pwncollege · Jfar97 · Aug 23, 2025 · Aug 23, 2025 · Aug 23, 2025 · Aug 23, 2025
diff --git a/.DS_Store b/.DS_Store
diff --git a/demo/DESCRIPTION.md b/demo/DESCRIPTION.md
diff --git a/demo/desktop-auto-launch/.init b/demo/desktop-auto-launch/.init
diff --git a/demo/desktop-auto-launch/DESCRIPTION.md b/demo/desktop-auto-launch/DESCRIPTION.md
diff --git a/demo/module.yml b/demo/module.yml
diff --git a/dojo.yml b/dojo.yml
@@ -1,10 +1,8 @@
 id: example
-name: Example Dojo
+name: Introduction to Reverse Engineering
 type: example
 award:
-  emoji: 😀
+  emoji: 🔓
 image: pwncollege/challenge-simple
 modules:
-  - id: hello
-  - id: world
-  - id: demo
+  - id: re-intro
diff --git a/hello/DESCRIPTION.md b/hello/DESCRIPTION.md
diff --git a/hello/apple/DESCRIPTION.md b/hello/apple/DESCRIPTION.md
diff --git a/hello/apple/README.md b/hello/apple/README.md
diff --git a/hello/apple/apple b/hello/apple/apple
diff --git a/hello/banana/DESCRIPTION.md b/hello/banana/DESCRIPTION.md
diff --git a/hello/banana/README.md b/hello/banana/README.md
diff --git a/hello/banana/_0/.config b/hello/banana/_0/.config
diff --git a/hello/banana/_1/.config b/hello/banana/_1/.config
diff --git a/hello/banana/_2/.config b/hello/banana/_2/.config
diff --git a/hello/banana/banana b/hello/banana/banana
diff --git a/hello/module.yml b/hello/module.yml
diff --git a/re-intro/.DS_Store b/re-intro/.DS_Store
diff --git a/re-intro/1-Rename-Lesson/.init b/re-intro/1-Rename-Lesson/.init
@@ -0,0 +1,89 @@
+#!/usr/local/bin/python
+
+# IMPORTS
+import os
+import shutil
+import subprocess
+
+
+# DECLARATIONS
+# challenge/ Files Declarations
+c_file = "source.c"
+script = "Autoscript.py"
+executable = "executable"
+check_xml = "CheckXML.py"
+addresses_file = "addresses.txt"
+zip_name = "ghidra_11.4.2_PUBLIC_20260324_AutoScripting.zip"
+tool_config = "_auto_start.tcd"
+
+# Directory Declarations
+curr_dir = os.path.dirname(os.path.abspath(__file__))
+script_dir = "/home/hacker/ghidra_scripts"
+ext_dir = "/home/hacker/.config/ghidra/ghidra_11.4.2_NIX/Extensions"
+tools_dir = "/home/hacker/.config/ghidra/ghidra_11.4.2_NIX/tools"
+
+# challenge/ Files Path Declarations
+c_path = os.path.join(curr_dir, c_file)
+script_path = os.path.join(curr_dir, script)
+executable_path = os.path.join(curr_dir, executable)
+check_xml_path = os.path.join(curr_dir, check_xml)
+addresses_file_path = os.path.join(curr_dir, addresses_file)
+zip_path = os.path.join(curr_dir, zip_name)
+tool_path = os.path.join(curr_dir, tool_config)
+
+# Tool Path Declarations
+gcc_path = "/run/dojo/bin/gcc"
+nm_path = "/run/dojo/bin/nm"
+unzip_path = "/run/dojo/bin/unzip"
+
+# Destination Path Declarations
+script_destination = os.path.join(script_dir, script)
+tool_destination = os.path.join(tools_dir, tool_config)
+
+# Command Declarations
+c_compile = [gcc_path, c_path, "-o", executable_path]
+nm_command = [nm_path, executable_path]
+unzip_command = [unzip_path, "-o", zip_path, "-d", ext_dir]
+
+
+# CHALLENGE SETUP
+# Create extensions/ if it does not exist in user settings and then unzip extension into it to install extension and plugin
+os.makedirs(ext_dir, exist_ok=True)
+subprocess.run(unzip_command, check=True)
+
+# Copy the script into ghidra_scripts
+shutil.copy2(script_path, script_destination)
+os.chmod(script_destination, 0o444)
+
+# Copy the tool config into tools
+shutil.copy2(tool_path, tool_destination)
+
+# Compile the C file to get the executable
+subprocess.run(c_compile, check=True)
+
+# Use nm to get the addresses of the variable and function that need to be renamed, and write those to a file for the script to read
+nmOutput = subprocess.run(nm_command, check=True, capture_output=True, text=True)
+nmStdout = nmOutput.stdout
+
+targets = {"global_target", "functiontarget"}
+nm_addresses = {}
+
+for line in nmStdout.splitlines():
+    parts = line.split()
+
+    if len(parts) == 3:
+        addr, sym_type, name = parts
+        if name in targets:
+            nm_addresses[name] = "0010" + format(int(addr, 16), "x")[-4:]
+
+global_targ_address = nm_addresses.get("global_target")
+func_targ_address = nm_addresses.get("functiontarget")
+
+
+with open(addresses_file_path, "w") as f:
+    f.write(f"{global_targ_address}\n")
+    f.write(f"{func_targ_address}\n")
+
+
+
+
diff --git a/re-intro/1-Rename-Lesson/Autoscript.py b/re-intro/1-Rename-Lesson/Autoscript.py
@@ -0,0 +1,79 @@
+#@runtime Jython
+
+from ghidra.framework.model import DomainObjectListener
+from ghidra.app.util.exporter import XmlExporter
+from java.io import File
+import subprocess
+
+addresses_file_path = "/challenge/addresses.txt"
+
+with open(addresses_file_path, "r") as f:
+    VAR_TARGET_ADDR = toAddr(int(f.readline().strip(), 16))
+    FUNC_TARGET_ADDR = toAddr(int(f.readline().strip(), 16))
+
+VAR_EXPECTED_NAME = "pwned_var"
+PARAM_EXPECTED_NAME = "pwned_param"
+FUNC_EXPECTED_NAME = "pwnedfunction"
+
+done_var = False
+done_parameter = False
+done_function = False
+
+print("In this challenge, you will have to rename several parts of the binary in order to get the flag.")
