> For the complete documentation index, see [llms.txt](https://alham-rizvi.gitbook.io/alhamrizvi/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://alham-rizvi.gitbook.io/alhamrizvi/picoctf-writeups/picoctf/reverse-engineering/binary-instrumentation-1.md).

# Binary Instrumentation 1

I started by analyzing the given Windows executable using `rabin2` to inspect its sections:

```bash
rabin2 -S bininst1.exe
```

This showed standard PE sections like `.text`, `.rdata`, `.data`, `.rsrc`, and `.reloc`.

Next, I used `binwalk` to check for embedded files inside the binary:

```bash
binwalk bininst1.exe
```

It detected:

* A PE executable
* An XML manifest
* LZMA compressed data

Then I extracted the contents using:

```bash
binwalk -e bininst1.exe
```

Inside the extracted folder, I found a file (`6000`) which contained mostly binary garbage. I used `strings` on it to search for readable content:

```bash
strings 6000
```

Among system strings and function names, I found a clear message:

> "Hi, I have the flag for you just right here! I'll just take a quick nap before I print it out for you... Ok, I'm up! The flag is: cGljb0NURnt3NGtlX20zX3VwX3cxdGhfZnIxZGFfZjI3YWNjMzh9"

This looked like Base64 encoding, so I decoded it:

```bash
echo "cGljb0NURnt3NGtlX20zX3VwX3cxdGhfZnIxZGFfZjI3YWNjMzh9" | base64 -d
```

Final flag:

```
picoCTF{w4ke_m3_up_w1th_fr1da_f27acc38}
```