All Writeups

Comprehensive collection of CTF challenges, solutions, and insights.

2026-03-01 Reverse Engineering Insane

DEADROP Rev 6 - UNIT7

A VM-within-a-VM. An outer stack machine prints the banner. An inner register machine (UNIT7-LANG) runs two chained programs, program 1 computes the passphrase via a cross-register dependency chain, program 2 uses that state to compute and print the flag. No ciphertext stored, no flag wrapper, no shortcut.

rev vm custom-isa register-machine

2026-03-01 Reverse Engineering Hard

DEADROP Rev 5 - Drone Firmware

A drone firmware binary with a constraint-based authentication system. Reverse the validation logic, model it as a constraint satisfaction problem, and use Z3 to solve for the correct input automatically.

rev z3 smt constraint-solving

2026-03-01 Reverse Engineering Hard

DEADROP Rev 4 - VM Executor

A custom stack-based VM interpreter provided without its bytecode. The bytecode that prints the flag is embedded inside the executor itself. Reverse the ISA, extract the embedded bytecode from .rodata, and either run it or trace the arithmetic manually.

rev vm custom-isa bytecode

2026-03-01 Reverse Engineering Easy

DEADROP Rev 1 - agent_verify

A Linux ELF binary that XOR-encodes the correct passphrase in .rodata. The flag is the passphrase itself, ltrace -s 200 hands it to you directly via strcmp interception.

rev xor ltrace elf