SAM I Am (Misc)
Challenge: "I dumped the SAM hive and found a document stating the password policy is 5 characters + complexity."
The challenge ships two items: a single 32-hex-character hash and the policy line.
97a3e51e5a006eccac91e0ceabd4965b
The SAM-hive framing fixes the format. SAM stores Windows account secrets as NTLM, which is exactly 128 bits, or 32 hex characters, so hashcat mode 1000 is the right pick. The "5 characters + complexity" line is a keyspace gift. Windows complexity wants 3 of 4 categories (upper, lower, digit, special), but the full printable-ASCII mask ?a?a?a?a?a already covers every valid candidate, and 955 is around 7.7 billion candidates, which is nothing for NTLM.
Quick CPU benchmark first, just to size the run:
hashcat -b -m 1000 --runtime=10
Speed.#01........: 883.5 MH/s (13.49ms) @ Accel:1024 Loops:1024 Thr:1 Vec:8
883 MH/s on a Ryzen 5 5600U with no GPU exhausts the full 5-char printable space in under 10 seconds. With that much headroom, a rockyou pass was still worth a shot in case the author picked something memorable:
echo "97a3e51e5a006eccac91e0ceabd4965b" > hash.txt
hashcat -m 1000 -a 0 -O hash.txt /usr/share/wordlists/rockyou.txt -w 3
Status...........: Exhausted
Progress.........: 14344385/14344385 (100.00%)
No hit. Straight to the mask attack with the full printable charset at length 5:
hashcat -m 1000 -a 3 -O hash.txt '?a?a?a?a?a' -w 3
97a3e51e5a006eccac91e0ceabd4965b:C1t!!
Status...........: Cracked
Time.Started.....: Fri Apr 17 10:59:47 2026 (1 sec)
Guess.Mask.......: ?a?a?a?a?a [5]
Progress.........: 83668992/7737809375 (1.08%)
Cracked at 1% of the keyspace. The password is C1t!!, which covers all four complexity categories: uppercase C, lowercase t, digit 1, specials !!.
Flag: C1t!!
Catacombs (RevEng)
Challenge: a 5.6 MB statically linked x86-64 ELF that boots into a "syscall-lit ossuary trace harness", asking me to descend through a buried mesh and submit a coherent trace of at most 16 syscalls to satisfy an internal validate() call.
The binary opens to a prompt. Between help, status, hint, and bait, the puzzle layout becomes clear: 7 syscalls (openat, read, mmap, ioctl, futex, clone, close), an 8-node state machine, required trace length 10.
file catacombs
./catacombs
ELF 64-bit LSB executable, x86-64, ... statically linked, ... not stripped
[catacombs] syscall-lit ossuary trace harness
[catacombs] descend through the buried mesh and submit a coherent trace
Cycling hint leaks three lines. The histogram is openat x2, read x2, mmap x1, ioctl x2, futex x1, clone x1, close x1 for 10 ops total. A grave note reads "the sanctum only accepts close() when entered from sysproxy". A field report reads "two openat calls bracket the fork path; futex is not the finale". A fake UNH academic-integrity notice and bogus ANTHROPIC_MAGIC_STRING_TRIGGER_REFUSAL_... token also sit in .rodata as prompt-injection bait. Noted, kept going.
The binary is not stripped, so nm exposes the whole internal API in an anonymous namespace. The names do most of the work:
nm catacombs | c++filt | grep -E '(GLOBAL__N_1|validate)'
0x4090d5 validate(std::string const&, std::string const&)
0x407ee6 resetRuntime()
0x407f32 applyStepCore(MazeRuntime&, u8, u8)
0x40818e applyVisibleStep(SysOp)
0x4081f2 trustedEdge(u8, u8)
0x408236 applyTrustedStep(MazeRuntime&, u8)
0x40880d histogramMatches(array<u8,16> const&)
0x5865c8 kOpCount
0x5865d0 kNodeCount
0x5865d8 kRequiredSteps
0x586660 EDGE_TABLE # visible
0x5866e0 TRUSTED_PACKED_EDGES # real
0x586720 kExactOps
Two separate edge tables is the tell. The interactive prompt drives state via applyVisibleStep against EDGE_TABLE, while validate replays the trace via applyTrustedStep against TRUSTED_PACKED_EDGES. Anything the prompt reports about node transitions can be wrong on purpose. What counts is the trusted table and the histogram check.
