pico2024 FactCheck

Used Ghidra to display a decompiled version of the file. With that information, used GDB to set a breakpoint at the position in the program where the flag string had been built and displayed its contents.

[theblueview]

At 3:55 you recognize the values as ASCII, what in particular gave that away?

[wolfleader]

why is it that the breakpoint value is 0x8001860 when the memory addr shown in ghidra is different?

[ziomeq]

im sorry, but for me it's not clear, how did you know to use command x/8x $rax and that the flag will be there?