Arm64 Baremetal

Category: REV · Difficulty: Advanced · Points: 500 · Challenge: 506

Background

The target is a firmware blob extracted from an edge sensor that runs on bare-metal AArch64 hardware with no underlying OS kernel. The stated technique is to disassemble the reset vector and the memory map. FORMAT: FLAG{ }

Analysis

The artifact is presented as a compiled binary but is 98 bytes. Its first sixteen bytes are the ELF identification string, and from offset 16 onward it is ASCII rather than machine code:

$ file challenge-064.bin
challenge-064.bin: ELF 64-bit LSB *unknown arch 0x4752* (SYSV)

$ xxd challenge-064.bin
00000000: 7f45 4c46 0201 0100 0000 0000 0000 0000  .ELF............
00000010: 5441 5247 4554 5f52 4556 5f4b 4559 5f30  TARGET_REV_KEY_0
00000020: 3532 5f46 4c41 477b 6377 6132 3032 365f  52_FLAG{cwa2026_
00000030: ...                                           }.........

The unidentified machine type is a consequence of the layout rather than a real target: the e_machine field at offset 18 falls inside the ASCII marker, so the value 0x4752 is simply the characters GR. There is therefore no program image to disassemble, no symbol table and no control flow to trace, and the reset vector disassembly described in the brief could not be carried out, since no AArch64 instruction encoding and no memory map were present. The marker TARGET_REV_KEY_064_ wraps the flag in cleartext and the remainder of the file is NUL padding.

Result

FLAG{cwa2026_7acdcc8d1c1315d9}