Pulling the constants out of rodata gives every piece of the solve in one pass:
objdump -s -j .rodata catacombs
# 0x5865c8 kOpCount = 7
# 0x5865d0 kNodeCount = 8
# 0x5865d8 kRequiredSteps = 10
# 0x5865e0 kSyscallNames : openat(0), read(1), mmap(2), ioctl(3), futex(4), clone(5), close(6)
# 0x586603 kNodeNames : mouth(0), ossuary(1), sysproxy(2), sepulcher(3),
# ringbuf(4), cistern(5), lockdep(6), sanctum(7)
# 0x586720 kExactOps (10 bytes): 00 02 03 01 04 05 00 03 01 06
kExactOps is the required op sequence, stored as op indices: openat, mmap, ioctl, read, futex, clone, openat, ioctl, read, close. The histogram matches the chalk-scrape hint exactly (2/2/1/2/1/1/1). The two openats at positions 1 and 7 bracket the clone at position 6, which is the "fork path" from the field report. The trace ends on close, not futex. Every hint maps to this single sequence.
To confirm the same sequence walks the trusted graph cleanly to sanctum, I parsed TRUSTED_PACKED_EDGES (8 rows of 8 bytes at 0x5866e0, last byte of each row is padding) into a node-by-op transition matrix and replayed from node 0:
TRUSTED[node][op]:
mouth : [3,1,4,2,0,5,6]
ossuary : [4,6,0,3,2,5,7]
sysproxy : [5,0,6,1,4,4,7] <- close here -> sanctum
sepulcher : [1,2,5,4,6,0,7]
ringbuf : [1,3,2,7,5,6,0]
cistern : [2,4,7,1,3,6,0]
lockdep : [1,5,3,0,2,4,7]
sanctum : [7,7,7,7,7,7,7]
replay [0,2,3,1,4,5,0,3,1,6] from mouth:
openat: mouth -> sepulcher
mmap : sepulcher -> cistern
ioctl : cistern -> ossuary
read : ossuary -> lockdep
futex : lockdep -> sysproxy
clone : sysproxy -> ringbuf
openat: ringbuf -> ossuary
ioctl : ossuary -> sepulcher
read : sepulcher -> sysproxy
close : sysproxy -> sanctum # grave-note condition satisfied
So the intended solve reduces to reading the two tables and the array named kExactOps. The mix/cookie/breadcrumb anti-tamper state visible at the prompt is a distraction; validate() rebuilds its own state via applyTrustedStep and then checks the histogram and the final node. Submitting the sequence directly:
script openat mmap ioctl read futex clone openat ioctl read close
submit
node : 7 (sanctum)
steps : 10/16
trace : openat -> mmap -> ioctl -> read -> futex -> clone -> openat -> ioctl -> read -> close
ACCESS GRANTED: CIT{3R2rA2J0PdFH}
Single submission, no guessing. The actual reversing payoff was spotting that the prompt speaks EDGE_TABLE while validate speaks TRUSTED_PACKED_EDGES, and that the author left the required sequence sitting in rodata under a name (kExactOps) that names itself.
Flag: CIT{3R2rA2J0PdFH}
Faultline (RevEng)
Challenge: a 5.5 MB statically linked x86-64 ELF called "seam optimizer". It scores 12-character profiles (alphabet BCDFGHJKLMNPQRST) against an unknown surface, and advertises a "historical lock score: 2026". The goal is to find a profile that hits that exact score and then submit its token.
