187,064 Instructions for One Flag: Reverse Engineering HTB Callfuscated Insane Challenge
The HackTheBox challenge Callfuscated presents a stripped 64-bit ELF binary that requests a password and prints either Correct or Incorrect flag. Inside the binary lies a heavily obfuscated verification routine built from four complementary techniques that survive static analysis but collapse under concrete execution.
The Obfuscation Arsenal
The protection consists of a custom VM whose bytecode resides in a 586-element array called program[]. A dispatcher reads the current program counter, fetches an opcode, and dispatches to handlers. Every arithmetic primitive is further expanded with Mixed Boolean-Arithmetic expressions. Opaque predicates double the control-flow graph with branches whose outcome is known at compile time. Finally, genuine instructions are wrapped inside thousands of call gadgets of the form pop r8; <insn>; call next, producing the 187,064-instruction count mentioned in the title.
Dynamic Reconnaissance
Because all four layers are execution-dependent, the author recorded a full instruction trace using ptrace with PTRACE_SINGLESTEP on a known input. The resulting log contained 187,064 lines together with register values after each instruction inside the image range 0x401000–0x40d000. A separate memory dumper extracted the VM program array and stack frames directly from the running process.
Building a Faithful Emulator
The trace was replayed inside a custom x86-64 emulator written in Python that parsed objdump output and implemented handlers for the thirty opcodes actually encountered. Two notable bugs were corrected during validation:
- rand() is invoked from four distinct call sites (0x409235, 0x40ad5b, 0x40af37, 0x40b10b) for a total of 192 calls; each return address must be calculated as call-site + 5 rather than assuming a single fixed location.
- Operand-size detection used a naïve substring check that incorrectly treated “DWORD PTR” as containing “WORD”, truncating 32- and 64-bit memory accesses.
After these fixes the emulator matched the original trace line-by-line and reached the final instruction at address 0x40b537 with eax equal to 0xffffffff, exactly as the real binary behaves on an incorrect password.
Recovering the VM Semantics
With a working emulator the author dumped the data stack after every dispatch and decoded the 586 VM instructions. The bytecode implements a simple stack machine whose relevant operations are:
- PUSH imm – push constant
- H2 – addition (used to compute input buffer address 0x40f080)
- DEREF – read input byte
- H5 – multiply accumulator by 256
- H7 – add next byte
- G8 / G3 – XOR with per-group constants
Consequently every four input characters are accumulated into a 32-bit big-endian word. Eight such words are XORed with the following constant pairs:
- (0x0915033a, 0x41414141)
- (0x427d7872, 0x11111111)
- (0x30310a00, 0x55555555)
- (0x2a052e32, 0x5a5a5a5a)
- (0xcff5ecdf, 0xaaaaaaaa)
- (0x1914031e, 0x77777777)
- (0xf6f7c6ad, 0x99999999)
- (0x6c6a524e, 0x33333333)
The resulting 32-bit values must all be zero for the password to be accepted. Solving each equation yields the flag bytes directly: HTB{******_**_***_********_*_**}.
Conclusion
The exercise demonstrates that even an extreme combination of VM-based dispatch, MBA, opaque predicates and call obfuscation remains vulnerable once execution is recorded and replayed. All four techniques ultimately depend on concrete runtime values that a faithful emulator can capture and simplify.
Related articles
HollowGraph Malware Abuses Microsoft 365 Calendars to Conceal Stolen Files and C2 Traffic
A newly discovered espionage malware called HollowGraph turns compromised Microsoft 365 calendars into hidden channels for receiving commands and exfiltrating stolen data. The implant schedules events for 13 May 2050, a distant future date chosen to reduce the likelihood of discovery by account owners. Developed as a Windows DLL, HollowGraph leverages the Microsoft Graph API to blend its traffic with legitimate corporate service activity, eliminating the need to contact attacker-controlled servers directly. It supports two primary commands: “get” to retrieve instructions attached to operator-created appointments and “send” to encrypt collected data with RSA and AES-256-GCM before uploading it as calendar attachments. Separate encryption keys are used for inbound commands and outbound data, while stolen files are written to a disguised logAzure.txt file. Researchers have identified at least 12 compromised systems, three of which remained active, with operations observed between 3 June and 9 July 2026 and primarily targeting Israeli entities.
ClickLock Stealer Locks macOS Until Victims Enter Real Passwords and Exfiltrates Browser, Crypto and Keychain Data
Researchers at Group-IB have discovered a new macOS infostealer called ClickLock that blocks normal computer operation until the user supplies valid account credentials. The campaign, active since May 2026, has already affected at least 100 victims across 33 countries. Infection begins with a fake Cloudflare verification page that tricks users into pasting a command into Terminal, after which the malware silently downloads four modules from compromised WordPress sites. A convincing macOS password prompt then appears; ClickLock validates the entered password locally and only forwards working credentials to the operators. Two persistent LaunchAgent modules repeatedly close all visible applications and force Keychain authorization, while a separate process disables Notification Center for several hours. The malware harvests data from eight browsers, 31 crypto-wallet extensions, seven password managers, eight desktop wallets, Keychain items, command history, FTP credentials and six blockchain addresses before exfiltrating everything via Telegram bots and hijacked domains, leaving behind a disguised GSocket backdoor.
New Russian Translations of Leading Cybersecurity Books on Ethical Hacking, Reverse Engineering, Malware Analysis, and Privacy Released
A popular Russian library project has published fresh translations of more than a dozen top-tier English-language books covering ethical web hacking, bug bounty hunting, network protocol attacks, binary reverse engineering, malware analysis, fuzzing, and privacy protection. The updates continue the long-running “Materials on Hacking in Russian” series, with all books made freely available through the Hackbooks platform. Titles include Web Hacking 101, Real-World Bug Hunting, the official Nmap guide, Attacking Network Protocols, a comprehensive beginner’s reverse engineering textbook, and specialized works on binary format analysis, obfuscation techniques, Windows security internals, Practical Malware Analysis, Evasive Malware, and The Fuzzing Book. Additional volumes address the history of state surveillance, Crypto Wars, and the societal implications of mass data collection. Each book entry features detailed descriptions, practical examples, and direct links to the corresponding Hackbooks cards, enabling Russian-speaking researchers and students to study advanced information security topics without language barriers.
TELEPUZ Malware Spreads via ClickFix Social Engineering, Targets Windows with Modular Capabilities and Resilient C2 Infrastructure
Since late April 2026, compromised websites have been distributing the new modular malware TELEPUZ through the ClickFix scheme. Attackers replace standard browser error fixes with instructions that trick users into pasting and executing a PowerShell command from the clipboard, which then downloads an intermediate loader, the Vidar infostealer, and finally TELEPUZ via rundll32.exe. The malware performs extensive environment checks to avoid sandboxes and debuggers before disabling Windows security features, escalating privileges, and persisting as a service inside svchost.exe. For command-and-control, TELEPUZ relies on WebSocket connections with multiple fallback mechanisms, including encrypted links stored in Telegram profiles, Steam accounts, DNS records, and a Polygon smart contract. It offers a wide range of capabilities such as file manipulation, keylogging, screenshot capture, process management, cookie theft from Chromium browsers, and arbitrary JavaScript execution in both Chromium and Firefox. Researchers at Elastic assess TELEPUZ as a malware-as-a-service offering still in early development, evidenced by a limited number of C2 domains yet frequent daily builds and rapid updates hosted on compromised sites in Brazil and India.