labs

Labs

Weekly hands-on lab. RE walkthroughs, exploits, original CTFs. Done in a sandbox.

labs

May 1, 2026 · 23 min solve · beginner

Twenty-five bytes of /bin/sh: picoCTF 2019 "Handy Shellcode" the long way

Handy Shellcode is the picoCTF 2019 challenge that hands you the gun and the bullets — an x86 ELF that allocates an RWX page, reads your input straight into it, and calls it. The interesting part isn't the jump. The interesting part is sitting down with `as`, a stack diagram, and a memory of Aleph One, and writing the 25 bytes that turn that pointer into a shell — by hand, with no libraries.

— twenty-five bytes is plenty

Apr 24, 2026 · 28 minsolve · advanced

FlipVM: a tiny ISA that pretends to forget everything between instructions

A 29 KB statically-linked ELF ships next to a 27 KB blob of bytecode on crackmes.one — advertised as "a virtual machine with unique architecture and basic encryption at rest." This post takes the machine apart and rebuilds enough of it in Python to disassemble the blob and re-implement the mutation function the guest program uses to test its "customer password." The trick: almost every instruction is allowed to XOR the entire VM state with a one-byte broadcast before it executes, and the guest program uses that to run with a key that changes hundreds of times per function.

— machine forgets, we remember

Apr 24, 2026 · 6 minsolve · beginner

Shake It, Baby — An Encoding That Isn't

A "difficulty 1.6" Linux ELF from crackmes.one. The binary swaggers in with two dozen cryptic strings and a custom "decoder" function, but every decoy is a plant — the real password sits in plain sight, spelled out twice in a hex alphabet that `printf "%x"` reverses in a line.

— hex is not a disguise