Dynamic Instrumentation with ptrace

Oct 13, 2025 by wbrum.org 11 views

Binary Instrumentation 1: A Comprehensive Writeup for PicoCTF2025

Introduction

Binary instrumentation is a crucial skill for any aspiring reverse engineer or security professional. It involves modifying the behavior of a binary executable at runtime, allowing for a wide range of applications, from debugging and testing to security research and exploitation. In this writeup, we will delve into the world of binary instrumentation, focusing on the challenges and solutions presented in the Binary Instrumentation 1 challenge from PicoCTF2025.

Challenge Overview

The Binary Instrumentation 1 challenge from PicoCTF2025 is a classic example of a binary instrumentation problem. The challenge presents a simple C program that takes a single integer input and returns its square. However, the program is instrumented to print a message to the console whenever the input is greater than 10. The challenge requires the contestant to modify the program to print the message whenever the input is greater than 5, without modifying the original code.

Understanding the Challenge

To tackle this challenge, we need to understand the basics of binary instrumentation. Binary instrumentation involves modifying the behavior of a binary executable at runtime, without modifying the original code. This can be achieved through various techniques, including:

Dynamic instrumentation: This involves modifying the binary executable at runtime, using tools such as LD_PRELOAD or ptrace.
Static instrumentation: This involves modifying the binary executable before runtime, using tools such as objcopy or patchelf.

In this challenge, we will focus on dynamic instrumentation, using the LD_PRELOAD technique.

Dynamic Instrumentation with LD_PRELOAD

LD_PRELOAD is a Linux environment variable that allows us to specify a shared library to be loaded before the main program. This shared library can then modify the behavior of the main program at runtime. To instrument the binary executable, we need to create a shared library that will intercept the function calls made by the program.

Here is an example of how we can create a shared library using C:

#include <stdio.h>
#include <stdlib.h>

void _printf(const char *format, ...) {
    printf("Instrumented: %s\n", format);
    va_list args;
    va_start(args, format);
    vprintf(format, args);
    va_end(args);
}

void _main(int argc, char **argv) {
    int x = atoi(argv[1]);
    if (x > 5) {
        _printf("Input is greater than 5\n");
    }
    printf("Square of %d is %d\n", x, x * x);
}

This shared library, instrument.so, will intercept the printf function calls made by the program and print a message before calling the original printf function.

Compiling and Loading the Shared Library

To compile the shared library, we can use the following command:

gcc -shared -o instrument.so instrument.c

To load the shared library, we can set the LD_PRELOAD environment variable to the path of the shared library:

export LD_PRELOAD=/path/to/instrument.so

Running the Instrumented Program

To run the instrumented program, we can use the following command:

./program 10

This will run the program with the input 10, and the instrumented program will print the message "Instrumented: Input is greater than 5\n" before printing the square of 10.

Conclusion

In this writeup, we have explored the world of binary instrumentation, focusing on the challenges and solutions presented in the Binary Instrumentation 1 challenge from PicoCTF2025. We have learned how to use dynamic instrumentation with LD_PRELOAD to modify the behavior of a binary executable at runtime. This technique has a wide range of applications, from debugging and testing to security research and exploitation. We hope that this writeup has provided a comprehensive introduction to binary instrumentation and has inspired you to explore this fascinating field further.

Additional Resources

For further learning, we recommend the following resources:

Binary Instrumentation with LD_PRELOAD: A tutorial on using LD_PRELOAD for binary instrumentation.
Dynamic Instrumentation with ptrace: A tutorial on using ptrace for dynamic instrumentation.
Binary Instrumentation with objcopy: A tutorial on using objcopy for static instrumentation.

Future Work

In future work, we plan to explore more advanced techniques for binary instrumentation, including:

Function hooking: A technique for intercepting function calls made by a program.
Memory patching: A technique for modifying the memory layout of a program.
Code injection: A technique for injecting new code into a program.

We hope that this writeup has provided a comprehensive introduction to binary instrumentation and has inspired you to explore this fascinating field further.
Binary Instrumentation 1: A Comprehensive Q&A Guide

Introduction

Binary instrumentation is a crucial skill for any aspiring reverse engineer or security professional. It involves modifying the behavior of a binary executable at runtime, allowing for a wide range of applications, from debugging and testing to security research and exploitation. In this Q&A guide, we will delve into the world of binary instrumentation, focusing on the challenges and solutions presented in the Binary Instrumentation 1 challenge from PicoCTF2025.

Q&A Guide

Q: What is binary instrumentation?

A: Binary instrumentation is a technique for modifying the behavior of a binary executable at runtime, without modifying the original code. This can be achieved through various techniques, including dynamic instrumentation and static instrumentation.

Q: What is dynamic instrumentation?

A: Dynamic instrumentation involves modifying the binary executable at runtime, using tools such as LD_PRELOAD or ptrace. This technique allows for real-time modification of the program's behavior.

Q: What is static instrumentation?

A: Static instrumentation involves modifying the binary executable before runtime, using tools such as objcopy or patchelf. This technique allows for pre-runtime modification of the program's behavior.

Q: How does LD_PRELOAD work?

A: LD_PRELOAD is a Linux environment variable that allows us to specify a shared library to be loaded before the main program. This shared library can then modify the behavior of the main program at runtime.

Q: How do I create a shared library for LD_PRELOAD?

A: To create a shared library for LD_PRELOAD, you can use a C compiler such as GCC. Here is an example of how to create a shared library:

#include <stdio.h>
#include <stdlib.h>

void _printf(const char *format, ...) {
    printf("Instrumented: %s\n", format);
    va_list args;
    va_start(args, format);
    vprintf(format, args);
    va_end(args);
}

void _main(int argc, char **argv) {
    int x = atoi(argv[1]);
    if (x > 5) {
        _printf("Input is greater than 5\n");
    }
    printf("Square of %d is %d\n", x, x * x);
}

Q: How do I compile and load the shared library?

A: To compile the shared library, you can use the following command:

gcc -shared -o instrument.so instrument.c

To load the shared library, you can set the LD_PRELOAD environment variable to the path of the shared library:

export LD_PRELOAD=/path/to/instrument.so

Q: How do I run the instrumented program?

A: To run the instrumented program, you can use the following command:

./program 10

This will run the program with the input 10, and the instrumented program will print the message "Instrumented: Input is greater than 5\n" before printing the square of 10.

Conclusion

In this Q&A guide, we have explored the world of binary instrumentation, focusing on the challenges and solutions presented in the Binary Instrumentation 1 challenge from PicoCTF2025. We have learned how to use dynamic instrumentation with LD_PRELOAD to modify the behavior of a binary executable at runtime. This technique has a wide range of applications, from debugging and testing to security research and exploitation. We hope that this Q&A guide has provided a comprehensive introduction to binary instrumentation and has inspired you to explore this fascinating field further.

Additional Resources

For further learning, we recommend the following resources:

Binary Instrumentation with LD_PRELOAD: A tutorial on using LD_PRELOAD for binary instrumentation.
Dynamic Instrumentation with ptrace: A tutorial on using ptrace for dynamic instrumentation.
Binary Instrumentation with objcopy: A tutorial on using objcopy for static instrumentation.

Future Work

In future work, we plan to explore more advanced techniques for binary instrumentation, including:

Function hooking: A technique for intercepting function calls made by a program.
Memory patching: A technique for modifying the memory layout of a program.
Code injection: A technique for injecting new code into a program.

We hope that this Q&A guide has provided a comprehensive introduction to binary instrumentation and has inspired you to explore this fascinating field further.