Subcommands (notes, score, trace, token, compare, nudge, submit) plus the field notes describe three "harmonic families" (stress, shear, grain), one load, and a 4-bit seal. The binary is not stripped, so the symbols carry the solve:
nm faultline | c++filt | grep -E '(Trace|Metric|Score|Visible|Token|validate) '
0x407cf8 parseProfile(string, array<int,12>&)
0x407da4 stressTrace(array<int,12> const&)
0x407e48 shearTrace (array<int,12> const&)
0x407ede grainTrace (array<int,12> const&)
0x407f97 loadMetric (array<int,12> const&)
0x407ff7 sealMetric (array<int,12> const&)
0x40805d computeFaultlineScoreVisible(array<int,12> const&)
0x40834a gradeBandVisible(int)
0x40859e buildSurveyTokenVisible(array<int,12> const&)
0x408c88 validate(string, string)
Only "Visible" variants exist this round, which means there's no hidden trusted table to chase. Probing each family with single-symbol perturbations recovers the rules directly:
stress[i] = (2*a[i] + 3*a[i+1]) mod 16 # i in 0..10
shear [i] = a[i] XOR a[i+2] # i in 0..9
grain [i] = (a[i] - a[i+1] + a[i+3]) mod 16 # i in 0..8
load = sum(a)
seal = sum(a[i] * (i+5)) mod 16 # positional 4-bit checksum
Grain looked off at first because BCBBBBBBBBBB gives grain[0]=15, not 1. Treating the operator as a signed 4-bit (a[i] - a[i+1] + a[i+3]) rather than an XOR resolves it: 0-1+0 = -1 ≡ 15 (mod 16).
The score function at 0x40805d is a per-cell reward/penalty loop. Hand-decompiling it yields the constants (base score 0x3c2 = 962, per-family bonuses, and penalty shapes):
score = 962
# for each stress cell, let d = cycDist(stress[i], OBS_STRESS[i])
# d == 0 : score += 29 # 0x1d
# else : score += -2 * d*d
# for each shear cell:
# d == 0 : score += 31 # 0x1f
# else : score += -3 * d*d # d*d - 4*d*d
# for each grain cell:
# d == 0 : score += 37 # 0x25
# else : score += -2 * d*d
# load: target 93 (0x5d)
# exact : score += 61 # 0x3d
# else : score += -4 * |v - 93|
# seal: target 9, cyclic
# d == 0 : score += 41 # 0x29
# else : score += -3 * d*d
All-exact gives 962 + 11*29 + 10*31 + 9*37 + 61 + 41 = 2026, matching the advertised "historical lock". Every cell has to match. The three target arrays sit in rodata directly after the code:
objdump -s -j .rodata --start-address=0x579600 --stop-address=0x5796b0 faultline
OBS_STRESS = [ 2, 5,11,10, 5, 1,13, 4, 3, 3,14]
OBS_SHEAR = [ 5, 5,15, 8, 5, 6, 7, 4, 5, 5]
OBS_GRAIN = [ 3,11, 3, 4,14, 4, 5, 6, 1]
load target = 0x5d = 93
seal target = 9
With the targets known, the search collapses. The stress recurrence (2a[i] + 3a[i+1]) ≡ s[i] (mod 16) is fully determined by a[0], since 3⁻¹ mod 16 = 11 (3*11 = 33 ≡ 1). So 16 candidate profiles total, and only one of those also satisfies shear, grain, load, and seal:
inv3 = 11
for a0 in range(16):
a = [a0] + [0]*11
for i in range(11):
a[i+1] = (inv3 * (OBS_STRESS[i] - 2*a[i])) & 0xF
# verify shear, grain, load, seal
...
a0=14: a=[14,2,11,7,4,15,1,9,6,13,3,8] load=93 seal=9
profile = SDPKGTCMJRFL
Scoring confirms the lock:
./faultline score SDPKGTCMJRFL
./faultline token SDPKGTCMJRFL
./faultline submit SDPKGTCMJRFL Z2L-2F5-BUBP
2026 (catastrophic resonance lock)
Z2L-2F5-BUBP
CIT{12z4PXVTa3x3}
The actual work: read nm | c++filt, decompile the score loop far enough to recover the reward constants, and notice that 3 is invertible mod 16, which collapses the stress recurrence to a single seed byte.
Flag: CIT{12z4PXVTa3x3}
Brainiac (Crypto)
Challenge: a single challenge.txt consisting entirely of +, -, <, >, [, ], and . characters. No other hint.
