## Reversing - 7w1n5
We are given two binaries, both of which print:
```Let's start analysis! :)```
and immediately exit. Under `gdb` they also print:
```No no no no no```
and still exit.
Inspection with IDA reveals a soup of encryption calls, environment checks and`exec`s. Let's try dynamic analysis first in order to figure out where these twomessages are printed, and how it detects `gdb`. The first theory is `ptrace`system call, of course, so let's use `strace` to verify it:
```$ strace -f -s 8192 -o strace.out ./Brother1```
No `ptrace`. What are those `exec`s doing?
```$ grep exec < strace.outexecve("/bin/bash", ["./Brother1", "-c", " " * 4096 +"#!/bin/bash\necho \"Let's start analysis! :)\"\nps -a|grep -v grep|grep -e gdb -e \" r2\" -q &&  echo \"No no no no no\" &&  exit 1\necho Close! So close! >/dev/null\nfor I in 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15\ndo\n  date +" + "x" * 770 + "SECCON{Which_do_yo|tr A-Za-z N-ZA-Mn-za-m >/dev/null &  # base64\343\201\253\343\201\252\343\201\243\343\201\246\343\201\204\343\202\213\ndone\necho Close! So close! >/dev/null\n","./Brother1"], /* 62 vars */) = 0```
Ok, it just looks for `gdb` and `r2` in the process list, so we can simply use asymlink to trick it. Wait a second, what's this: `SECCON{Which_do_yo`?
```$ strace -f -s 8192 ./Brother2 2>&1 | grep execexecve("./Brother2", ["./Brother2"], /* 62 vars */) = 0execve("/bin/bash", ["./Brother2", "-c", "exec '/usr/bin/strace' \"$@\"","./Brother2"], /* 63 vars */) = 0execve("/usr/bin/strace", ["/usr/bin/strace"], /* 63 vars */) = 0```
`argv[0]` trick, how cute.
```$ strace -f -s 8192 bash -c ./Brother2 2>&1 | grep execexecve("/bin/bash", ["./Brother2", "-c", " " * 4096 +"#!/bin/bash\necho \"Let's start analysis! :)\"\nps -a|grep -v grep|grep -e gdb -e \" r2\" -q &&  echo \"No no no no no\" &&  exit 1\necho Close! So close! >/dev/null\nfor I in 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15\ndo\n  date +" + "x" * 770 + "u_like_Bin_or_TxT}|tr A-Za-z N-ZA-Mn-za-m >/dev/null &  # base64\343\201\253\343\201\252\343\201\243\343\201\246\343\201\204\343\202\213\ndone\necho Close! So close! >/dev/null\n","./Brother2"], /* 62 vars */) = 0```
Hard to believe, but `SECCON{Which_do_you_like_Bin_or_TxT}` is indeed the flag!