> For the complete documentation index, see [llms.txt](https://simon-6.gitbook.io/simoncyber/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://simon-6.gitbook.io/simoncyber/ctf-writeups/picoctf-2025/reverse-engineering/binary-instrumentation-1-medium.md).

# Binary Instrumentation 1 (Medium)

<figure><img src="/files/8I1MpFbOQ3lgSRa4n9oH" alt=""><figcaption></figcaption></figure>

***

The first thing I usually do is to run binwalk and strings on the file. This time I didn't get anything too meaningful. If that doesn't work the next thought would be to run through Ghidra to see if there's anything weird going on with the source code.&#x20;

<figure><img src="/files/UolNmq2sAkRLZaSv4vYp" alt=""><figcaption></figcaption></figure>

There doesn't seem to be any sign in the source code either. I pressed the hint and it told me to download the "Frida" tool.&#x20;

***

> The frida-tools package provides a set of command-line utilities that expose Frida's powerful instrumentation capabilities through an easy-to-use interface. These tools enable tasks such as:

From what I see, Frida is used a lot within interactive code and androids. It provides a lot of tools so I'm sure it more than that, but that just a guess.

The second hint told to use frida-trace. Since I didn't know what to trace, I tried to execute the exe through my host OS. (didn't download wine since it took too much space...)&#x20;

<figure><img src="/files/8bjM3AkCBTvDsYDxLSV9" alt=""><figcaption></figcaption></figure>

After fighting with windows antivirus, the exe managed to print this. Since the description of the challenged noted use of a Windows API, this might have to be with the sleep() function.

> The Windows API Sleep function suspends the execution of the current thread for a specified time interval, measured in milliseconds. It is commonly used to delay program execution or to manage timing in applications

Knowing this, we could then use frida to somehow hack into it.

***

Frida has many functions but I'll list the most commonly used.

```
frida-ps        # Local processes
frida-ps -U     # USB-connected device (Android/iOS)
frida-ps -D     # Specific device

frida -l script.js <process-name>
frida -U -l script.js -f com.example.app

frida-trace -i "function_name" <process>
frida-trace -U -f com.app -i "Java.perform"

-U - Use USB device (for mobile)
-l - Load script file
-f - Spawn/launch application
-p - Attach to process by PID
--no-pause - Don't pause on spawn
-o - Output to file
-D - Device ID
```

Knowing this, we could this try command:

<figure><img src="/files/NqoCURvsPO25eWD52jSH" alt=""><figcaption></figcaption></figure>

To be honest, I'm not sure why it doesn't work. I tried other commands but it just didn't seem to budge, so I tried other ways.

### Solution

Although this didn't use frida, I thought of using binwalk to further extract the exe file since they tend to include more than just the exe file itself.

Once extracted, you can see there's 2 different files.

<figure><img src="/files/DMvgSv7r5gIhEFOXOzAB" alt=""><figcaption></figcaption></figure>

I cat 6000, and right there, it was the flag in base64!

<figure><img src="/files/JPuPPDDwTjkNe6QJ0LXG" alt=""><figcaption></figcaption></figure>

Kind of anticlimactic but we solved it.&#x20;