Static Analysis of ELF x86 Binary - RootMe Challenge

TL;DR

What this teaches: Systematic static analysis workflow for unprotected ELF binaries
Key tools: file, strings, binwalk, Ghidra
Difficulty: Beginner
Time investment: 15-20 minutes reading, 30 minutes reproduction

Context

Target Information

• Binary: ch1.bin
• Hash: Not provided (challenge environment)
• Platform: Linux ELF x86-32
• Source: RootMe “ELF x86 - 0 Protection” challenge

Initial Observations

• Challenge rated “Very Easy” - suggests minimal protection
• Title indicates “0 protection” - no packing/obfuscation expected
• Objective: Extract hardcoded password through static analysis

Initial Recon

Static Analysis

# Basic file identification
file ch1.bin
# Output: ELF 32-bit LSB executable, Intel 80386, dynamically linked

# String extraction with minimum length filter
strings -n 4 ch1.bin | less

# Binary structure analysis
binwalk ch1.bin

Key findings from static analysis:

• Standard ELF executable, no embedded files
• Dynamically linked against standard libraries
• Readable strings present in binary (potential password candidates)
• No obvious packing or obfuscation signatures

Dynamic Setup

Not required for this analysis - static techniques sufficient.

Hypothesis

Based on initial recon, working theory:

• Binary behavior: Simple password validation program
• Protection level: None (as indicated by challenge title)
• Expected approach: Static analysis should reveal hardcoded password
• Analysis complexity: Minimal - suitable for demonstrating basic workflow

Analysis

Phase 1: File Format Verification

file ch1.bin

Result: Confirmed 32-bit ELF executable for Intel x86 architecture.

Key insight: Standard Linux binary format - no unusual characteristics that would complicate analysis.

Phase 2: String Enumeration

strings -n 4 ch1.bin | grep -v "^[[:space:]]*$" | head -20

Tools used: strings command with minimum length filter to reduce noise
Challenges encountered: Large volume of library strings - need to identify application-specific strings

Key findings:

• Standard C library function names present
• Potential password candidates visible in string output
• No obvious obfuscation of string data

Phase 3: Ghidra Decompilation

Import process:

1. Create new Ghidra project
2. Import ch1.bin with auto-analysis enabled
3. Navigate to main() function via Symbol Tree

// Decompiled main() function (simplified)
int main(void) {
    char user_input[32];

    printf("Password: ");
    scanf("%s", user_input);

    if (strcmp(user_input, "123456789") == 0) {
        printf("Good password!\n");
        return 0;
    } else {
        printf("Bad password!\n");
        return 1;
    }
}

Key insight: Direct string comparison reveals hardcoded password “123456789”.

Key Pivot Moments

Breakthrough 1: String Analysis Success

• What happened: strings command immediately revealed password candidate
• Why it mattered: Demonstrated that static analysis alone could solve this challenge
• Technique used: Basic string extraction with length filtering

Breakthrough 2: Ghidra Decompilation Confirmation

• What happened: Decompiled code confirmed string comparison logic
• Why it mattered: Provided definitive proof of password validation mechanism
• Technique used: Static decompilation and code flow analysis

Takeaways

Technical Lessons

• Static analysis priority: Always attempt static techniques before dynamic analysis
• Tool layering: Multiple tools provide complementary information (file + strings + disassembler)
• Decompilation power: Modern tools like Ghidra can reconstruct readable code from binaries

Patterns Observed

• Unprotected binaries: Hardcoded strings often visible in static analysis
• Simple validation: Basic strcmp() patterns common in beginner challenges
• Standard compilation: No unusual compiler flags or protection mechanisms

Future Applications

• Methodology template: This workflow applies to any unprotected ELF binary
• Tool selection: Static analysis sufficient when no protection mechanisms present
• Complexity assessment: Challenge difficulty correlates with protection level

References

• RootMe Challenge Platform
• Ghidra Documentation
• ELF Format Specification

Analysis completed on 2025-12-18 using Ghidra 10.4, strings, file, binwalk