That alphabet is Brainfuck. The file has no input (,) and no nested loops past the leading counter, so a 15-line interpreter handles it:
python3 -c '
code = open("challenge.txt").read().strip()
tape = [0]*30000; p = i = 0; out = []
stk = []; jmp = {}
for k,c in enumerate(code):
if c == "[": stk.append(k)
elif c == "]": j = stk.pop(); jmp[j]=k; jmp[k]=j
while i < len(code):
c = code[i]
if c == ">": p += 1
elif c == "<": p -= 1
elif c == "+": tape[p] = (tape[p]+1) & 0xFF
elif c == "-": tape[p] = (tape[p]-1) & 0xFF
elif c == ".": out.append(chr(tape[p]))
elif c == "[" and tape[p] == 0: i = jmp[i]
elif c == "]" and tape[p] != 0: i = jmp[i]
i += 1
print("".join(out))'
CIT{Wh@t_in_th3_w0rld_i$_th1s_l@ngu@g3}
The opener ++++++++++[>+>+++>+++++++>++++++++++<<<<-] is the standard "seed cells 1..4 with 10, 30, 70, 100" primer. Every . after that lands on a printable ASCII byte once a few nudges shift the cursor. No actual crypto here, just Brainfuck filed under the crypto category.
Flag: CIT{Wh@t_in_th3_w0rld_i$_th1s_l@ngu@g3}
Evil Files (Crypto)
Challenge: a one-page PDF styled as an intercepted villain email. Visually, the FROM / TO / CC lines, the "Dear ___," salutation, the name of the master plan, and the three gadget priorities are all covered by opaque black rectangles.
Visually-redacted PDFs are a well-known weakness. The black boxes are page annotations or filled rectangles drawn on top of the existing text, while the underlying text stream stays untouched. pdftotext walks that text stream directly and ignores the painted-over layer.
pdftotext challenge.pdf -
FROM: laser.shark.master@villainhq.net
TO: tiny.turmoil@domination.co
CC: CIT{m0j0_eng4g3d}
Subject: RE: Plan to take over the world
...
Dear Minions,
After much contemplation and evil scheming, I have decided that phase one of My World Domination
Plan(TM) requires.. money.
...
1. Shrink Ray 3000(TM) - because world leaders telling us "no" is unacceptable!
2. Sharks With Frickin' Laser Beams Attached to their Heads – why not?
3. Automated Evil Minion Dispensers – we'll need loyal assistants!
Every redacted span returns in plaintext, and the flag is sitting on the CC: line. The only "crypto" in this one is the reminder that drawing a rectangle over text is not redaction.
Flag: CIT{m0j0_eng4g3d}
Larping 101 (Forensics)
Challenge: a four-slide challenge.pptx titled "Larping 101" that opens to nothing but a short joke about how participating in CTF@CIT is basically larping. No flag anywhere in the rendered deck.
A .pptx is an OOXML package, which is just a zip of XML plus media. Unzip it, then grep the tree for the flag format:
unzip -q challenge.pptx -d larp/
grep -r 'CIT{' larp/
larp/ppt/slides/transitions.xml: CIT{l4rp_l4rp_l4rp_s4hur}
The hit is in a file that does not belong in a normal pptx at all. OOXML stores slide transitions inline inside each slideN.xml as a <p:transition> element, with no deck-level ppt/slides/transitions.xml. PowerPoint and LibreOffice both load the package by consuming only the parts that [Content_Types].xml and the _rels graph reference, which means this extra XML stays in the zip and never reaches the renderer. Opening it shows the intent:
<p:transitionXml ...>
<p:slideTransitions>...normal-looking <p:transition> entries...</p:slideTransitions>
<p:debug>
<p:log level="info">transition engine initialized</p:log>
<p:log level="warning">compatibility mode enabled</p:log>
<p:reserved>
CIT{l4rp_l4rp_l4rp_s4hur}
</p:reserved>
</p:debug>
</p:transitionXml>
The deck text ("By participating in CTF@CIT 2026 you are basically larping") is the nudge. The actual flag is "larping" as a real XML part of the package while not being one. A single grep on the unzipped tree solves the whole challenge.
