```——> ./runDecrypting the Flag into global variable 'flag_buf'.....................................Finished Reading Flag into global variable 'flag_buf'. Exiting.```
it takes quite some time; let's see what it does under the hood
```——> ltrace ./run__libc_start_main(0x4008c9, 1, 0x7fffe0f8a7c8, 0x400920 <unfinished ...>setvbuf(0x7f31b33445c0, 0, 2, 0)                                                                        = 0puts("Decrypting the Flag into global "...Decrypting the Flag into global variable 'flag_buf')                                                             = 52malloc(47)                                                                                              = 0x1488260putchar(46, 0x1488290, 0x1488260, 0x1488260.)                                                            = 46usleep(250000)                                                                                          = <void>strtol(0x7fffe0f8a6b0, 0, 16, 0)                                                                        = 69putchar(46, 0x7fffe0f8a6b1, 112, 0xfffffffffffffff.)                                                     = 46usleep(250000)                                                                                          = <void>strtol(0x7fffe0f8a6b0, 0, 16, 0)                                                                        = 62putchar(46, 0x7fffe0f8a6b1, 105, 0xfffffffffffffff.)                                                     = 46usleep(250000)                                                                                          = <void>strtol(0x7fffe0f8a6b0, 0, 16, 0)                                                                        = 56putchar(46, 0x7fffe0f8a6b1, 99, 0xfffffffffffffff.)                                                      = 46usleep(250000)                                                                                          = <void>[..]```
okay so it computes a char at a time then sleeps for 0.25 seconds. lets' geedeebee and break at a call to putchar.
```——> gdb ./runReading symbols from ./run...(no debugging symbols found)...done.gdb-peda$ disas mainDump of assembler code for function main:   0x00000000004008c9 <+0>:	push   rbp   0x00000000004008ca <+1>:	mov    rbp,rsp   0x00000000004008cd <+4>:	sub    rsp,0x10   0x00000000004008d1 <+8>:	mov    DWORD PTR [rbp-0x4],edi   0x00000000004008d4 <+11>:	mov    QWORD PTR [rbp-0x10],rsi   0x00000000004008d8 <+15>:	mov    rax,QWORD PTR [rip+0x200af9]        # 0x6013d8 <stdout@@GLIBC_2.2.5>   0x00000000004008df <+22>:	mov    ecx,0x0   0x00000000004008e4 <+27>:	mov    edx,0x2   0x00000000004008e9 <+32>:	mov    esi,0x0   0x00000000004008ee <+37>:	mov    rdi,rax   0x00000000004008f1 <+40>:	call   0x400650 <setvbuf@plt>   0x00000000004008f6 <+45>:	mov    edi,0x4009d0   0x00000000004008fb <+50>:	call   0x400600 <puts@plt>   0x0000000000400900 <+55>:	mov    eax,0x0   0x0000000000400905 <+60>:	call   0x400786 <decrypt_flag>   0x000000000040090a <+65>:	mov    edi,0x400a08   0x000000000040090f <+70>:	call   0x400600 <puts@plt>   0x0000000000400914 <+75>:	mov    eax,0x0   0x0000000000400919 <+80>:	leave     0x000000000040091a <+81>:	ret    End of assembler dump.gdb-peda$ disas decrypt_flagDump of assembler code for function decrypt_flag:   0x0000000000400786 <+0>:	push   rbp[..]  0x00000000004007e0 <+90>:	mov    DWORD PTR [rbp-0x1c],0x0  0x00000000004007e7 <+97>:	jmp    0x400889 <decrypt_flag+259>  0x00000000004007ec <+102>:	mov    edi,0x2e  0x00000000004007f1 <+107>:	call   0x4005f0 <putchar@plt>  0x00000000004007f6 <+112>:	mov    edi,0x3d090  0x00000000004007fb <+117>:	mov    eax,0x0  0x0000000000400800 <+122>:	call   0x400670 <usleep@plt>[..]  End of assembler dump.  gdb-peda$ break *0x00000000004007f1  Breakpoint 1 at 0x4007f1```
after running it, having gdb peda, i noticed that on the RDX register were passed the characters of the flag one by one
```gdb-peda$ cContinuing..[----------------------------------registers-----------------------------------]RAX: 0x5RBX: 0x0RCX: 0xfffffffffffffffRDX: 0x70 ('p') <---- first char of "picoCTF{......}"```
so at this point i just told gdb to redirect the output to a file and print the value in $rdx every time it hit that breakpoint and run the program again from the start
```(gdb) set pagination off(gdb) set logging file gdb.output(gdb) set logging onCopying output to gdb.output.(gdb)Already logging to gdb.output.(gdb) break *0x00000000004007f1Breakpoint 1 at 0x4007f1(gdb) command 1Type commands for breakpoint(s) 1, one per line.End with a line saying just "end".>p/c $rdx>continue```
also had to rerun gdb without sourcing .gdbinit because with gdb-peda it crashed.
```(gdb) rStarting program: /home/andrei/Documents/pico/runDecrypting the Flag into global variable 'flag_buf'
Breakpoint 1, 0x00000000004007f1 in decrypt_flag ()$1 = 96 '`'.Breakpoint 1, 0x00000000004007f1 in decrypt_flag ()$2 = 112 'p'[..]Breakpoint 1, 0x00000000004007f1 in decrypt_flag ()$36 = 49 '1'.Breakpoint 1, 0x00000000004007f1 in decrypt_flag ()$37 = 52 '4'.Finished Reading Flag into global variable 'flag_buf'. Exiting.```
then parse the output in the gdb.output to get the flag printed sanely, with this horrendous line
```——> cat gdb.output  | grep "'" | sed -e "s_.* __g" -e "s_'__g" | tr -d '\n' | tr -d '`'picoCTF{gDb_iS_sUp3r_u53fuL_f3f39814```
just add the last bracket and we're done.