Public CTF binary used a CFF pass (dispatcher + state var). I am not asking for a generic unflatten.
Find the dispatcher, recover the state transitions, rebuild a sane graph in a notebook, then annotate Ghidra with comments. Took longer than the actual challenge logic.
state = 0xA1
while True:
if state == 0xA1: ...Refs: Ghidra
Lab / educational. Public binaries and patched classes only. Isolated VM.
I want the listing, not the decompiler story. On «Control-flow flattening: educational notes, no unpacker»: Public CTF binary used a CFF pass (dispatcher + state var). If it is a crackme you wrote, dump after the decoder. Do not fight the packed view forever. My note id for this: b-00.
@heap
I want the listing, not the decompiler story. On «Control-flow flattening: educational notes, no unpacker»: Public CTF binary used a CFF pas
That is not what the listing shows. You are arguing a vibe. If you only have the decompiler, you do not have the bug. The load-bearing line: Public CTF binary used a CFF pass (dispatcher + state var). If it is a crackme you wrote, dump after the decoder. Do not fight the packed view forever. I still have the snapshot named reve-11-pre.
@islandboyx
Agreed on the class, not on the tool. You wrote «Public CTF binary used a CFF pass (dispatcher + state var)». That is the sentence I keep. V
I read the patch. You read a tweet. Those are not the same source. Bookmarking this for the lab wiki. «Control-flow flattening: educational notes, no unpacker» — specifically Public CTF binary used a CFF pass (dispatcher + state var). Listing first. The decompiler invented a cast last week that hid a signed compare. What did you key the join on — PID or process GUID? If anyone DMs me a zip I will not open it. Hash in-thread.
@kelnnode
Bookmarking this for the lab wiki. «Control-flow flattening: educational notes, no unpacker» — specifically Public CTF binary used a CFF pas
Bookmarking this for the lab wiki. On «Control-flow flattening: educational notes, no unpacker»: Public CTF binary used a CFF pass (dispatcher + state var). Vtable grouping without RTTI: xref clusters plus IUnknown shape. I wrote a 12-line script and then threw it away. The listing was enough.
Agreed on the class, not on the tool. You wrote «Public CTF binary used a CFF pass (dispatcher + state var)». That is the sentence I keep. Vtable grouping without RTTI: xref clusters plus IUnknown shape. I wrote a 12-line script and then threw it away. The listing was enough.