Program Anatomy Lab

How Programs WorkLab 2 of 22–3 hoursLab included

Hands-on lab

Mission

A stripped executable accepts one candidate string. Recover the accepted candidate and explain the comparison using ELF metadata, disassembly, runtime behavior, allocation evidence, and system calls.

Scope and artifact

The supplied binary inside your course VM is the complete authorized target. Download program-anatomy-v1.0.0.tar.

Expected archive SHA-256:

4cee7daa0ef31461fc74646d6f6a97b98856848354cf8e2eec7d78321bf210c3

cd ~/Downloads
sha256sum program-anatomy-v1.0.0.tar
mkdir -p ~/underdunn-labs/program-anatomy
tar -xf program-anatomy-v1.0.0.tar -C ~/underdunn-labs/program-anatomy
cd ~/underdunn-labs/program-anatomy/program-anatomy-v1.0.0

Phase 1: Establish identity and behavior

Record the artifact’s type, architecture, ELF type, entry point, segments, interpreter, and whether it is stripped. Run it with no argument, a one-character argument, and a six-character argument. Record exit codes with:

./anatomy-target test
printf 'exit=%s\n' "$?"

Form a hypothesis about the required input length before opening the disassembly.

Phase 2: Map the decision

Use objdump -d -Mintel ./anatomy-target | less. Symbols have been stripped, so names will not guide you. Find calls through the procedure linkage table for functions such as strlen, malloc, snprintf, puts, and free. Work outward from those known calls.

Build a control-flow sketch containing:

• the argument-count check;
• the candidate-length check;
• the comparison loop;
• accepted and rejected output paths;
• allocation and release of the output buffer.

The comparison transforms each input byte with one constant before comparing it with six stored bytes. Record the constant, the stored bytes, and the inverse operation needed to recover the candidate.

Phase 3: Confirm dynamically

Run your candidate and record the exact output. Then trace only the most relevant boundary behavior:

strace -o anatomy.trace -e trace=execve,brk,mmap,write,exit_group ./anatomy-target 'your-candidate'

Explain why the trace can prove which candidate was supplied and which output was written, but cannot by itself explain the internal byte-comparison loop.

Construct and verify the flag

Replace the punctuation separating the two candidate components with an underscore and place the lowercase result in the flag wrapper:

UNDERDUNN{first_second}

Expected flag SHA-256:

9a005d5fbebb3d3a66e629597d676b90912c9ac6f216d358ede195dc50a23f08

printf '%s' 'UNDERDUNN{your_candidate}' | sha256sum

Hint 1: Start with known library calls

The binary is stripped, but imported library names remain. The result of strlen leads toward the length and byte checks.

Hint 2: The operation reverses itself

The comparison uses XOR with one constant. Applying the same XOR constant to the stored byte recovers the original byte.

Hint 3: Recover all six bytes

Locate the six-byte constant array referenced by the loop, then XOR each byte with the immediate constant used on the candidate byte. Interpret the results as ASCII.

Completion standard

Submit an evidence log with commands, relevant output, observations, and conclusions. It must explain the accepted input, not merely present it. Include the ELF identity, control-flow sketch, encoded bytes, inverse transformation, successful execution, trace evidence, allocation lifetime, and matching flag hash.

Reset by deleting only the extracted program-anatomy-v1.0.0 directory and extracting the verified archive again. Cleanup requires no network service or background process.