TryHackMe Compiled Walkthrough: My First Time Decompiling a Program

Bybwright
TryHackMe Compiled Walkthrough Walkthrough showing decompiled main function

This TryHackMe Compiled walkthrough was a little different from the rooms I normally work through. Instead of enumerating a web server, exploiting a service, or digging through logs, I had to open a compiled program and figure out what was happening inside it.

More importantly, this was the first time I had ever decompiled a program to find a TryHackMe flag.

I have looked at source code plenty of times, but this was different. I wasn’t given the original source. I had a compiled binary and needed to work backward from it.

For that, I used Ghidra.

Starting the Binary Analysis in Ghidra

I created a new Ghidra project and imported the challenge binary. Ghidra identified it as an ELF executable and offered to analyze it.

For my first attempt, I didn’t change any of the analysis options. I simply used Ghidra’s standard defaults and let it perform its initial analysis.

Once the analysis completed, I opened the Symbol Tree and expanded:

Functions

There were a number of functions listed, but the one I was interested in was:

main

Finding main was the moment this challenge started making sense.

Finding main in Ghidra

When I opened main, Ghidra’s Decompiler displayed a C-like representation of the compiled program.

This was the part that really clicked for me.

Instead of trying to understand assembly instructions one at a time, I could see logic that looked surprisingly similar to normal C code.

One of the first interesting lines was:

__isoc99_scanf("DoYouEven%sCTF", local_28);

That immediately told me the program was accepting input and storing part of that input inside the local_28 variable.

Further down, I found several calls to strcmp().

One comparison was:

strcmp(local_28, "__dso_handle");

But another was much more interesting:

iVar1 = strcmp(local_28, "_init");

if (iVar1 == 0) {
    printf("Correct!");
}

That was the important discovery.

Understanding strcmp()

This challenge also gave me a practical reason to understand how strcmp() works.

In C, strcmp() compares two strings. When the strings are identical, it returns:

0

That means this condition:

if (iVar1 == 0)

will only reach the Correct! message when the value stored in local_28 matches the string being checked by the program.

At this point, the challenge had changed from guessing a password into understanding how the program expected its input to be formatted.

I won’t include the final flag or complete answer here, but the decompiled code provided everything necessary to determine the correct input.

The scanf Format Was the Real Clue

The most interesting part for me was realizing that finding the comparison string wasn’t quite enough.

The program wasn’t simply doing something like:

scanf("%s", local_28);

Instead, its format string contained literal text surrounding the %s conversion:

"DoYouEven%sCTF"

That meant I needed to think about how scanf() processed the supplied input and what portion would ultimately be placed into local_28.

This was a great example of why reverse engineering isn’t necessarily about finding a suspicious-looking string and submitting it.

You still have to understand the program’s logic.

My First Real Ghidra Win

This was a relatively small challenge, but it was one of those TryHackMe exercises where the technique was more valuable to me than the flag.

Before this, opening a compiled binary in Ghidra felt intimidating. There are functions, addresses, assembly instructions, symbols, variables with strange names, and an enormous amount of information on the screen.

But I didn’t need to understand everything.

The basic workflow was surprisingly straightforward:

Import binary
        ↓
Run Ghidra analysis
        ↓
Locate main()
        ↓
Open the Decompiler
        ↓
Identify input functions
        ↓
Follow string comparisons
        ↓
Understand the program logic
        ↓
Determine the expected input

That is the biggest lesson I’m taking away from this room.

You don’t always need to understand an entire binary. Sometimes you just need to find the program’s entry point, identify where user input goes, and follow that data until you reach the decision that determines success or failure.

For my first time using Ghidra to decompile a program and recover a TryHackMe flag, I’ll call that a win.

And now Ghidra doesn’t look nearly as intimidating as it did before.

Similar Posts