Executable Mapping Lab

How Programs WorkLab 1 of 260–90 minutesLab included

Hands-on lab

Mission

Inspect a supplied ELF executable, predict its live mappings from the program headers, run it, and compare that prediction with /proc. Recover the flag from the loadable-segment count and entry point.

Scope and artifact

Work only with the supplied artifact in the course VM. Download executable-mapping-v1.0.0.tar.

Expected archive SHA-256:

b34e1eab25c8d7bff3544c84c7fd86f5b9f1968889068f47dc8a7b7e2b8b82da

cd ~/Downloads
sha256sum executable-mapping-v1.0.0.tar
mkdir -p ~/underdunn-labs/executable-mapping
tar -xf executable-mapping-v1.0.0.tar -C ~/underdunn-labs/executable-mapping
cd ~/underdunn-labs/executable-mapping/executable-mapping-v1.0.0

Stop if the hash differs.

Investigation

Create an evidence table containing the command, relevant output, observation, and conclusion. Establish:

1. ELF class, machine, type, and entry point.
2. Every LOAD segment’s offset, virtual address, file size, memory size, and flags.
3. Which segment contains executable code.
4. Which segment gains zero-filled memory during loading.
5. The live mappings associated with the target.

Begin with file, readelf -h, and readelf -lW. Before running the binary, predict the permissions of its file-backed mappings.

Run the target in the background. It remains alive for two minutes so you can inspect it:

./mapping-target &
mapping_pid=$!
printf 'PID: %s\n' "$mapping_pid"

Compare its live executable mappings with your prediction:

grep "$(readlink "/proc/$mapping_pid/exe")" "/proc/$mapping_pid/maps"

When finished, clean up and confirm the process is gone:

kill "$mapping_pid"
wait "$mapping_pid"
ps -p "$mapping_pid"

Construct and verify the flag

Count entries whose program-header type is exactly LOAD. Record the entry point exactly as readelf -h prints it, including the 0x prefix. Construct:

UNDERDUNN{COUNT_load_ENTRY}

Use the decimal count, lowercase load, and lowercase hexadecimal characters. Expected flag SHA-256:

aac34495ec0308983e4cf20f63ea4f94c36c73c79dfe3d508cecf37ed3b0e571

printf '%s' 'UNDERDUNN{your_candidate}' | sha256sum

Hint 1: Which table?

Use the program header table, not the section table. Linux maps segments.

Hint 2: Counting

readelf -lW ./mapping-target prints one line for every LOAD entry. Count those exact type labels.

Finish and reset

Your evidence log must support both values used in the flag and explain why the writable segment’s memory size exceeds its file size. To reset, delete only the extracted executable-mapping-v1.0.0 directory with Ubuntu Files and extract the verified archive again.