> For the complete documentation index, see [llms.txt](https://alham-rizvi.gitbook.io/alhamrizvi/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://alham-rizvi.gitbook.io/alhamrizvi/picoctf-writeups/picoctf/reverse-engineering/breadth.md).

# breadth

### 1. The Problem: Too Many Flags

If you run `strings` on the files, you'll see hundreds of fake flags. This is "horizontal scaling" in a literal, troll-y sense—the developer just packed the binary with thousands of functions, each printing a different fake flag.

Since the program always exits with "Goodbye!", none of these functions are actually being called. They are **dead code**.

### 2. The Strategy: Binary Diffing

Instead of reverse engineering thousands of functions, we compare the "broken" version (`v1`) with the "fixed" version (`v2`). The function that changed is almost certainly the one containing the real flag.

#### Step A: Finding the Difference

We use `radiff2` to see exactly which bytes are different between the two files.

```bash
radiff2 breadth.v1 breadth.v2
```

The output shows a few changes, but one stands out at offset `0x0009504b`. This is where the logic actually changed, rather than just metadata like the Build ID.

### 3. The Solution: Deep Dive with Radare2

Now, we open the **fixed version (`v2`)** in `r2` and jump to that specific address to see what the "fix" was.

#### Step B: Inspecting the Code

1. **Open and Analyze:** `r2 ./breadth.v2` then run `aa` (analyze all).
2. **Seek to the address:** `s 0x0009504b`
3. **Disassemble:** `pdb` (print disassemble block).

In the assembly, we see a function `sym.fcnkKTQpF`:

* It moves a value (`0x41bc73e`) into a register.
* It compares (`cmp`) that register against the same value.
* It jumps if equal (`je`) to a specific address: `0x95060`.

#### Step C: Following the Jump

When we look at the code at `0x95060`, we see:

```asm
lea rdi, str.picoCTF{VnDB2LUf1VFJkdfDJtdYtFlMexPxXS6X}
jmp sym.imp.puts
```

This function loads a specific string into `rdi` and calls `puts` to print it. Because this was the only functional change between the "broken" and "fixed" versions, this must be the real flag.

### Final Flag

**`picoCTF{VnDB2LUf1VFJkdfDJtdYtFlMexPxXS6X}`**

***

### Summary for Beginners

* **Horizontal Scaling:** A joke about the binary having a massive amount of identical-looking functions.
* **Dead Code:** Functions that exist in the file but are never executed by the `main` loop.
* **Diffing:** The fastest way to find a needle in a haystack when you have two slightly different haystacks.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://alham-rizvi.gitbook.io/alhamrizvi/picoctf-writeups/picoctf/reverse-engineering/breadth.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.