Behind The Scenes

Interacting with the File

After downloading the file if we interact with it, it requires a password:

└─$ ./behindthescenes             
./challenge <password>

Getting Strings

We could hope to spot a password inside defined strings of executable.

strings behindthescenes
---SNIP---
./challenge <password>
---SNIP---

We can see strncmp, strlen meaning the password is definitely being compared to some stored string. But we don’t see the password exposed.

Let’s open it in Ghidra and get a better look at the executable.

Running Ghidra

This is what the decompiled entry point look like:

The most interesting part of the decompiled main is:

pcVar1 = (code *)invalidInstructionException();

It corresponds to UD2 assembly call and what’s even more interesting is that nothing after this assembly call is disassembled. Let’s figure out what this operation is.

Understanding what UD2 is

UD2 is the mnemonic for the Undefined Instruction opcode 0F 0B in x86 assembly. When the CPU executes it, it unconditionally raises the processor’s invalid-opcode exception (#UD) . UD2 is explicitly reserved for this purpose; it does not read or modify any registers or memory other than causing the exception. Because the saved instruction pointer points to the UD2 itself, an exception handler can easily identify where the fault occurred.

Typical uses:

• Software testing / debugging – force an exception to verify the exception-handling path.
• Marking unreachable code – compilers insert UD2 after code they “know” can never be reached (e.g., after a noreturn call, or when undefined behaviour is detected) so that incorrect control flow crashes immediately instead of continuing silently .
• Halt or panic – operating-system kernels use it when they decide the system must stop.
• Anti-disassembly tricks – binaries sometimes place UD2 to confuse disassemblers .

We could conclude that UD2 was placed to confuse any disassembly operation.

Disassembling the rest

We will select the assembly afterwards and disassemble rest of it.

After disassembling we can see 4 strncmp calls that expose a combination of 4 separate strings. Itz******UD2 should give you the flag.

---