Hackthebox - Golfer - Reversing

Downloaded an ELF file.

Opened in Ghidra. Saw an entry point, seemed like a simple program with a couple of sys calls.

There is entry and FUN_0800012f which is an undefined function (FUN_*).

FUN_0800012f() is called about 21 times, so it could be spelling out the flag?

golfer

Each function references registers. If you double click them it will take you to the data.

Took me a while to realise but I had to convert the bytes into chars by right clicking > data > char.

If you follow the given sequence in the undefined function, it will spell out the following flag:

HTB{y0U_4R3_a_g0lf3r}