> For the complete documentation index, see [llms.txt](https://rock-or-something.gitbook.io/home/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://rock-or-something.gitbook.io/home/writeups/capture-the-flag/correlation-one/hardcoded-lies.md).

# Hardcoded Lies

## Description

This is a reverse engineering challenge. The challenge file `hardcodedlies` can be found [here](https://github.com/jerryarciaga/Rock-or-Something/tree/ctf-writeup/writeups/correlation-one-2025/files). Below is the challenge description:

![Description](https://2704509284-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQH8BQotIIolUZ3Q72SQU%2Fuploads%2Fgit-blob-702091c8af5b47ea551623334a7a4ee5731ed262%2Fdescription.png?alt=media)

## Writeup

The challenge description tells us to "pull some `strings`". Lets see what happens when we do:

```
$ strings hardcodedlies
__PAGEZERO
__TEXT
__text
__TEXT
__stubs
__TEXT
__cstring
__TEXT
__unwind_info
__TEXT
__DATA_CONST
__got
__DATA_CONST
__LINKEDIT
/usr/lib/dyld
/usr/lib/libSystem.B.dylib
Initializing network interface...
C1{h4rdc0ded_but_0verlooked}
_printf
__mh_execute_header
__mh_execute_header
_printf
radr://5614542
hardcodedlies
```

This is fairly easy, but also easy to miss if you've never heard of the `strings` utility. This is usually the first thing I run whenever I encounter reverse engineering challenges involving binary executables. They either give me the flag, a base64-encoded version of it, or an idea on what it does.