{
  "added_at": "2026-11-06",
  "category": "native-analysis",
  "description_en": "The m0rph investigation examines an obfuscated x86-64 ELF CTF flag checker with readelf, strings, Cutter and Radare2. Its write-up traces indirect CALL RAX execution into allocated memory and describes recovering expected characters by breaking at the call and inspecting RDI during each loop iteration.",
  "description_zh": "m0rph 调查使用 readelf、strings、Cutter 和 Radare2 分析一款经过混淆的 x86-64 ELF CTF 字符串校验程序。报告追踪 CALL RAX 跳转到动态分配内存的执行过程，并说明如何逐次在调用处设断点、检查 RDI 以还原预期字符。",
  "entry_url": "https://awesomerea.org/resources/m0rph-ctf-analysis-case/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/m0rph-ctf-analysis-case/",
  "evidence_url": "https://github.com/UmbertoDellaMonica/m0rph-CTF-CyberChallenge.IT/blob/064dbf1bcedd39a0360a311daaa86c32b525a7db/README.md",
  "group": "learn",
  "id": "m0rph-ctf-analysis-case",
  "json_url": "https://awesomerea.org/resources/m0rph-ctf-analysis-case/record.json",
  "kind": "case-study",
  "markdown_url": "https://awesomerea.org/resources/m0rph-ctf-analysis-case/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/m0rph-ctf-analysis-case/index.md",
  "name": "m0rph: tracing an obfuscated ELF flag checker",
  "name_zh": "m0rph：追踪混淆 ELF 程序的字符串校验逻辑",
  "record_type": "resource",
  "relationship": "learning",
  "requirement_facets": [
    "prerequisites",
    "prerequisites",
    "license"
  ],
  "requirements": [
    "The m0rph x86-64 ELF challenge binary and a Linux analysis environment are needed to repeat the investigation.",
    "Radare2, Cutter and standard Linux inspection utilities are used in the described workflow.",
    "MIT license."
  ],
  "requirements_zh": [
    "复现调查需要 m0rph x86-64 ELF 题目程序及 Linux 分析环境。",
    "所述流程使用 Radare2、Cutter 和常见 Linux 检查工具。",
    "采用 MIT 许可证。"
  ],
  "targets": [
    "binary"
  ],
  "url": "https://github.com/UmbertoDellaMonica/m0rph-CTF-CyberChallenge.IT",
  "verification": "source-reviewed",
  "verified_at": "2026-11-06"
}