Forbidden executable
100 points Hard

Hey, I've got tiny binary, I cannot reverse it, even debug it till its end, but running it outside debugger causes no trouble. I'm wondering what is the value of ECX register when the program exits ? Provide it as decimal value in format CTFlearn{XXX}. Program is well written and not cause any exceptions or access violations in normal execution.

impossible_disasm.exe
Flag
Reverse Engineering ยท domin568
37 solves
Rating 4.23
5
4
3
2
1
Must solve to rate

Discussion

avatar
Davidpb

4 months ago

Reply Share
Protected
0
avatar
Canlex

2 years ago

Reply Share
Protected
0
avatar
EaZyq

3 years ago

Reply Share

flag is the value in cx not ecx?

1
avatar
Ichild

3 years ago

Reply Share

Not much fun, but this program's really amazing, it's so delicate.

0
avatar
Rivit

4 years ago

Reply Share

Educating, interesting, learned a lot of new cool stuff. Thanks!

1
avatar
Caillou

4 years ago

Reply Share
Protected
-1
avatar
b4el7d

4 years ago

Reply Share

i think this EXE contains trojan Zpevdo.A Check this file.

0
avatar
domin568

4 years ago

Reply Share

False positive, maybe because there are anti debug tricks out there.

0
avatar
Caillou

4 years ago

Reply Share

The file is safe. Did the same alerts perhaps du to signature.

0
avatar
Tearth

4 years ago

Reply Share
Protected
0
avatar
Caillou

4 years ago

Reply Share
Protected
0
avatar
domin568

4 years ago

Reply Share

Yeah, I cannot change it, there is no such possibility for me as challenge onwner. If somebody sees it from administration please change ECX to CX in challenge description.

2