dreamhack.io Dreamhack wargames 21 posts reversing.kr Reverse engineering challenges 20 posts pwnable.kr Binary exploitation wargames 5 posts
All posts
2026.08.18basic_heap_overflowNo PIE fixes the address of get_shell, so a 28-byte heap overflow is enough to redirect execution.dreamhackPwn2026.08.18awesome-basicsA textbook stack overflow: an 80-byte buffer read with 0x80, overwriting RIP to jump into shellcode.dreamhackPwn2026.08.18Sigreturn-Oriented Programming (SROP)Notes on SROP: forging a sigcontext frame so a single sigreturn sets every register at once.dreamhackPwn2026.08.18cherrystrncmp only checks the first six bytes, so the rest of the overflow is free to reach the return address.dreamhackPwn2026.08.18mmappedOverflow the length argument to mprotect so the real flag page is never protected before it is written out.dreamhackPwn2026.08.18validatorNX disabled and a writable GOT, so the shellcode is written directly into the GOT and jumped to.dreamhackPwn2026.08.18off_by_one_000A single byte past the end of the buffer is enough to shift the saved frame pointer and take control.dreamhackPwn2026.08.18ssp_000Stack canary present, so the exploit reads it out first and writes it back in place during the overflow.dreamhackPwn2026.08.18memory_leakageA struct read back without clearing it first leaks adjacent heap memory field by field.dreamhackPwn2026.08.18basic_exploitation_003A 32-bit binary with no canary and no PIE, exploited by overflowing into the return address.dreamhackPwn2026.08.18Exploit Tech: __environFull RELRO and PIE, so the stack address is leaked through the environ pointer in libc instead.dreamhackPwn2026.08.18hookThe binary is linked with -z norelro, leaving the init/fini arrays writable and hijackable.dreamhackPwn2026.08.18sintA signed comparison lets a negative length through, which then becomes a huge unsigned size in the copy.dreamhackPwn2026.08.18Return to Library (RTL)NX blocks shellcode, so the return address goes to a libc function instead. PIE is off, so the offsets hold.dreamhackPwn2026.08.18Return to ShellcodeA canary blocks a direct return overwrite, but the stack is executable, so the shellcode goes there.dreamhackPwn2026.08.18oneshot46 bytes into a 16-byte buffer, with a leaked stdout address turning a one-gadget into a working shell.dreamhackPwn2026.08.18dreamhack.io Reversing Basic Challenge #6Static analysis in IDA of a routine that checks user input character by character.dreamhackReversing2026.08.18send_sigThe program forwards a signal number straight to the kernel; the exploit is choosing the right one.dreamhackPwn2026.08.18cmd_centerA 24-byte name buffer read with 100 bytes, overflowing into the command string passed to system().dreamhackPwn2026.08.18dreamhack.ioprintf(buf) instead of printf("%s", buf) - a format string bug turned into a GOT overwrite.dreamhackPwn2026.08.18mistakeOperator precedence: the result of the comparison lands in fd instead of the file descriptor from open().pwnable-krPwn2026.08.18[randomrand() is never seeded, so it returns the same value every run and the password is a fixed constant.pwnable-krPwn2026.08.18bofA stack canary blocks the naive overflow, so the write has to be placed around it rather than through it.pwnable-krPwn2026.08.18[collisionTwenty input bytes are read as five ints and summed; any five values adding to 0x21DD09EC pass the check.pwnable-krPwn2026.08.18[fdatoi(argv[1]) - 0x1234 becomes a file descriptor, so passing 4660 makes the program read from stdin.pwnable-krPwn2026.08.18PEPasswordA packed PE unpacked first, then the password-check and decryption paths traced in the original binary.reversing-krReversing2026.08.18SimpleVMA tiny bytecode VM validating the key; solving it means understanding the instruction set and running it backwards.reversing-krReversing2026.08.18Direct3D FPSA Direct3D game where the win condition is reached by patching the check rather than playing it.reversing-krReversing2026.08.18WindowKernelA Windows kernel driver reading the keyboard port directly, communicating over IOCTL rather than user-mode input.reversing-krReversing2026.08.18AutoHotkey2UPX-packed and reporting "exe corrupt"; the CRC routine has to be debugged in the original, not the unpacked, file.reversing-krReversing2026.08.18x64 LottoA lottery check decompiled in IDA, where the comparison can be satisfied without guessing the numbers.reversing-krReversing2026.08.18AutoHotkey1An AutoHotkey-compiled binary: recovering the DecryptKey and the EXE key, then combining them into the AuthKey.reversing-krReversing2026.08.18HateIntelThe binary is for a non-Intel architecture and will not run, so the whole solve is static analysis in IDA.reversing-krReversing2026.08.18Flash EncryptA SWF file observed dynamically by embedding it in a page, rather than decompiling the ActionScript.reversing-krReversing2026.08.18Easy UnpackFinding the original entry point of a packed binary and dumping it once the unpacking stub has run.reversing-krReversing2026.08.18ImagePcrThe program compares a drawing against a bitmap held in its resources; the flag is the image it expects.reversing-krReversing2026.08.18MultiplicationA Java jar with an anti-decompiler trick that breaks JD-GUI, read with CFR instead. The bug is a long overflow.reversing-krReversing2026.08.18CSHOPA .NET binary that no debugger would open, read instead as IL through a .NET decompiler.reversing-krReversing2026.08.18RansomwareBroken output until the code page is fixed, then recovering the key the sample uses to encrypt and restore files.reversing-krReversing2026.08.18Easy ELFA small Linux ELF that XORs input against a fixed table before comparing it to the stored password.reversing-krReversing2026.08.18ReplacePatching the compare instruction so any input is accepted, which reveals the stored password.reversing-krReversing2026.08.18PositionThe serial depends on the position of each character of the name, so the keygen has to invert that mapping.reversing-krReversing2026.08.18Music PlayerTiming check in a media player: the program has to believe the track played to the end.reversing-krReversing2026.08.18EASY KEYGENReversing the serial routine and reimplementing it as a keygen that produces a valid serial for any name.reversing-krReversing2026.08.18EASY CRACK MEBreakpointing the comparison in x32dbg and reading the expected password out one character at a time.reversing-krReversing2026.07.17tcache_dupA double free puts the same chunk in the tcache list twice, so a later malloc hands back a pointer we control.dreamhackPwn