+print("The first portion of the executable you should rename is the variable 'global_target'. Locate this variable inside of main and rename it to 'pwned_var'.")
+
+class ProgListener(DomainObjectListener):
+    def domainObjectChanged(self, ev):
+        global done_var
+        global done_parameter
+        global done_function
+        global listener
+
+        if not done_var:
+            sym = currentProgram.getSymbolTable().getPrimarySymbol(VAR_TARGET_ADDR)
+            if sym and sym.getName() == VAR_EXPECTED_NAME:
+                print("Correct! You can also rename functions just like with variables. Locate the function named 'functiontarget' and rename it to 'pwnedfunction'.")
+                done_var = True
+            return
+
+        if done_var and not done_function:
+            sym = currentProgram.getSymbolTable().getPrimarySymbol(FUNC_TARGET_ADDR)
+            if sym and sym.getName() == FUNC_EXPECTED_NAME:
+                print("Correct! Finally, just like with variables declared outside of functions, you can also rename function parameters. Locate the parameter of 'pwnedfunction' and rename it to 'pwned_param'.")
+                done_function = True
+            return
+
+        if done_function and not done_parameter:
+            func = currentProgram.getFunctionManager().getFunctionAt(FUNC_TARGET_ADDR)
+            if func:
+                params = func.getParameters()
+                if params and params[0].getName() == PARAM_EXPECTED_NAME:
+                    print("Correct! You have successfully completed the rename challenge")
+                    done_parameter = True
+
+                    currentProgram.removeListener(listener)
+
+                    program = getCurrentProgram()
+                    exporter = XmlExporter()
+                    output_file = File("/tmp/rename_challenge_completed.xml")
+                    exporter.export(output_file, program, None, getMonitor())
+
+                    result = subprocess.Popen(
+                        ['/challenge/CheckXML.py'],
+                        stdout=subprocess.PIPE,
+                        stderr=subprocess.PIPE
+                    )
+                    out, err = result.communicate()
+                    out = out.strip()
+
+                    if out == "INCORRECT":
+                        print("Something was not renamed correctly. Please try again.")
+
+                    else:
+                        print(out)
+
+            return
+
+listener = ProgListener()
+currentProgram.addListener(listener)
+print("Monitoring: " + currentProgram.getName())
diff --git a/re-intro/1-Rename-Lesson/CheckXML.py b/re-intro/1-Rename-Lesson/CheckXML.py
@@ -0,0 +1,44 @@
+#!/usr/bin/exec-suid -- /usr/local/bin/python -I
+import os
+
+curr_dir = os.path.dirname(os.path.abspath(__file__))
+addresses_file_path = os.path.join(curr_dir, "addresses.txt")
+
+global_target_addr = ""
+function_target_addr = ""
+
+with open(addresses_file_path, "r") as f:
+    global_target_addr = f.readline().strip()
+    function_target_addr = f.readline().strip()
+
+edited_global = f"SYMBOL ADDRESS=\"{global_target_addr}\" NAME=\"pwned_var\" NAMESPACE=\"\" TYPE=\"global\" SOURCE_TYPE=\"USER_DEFINED\" PRIMARY=\"y\""        
+edited_function = f"SYMBOL ADDRESS=\"{function_target_addr}\" NAME=\"pwnedfunction\" NAMESPACE=\"\" TYPE=\"global\" SOURCE_TYPE=\"USER_DEFINED\" PRIMARY=\"y\""      
+edited_param = "REGISTER_VAR NAME=\"pwned_param\" REGISTER=\"EDI\" DATATYPE=\"undefined4\" DATATYPE_NAMESPACE=\"/\""     
+
+global_edited = False
+function_edited = False
+param_edited = False
+
+with open("/tmp/rename_challenge_completed.xml", "r", encoding="UTF-8") as file:
+    for line in file:
+        if edited_global in line:
+            if(not global_edited):
+                print("Global variable renamed correctly!")
+                global_edited = True
+        if edited_function in line:
+            if(not function_edited):
+                print("Function renamed correctly!")
+                function_edited = True
+        if edited_param in line:
+            if(not param_edited):
+                print("Parameter renamed correctly!")
+                param_edited = True
+        if global_edited and function_edited and param_edited:
+            break
+
+#print("euid:", os.geteuid())
+if global_edited and function_edited and param_edited:
+    with open("/flag", "r") as flag:
+        print(flag.read())
+else:
+    print("INCORRECT")