Bypass Me: Extract Passwords from Memory 🛡️ | picoCTF 2026

In this picoCTF 2026 writeup for Bypass Me, we explore a reverse engineering challenge where a binary sanitizes all user input to prevent common exploits. Instead of trying to bypass the filter manually, we use the LLDB debugger to look under the hood. By disassembling the main function, we identify a decode_password function that places the cleartext password into memory. We walk through setting breakpoints and inspecting the stack at RBP - 0x110 to extract the secret "SuperSecure" password and capture the flag.

https://play.picoctf.org/practice/challenge/761

Video Chapters
00:00 Introduction to Bypass Me
00:35 Connecting via SSH
01:40 Introduction to LLDB Debugger
02:02 Testing Input Sanitization
02:24 Disassembling the Main Function
03:03 Identifying the Password Decoding Logic
03:24 64-bit Calling Conventions (RDI Register)
04:33 Setting Breakpoints in LLDB
05:14 Inspecting Memory to Extract Password
06:19 Authenticating & Flag Capture
06:47 Mitigation & Security Best Practices

#picoctf2026 #reverseengineering #lldb #debugging #cybersecurity #ctf #hacking #ethicalhacking