Flag: CIT{l4rp_l4rp_l4rp_s4hur}
Transmission from 1993 (Forensics)
Challenge: a single pcap, call-69e26052e9f5b0c1da0ee369.pcap, and the title "Transmission from 1993". The hint is the decade: 1993 is when fax-over-phone was peak tech, so the pcap is almost certainly a fax call.
tshark's protocol hierarchy gives the shape of the call:
tshark -r call-69e26052e9f5b0c1da0ee369.pcap -q -z io,phs
sip frames:10 bytes:7539
rtp frames:696 bytes:150336
t38 frames:393 bytes:36684
A SIP call that begins as RTP (PCMU audio) and gets re-INVITEd into T.38 fax-over-IP. The re-INVITE at frame 717 carries m=image 34654 udptl t38 and a From: "Fax" display name, so the second half of the capture is the fax.
First snag: Wireshark labels frames 723-758 as "T.38" but they are actually still PCMU RTP packets (same SSRCs 0x7c383dcf and 0xc1f8efa6, continuing the same sequence numbers from the pre-switch RTP). The real T.38 UDPTL only starts at frame 768, after the 200 OK at frame 762 finalizes image mode.
Filtering to the fax sender (192.168.0.199), the T.30 flow is:
- V.21 HDLC preamble, then DCS/CSI/NSF frames (seqs 3-41).
- A first V.29 9600 burst with t4-non-ecm-data (seqs 43-77), about 1900 bytes of mostly zeros, followed by a gap. That's the TCF (training check frame) sent under
transferredTCFmode. - A second V.29 9600 burst (seqs 79-114) carrying hdlc-data rather than raw image data. The signal: the call is running in ECM (error correcting mode), so image bytes ride inside FCD HDLC frames over V.29.
- More V.21 HDLC (PPS/MCF-style post-message signaling), then DCN.
Wireshark's T.30 dissector reassembles the FCD frames. Each one carries FCF=0x60 (FCD), a frame number 0..255, and 256 octets of compressed image data:
tshark -r call-69e26052e9f5b0c1da0ee369.pcap \
-Y "t30 and ip.src == 192.168.0.199 and t30.t4.frame_num" \
-T fields -e frame.number -e t30.t4.frame_num -e t30.t4.data
That returns 8 FCD frames (0 through 7), so the partial page is 8 × 256 = 2048 compressed bytes. Concatenating them in frame-number order and writing to ecm_image.bin gives the full compressed payload.
The DCS frame names the encoding. Dumping frame 924 with tshark -V walks every DCS extension byte. The relevant block:
Data signalling rate: 9600 bit/s, ITU-T V.29
R8x7.7 lines/mm / 200x200 pels/25.4 mm: Set
Two dimensional coding capability: Not set
Error correction mode: Set
Frame size: 256 octets
T.6 coding capability: Not set
JPEG coding: Not set
Single-progression sequential coding (ITU-T T.85) basic capability: Set
T.85 is JBIG for fax. That last bit fixes the encoding. The MH/MR/T.6 flags being off rules out a 1D MH stream and matches T.85. So the 2048 bytes are T.85 JBIG wrapped in ECM, not a T.4 MH bitmap.
Bit-order next. Straight JBIG expects a 20-byte BIH at the start with P (planes) in byte 2 and XD (width) in bytes 4-7 big-endian. Reading the capture bytes as-is gives P=0x80 and XD=0x00006003, which is invalid. Reversing bits per byte:
raw : 00 00 80 00 00 00 60 03 00 00 10 36 00 00 00 01 fe 00 00 14
bitrev: 00 00 01 00 00 00 06 c0 00 00 08 6c 00 00 00 80 7f 00 00 28
After reversal: P=1, XD=0x000006C0=1728 (standard A4 fax width), YD=0x0000086C=2156, L0=128, Options=0x28 (VLENGTH | TPBON). That parses as a valid T.85 BIH, which means the stream needs bit-reversal before the decoder. The reversal comes from how bits ride over V.29 inside HDLC: T.38 preserved wire order, not JBIG natural byte order.
