Add a graph view screenshot

p4-team · May 14, 2020 · 33abcd9 · 33abcd9
1 parent 1a41eff
commit 33abcd9
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 0 deletions.
diff --git a/2020-05-10-spam-and-flags-teaser/journey2/README.md b/2020-05-10-spam-and-flags-teaser/journey2/README.md
@@ -209,6 +209,8 @@ I noticed this function during the CTF, but the code looked like decompiled
 However, further analysis reveals that it checksums most of the code section
 and derives an address from the checksum, which is then patched with a `xor`.
 
+![](init_array_graph.png)
+
 Checking with gdb, we see that the address being patched is `0x400902`. This
 corresponds to an `add` instruction in the RC4 code, which this xor turns into
 a `sub`. The following change in the decoding script makes it decrypt the flag

diff --git a/2020-05-10-spam-and-flags-teaser/journey2/init_array_graph.png b/2020-05-10-spam-and-flags-teaser/journey2/init_array_graph.png