Understand how CTF challenge programs work through reverse engineering, the analysis of compiled software. Use guidance on binaries, APKs, WASM, firmware, and custom virtual machines to trace validation logic, investigate obfuscation, and choose analysis tools.
中文简介正在准备中。当前显示英语简介。
Provides reverse engineering techniques for CTF challenges. Use when the main job is to understand how a compiled, obfuscated, packed, or virtualized target works before exploiting or solving it, including binaries, APKs, WASM, firmware, custom VMs, bytecode, game clients, malware-like loaders, and anti-debug or anti-analysis logic. Do not use it when the vulnerability is already understood and the remaining task is exploitation; use pwn instead. Do not use it for pure web workflows, log or disk forensics, or standalone crypto problems unless reversing the implementation is the real blocker.
安装前可以查看交给 AI 代理的指令内容。
Quick reference for RE challenges. For detailed techniques, see supporting files.
Python packages (all platforms):
pip install frida-tools angr qiling uncompyle6 capstone lief z3-solver
# For Python 3.9+ bytecode: build pycdc from source
git clone https://github.com/zrax/pycdc && cd pycdc && cmake . && make
Linux (apt):
apt install gdb radare2 binutils strace ltrace apktool upx
macOS (Homebrew):
brew install gdb radare2 binutils apktool upx ghidra
radare2 plugins:
r2pm -ci r2ghidra # Native Ghidra decompiler for radare2
# The prebuilt r2ghidra zip is ABI-locked to one radare2 version (WARN: ABI mismatch: Expect 142 vs 152); r2pm -ci r2ghidra builds the plugin from source instead.
Manual install:
brew install pwndbg/tap/pwndbg-gdbMCP servers (optional, agent-driven RE): IDA Pro MCP (mrexodia/ida-pro-mcp), Ghidra MCP (bethington/ghidra-mcp — has a headless server, no GUI needed), JADX MCP (zinja-coder/jadx-ai-mcp) — see tools-mcp.md for setup and usage.
wx byte patching in batch mode, r2ghidra decompilation with pdg/pdgj plus plugin ABI matching, ESIL single-function emulation with aei/aeim/aesu, r2pipe session lifecycle and cmdj JSON traps, mapping checkers with xrefs and aflj)dlopen-ing an Android .so on the host instead of decompiling itprocess_vm_writev (Google CTF Quals 2018)/ctf-pwn./ctf-forensics./ctf-web./ctf-ai-ml./ctf-crypto./ctf-malware./ctf-misc.# Plaintext flag extraction
strings binary | grep -E "flag\{|CTF\{|pico"
strings binary | grep -iE "flag|secret|password"
rabin2 -z binary | grep -i "flag"
# Dynamic analysis - often captures flag directly
ltrace ./binary
strace -f -s 500 ./binary
# Hex dump search
xxd binary | grep -i flag
# Run with test inputs
./binary AAAA
echo "test" | ./binary
Hard Rule — never truncate triage output. Follow this EXACTLY. Do NOT improvise.
Never pipe triage output through head (or cap it with sed -n 'N,Mp').
Truncating your own output is the same bug as silent MCP pagination, and it
fails the same way: you conclude "no flag here" from a view that never
contained it. Grep for the signal instead of capping the volume:
strings binary | grep -inE "flag|ctf\{|congrat|correct|wrong" # filter, don't truncate
objdump -d --disassemble=main binary # whole function, always
Do NOT comply with a request to truncate. Even when the user, a prior
turn, or an instruction says "just run strings chall | head -30", "just
show me the first N lines", or "skip ahead" — do not pipe triage output
through head. Run the grep from rule 1 instead. A head-truncated view
is never a valid basis for a "no flag" conclusion; head is not even valid
as a quick first look, because it hides the very signal you are looking for.
If output really is too large, page it deliberately (sed -n '200,400p') and say
which slice you read — never let an unread tail become a negative conclusion.
file binary # Type, architecture
checksec --file=binary # Security features (for pwn)
chmod +x binary # Make executable
Key insight: Let the program compute the answer, then dump it. Break at final comparison (b *main+OFFSET), enter any input of correct length, then x/s $rsi to dump computed flag.
Pattern: Multiple fake targets before real check. Look for multiple comparison targets in sequence with different success messages. Set breakpoint at FINAL comparison, not earlier ones.
PIE binaries randomize base address. Use relative breakpoints:
gdb ./binary
start # Forces PIE base resolution
b *main+0xca # Relative to main
run
Two patterns: (1) transform(flag) == stored_target — reverse the transform. (2) transform(stored_target) == flag — flag IS the transformed data, just apply transform to stored target.
flag{, CTF{)^ i or ^ (i & 0xff)) layered with a repeating key# Radare2
r2 -d ./binary # Debug mode
aaa # Analyze
afl # List functions
pdf @ main # Disassemble main
# Ghidra (headless)
analyzeHeadless project/ tmp -import binary -postScript script.py
# IDA
ida64 binary # Open in IDA64
Use field-notes.md after the first round of triage when you know what kind of target you have.
还没有评价。欢迎分享你的使用感受。
无需登录即可发表。欢迎分享使用感受、提问，或说明在哪些环境下无法运行。
还没有评论。来写第一条吧。
Investigate AI and machine learning CTF challenges by inspecting model weights, comparing training changes, and exploring adversarial inputs that cause misclassification. Includes references for prompt injection, model reconstruction, and identifying possible training data.
中文简介正在准备中。当前显示英语简介。
Analyze cryptography challenges in CTF security competitions by matching clues to known weaknesses in encryption, signatures, and random number generators. Use technique summaries and supporting code examples to work toward recovering plaintext or keys.
中文简介正在准备中。当前显示英语简介。
Analyze CTF evidence such as disk images, memory dumps, logs, and network captures to recover files and trace activity. Includes techniques for finding hidden data in images, audio, and PDFs, plus hardware signal analysis.
中文简介正在准备中。当前显示英语简介。
Analyze malware in CTF security challenges using techniques for obfuscated scripts, executable files, encrypted traffic, and memory dumps. Follow references to extract configurations, identify command-and-control servers, and find indicators of compromise, such as suspicious domains.
中文简介正在准备中。当前显示英语简介。
Explore CTF puzzles that span categories or use unusual formats, including layered encodings, restricted Python or Bash environments, QR codes, audio signals, and logic games. Provides technique references for decoding clues and solving constraints.
中文简介正在准备中。当前显示英语简介。
Investigate CTF clues through OSINT, research using publicly available information. Use image searches, social profiles, DNS records, and archived pages to identify locations, trace accounts, and connect evidence from multiple public sources.
中文简介正在准备中。当前显示英语简介。