1. Reverse Engineering for CTFs
Unit 3:

2. Overview
Homework questions?
Java RE
Pwntools
Stack basics
GDB

3. JAD Java Decompiler
Jad is a command line utility for decompiling Java class files.
Why can we decompile Java but not C/C++?
Java is compiled into Java-bytecode which is then executed by the JVM.
The byte code is closer to Java source than assembly is to C source code.
Java class files contain metadata, whereas C files do not.
To install
ed).zip
unzip Jad1.5.8eforLinux(statically linked).zip
Run:
./jad file.class

4. Sample Java Code

5. Java Bytecode

6. pwntools pwntools is a CTF framework and exploit development library.
Written in Python.
Designed for rapid prototyping and development
intended to make exploit writing as simple as possible
Follow the instructions at to install.
Documentation at

7. pwntools

8. 32 Bit Stack Example

9. 32 Bit Stack Example Each stack entry is 4 bytes (32 bits)
Function arguments are pushed on the stack from right to left.
The return address is pushed after the arguments.
The function prologue of foo then saves the ebp and adjusts esp to allow room for local variables.
EBP minus a value = local variable
EBP plus a value = arguments

10. 64 Bit Stack Example

11. 64 Bit Stack Example

12. 64 Bit Stack Example Each stack entry is 8 bytes (64 bits)
Arguments are passed right to left using registers, until the RDI, RSI, RDX, RCX, R*, and R9 registers are used.
Once all 6 of the mentioned registers have been used, any remaining arguments are passed left to right by pushing them on the stack.
Function prologue saves rbp and adjusts rsp to create room for local variables.

13. GDB: print value at [ebp-0xff]
x/xw (int*)($ebp +/- 0xHexValue)
x = Examine memory
/xw = Examine hex value of 1 word size (4 bytes)
(int*) Cast value to an integer
($ebp +/- 0xHexValue) = The address to examine
Note: this could also be ($esp +/- 0xHexValue) or any address on the stack.

14. GDP: Print string at an address
x/100s ADDRESS
X = Examine memory
/100 = Length to be examined
s = Examine string
ADDRESS = Hex address to be examined

15. GDB: context
Use the ‘context’ command to reopen pwndbg’s or peda’s context display.