However, its existence is not apparent because the code is encrypted and obfuscated. In fact, in challenge 5, RC6 is used to decrypt the final flag. If two Binary Ninja users discuss the Flare-On challenge this year, the word “RC6” will pop up. It can help me discover important things in the code, and the next section is a great example. More importantly, combining BN with the TTD in WinDbg as opposed to just working with the trace in WinDbg, I can see the beautiful control-flow graph and decompiled HLIL when I explore the trace. Also, if I miss a breakpoint or step over when I should step into, I don’t need to restart the target but can rewind instead. Now, I have a deterministic debugging experience where the addresses never change. The main difference from normal debugger usage is that you need to select a different debug adapter, DBGENG_TTD(BETA), and set the *.run replay file generated by WinDbg as the executable path:

Please refer to our TTD documentation for a setup guide.

To address this, I leveraged WinDbg TTD (time-travel debugging) to record an execution trace and replay it within Binary Ninja’s debugger. It is thus hard to debug the decrypted code since previous breakpoints would be off.

While it is easy to follow the decryption routine, dump the decrypted code, and then analyze it, the address of the allocated buffer could vary on each execution. The first problem I encountered was that the binary had a blob that was decrypted and executed at runtime. Fixating the Addresses with TTD Record/Replay The first challenge we’ll take a look at is the fifth of the thirteen challenges, where_am_i. Thanks to Mandiant and the Flare-On team for another great event! 5th – where_am_i If you wish to read full write-ups, I recommend you refer to the official solutions published by Mandiant. I will put more focus on the obfuscation rather than the validation algorithm. In this write-up, I will discuss two challenges (5th and 13th) and share how Binary Ninja can easily tackle obfuscated code. As a long-time player, I was very excited to complete all challenges in just over a month. This year, while celebrating the 10th sequel of the event, the organizers set “a new standard for difficulty and creativity” (words from last year’s challenge solutions). The Flare-On challenge is the Olympics for reverse engineers.

Free downloads Binary Ninja 3.5.4526