Press enter or click to view image in full size![]()
🇧🇩 BdSecCTF 2025 — Minar ’52 Enigma Challenge Write-Up
4 min readJul 24, 2025
🔐 Challenge: minar_52_enigma.bdsec
Category: Reversing
Author: NomanProdhan
Flag Format: BDSEC{...}
🧩 Challenge Prompt
Upon running the binary:
❯ ./minar_52_enigma.bdsec
____||____
/ \
| 1952 |
| Language |
| Movement |
\__________/
|| ||
|| ||
|| ||
|| ||
‘We will give blood, we will give life, but we won't give away Bangla.’
Enter the secret: 🔎 Initial Analysis
❯ file minar_52_enigma.bdsec
minar_52_enigma.bdsec: ELF 64-bit LSB executable, x86-64, version 1 (GNU/Linux), statically linked, BuildID[sha1]=8a3c9740a2b5772818978c966f023317b0277dff, for GNU/Linux 4.4.0, not stripped❯ checksec minar_52_enigma.bdsec
Arch: amd64-64-little
RELRO: Partial RELRO
Stack: Canary found
NX: NX enabled
PIE: No PIE (0x400000)
Stripped: NoPerfect for reverse engineering. Since it’s not stripped, and statically linked, we can dive into main() using GDB.
🔬 Disassembling main
Using GEF:
gdb -q ./minar_52_enigma.bdsec
gef➤ disas main
Dump of assembler code for function main:
0x0000000000402e00 <+0>: push rbx
0x0000000000402e01 <+1>: lea rbx,[rip+0x79288] # 0x47c090
0x0000000000402e08 <+8>: sub rsp,0xb0
0x0000000000402e0f <+15>: mov rdi,QWORD PTR fs:0x28
0x0000000000402e18 <+24>: mov QWORD PTR [rsp+0xa8],rdi
0x0000000000402e20 <+32>: lea rdi,[rip+0x791e9] # 0x47c010
0x0000000000402e27 <+39>: call 0x40ca70 <puts>
0x0000000000402e2c <+44>: lea rdi,[rip+0x791f1] # 0x47c024
0x0000000000402e33 <+51>: call 0x40ca70 <puts>
0x0000000000402e38 <+56>: lea rdi,[rip+0x791fa] # 0x47c039
0x0000000000402e3f <+63>: call 0x40ca70 <puts>
0x0000000000402e44 <+68>: lea rdi,[rip+0x79204] # 0x47c04f
0x0000000000402e4b <+75>: call 0x40ca70 <puts>
0x0000000000402e50 <+80>: lea rdi,[rip+0x7920e] # 0x47c065
0x0000000000402e57 <+87>: call 0x40ca70 <puts>
0x0000000000402e5c <+92>: lea rdi,[rip+0x79218] # 0x47c07b
0x0000000000402e63 <+99>: call 0x40ca70 <puts>
0x0000000000402e68 <+104>: mov rdi,rbx
0x0000000000402e6b <+107>: call 0x40ca70 <puts>
0x0000000000402e70 <+112>: mov rdi,rbx
0x0000000000402e73 <+115>: call 0x40ca70 <puts>
0x0000000000402e78 <+120>: mov rdi,rbx
0x0000000000402e7b <+123>: call 0x40ca70 <puts>
0x0000000000402e80 <+128>: mov rdi,rbx
0x0000000000402e83 <+131>: lea rbx,[rip+0x7adce] # 0x47dc58
0x0000000000402e8a <+138>: call 0x40ca70 <puts>
0x0000000000402e8f <+143>: mov rdi,rbx
0x0000000000402e92 <+146>: call 0x40ca70 <puts>
0x0000000000402e97 <+151>: lea rdi,[rip+0x7b34a] # 0x47e1e8
0x0000000000402e9e <+158>: call 0x403190 <print_slow>
0x0000000000402ea3 <+163>: mov rdi,rbx
0x0000000000402ea6 <+166>: lea rbx,[rsp+0x60]
0x0000000000402eab <+171>: call 0x40ca70 <puts>
0x0000000000402eb0 <+176>: lea rdi,[rip+0x791ed] # 0x47c0a4
0x0000000000402eb7 <+183>: xor eax,eax
0x0000000000402eb9 <+185>: call 0x406410 <printf>
0x0000000000402ebe <+190>: mov rdi,QWORD PTR [rip+0xa47eb] # 0x4a76b0 <stdout>
0x0000000000402ec5 <+197>: call 0x40c570 <fflush>
0x0000000000402eca <+202>: mov rdx,QWORD PTR [rip+0xa47e7] # 0x4a76b8 <stdin>
0x0000000000402ed1 <+209>: mov esi,0x40
0x0000000000402ed6 <+214>: mov rdi,rbx
0x0000000000402ed9 <+217>: call 0x40c6d0 <fgets>
0x0000000000402ede <+222>: test rax,rax
0x0000000000402ee1 <+225>: je 0x40300c <main+524>
0x0000000000402ee7 <+231>: lea rsi,[rip+0x79fa5] # 0x47ce93
0x0000000000402eee <+238>: mov rdi,rbx
0x0000000000402ef1 <+241>: call 0x401090
0x0000000000402ef6 <+246>: mov esi,0x502
0x0000000000402efb <+251>: mov BYTE PTR [rsp+0x4b],0x5f
