[0CTF/TCTF qualifiers 2020] Happy Tree
We are greeted with a binary file download and an initial investigation with file reveals a 32-bit ELF binary (stripped, of course):
➜ file happy_tree happy_tree: ELF 32-bit LSB pie executable, Intel 80386, version 1 (SYSV), dynamically linked, interpreter /lib/ld-linux.so.2, for GNU/Linux 3.2.0, BuildID[sha1]=fd7f1b2d769e389444cc6eea0f801be7ebc6a7e4, stripped Upon opening the binary with my favourite disassembler, some unusual things reveal themselves:
IDA is unable to find the main entrypoint (not that unusual, but more on that later) Address calculations seemed to be done in some sort of relative manner.