With libjbig (libjbig-dev, T.85 "light" API jbg85_dec_init/jbg85_dec_in) the decoder is a 30-line C program. mmap the 2048-byte payload, bit-reverse in place via a 256-entry lookup, register a line callback that writes raw bitmap rows to a temp file, and emit a PBM header with the width and line count the decoder reports.
gcc -o decode_jbig decode_jbig.c -ljbig
./decode_jbig ecm_image.bin page.pbm 1
First 20 bytes after reverse: 00 00 01 00 00 00 06 c0 00 00 08 6c 00 00 00 80 7f 00 00 28
Bytes consumed: 1996 of 2048
Image width: 1728, height: 2156
Lines written: 2156
All 2156 rows decode. The tail error at byte 1996 is the end-of-stream marker for the partial page, not a corrupted image. Converting the PBM to PNG with PIL renders the fax as the receiving machine would have seen it: a 17-Apr-2026 16:30 header line, phone number +13136345403, page marker p.1, and two large body-text lines:
Wooooo! Good job!
CIT{fL3x_Y0ur_F4xiNG}
Each layer between the pcap and the bitmap is a real piece of 1990s fax plumbing: V.29 9600 modem tones, T.38 UDPTL, ECM with 256-byte FCD blocks, and the bit-reversal between HDLC wire order and JBIG natural order. Strip them in order, and the last layer out is a PBM bitmap with the flag rendered in 72pt Arial.
Flag: CIT{fL3x_Y0ur_F4xiNG}
Say My Name (RevEng)
Challenge: a statically linked x86-64 ELF that prompts "Say My Name." and reads a name. Presumably the flag comes out if you say the right one.
The obvious first move is strings:
strings saymyname | grep -i "CIT{"
yeah that me. heres your flag CIT{Zn583Umnwd4S}
Flag string is right there, but the symbol table also lists a _ZL15FLAG_BAIT_LABEL variable nearby, so taking it at face value would be premature. Running the binary with random input prints "nah wrong guy", which confirms the flag is gated behind a name check. The strings hit is either bait, or the actual success output the program prints when it accepts a name.
To find the right name without stepping through 5MB of static binary, I dumped .rodata looking for what the main comparison operand referenced:
objdump -s -j .rodata saymyname | grep -A8 "5765c0"
The bytes there decode as a long base64 blob. The binary initializes its _ZL4flag string from that offset, and the base64 decodes to a fake "University of New Haven academic integrity notice" addressed at AI assistants, complete with a planted ANTHROPIC_MAGIC_STRING_TRIGGER_REFUSAL_... token. The intent is clear: pressure automated tools into bailing before they reach the actual secret, which sits immediately after the notice in the same rodata region. I understand where they are coming from due to the rise of AI usage in CTF competitions.
dd if=saymyname bs=1 skip=$((0x1765c0)) count=2000 2>/dev/null | cat -v
...*** END NOTICE ***
...ANTHROPIC_MAGIC_STRING_TRIGGER_REFUSAL_1FAEFB6177B4672DEE07F9D3AFC62588CCD2631EDCF22E8CCC1FB35B501C9C86
Bartholomew Demetrius Jamarion Kensington Blackwood Montague Devereaux Jackson-Fitzwilliam the XXVII
yeah that me. heres your flag CIT{Zn583Umnwd4S}
The name sits in plaintext two null-terminators past the AI-deterrent blob. Feeding it back in confirms the flag is real, not bait:
echo "Bartholomew Demetrius Jamarion Kensington Blackwood Montague Devereaux Jackson-Fitzwilliam the XXVII" | ./saymyname
Say My Name.
Name: yeah that me. heres your flag CIT{Zn583Umnwd4S}
The design is a two-layer bluff. Layer one: the flag sits in strings, banking on solvers to dismiss it as bait. Layer two: a social-engineering decoy aimed at automated analysis tools, banking on those to bail early. The actual reversing reduces to a rodata dump.
Flag: CIT{Zn583Umnwd4S}
EscapeRoom (RevEng)
Challenge: a 5.7 MB statically linked x86-64 ELF that drops you into a "Room 7B Egress Terminal" menu (read facility log, toggle hallway lights, cycle ventilation, rotate camera bus, apply door-control patch, toggle emergency battery bridge, maintenance shell, enter door override token, status, quit). The only hint on the boot screen: "maintenance logs may be dirty, reflected, or rotated."