0x0000000000402f00 <+256>: movabs rdx,0x1b69081f0e736c4f
0x0000000000402f0a <+266>: mov BYTE PTR [rsp+rax*1+0x60],0x0
0x0000000000402f0f <+271>: mov eax,0x502
0x0000000000402f14 <+276>: mov ecx,0xffffc23e
0x0000000000402f19 <+281>: mov r9,rsp
0x0000000000402f1c <+284>: mov WORD PTR [rsp+0x54],ax
0x0000000000402f21 <+289>: mov edi,0xffffc23e
0x0000000000402f26 <+294>: movabs rax,0x6f707e090b5646b2
0x0000000000402f30 <+304>: movabs r8,0xcccccccccccccccd
0x0000000000402f3a <+314>: mov DWORD PTR [rsp+0x43],0x32353931
0x0000000000402f42 <+322>: mov DWORD PTR [rsp+0x47],0x4b372310
0x0000000000402f4a <+330>: mov QWORD PTR [rsp+0x4c],rdx
0x0000000000402f4f <+335>: mov QWORD PTR [rsp+0x56],rax
0x0000000000402f54 <+340>: mov QWORD PTR [rsp],rdx
0x0000000000402f58 <+344>: mov WORD PTR [rsp+0x8],si
0x0000000000402f5d <+349>: mov QWORD PTR [rsp+0xa],rax
0x0000000000402f62 <+354>: mov BYTE PTR [rsp+0x20],0x42
0x0000000000402f67 <+359>: mov WORD PTR [rsp+0x5e],cx
0x0000000000402f6c <+364>: mov ecx,0x1
0x0000000000402f71 <+369>: mov WORD PTR [rsp+0x12],di
0x0000000000402f76 <+374>: lea rdi,[rsp+0x20]
0x0000000000402f7b <+379>: nop DWORD PTR [rax+rax*1+0x0]
0x0000000000402f80 <+384>: mov rax,rcx
0x0000000000402f83 <+387>: movzx esi,BYTE PTR [r9+rcx*1]
0x0000000000402f88 <+392>: mul r8
0x0000000000402f8b <+395>: xor esi,0xffffffcc
0x0000000000402f8e <+398>: mov rax,rdx
0x0000000000402f91 <+401>: and rdx,0xfffffffffffffffc
0x0000000000402f95 <+405>: shr rax,0x2
0x0000000000402f99 <+409>: add rdx,rax
0x0000000000402f9c <+412>: mov rax,rcx
0x0000000000402f9f <+415>: sub rax,rdx
0x0000000000402fa2 <+418>: mov rdx,rcx
0x0000000000402fa5 <+421>: and edx,0x3
0x0000000000402fa8 <+424>: sub sil,BYTE PTR [rsp+rdx*1+0x43]
0x0000000000402fad <+429>: sub sil,BYTE PTR [rsp+rax*1+0x47]
0x0000000000402fb2 <+434>: mov BYTE PTR [rdi+rcx*1],sil
0x0000000000402fb6 <+438>: add rcx,0x1
0x0000000000402fba <+442>: cmp rcx,0x14
0x0000000000402fbe <+446>: jne 0x402f80 <main+384>
0x0000000000402fc0 <+448>: mov rsi,rdi
0x0000000000402fc3 <+451>: mov rdi,rbx
0x0000000000402fc6 <+454>: mov BYTE PTR [rsp+0x34],0x0
0x0000000000402fcb <+459>: call 0x401080
0x0000000000402fd0 <+464>: test eax,eax
0x0000000000402fd2 <+466>: jne 0x402ffe <main+510>
0x0000000000402fd4 <+468>: lea rdi,[rip+0x790dc] # 0x47c0b7
0x0000000000402fdb <+475>: call 0x40ca70 <puts>
0x0000000000402fe0 <+480>: xor eax,eax
0x0000000000402fe2 <+482>: mov rdx,QWORD PTR [rsp+0xa8]
0x0000000000402fea <+490>: sub rdx,QWORD PTR fs:0x28
0x0000000000402ff3 <+499>: jne 0x403013 <main+531>
0x0000000000402ff5 <+501>: add rsp,0xb0
0x0000000000402ffc <+508>: pop rbx
0x0000000000402ffd <+509>: ret
0x0000000000402ffe <+510>: lea rdi,[rip+0x7b233] # 0x47e238
0x0000000000403005 <+517>: call 0x40ca70 <puts>
0x000000000040300a <+522>: jmp 0x402fe0 <main+480>
0x000000000040300c <+524>: mov eax,0x1
0x0000000000403011 <+529>: jmp 0x402fe2 <main+482>
0x0000000000403013 <+531>: call 0x427850 <__stack_chk_fail_local>We observe:
- The program prints a bunch of messages.
- Then prompts for input using
fgets(). - The input is passed through a transformation loop, and then:
- Compared using a custom function (at
0x401080).
Let’s set a breakpoint just before the validation happens:
b *0x402fc0
rBingo! We get the expected result:
Press enter or click to view image in full size![]()
That’s our flag! 🏁
🏁 Final Flag
BDSEC{MnR1952C1ph3r}💬 Reflection
This was a beautifully crafted reversing challenge with deep binary reverse engineering.
