radare2 | like reverse engineering framework and command-line toolset | Reverse Engineering library

You can tweak the Ghidra reverse result by edit variable type. Based on scanf const string %32s your local_38 should be char [32].

Before the first if, there are some char swap.

And the first if statment give you a long constrain of flag

At this point, you can confirm part of flag is FARADAY{d0ubl3_@nd_f1o@t, then is ther main part of this challenge.

It print x, y, z based on the flag, but you'll quickly find x and y is constrain by the if, so you only need to solve z to get the flag, so you think you need to bruteforce all double value limit by printable ascii.

But there are a limitaion in if statment says byte0 of this double must be _ and a math constrain there, simple math tell dVar2 - 4088116.817143337 <= 1.192092895507813e-07 and it comes dVar2 is very close 4088116.817143337 And byte 3 and byte 7 in this double will swap

By reverse result: dVar2 = y*y*x*x/z, solve this equation you can say z must near 407.2786840401004 and packed to little endian is `be}uty@. Based on double internal structure format, MSB will affect exponent, so you can make sure last byte is @ and it shows byte0 and byte3 is fixed now by constrain and flag common format with {} pair.

So finally, you only need to bureforce 5 bytes of printable ascii to resolve this challenge.

Well, the argv array is malformed. You set that parameter to an address on the stack but you didn't put a null pointer to terminate it.

This is the (lower portion of) stack when the first instruction of _start is executed:

In order to dump a function's bytes, you will have to know where that function ends.
You could do some static analysis which might work or you could do one of the following:

For 64-bit executables, you can parse the .pdata section which contains a list of RUNTIME_FUNCTIONs. DUMPBIN can do that using either the /unwindinfo or /pdata option.
Note that this may not include every exported function, see reference.

The second option, which works for both 32 and 64-bit executables, is to make use of the DIA SDK
(see IDiaSymbol::get_length). This should cover all exported and non-exported functions but requires you to have access to the executable's .pdb file.

This can be achieved with /ad (tested with version 4.5.0 and 5.0.1):

Your program does spawn a shell. This is easy to see, because when you change it to spawn ls, it spawns ls.

Your program's standard input comes from a Python script. Your program reads all the output from the script, then starts a shell. The shell uses the same standard input as your program. The shell tries to read a command, but there is no more input, so it just exits.

The message

Acording to the ARM a64 instruction set architecture (page 98), the instruction BLRAAZ is

ENVIRONMENT

• radare2: radare2 4.2.0-git 23519 @ linux-x86-64 git.4.1.1-84-g0c46c3e1e commit: 0c46c3e1e30bb272a5a05fc367d874af32b41fe4 build: 2020-01-08__09:49:0
• system: Ubuntu 18.04.3 LTS

SOLUTION

This example shows 4 different options to view / print disassembly or opcodes.

1. View disassembly in radare2 via visual mode:

   • Command one: aaaa # Analyze the file
   • Command two: Vp # Open disassembly in visual mode

2. Print disassembly of all functions in r2 or r2pipe:

   • Command one: aaaa # Analyze the file
   • Command two: pdf @@f > out
     • pdf # Print disassembly of a function
     • @@f # Repeat the command for every function
     • > out # Redirect the output to the file named out

3. Print only the instruction in r2 or r2pipe:

   • Command one: aaaa # Analyze the file
   • Command two: pif @@f ~[0] > out
     • pif # Print instructions of a function
     • @@f # Repeat the command for every function
     • ~[0] # Only print the first column (The instruction)
     • > out # Redirect the output to the file named out

4. Obtained detailed information for each opcode using r2 or r2pipe:

   • Command one: aaaa # Analyzey the file
   • Command two: aoj @@=`pid @@f ~[0]` > out
     • aoj # Display opcode analysis information in JSON
     • @@= # Repeat the command for every offset return by sub-query
     • pid @@f ~[0] # The sub-query
       1. pid # Print disassembly with offset and bytes
       2. @@f # Repeat the command for every function
       3. ~[0] # Only print the first column (The offset)
     • > out # Redirect the output to the file named out

EXAMPLE

Replace the commands here with any option from above.

Example using radare2 shell

ENVIRONMENT

• Radare2: 4.5.0-git 24843 @ darwin-x86-64 git.4.4.0-125-g561989265 commit: 5619892652d7dce87458d77962777331c28275a6 build: 2020-05-04__09:53:49
• System: macOS Catalina Version 10.15.4

SOLUTION

• Start radare2 with the "-w" flag which "open(s) file in write mode"