We are given a Linux application, that asks for input and exits:
```sh$ ./easy_re
OMG!!!! I forgot kid's idReady to exit     AAAA```
After reversing the application in ```Snowman``` we see the rough outline:
```c...pipe(esp1 + 6);eax3 = fork(esp1 + 6);esp4 = reinterpret_cast<int32_t*>(esp1 - 1 + 1 - 1 + 1);if (!eax3) {    puts("\nOMG!!!! I forgot kid's id", v5, v6);    write(v7, "69800876143568214356928753", 29);    puts("Ready to exit     ", "69800876143568214356928753", 29);    exit(0, "69800876143568214356928753", 29);    esp4 = esp4 - 1 + 1 - 1 + 1 - 1 + 1 - 1 + 1;}read(v8, reinterpret_cast<uint32_t>(esp4) + 46, 29);esp9 = reinterpret_cast<void*>(esp4 - 1 + 1);__isoc99_scanf("%d", reinterpret_cast<uint32_t>(esp9) + 36, 29);esp10 = reinterpret_cast<void*>(reinterpret_cast<uint32_t>(esp9) - 4 + 4);if (v11 == eax3) {    eax12 = g80485f7;    if ((eax12 & 0xff) == 0xcc) {        puts(":D", reinterpret_cast<uint32_t>(esp9) + 36, 29);        exit(1, reinterpret_cast<uint32_t>(esp9) + 36, 29);        esp10 = reinterpret_cast<void*>(reinterpret_cast<uint32_t>(esp10) - 4 + 4 - 4 + 4);    }    printf("\nYou got the key\n ", reinterpret_cast<uint32_t>(esp9) + 36, 29);    lol(reinterpret_cast<uint32_t>(esp10) - 4 + 4 + 46, reinterpret_cast<uint32_t>(esp9) + 36, 29);}...```
The above code:
* Opens a pipe for communication* Forks* The parent application writes to pipe and exits* The forked child reads from the pipe and reads a number from keyboard (it expects the entered value to match the PID of the child)* Forked child then does some work in ```lol``` function:
```cvoid lol(void* a1, void* a2, int32_t a3) {    void* v4;    int32_t v5;    int32_t v6;
    if (1) {        printf("flag_is_not_here", v4, v5);    } else {        printf("%s", reinterpret_cast<int32_t>(__zero_stack_offset()) - 4 - 19, v6);    }    return;}```
Notice that there is a dead branch in this method that seems to output something. Let's go to the disassembled code (```objdump -d -M intel ./easy_re```):
```080485f4 <lol>: 80485f4:	55                   	push   ebp 80485f5:	89 e5                	mov    ebp,esp 80485f7:	83 ec 28             	sub    esp,0x28 80485fa:	8b 45 08             	mov    eax,DWORD PTR [ebp+0x8]  # some interesting calculations happening here 80485fd:	83 c0 01             	add    eax,0x1 8048600:	0f b6 00             	movzx  eax,BYTE PTR [eax] 8048603:	89 c2                	mov    edx,eax 8048605:	8b 45 08             	mov    eax,DWORD PTR [ebp+0x8] 8048608:	83 c0 01             	add    eax,0x1 804860b:	0f b6 00             	movzx  eax,BYTE PTR [eax] 804860e:	8d 04 02             	lea    eax,[edx+eax*1] 8048611:	88 45 ed             	mov    BYTE PTR [ebp-0x13],al 8048614:	8b 45 08             	mov    eax,DWORD PTR [ebp+0x8] 8048617:	83 c0 04             	add    eax,0x4 804861a:	0f b6 00             	movzx  eax,BYTE PTR [eax] 804861d:	89 c2                	mov    edx,eax 804861f:	8b 45 08             	mov    eax,DWORD PTR [ebp+0x8] 8048622:	83 c0 05             	add    eax,0x5 8048625:	0f b6 00             	movzx  eax,BYTE PTR [eax] 8048628:	8d 04 02             	lea    eax,[edx+eax*1] 804862b:	88 45 ee             	mov    BYTE PTR [ebp-0x12],al 804862e:	8b 45 08             	mov    eax,DWORD PTR [ebp+0x8] 8048631:	83 c0 08             	add    eax,0x8 8048634:	0f b6 00             	movzx  eax,BYTE PTR [eax] 8048637:	89 c2                	mov    edx,eax 8048639:	8b 45 08             	mov    eax,DWORD PTR [ebp+0x8] 804863c:	83 c0 09             	add    eax,0x9 804863f:	0f b6 00             	movzx  eax,BYTE PTR [eax] 8048642:	8d 04 02             	lea    eax,[edx+eax*1] 8048645:	88 45 ef             	mov    BYTE PTR [ebp-0x11],al 8048648:	8b 45 08             	mov    eax,DWORD PTR [ebp+0x8] 804864b:	83 c0 0c             	add    eax,0xc 804864e:	0f b6 00             	