> For the complete documentation index, see [llms.txt](https://simon-6.gitbook.io/simoncyber/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://simon-6.gitbook.io/simoncyber/ctf-writeups/picoctf-2024/reverse-engineering/winantidbg0x100-medium.md).

# WinAntiDbg0x100 (Medium)

<figure><img src="/files/8XaHGY0zsLOChd2i1qBj" alt=""><figcaption></figcaption></figure>

***

Despite this being a Windows challenge, we'll probably need to use Ghidra or something like that.&#x20;

The first thing to do is to search for functions related to flag in Ghidra.&#x20;

<figure><img src="/files/Dxi3XieI2WyPHQzmXZXe" alt=""><figcaption></figcaption></figure>

Once we search, we can find the function in question:

<figure><img src="/files/9kzgFb9o2lY2ocokKdvh" alt=""><figcaption></figcaption></figure>

{% hint style="info" %}
Instead of using Ghidra, you can use a Decomplier online such as <https://dogbolt.org/> for files under 2mb
{% endhint %}

Here is the code:

```c
undefined4 FUN_00401580(void)

{
  uint uVar1;
  int iVar2;
  BOOL BVar3;
  LPWSTR lpOutputString;
  undefined in_stack_fffffff4;
  
  uVar1 = FUN_00401130();
  if ((uVar1 & 0xff) == 0) {
    FUN_00401060(PTR_s________________________(_)_/_____00405020,in_stack_fffffff4);
    FUN_00401060("### To start the challenge, you\'ll need to first launch this program using a debu gger!\n"
                 ,in_stack_fffffff4);
  }
  else {
    OutputDebugStringW(L"\n");
    OutputDebugStringW(L"\n");
    FUN_004011b0();
    iVar2 = FUN_00401200();
    if (iVar2 == 0) {
      OutputDebugStringW(L"### Error reading the \'config.bin\' file... Challenge aborted.\n");
    }
    else {
      OutputDebugStringW(
                        L"### Level 1: Why did the clever programmer become a gardener? Because they  discovered their talent for growing a \'patch\' of roses!\n"
                        );
      FUN_00401440(7);
      BVar3 = IsDebuggerPresent();
      if (BVar3 == 0) {
        FUN_00401440(0xb);
        FUN_00401530(DAT_00405404);
        lpOutputString = FUN_004013b0(DAT_00405408);
        if (lpOutputString == (LPWSTR)0x0) {
          OutputDebugStringW(L"### Something went wrong...\n");
        }
        else {
          OutputDebugStringW(L"### Good job! Here\'s your flag:\n");
          OutputDebugStringW(L"### ~~~ ");
          OutputDebugStringW(lpOutputString);
          OutputDebugStringW(L"\n");
          OutputDebugStringW(
                            L"### (Note: The flag could become corrupted if the process state is tam pered with in any way.)\n\n"
                            );
          free(lpOutputString);
        }
      }
      else {
        OutputDebugStringW(
                          L"### Oops! The debugger was detected. Try to bypass this check to get the  flag!\n"
                          );
      }
    }
    free(DAT_00405410);
  }
  OutputDebugStringW(L"\n");
  OutputDebugStringW(L"\n");
  return 0;
}


```

The goal of this challenge is to essentially bypass all the if statements.

```
  uVar1 = FUN_00401130();
  if ((uVar1 & 0xff) == 0) {
    FUN_00401060(PTR_s________________________(_)_/_____00405020,in_stack_fffffff4);
    FUN_00401060("### To start the challenge, you\'ll need to first launch this program using a debu gger!\n"
                 ,in_stack_fffffff4);
```

It calls FUN\_00401330() and checks if it equals to 0, if not it continues. Keep in mind & is the bitwise operator, not the "and".&#x20;

```
BVar3 = IsDebuggerPresent();
      if (BVar3 == 0) {
        FUN_00401440(0xb);
        FUN_00401530(DAT_00405404);
        lpOutputString = FUN_004013b0(DAT_00405408);
        if (lpOutputString == (LPWSTR)0x0) {
          OutputDebugStringW(L"### Something went wrong...\n");
        }
        else {
          OutputDebugStringW(L"### Good job! Here\'s your flag:\n");
          OutputDebugStringW(L"### ~~~ ");
          OutputDebugStringW(lpOutputString);
          OutputDebugStringW(L"\n");
          OutputDebugStringW(
                            L"### (Note: The flag could become corrupted if the process state is tam pered with in any way.)\n\n"
                            );
          free(lpOutputString);
        }
      }
      else {
        OutputDebugStringW(
                          L"### Oops! The debugger was detected. Try to bypass this check to get the  flag!\n"
                          );
      }
    }
    free(DAT_00405410);
  }
```

&#x20;BVar3 stores a boolean value, which calls the function IsDebuggerPresent(). If Bvar3 is True, it calls some functions and outputs an error.  (We need Bvar3 to be 1) Next, we need to have the output string = to "LPWSTR".&#x20;

<figure><img src="/files/jwveNQIzIcsdZMWXItZf" alt=""><figcaption></figcaption></figure>

If we highlight the code here, it runs "TEST" on EAX (or itself). TEST is the bit wise AND operator in assembly, so it essentially produces a result of either 1 or 0. If the result is 0, it pushes the debugger comment, but continues if it's 1. "TEST" updates the **Zero Flag,** which is kind of a like in a switch in the program (not a variable). Anyways, the next command, JZ, is "Jump if Zero Flag". Essentially, it will jump to the function if the Zero Flag is 1.&#x20;

***

### Solving It

For this we'll be using&#x20;

<https://www.youtube.com/watch?v=Q3rRt_Ird-8>