The main function of the binary:
undefined8 main(void)
{
header();
set_timer();
get_key();
print_flag();
return 0;
}
The program starts, sets a timer then ends before finishing execution of the other functions.
To solve this challenge I jumped over the set_timer instruction in pwndbg
pwndbg> start
Temporary breakpoint 1 at 0x91e
Temporary breakpoint 1, 0x000055555540091e in main ()
► 0x55555540091e <main+4> sub rsp, 0x10
0x555555400922 <main+8> mov dword ptr [rbp - 4], edi
0x555555400925 <main+11> mov qword ptr [rbp - 0x10], rsi
0x555555400929 <main+15> mov eax, 0
0x55555540092e <main+20> call header <header>
0x555555400933 <main+25> mov eax, 0
0x555555400938 <main+30> call set_timer <set_timer>
0x55555540093d <main+35> mov eax, 0
0x555555400942 <main+40> call get_key <get_key>
0x555555400947 <main+45> mov eax, 0
0x55555540094c <main+50> call print_flag <print_flag>
Some instructions later, after the header was called, I jumped to the get key instruction, waited for the program to finish and got the flag.
pwndbg> jump *0x55555540093d
Continuing at 0x55555540093d.
Creating key...
Finished
Printing flag:
PICOCTF{Good job keeping bus #190ca38b speeding along!}
[Inferior 1 (process 34782) exited normally]
pwndbg>