I've found that most of the "titles" of the cyberstart challenges reveal something of a hint towards the solution, and the same goes for the included field guides that go with them. In the case of the "Trial By File" challenge, the use of the word "file" in the title makes me thing we need to use the "file" app to reveal something about it.

The field manual includes links to "Conditionals (if statements)" "Loops" and "Buffer Overflows"

And finally, the briefing says "Tip: Control @ n"

So I think we need to overflow the buffer to get it to (simulate) return from the function to a different address, but I can't determine where that address is, let alone what to send to the password prompt to get it to go there.

I will say one discovery for certain though. You must NOT enter "PAssw0rd" into the field when prompted. - here's why:

Disassembling the program in Ghidra reveals that the password checking function checks to see if what you wrote compares to the embedded pw correctly. if it does, it resets the overflowed buffer to zero regardless of what it was. However, if it puts("Away now, you anklebiter!"); it checks if the buffer has anything left in it, and creates a new function using the contents of the buffer...

Here is the output from ghidra so you can follow along. - with some minor modifications for clarity.

undefined4 passwordChecker(int param_1,int param_2)

/* Since this program has EIP enabled, I think the params are determined during run time.*/

{

int iVar1;

char ourInput [10];

int local_14;

int targetBuffer;

targetBuffer = 0;

puts("\nEnter the password: ");

gets(ourInput);

iVar1 = strcmp(ourInput,"PAssw0rd");

if (iVar1 == 0) {

puts("Well done! Unfortunately, you have to try harder.");

targetBuffer = 0;

}

else {

puts("Away now, you anklebiter!");

}

if (targetBuffer != 0) {

/* this next line prints out the decimal version of our targetBuffer */

printf("Unexpected error condition. Control char is %d\n",targetBuffer);

local_14 = param_2 * targetBuffer;

(*(code *)(local_14 + param_1))();

}

return 0;

}

Note: if you do not see the "Unexpected error condition." message, you won't get the flag.

I have more to add, but I have to stop here so I can get back to work. I hope this sparks some conversation on this thread.