Tags: reverse 

Rating:

## Catana Gift - Reverse 59 pts

Here is a write up of the Catana Gift challenge from the X-MAS CTF 2018. Write-up by WAFU team !

### File analysis
```
$ file catana
```
The input file is an ELF-64 bits file. When open with IDA we can found:
- A double for loop :
- Call the function stored at 0x400556
- Several operations to construct a string using the results of the 0x400556 function
- A print of this string at the end of the program.

However we remark taht the execution of the program is far too long to arrive to this printf call. Indeed, the function at 0x400556 is recursive and makes the program running very slowly. Our goal will be to patch the main program with a faster function !

### Function 0x400556 analysis
The function is called with three arguments stored in the registers EDI, ESI, EDX. In the main function, the function is called at 0x40062D with the following parameters, and gives the following results (obtained through a debugger with a breakpoint at 0x40062D) :
- func(0,0,0) = 1
- func(1,0,0) = 1
- func(2,0,0) = 2
- func(3,0,0) = 5
- func(4,0,0) = 14
- func(5,0,0) = 42

As everyone should know these results are the beginning of the Catalan Suite, and there is a much faster way to compute its nth terms :

```c
int catalan_2(int a){
int res = 1;
for (int i=0; i

Original writeup (https://github.com/elyrian/CTF_WriteUP/tree/master/2018/X-MAS_CTF/CatanaGift).