This was the first reverse engineering challenge in the TrollCat CTF.First, I checked the file type:```$ file crackmecrackme: ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=da0b706ba33eedf2a1c6122a3054203e69a4d343, for GNU/Linux 3.2.0, stripped```
When running it, it simply asks for a key, and tells if the key entered is correct.
Since the simple techniques, such as strings, strace, ltrace didn't work, i analyzed the file using Cutter.I collected the success and failure addresses, and wrote a python script using angr to retrieve the key:
```import angrimport claripy
success_addr = 0x00001832 
failure_addr = 0x00002095 # ;-- str.Invalid_key:						  # 0x00002095          .string "Invalid key" ; len=12
flag_length = 15 # >>> sys.getsizeof('A'*15)				 # 64
proj = angr.Project("crackme") # create a projects
# create stdin variable that angr can work withkey_chars = [claripy.BVS(f"key_{i}", 8) for i in range(flag_length)]key = claripy.Concat(*key_chars + [claripy.BVV(b"\n")])
# define the simulation manager's statestate = proj.factory.full_init_state(	args=["./crackme"],	add_options=angr.options.unicorn,	stdin=key	)
# limit to pritable characters onlyfor c in key_chars:	state.solver.add(c <= 0x7f)	state.solver.add(c >= 0x20)
sm = proj.factory.simulation_manager(state)sm.explore(find=success_addr, avoid=failure_addr)
# print all dead ends - stdin and stdoutfor end in sm.deadended:	print(end.posix.dumps(0), end.posix.dumps(1))
```
The most "readable" output was "dumbha", and since there was some unknown characters at the end, I guessed that the paswordis "dumbhacker". Bingo! After performing the netcat connection that was included in the description, I got the flag:
Trollcat{y0u_ptr4c3d_m3}