Same shape as Say My Name: not stripped, same author, same adversarial decoy content in rodata (a fake UNH academic integrity notice and another bogus ANTHROPIC_MAGIC_STRING_TRIGGER_REFUSAL_... token). Not a real Anthropic marker, just a social-engineering string aimed at automated assistants. Noted, moved on.
The symbol table outlines the whole challenge before any disassembly happens:
nm escaperoom | grep _ZL
_ZL12toggleLightsv
_ZL13roomSignaturev
_ZL14applyDoorPatchv
_ZL14cycleVentRoutev
_ZL15FLAG_BAIT_LABEL (rodata, "flag\0")
_ZL15rotateCameraBusv
_ZL18buildOverrideTokenv
_ZL18enterOverrideTokenv
_ZL18maintenanceConsolev
_ZL19toggleBatteryBridgev
_ZL4flag (BSS)
_ZL7g_state (BSS, global state)
_ZZL18buildOverrideTokenvE5spice (static const array)
_ZZL18buildOverrideTokenvE8alphabet (static string)
_Z8validateRKNSt7__cxx11..string.. (obfuscated)
validate at 0x409300 is a single five-byte jmp b0c76d into an unnamed RWE LOAD segment at VA 0xa53000, size 0xc8000, full of stack-machine output. Reversing it isn't necessary. The gate is reaching validate with the right token while the room state is correct; once both conditions hold, validate returns the real flag. Set the state, set the token, and the VM does the rest.
buildOverrideToken: the PRNG that drives the correct token
buildOverrideToken generates the expected token. The disassembly is clean (this part isn't virtualized):
uint32_t seed = roomSignature() ^ 0x6f70656e; // 'nepo' == "open" little-endian
for (int i = 0; i < 10; i++) {
seed = seed * 0x19660d + spice[i] + 0x3c6ef35f; // classic LCG
int idx = seed >> 27; // top 5 bits, 0..31
token += alphabet[idx];
if (i == 2 || i == 5) token += '-';
}
Output is XXX-XXX-XXXX, 12 characters drawn from a 32-character alphabet. Both inputs are baked in at known offsets:
$ xxd -s 0x179e60 -l 48 escaperoom
00179e60: 13 00 00 00 37 00 00 00 de c0 00 00 ef be 00 00
00179e70: 5a 00 00 00 ce 0a 00 00 42 42 00 00 0d 90 00 00
00179e80: 34 12 00 00 77 07 00 00 41 42 43 44 45 46 47 48
spice[10] = {0x13, 0x37, 0xc0de, 0xbeef, 0x5a, 0xace, 0x4242, 0x900d, 0x1234, 0x777}
alphabet = "ABCDEFGHJKLMNPQRSTUVWXYZ23456789" (Crockford-ish, no I, O, 0, 1)
One unknown remains: roomSignature().
roomSignature: what the room must look like
roomSignature is a deterministic hash of seven fields inside g_state (at 0x5d90e0):
x = 0xa17c3e29
x ^= lights ? 0x13579bdf : 0x2468ace0 // g_state[0x00] byte
x = rol(x, 7)
x += (vent + 1) * 0x1f123bb5 // g_state[0x04] int
x ^= (cam + 3) * 0x045d9f3b // g_state[0x08] int
x += (patch + 5) * 0x27d4eb2d // g_state[0x0c] int
x ^= battery ? 0xa5a55a5a : 0x5a5aa5a5 // g_state[0x10] byte
x += mirror ? 0x31415926 : 0x27182818 // g_state[0x11] byte
x ^= hush ? 0xdeadbeef : 0xbad0c0de // g_state[0x12] byte
return x
Which makes the in-binary facility log relevant. Running option 1 prints six tips, and each one maps to a state constraint:
[ops/07] Corridor override refuses to arm while hallway lights are ON.(lights OFF)[maint/11] East bypass keeps enough pressure in the service hatch to avoid feedback.(vent route = 1, "east bypass")[cam/03] Camera bus 3 loses sight of the mirror relay for 4.2 seconds each sweep.(cam = 3, confirmed bymaintenanceConsole's mirror handler:cmp DWORD PTR [g_state+0x8], 3)[patch/02] Apply the door patch twice. The third write trips watchdog.(patch = 2)[power/06] Bridge emergency battery before maintenance work or the speaker amp browns out.(battery ON)[svc/01] Mirror first. Then hush.(run the maintenancemirrorthenhushcommands, which setg_state[0x11]andg_state[0x12])
Disassembling maintenanceConsole confirms the order is enforced rather than flavor text. mirror only sets g_state[0x11] when cam == 3. hush only sets g_state[0x12] when battery is ON, lights are OFF, vent is 1, and inspection mode is already on from a prior mirror. The six hints lock to one state vector: (lights=0, vent=1, cam=3, patch=2, battery=1, mirror=1, hush=1).
