Behind the Scenes

Platform: HackTheBox | Category: Reversing | Type: Challenge | Difficulty: Easy | OS: NA | Author: D3v0o0Nu11 | Date: 2026-01-31 | Status: Solved Techniques: ud2_anti_decompilation, signal_handler_bypass, static_analysis, rodata_extraction

Summary

The behindthescenes binary is an ELF 64-bit file that uses an anti-decompilation technique to protect the password verification logic.

Recon

Port scan

nmap -p- -sV -sC <TARGET> --min-rate 1000 -Pn

Enumeration highlights

• Event: HackTheBox | ID: 20260131_hackthebox_behindthescenes
• Tags: elf, anti-decompilation, ud2, sigill, signal_handler
• Indicators: ud2 instruction (0f 0b), SIGILL handler registered, strncmp with chunked comparison, decompiler fails/crashes
• Source: 20260131_hackthebox_behindthescenes.md

Foothold

Vulnerability / Misconfiguration

1. Ud2_anti_decompilation
2. Signal_handler_bypass
3. Static_analysis
4. Rodata_extraction

<command>

Exploitation

• See original writeup content for detailed exploitation.

Privilege Escalation

Enumeration

sudo -l
find / -perm -4000 2>/dev/null
getcap -r / 2>/dev/null
cat /etc/crontab
ps aux

Exploitation

1. N/A for challenge-type writeup; see exploitation above.
2. Flag obtained via challenge solve.

<command>

Flags

Key Takeaways / Lessons

• ud2_anti_decompilation
• signal_handler_bypass
• static_analysis
• rodata_extraction
• Tags: elf, anti-decompilation, ud2, sigill, signal_handler

Original Writeup

<details><summary>Click to expand original content</summary>

Description

"After struggling to secure our secret strings for a long time, we finally figured out the solution to our problem: Make decompilation harder. It should now be impossible to figure out how our programs work!"

The behindthescenes binary is an ELF 64-bit file that uses an anti-decompilation technique to protect the password verification logic.

Analysis

Initial Analysis

$ file behindthescenes
behindthescenes: ELF 64-bit LSB pie executable, x86-64, dynamically linked, not stripped

$ strings behindthescenes
./challenge <password>
> HTB{%s}

The binary takes a password as an argument and outputs the flag in the format HTB{password}.

Anti-Decompilation: ud2 + SIGILL

The key protection mechanism uses the ud2 instruction (undefined instruction, opcode 0f 0b):

1. Handler registration: At the start of main, a signal handler for SIGILL is registered (segill_sigaction)
2. Scattered ud2: The code contains scattered ud2 instructions that trigger an "illegal instruction" exception
3. Handler skips: The signal handler intercepts SIGILL and increments the instruction pointer by 2 bytes (the size of ud2)
4. Decompiler breaks: Static analyzers (IDA, Ghidra) don't understand that ud2 will be skipped and incorrectly build the CFG

; Typical pattern in the code:
mov    rdi, [rbp-0x10]
ud2                      ; <- decompiler thinks this crashes
add    rdi, 0x3          ; <- this code is not analyzed

Password Verification Logic

The logic extracted from the disassembler (objdump -d):

1. Check argc == 2 (argument required)
2. Check password length == 12 characters
3. Compare password in chunks using strncmp:

Extracting Strings from .rodata

$ objdump -s -j .rodata behindthescenes

2010 3c706173 73776f72 643e0049 747a005f  <password>.Itz._
2020 306e004c 795f0055 4432003e 20485442  0n.Ly_.UD2.> HTB

Strings confirmed:

• Itz @ 0x201b
• _0n @ 0x201f (displayed as 0n due to null-terminator)
• Ly_ @ 0x2023
• UD2 @ 0x2027

Solution

Concatenating the password parts:

Itz + _0n + Ly_ + UD2 = REDACTED

Verification:

$ ./behindthescenes REDACTED
> HTB{REDACTED}

Bypassing the Technique

1. Static analysis: Ignore ud2, read the disassembler as if they don't exist
2. Patching: Replace ud2 with nop nop (90 90) and re-run analysis
3. Dynamic analysis: Use a debugger (gdb) that correctly handles signals
4. Emulation: Unicorn/Qiling with proper signal handler emulation

Tools

• file — file type identification
• strings — string search
• objdump -d — disassembly
• objdump -s -j .rodata — data section dump
• xxd — hex dump for verification

</details>

---

Auto-tracked: saved to WriteUps; run /xesor-revise to fold lessons into XESXor_Methodology.md.

signed by XESXOR