CTF Write‑up – “HUDSight” (Binary Reversing / Cracking Challenge)
Category: Reverse Engineering / Cracking
Points: 300 (typical mid‑range)
Difficulty: Medium – requires basic static & dynamic analysis, a bit of patching, and understanding of simple anti‑debug tricks.
| Tool | Command | Observations |
|------|---------|--------------|
| file | file hudsight | ELF 64‑bit LSB executable, dynamically linked (glibc 2.31). |
| checksec | checksec --file=hudsight | No RELRO, No PIE, NX enabled, No Stack canaries. |
| strings | strings -a -n 5 hudsight \| grep -i flag | No obvious flag or key. |
| objdump -h | objdump -h hudsight | 6 sections, .text starts at 0x400560. |
| readelf -l | readelf -l hudsight | Entry point: 0x400560. |
| ltrace | ltrace -e printf ./hudsight | Shows printf("Enter secret: "); then a call to gets. |
| strace | strace ./hudsight | No external files opened – pure in‑memory logic. |
The binary reads a line with gets (dangerous) into a global buffer (buf[64]). hudsight cracked
Darktable is a powerful, free, open‑source RAW processor with tethering support. It includes:
Completely free, no cracks required.
Adobe Lightroom’s tethered capture includes grid overlays, aspect ratio guides, and focus peaking (though not as advanced for stacking). It’s subscription‑based ($9.99/mo with Photoshop), but you also get a 7‑day free trial. Canon EOS Utility
If the constant were hidden (e.g., XOR‑ed), one could patch the binary to always jump to the success path:
# Replace the `jne` at 0x4d8 with `jmp 0x4e2` (the success branch)
r2 -w hudsight
[0x004004d8]> wa jmp 0x4e2
[0x004004d8]> wq
Running the patched binary would then accept any input.
Hudsight is a lightweight Windows and macOS application designed for photographers,显微摄影师 (microscopy photographers), and videographers. Its core features include: 显微摄影师 (microscopy photographers)
It works as an overlay on top of any camera’s tethering software (e.g., Canon EOS Utility, Lightroom tether, or OBS Studio). Many macro shooters rely on it for focus stacking.
gets into a 64‑byte global buffer.cmp of the first 8 bytes against a hard‑coded constant.0xdeadbeefdeadbeef.\xef\xbe\xad\xde\xef\xbe\xad\xde.printf.The official Hudsight website offers a fully functional trial (usually 14–30 days). No cracks, no malware. Use it to decide if the full version is worth $19–$29.
Linux x86‑64 uses little‑endian, so the bytes need to be supplied in reverse order:
0xef be ad de ef be ad de (hex)
If we feed these exact eight bytes (followed by a newline) the check will pass.