Position Independent Executable (PIE)
• Dynamically linked
• Stripped - no debugging symbols

String Analysis

strings day4

Key findings:

Nice try, but Santa sees when you're peeking!
Coal for you! Tampering detected.
NPLD Mainframe Authentication
Enter access code:
Jingle laughs. Wrong credential length!
Welcome to the mainframe, Operative. Jingle owes the elves a round.
Access Denied. Jingle smirks.
!1&9s,6r
/vs,$0v/q?
9*3$"

Analysis:

• Anti-debugging messages suggest tamper detection
• Clear authentication flow with length validation
• Suspicious encoded strings that might be the password
• Success/failure messages indicate binary behavior

Runtime Behavior Testing

echo "test" | ./day4

Output:

NPLD Mainframe Authentication
Enter access code: Jingle laughs. Wrong credential length!

This confirms the binary expects a specific input length.

Static Analysis with objdump

Since debugging is prohibited, we rely on disassembly to understand the program logic:

objdump -d day4

Key Assembly Analysis

1. Length Validation (at 0x11e8)

cmp $0x17,%rax    # Compare length with 0x17 (23 decimal)

The program expects exactly 23 characters of input.

2. Anti-Debugging Check (at 0x1343)

cmp $0xdeadbeef,%eax    # Check for debugging/tampering

This explains the anti-debugging messages we found in the strings.

3. Password Verification Algorithm (at 0x1362)

lea 0xda1(%rip),%rcx        # Load encoded password address (0x2110)
movsbl (%rdi,%rax,1),%edx   # Get input character
movzbl (%rcx,%rax,1),%esi   # Get stored character
xor $0x42,%edx              # XOR input with 0x42
cmp %esi,%edx               # Compare with stored value

Algorithm discovered:

input_char XOR 0x42 == stored_char

Extracting the Encoded Password

Using objdump to examine the .rodata section:

objdump -s -j .rodata day4

At offset 0x2110, we find the encoded password:

21 31 26 39 73 2c 36 72 1d 36 2a 71 1d 2f 76 73 2c 24 30 76 2f 71 3f

Reversing the XOR Cipher

Since the algorithm performs input_char XOR 0x42 == stored_char, we can reverse it:

password_char = stored_char XOR 0x42

Python Decoding Script

encoded = [0x21, 0x31, 0x26, 0x39, 0x73, 0x2c, 0x36, 0x72,
           0x1d, 0x36, 0x2a, 0x71, 0x1d, 0x2f, 0x76, 0x73,
           0x2c, 0x24, 0x30, 0x76, 0x2f, 0x71, 0x3f]

password = "".join(chr(byte ^ 0x42) for byte in encoded)
print(password)  # csd{1nt0_th3_m41nfr4m3}

Verification

Testing our decoded password:

echo "csd{1nt0_th3_m41nfr4m3}" | ./day4

Output:

NPLD Mainframe Authentication
Enter access code: Welcome to the mainframe, Operative. Jingle owes the elves a round.

Success! The authentication bypass is complete.

Key Learning Points

This challenge demonstrates several crucial reverse engineering concepts:

Static Analysis Techniques

• String analysis for understanding program behavior
• Disassembly reading to understand control flow
• Data section examination to extract encoded information
• Algorithm reconstruction from assembly code

Anti-Analysis Evasion

• Working around anti-debugging measures
• Using static analysis when dynamic analysis is blocked
• Understanding common tamper detection techniques

Cryptographic Analysis

• Recognizing simple XOR ciphers in assembly
• Reversing encryption algorithms mathematically
• Extracting keys and encoded data from binaries

Advanced Techniques Used

Assembly Pattern Recognition

• Identifying XOR operations in x86-64 assembly
• Understanding memory addressing modes
• Recognizing comparison and branching patterns

Binary Data Extraction

• Using objdump to examine specific sections
• Converting hex dumps to usable data
• Understanding ELF file structure

Algorithm Reversal

• Mathematical reversal of XOR operations
• Systematic approach to cipher breaking
• Validation through testing

Real-World Applications

These techniques are essential for:

• Malware Analysis: Understanding how malicious software operates
• Security Research: Finding vulnerabilities in software
• Incident Response: Analyzing unknown binaries during investigations
• Competitive CTFs: Solving reverse engineering challenges

Tools and Methodology

Essential Tools:

• objdump: Disassembly and section analysis
• strings: Quick reconnaissance of embedded text
• Python: Scripting for data manipulation and cipher breaking
• Ghidra: Advanced static analysis (though objdump sufficed here)

Flag

After successfully reversing the XOR-based authentication:

Answer: csd{1nt0_th3_m41nfr4m3}

Conclusion

Day 4 showcases the power of static analysis in reverse engineering. Even with anti-debugging measures and stripped binaries, systematic analysis can reveal authentication mechanisms and allow for successful exploitation.

The challenge demonstrates that understanding assembly language, recognizing cryptographic patterns, and applying mathematical reasoning can overcome sophisticated protection mechanisms. These skills are fundamental for security researchers and essential for advanced CTF competitions.

Jingle’s “unbreakable” authentication module proves that with the right techniques and persistence, even the most confident security implementations can be defeated through careful analysis.

This writeup is part of my Advent of CTF 2025 series. Reverse engineering skills like these are crucial for understanding how software works at the lowest level and identifying security vulnerabilities.