---
# System prepended metadata

title: EHAX CTF 2025
tags: ["Reverse Engineering\_"]

---

# EHAX CTF 2025
## MBR Shenanigans 
use QEMU for debugging
```
qemu-system-x86_64 -drive "file=file,format=raw,if=floppy" -boot a -m 1024 -gdb tcp::1234 -S
```

Use gdb to remote
```
[...]
pwndbg> target remote :1234
Remote debugging using :1234
[...]
pwndbg> c
Continuing.
```
![Screenshot 2025-02-16 160100](https://hackmd.io/_uploads/SJrPKQ19Jx.png)
Characters move from right to left -> `bx=0xcafe`

```
pwndbg> c
Continuing.
^C
Program received signal SIGINT, Interrupt.
[...]
pwndbg> set $bx=0xcafe
pwndbg> c
Continuing.
```
![image](https://hackmd.io/_uploads/B151c719ye.png)
`Flag: EH4X{b00t2boop}`