ctf-reverse

CTF reverse engineering

In-depth reference

The following reference materialsLoad on demand, select the corresponding file based on the specific direction identified:

• Static analysis tools (GDB/Ghidra/radare2/IDA/WASM/APK/.NET) → references/tools.md
• Dynamic analysis tools (Frida/angr/lldb/Qiling/Triton) → references/tools-dynamic.md
• Advanced tools (VMProtect/BinDiff/deobfuscation/Rizin/patching) → references/tools-advanced.md
• Anti-analysis countermeasures (Linux/Windows anti-debugging/anti-VM/anti-DBI/code integrity) → references/anti-analysis.md
• Language features (Python bytecode/Lua/WASM/.NET IL/Solidity) → references/languages.md
• Compiled languages (Go/Rust/Swift/Kotlin/C++/D/Nim) → references/languages-compiled.md
• Platform-specific (embedded firmware/macOS Mach-O/Android/Flutter/HarmonyOS) → references/platforms.md
• Language and platform combined → references/languages-platforms.md
• Reverse engineering patterns (verification/encoding/maze/virtual machine/game engine) → references/patterns.md
• CTF reverse engineering patterns Part1 (custom encryption/matrix/Brainfuck JIT) → references/patterns-ctf.md
• CTF reverse engineering patterns Part2 (constraint solving/side-channel/obfuscation transformation) → references/patterns-ctf-2.md
• CTF reverse engineering patterns Part3 (Z3 Boolean circuit/sliding window Popcount/multi-step encryption) → references/patterns-ctf-3.md
• Runtime patching and Oracle (anti-analysis Patch/multi-stage Shellcode) → references/patterns-runtime.md
• CTF anti-analysis in practice (SIGILL/SIGFPE/ptrace timing/junk instructions) → references/anti-analysis-ctf.md
• Emulation and side-channel tools (Qiling/Triton/Unicorn/instruction counting) → references/tools-emulation.md
• Hardware and special architectures (HD44780 LCD/RISC-V/FPGA/custom ISA) → references/platforms-hardware.md
• Reverse engineering practical notes (binary type quick reference/anti-debugging bypass/common patches) → references/field-notes.md

---

Classification decision tree

拿到逆向题？
├─ 识别文件类型: file binary
│  ├─ ELF → GDB + Ghidra
│  ├─ PE/DLL → x64dbg + IDA
│  ├─ Mach-O → lldb + Hopper
│  ├─ APK → apktool + jadx (Flutter → Blutter)
│  ├─ .NET → dnSpy / ILSpy
│  ├─ Python .pyc → uncompyle6 / decompyle3
│  ├─ WASM → wasm-decompile / wasm2wat
│  └─ 未知 → binwalk + strings + hexdump
├─ 分析策略
│  ├─ 静态优先 → Ghidra反编译 → 找 main/check 函数
│  ├─ 动态辅助 → GDB断点 / Frida hook
│  ├─ 符号执行 → angr（自动探路）
│  └─ 反混淆 → D-810 / GOOMBA / Miasm
├─ 有反调试？ → [references/anti-analysis.md](references/anti-analysis.md)
│  ├─ ptrace → LD_PRELOAD hook
│  ├─ /proc/self/status → 修改返回值
│  └─ 时间检测 → 跳过或 patch
└─ 常见模式
   ├─ 逐字符校验 → 逐字节爆破/约束求解
   ├─ 矩阵变换 → numpy/Z3 逆运算
   ├─ 自定义VM → 提取opcode表 → 反汇编
   └─ 迷宫 → BFS/DFS 自动求解

Quick start commands

# 基础分析
file binary && checksec binary
strings -n 6 binary | grep -iE "flag|pass|correct"
objdump -d binary | head -100

# GDB 调试
gdb -q binary -ex 'b main' -ex 'r'

# Ghidra 无头分析
analyzeHeadless /tmp/proj proj -import binary -postScript ExportDecompiled.java

# angr 符号执行
python3 -c "
import angr
p = angr.Project('./binary')
s = p.factory.entry_state()
sm = p.factory.simgr(s)
sm.explore(find=0x TARGET_ADDR)
print(sm.found[0].posix.dumps(0))
"

Common anti-debugging bypasses

Technique	Bypass method
ptrace(PTRACE_TRACEME)	LD_PRELOAD hook returns 0
/proc/self/status	Modify TracerPid
Time detection	patch out rdtsc/clock
IsDebuggerPresent (Win)	PEB.BeingDebugged = 0

Tool quick reference

Tool	Purpose
Ghidra	Free decompiler (supports multiple architectures)
GDB + pwndbg	Linux dynamic debugging
Frida	Runtime hook (cross-platform)
angr	Symbolic execution engine
dogbolt.org	Online multi-decompiler comparison