Codegate CTF ReverseMe 200pts Write-up
This task is really challenging as it contains some anti-reversing related stuff.\nI grabbed the binary and threw it in olly and .....Ooops ..it just quits immediatly .\n\n At first , I was stuck for minutes .because the binary is supposed to be landing on the entry point .\nThen after googling up , I figured out that the moment when the debugger attaches to it the binary purposefully hits the ret instructions because of the TLS callback .\n\nWell TLS stands for Thread Local Storage , it is section that resides in an executable that contains data variables particular to each thread and addresses of some functions (callbacks ) .\nThe windows loader ensures that the TLS section gets executed before it reaches the OEP of the program . Due to the fact that TLS gets executed first , task author managed to add some anti-debugging code in it ,therefore the debugger will not have a chance to hit the entry point .\n\nTo work this out , we need to use TLScatch plugin by waleed assar , which is used to set a breakpoints on TLS callbacks ,so that the debugger would be able to stop on the callback functions.\n\nI re-opened the binary in olly and to started to check its behaviour .I noticed the presence of some anti-debugging techniques have been implemented in it .\n