Reverse › Module 7 › Lesson 2
CTF Workflow
CTF reversing workflow — triage, static, dynamic, flag extraction, writeup discipline on $RE_LAB challenge binaries.
Visual · t23_ctf_workflow
CTF workflow = structured RE on challenge bins. $RE_LAB. Original Cyberlium.
Opening
CTF time pressure is fake — the workflow is real: triage, analyze, prove flag, write it up without paste-bin piracy.
CTF reversing workflow: (1) triage file type, strings, protections; (2) static in Ghidra/objdump — entry, main logic, compare; (3) dynamic in GDB with breakpoints; (4) derive flag or key on $RE_LAB; (5) writeup with hash, tools, steps, flag format, ethics line. Team rules: no sharing live flags before deadline if brief says so; no attacking CTF infra; no using RE skills on non-CTF commercial targets afterward. Cyberlium teaches reproducible workflow on YOUR assigned CTF/crackme — NOT plagiarized writeups, NOT flag hoarding to sell, NOT 'CTF skills' as excuse for piracy.
1. Triage to flag
file, strings, checksec-class literacy, Ghidra auto-analysis, rename functions honestly, dynamic confirm hypothesis.
Flag submission only on authorized CTF platform — document UTC solve time.
Command guide
Try these commands — Triage to flag
═══ LINUX / macOS (Malware Static & Dynamic Triage) ═══
Inspect PE / ELF binary headers and sections
Command — copy this
readelf -h sample.bin 2>/dev/null || xxd -g 1 -l 32 sample.bin
Check binary entropy (high entropy often signals packed or encrypted payloads)
Command — copy this
python3 -c "
import math, sys
data = open('sample.bin', 'rb').read() if len(sys.argv) > 1 else b'MZX\x00\x90'
ent = -sum((data.count(bytes([b]))/len(data))*math.log2(data.count(bytes([b]))/len(data)) for b in set(data))
print(f'Calculated File Entropy: {ent:.4f} (Entropy > 7.0 suggests packed/encrypted)')
" sample.bin 2>/dev/nullPrimary tools to practice this lesson: curl, strings. Reference sites: pwn.college (https://pwn.college/); crackmes.one (https://crackmes.one/); LiveOverflow CTF (https://www.youtube.com/c/LiveOverflow). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Writeup skeleton
Challenge name, hash, tools, static findings, dynamic proof, flag redacted in public share if brief requires.
Integrity: no commercial binary mixed in, no piracy side quest.
3. Team ethics
Collaborate per CTF rules; cite teammates; do not DoS challenge servers.
Skills transfer to defensive RE and malware class — not to cracking neighbor's app.
4. What you ship: CTF workflow checklist
Six-step workflow + writeup headers + ethics line + $RE_LAB target verify.
5. What you record before the next lesson
CTF workflow checklist path.
6. Wrong vs right: commercial piracy vs crackmes/CTF toys
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Use CTF GDB workflow on commercial app 'because same binary format.'
Right
CTF workflow checklist for $RE_LAB challenge. Next: Patch Literacy.
Mission: CTF workflow checklist
1) Write six workflow steps. 2) Draft writeup section headers. 3) Add ethics/scope line. 4) Note hash-verify before start.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Public writeup — flag redaction rule?”
Knowledge Check
APPLY: CTF workflow includes:
Multiple choice
Knowledge Check
APPLY: True or False: CTF skills justify cracking paid software.
True or False
Knowledge Check
APPLY: Writeup should document:
Multiple choice