Lesson pack 11 · Core · 120 minutes
Reverse engineering
Get from an unknown executable to the one function that decides whether your input is right, and recognise which of four shapes the check takes.
Print this page for a paper plan - the navigation and links drop out.Student-facing version
Before the session
- Nothing to install. Students need a browser and https://ctfpal.com. Confirm the room can reach it once; after that it works offline.
- Read the lesson yourself first - about 16 minutes.
- Have one worked example ready to paste. The classroom link builder on the instructor page turns it into a URL that opens preloaded.
Objectives
Written as things a student can do afterwards, so they can be assessed rather than asserted.
- Establish format, architecture and whether a binary is stripped, and say what each implies
- Use strings and cross-references to find the check function without reading from main
- Classify a flag check as direct comparison, transform-then-compare, hash-then-compare, or a constraint system
- Invert a transform-then-compare check using the constants already in the binary
- Say when a decompiler helps and when its output is a reconstruction to be distrusted
Running order (120 min)
| Time | What happens |
|---|---|
| 0:00-0:12 | Frame the problemWhat the category looks like when you meet it cold, and why the naive approach fails. |
| 0:12-0:36 | Teach the methodThe technique itself, on the board or from the lesson. No tools open yet. |
| 0:36-1:06 | Demonstrate liveSame technique, in the workspace, on your worked example. Narrate every choice. |
| 1:06-1:48 | Practice setStudents work the challenges. Circulate rather than present. |
| 1:48-2:00 | Checkpoint and wrapCollect the artefact, name what comes next. |
Tools used
- ELF, PE and Mach-O binary analyzer - Parse headers, sections, imports, and symbols from Linux, Windows, and macOS binaries, with C++ symbol demangling and gadget discovery.https://ctfpal.com/?tool=elf-pe-analyzer
- Strings extractor for binaries and blobs - Pull printable ASCII and UTF-16 strings out of any file, filtered by length, with flag-pattern highlighting.https://ctfpal.com/?tool=strings-extractor
- ROP gadget finder - Search a binary for return-oriented programming gadgets, filter by the registers they touch, and exclude ones containing bad bytes.https://ctfpal.com/?tool=rop-gadget-finder
- Java .class disassembler - Disassemble JVM bytecode, read the constant pool, and recover strings and logic from .class and .jar files.https://ctfpal.com/?tool=java-class-disassembler
- Python .pyc bytecode disassembler - Disassemble compiled Python, read code objects and constants, and recover logic from a .pyc without running it.https://ctfpal.com/?tool=pyc-disassembler
Reading
- Reading a binary you have never seen before - 5 min. A reversing challenge hands you an executable and no question. The order that gets you to the check function fastest - protections, strings, symbols, cross-references - and the four comparison patterns that account for most flag checks.
- Reversing managed code: .NET, Java, and Python bytecode - 6 min. When the binary is not machine code but bytecode with names attached, the job stops being disassembly and becomes reading. Decompiling .NET and Java back to source, disassembling .pyc, and what obfuscators actually take away.
- Reversing WebAssembly: a stack machine in the browser tab - 5 min. Reading .wasm as text, finding the exported function that checks your flag, following the linear memory that holds the strings, and why the JavaScript glue is usually where the answer is.
Practice set
Real picoCTF challenges tagged with this module’s techniques, easiest first. Assign the first three in class and the rest as homework.
- Quizploit - picoCTF 2026, easy
- ASCII FTW - picoGym Exclusive, medium
- asm1 - picoCTF 2019, medium
- Autorev 1 - picoCTF 2026, medium
- Bbbbloat - picoCTF 2022, medium
- Bit-O-Asm-1 - picoGym Exclusive, medium
- Bit-O-Asm-2 - picoGym Exclusive, medium
- Bit-O-Asm-3 - picoGym Exclusive, medium
- Bit-O-Asm-4 - picoGym Exclusive, medium
- Bypass Me - picoCTF 2026, medium
- FactCheck - picoCTF 2024, medium
- Fresh Java - picoCTF 2022, medium
Checkpoint (gradeable)
Given a stripped 64-bit binary that transforms input before comparing it, name the transform, invert it, and produce the flag without running the binary.
Deliberately a produced artefact rather than a quiz question: it is either there or it is not, which makes it fast to mark and hard to bluff. Every tool in ctfpal is deterministic, so two students who did the work correctly hand in the same value.
Where the room gets stuck
Students start at main and read forward, which is the slowest possible route. Make the first exercise strings-plus-cross-references only, with the disassembler closed - once they have found a check function that way they rarely go back to reading linearly.
If you finish early
- Hand out a challenge from the cross-CTF index in this category - each one has published solutions to compare afterwards.
- Run the same input through Identify and let the class argue with the ranking. Disagreeing with a confidence score is where the technique actually lands.
- Ask a student to break their own example - construct an input that defeats the tool, and explain why.
Take this into a room
Markdown files, built here in your browser. They print, they open in anything, and they carry the challenge text - so the session works with no network in the room.