0xv1n.github.iowriteupReversing ELFs on TryHackMe: Part 1
A walkthrough of four TryHackMe "crackme" ELF reversing challenges, progressing from simple execution and `strings` analysis, to decoding a base64-encoded password, to using GDB with the pwndbg plugin to set a breakpoint at `strcmp@plt` and read the hidden password directly out of the RAX/RDI registers. It demonstrates basic static (strings, chmod +x) and dynamic (disassembly with `disass`, breakpoints, register inspection) reverse-engineering workflow on x86-64 Linux binaries.
TL;DR Beginner walkthrough reversing four TryHackMe ELF crackmes using strings, base64, and GDB/pwndbg breakpoints to recover hidden passwords.
Technologies named here
Techniques named here
- Static analysis via string extraction
- Base64 decoding of encoded credentials
- Breakpoint-based dynamic analysis
- Disassembly of target function
- Register/stack inspection for hidden secrets
Related in Malware & RE
huntress.comwriteupReverse Engineering the Six Stages of MacSync Stealer and RAT
huntress.comwriteupPost-DEF CON Phishing Uses Malicious Google Doc to Deliver Malware
huntress.comwriteupClickFix Removes Your Background but Leaves the Malware
