Challenge

We’re given a binary that implements a custom stack-based esoteric language interpreter. The program reads a sequence of instructions and executes them against an internal stack, then checks whether the resulting state matches the expected flag bytes.

Approach

  1. Load the binary in Ghidra and identify the main dispatch loop — a large switch on single-byte opcodes.
  2. Map out the semantics of each opcode: PUSH <byte>, POP, DUP, ADD, XOR, CMP, JNE, etc.
  3. Extract the embedded bytecode from the .data section.
  4. Write a Python emulator that traces execution, collecting the sequence of CMP operands — these are the expected flag bytes.
  5. Reassemble bytes in order.

Solution

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16

bytecode = [...]  # extracted from binary

stack = []
flag = []
pc = 0
while pc < len(bytecode):
    op = bytecode[pc]
    if op == 0x01:   # PUSH
        pc += 1
        stack.append(bytecode[pc])
    elif op == 0x05: # CMP (peek top vs next byte)
        pc += 1
        flag.append(bytecode[pc])
    pc += 1

print(bytes(flag).decode())

Running the emulator prints the flag.

Flag

boroCTF{r3verse_by_guessncheck}