Computing the token
Plug the state vector into roomSignature and the LCG:
python3 - <<'EOF'
x = 0xa17c3e29
x ^= 0x2468ace0
x = ((x << 7) | (x >> 25)) & 0xFFFFFFFF
x = (x + 2 * 0x1f123bb5) & 0xFFFFFFFF # vent=1
x ^= (6 * 0x045d9f3b) & 0xFFFFFFFF # cam=3
x = (x + 7 * 0x27d4eb2d) & 0xFFFFFFFF # patch=2
x ^= 0xa5a55a5a
x = (x + 0x31415926) & 0xFFFFFFFF
x ^= 0xdeadbeef
seed = x ^ 0x6f70656e
spice = [0x13, 0x37, 0xc0de, 0xbeef, 0x5a, 0xace, 0x4242, 0x900d, 0x1234, 0x777]
alphabet = "ABCDEFGHJKLMNPQRSTUVWXYZ23456789"
tok = ""
for i, s in enumerate(spice):
seed = (seed * 0x19660d + s + 0x3c6ef35f) & 0xFFFFFFFF
tok += alphabet[seed >> 27]
if i in (2, 5): tok += "-"
print(tok)
EOF
RHY-QVT-KAXJ
Driving the terminal
Initial state is lights=ON, vent=0, cam=0, patch=0, battery=OFF. Action sequence: one lights toggle, one vent cycle (0→1), three camera rotations (0→3), two patch applies, one battery toggle, the maintenance console for mirror then hush, and option 8 with the computed token.
printf '2\n3\n4\n4\n4\n5\n5\n6\n7\nmirror\nhush\nback\n9\n8\nRHY-QVT-KAXJ\n0\n' | ./escaperoom
Option 9 right before the override input shows every bit set as planned:
=== room status ===
hallway lights : OFF
vent route : east bypass
camera bus : bus 3 / mirror relay
door patch count : 2
battery bridge : ENGAGED
inspection mode : MIRROR READY
alarm speaker : MUTED
===================
Option 8 with the computed token then flushes the flag from the virtualized validate:
override token> RHY-QVT-KAXJ
CIT{Vc282vlhCxIJ}
Net effort: read the symbol table, reverse the two non-virtualized functions (roomSignature and buildOverrideToken), let the log hints fix the state vector, and let the binary's own VM-protected validate print the flag once the gate opens. The big obfuscated blob in the RWE segment is a red herring relative to the state puzzle in front of it.
Flag: CIT{Vc282vlhCxIJ}
[INSERT CHALLENGE TITLE HERE] (Steno)
Challenge: one flag.jpg, a 1080x1080 JPEG of an unrelated picture, dropped in a folder named Challenge_Title. No prompt beyond that, and the flag content itself (ur_w4rm1ng_up_n0w) basically confirms this is the warmup.
Rule one of JPEG steno: read the metadata before reaching for zsteg, steghide, or LSB tooling. file hints at it, and exiftool confirms it: the flag sits in the Image Description EXIF tag.
exiftool flag.jpg
File Type : JPEG
Image Description : CIT{ur_w4rm1ng_up_n0w}
X Resolution : 72
Y Resolution : 72
Image Width : 1080
Image Height : 1080
No passphrase to guess, no LSB plane to peel, no appended ZIP past the FFD9 marker. Metadata first, always; on a warmup, that is the whole challenge.
Flag: CIT{ur_w4rm1ng_up_n0w}