movzx  eax,BYTE PTR [eax] 8048651:	89 c2                	mov    edx,eax 8048653:	8b 45 08             	mov    eax,DWORD PTR [ebp+0x8] 8048656:	83 c0 0c             	add    eax,0xc 8048659:	0f b6 00             	movzx  eax,BYTE PTR [eax] 804865c:	8d 04 02             	lea    eax,[edx+eax*1] 804865f:	88 45 f0             	mov    BYTE PTR [ebp-0x10],al 8048662:	8b 45 08             	mov    eax,DWORD PTR [ebp+0x8] 8048665:	83 c0 12             	add    eax,0x12 8048668:	0f b6 00             	movzx  eax,BYTE PTR [eax] 804866b:	89 c2                	mov    edx,eax 804866d:	8b 45 08             	mov    eax,DWORD PTR [ebp+0x8] 8048670:	83 c0 11             	add    eax,0x11 8048673:	0f b6 00             	movzx  eax,BYTE PTR [eax] 8048676:	8d 04 02             	lea    eax,[edx+eax*1] 8048679:	88 45 f1             	mov    BYTE PTR [ebp-0xf],al 804867c:	8b 45 08             	mov    eax,DWORD PTR [ebp+0x8] 804867f:	83 c0 0a             	add    eax,0xa 8048682:	0f b6 00             	movzx  eax,BYTE PTR [eax] 8048685:	89 c2                	mov    edx,eax 8048687:	8b 45 08             	mov    eax,DWORD PTR [ebp+0x8] 804868a:	83 c0 15             	add    eax,0x15 804868d:	0f b6 00             	movzx  eax,BYTE PTR [eax] 8048690:	8d 04 02             	lea    eax,[edx+eax*1] 8048693:	88 45 f2             	mov    BYTE PTR [ebp-0xe],al 8048696:	8b 45 08             	mov    eax,DWORD PTR [ebp+0x8] 8048699:	83 c0 09             	add    eax,0x9 804869c:	0f b6 00             	movzx  eax,BYTE PTR [eax] 804869f:	89 c2                	mov    edx,eax 80486a1:	8b 45 08             	mov    eax,DWORD PTR [ebp+0x8] 80486a4:	83 c0 19             	add    eax,0x19 80486a7:	0f b6 00             	movzx  eax,BYTE PTR [eax] 80486aa:	8d 04 02             	lea    eax,[edx+eax*1] 80486ad:	88 45 f3             	mov    BYTE PTR [ebp-0xd],al 80486b0:	c7 45 f4 00 00 00 00 	mov    DWORD PTR [ebp-0xc],0x0   # we set the value to 0 80486b7:	83 7d f4 01          	cmp    DWORD PTR [ebp-0xc],0x1   # and then compare it to 1 80486bb:	75 16                	jne    80486d3 <lol+0xdf>         80486bd:	b8 c0 88 04 08       	mov    eax,0x80488c0             # this branch will never be taken 80486c2:	8d 55 ed             	lea    edx,[ebp-0x13]            # and yet it's the one that prints 80486c5:	89 54 24 04          	mov    DWORD PTR [esp+0x4],edx   #  the value built above 80486c9:	89 04 24             	mov    DWORD PTR [esp],eax 80486cc:	e8 ff fd ff ff       	call   80484d0 <printf@plt> 80486d1:	eb 0d                	jmp    80486e0 <lol+0xec> 80486d3:	b8 c3 88 04 08       	mov    eax,0x80488c3 80486d8:	89 04 24             	mov    DWORD PTR [esp],eax 80486db:	e8 f0 fd ff ff       	call   80484d0 <printf@plt> 80486e0:	c9                   	leave   80486e1:	c3                   	ret    ```
As it turns out the decompiled C code does not reveal everything, there is a bunch of calculations occurring in that function, and yet the calculated value is abandoned and ```flag_is_not_here``` is printed instead.
To reveal that value let's patch out the executable and replace ```cmp    DWORD PTR [ebp-0xc],0x1``` with ```cmp    DWORD PTR [ebp-0xc],0x0```. This can be done in any binary editor. Essentially we are replacing ```83 7d f4 01``` with ```83 7d f4 00```.
Once the binary is patched we can run it. To figure out the PID we can first run the application, and while it's waiting for input run ```ps``` in a separate shell:
```sh$ ps -ef | grep easyroot      1695  1529  0 15:54 pts/0    00:00:00 ./easy_re_patchedroot      1696  1695  0 15:54 pts/0    00:00:00 [easy_re_patched] <defunct>root      1702  1536  0 15:55 pts/1    00:00:00 grep easy```
When we enter the PID we get the flag:
```sh$ ./easy_re_patched 
OMG!!!! I forgot kid's idReady to exit     1696
You got the key rhelheg```
The flag is ```RCTF{rhelheg}```.