Binary

ELF Aware

Reading ELF headers, section tables, and symbol tables · static disassembly of a tiny function · stripped vs unstripped binaries · reading questions literally · working out a checker's vocabulary

Mangled

Reading ELF headers, sections, and symbol tables · Itanium C++ name mangling, vtables, and RTTI · finding an embedded config record · MinGW PE files and their COFF symbol table · finding which field a checker rejected

Table Manners

Reading a .NET assembly as a PE file · the CLI header and metadata root (BSJB) · decompiling with ilspycmd · finding a config stored in a static field's initial data · carrying answers over in a compounding challenge · working out a checker's vocabulary

Go Fish

Triage of a stripped Go binary (.gopclntab function names, .go.buildinfo) · finding and checking an embedded XOR'd config record · carrying answers across compounding days · working out a checker's vocabulary · ELF vs native PE in Mastery

Rust Belt

Spotting a Rust binary from its toolchain metadata · one language-independent config extractor (HCFG, CRC-checked) · carrying confirmed answers across compounding challenges · working out an exact-text checker's vocabulary · finishing an exhausted Mastery in practice mode

Pool Party

Reading a JAR and its Java class files statically · the class-file constant pool · finding a Base64-encoded config blob · validating a config record by its CRC32 · carrying answers across compounding challenges · working out a checker's vocabulary

Routine Check

Reading a Kotlin JAR statically (javap, strings) · recognising a coroutine's continuation class · pulling a Base64 config out of the constant pool · decoding a CRC-checked config record · working out a checker's vocabulary · scripting a compounding, timed solve

Swift Justice

Reading ELF header fields as raw numbers · finding a config record in any language's binary · ZIP central-directory compression methods · reading a 3,000-member JAR in memory · making a solver fit a 10-second window · working out a checker's vocabulary

Nimble

Spotting a Nim binary by its runtime strings · finding a config record in .rodata · validating a match instead of trusting a magic number · file offsets · reusing a compounding solver across nine languages · native PE vs ELF answers

Zig Zag

Reading ELF and PE section tables · matching a named section to the config record it holds · raw header numbers (ELF e_machine, COFF Machine) · reusing a compounding solver across ten languages · handling a Mastery that mixes ELF and PE builds

D-Day

ELF triage across languages, HCFG config extraction, compounding field sets

Pascal's Wager

ELF triage, HCFG config extraction (campaign, domain, mutex, URL, CRC-32, file offset), compounding field sets, streamed Mastery downloads

Crystal Clear

ELF triage of a Crystal build, HCFG config extraction (campaign, domain, mutex, URL, CRC-32, file offset), compounding field sets, streamed Mastery downloads

Selective Memory

ELF triage of an Objective-C (GNUstep) build, HCFG config extraction from its own .hcfg section, compounding field sets

Stripped

Comparing a stripped ELF with its symbolized twin, artifact numbering when one day has two files, HCFG config extraction, extending a compounding solver without changing old answers

Wasm Up

WebAssembly binary format (sections, LEB128, memory limits), static analysis, regression-safe solver changes

Decoder Ring

Static binary analysis, ELF/PE/COFF parsing, archive and hash handling, HCFG decoding, batch diagnosis

Flow State

Executable headers, embedded config (HCFG) extraction, XOR keys

Jack in the Box

Static ELF inspection, archive handling, overlay decoding, SHA-256 and CRC32 validation, JSON parsing

Resourceful

Static ELF triage, overlay (bytes past the last section) location, a custom resource-overlay header (RS20) with bounds and SHA-256 checks, HCFG config records with CRC32, cumulative question sets

Shared Custody

Static ELF triage of a loader and its shared-library plug-in, e_machine as a number, HCFG config records with CRC32 found by scanning for the magic, cumulative question sets

Bridge Troll

Static PE/CLI triage (managed .NET assembly), machine-field labels, CLR metadata root (BSJB), HCFG config record, telling the primary assembly from dependency DLLs, streamed Mastery delivery

Trust Issues

Static PE/CLI triage (managed .NET assembly), machine-field labels, CLR metadata root (BSJB), HCFG config record, cumulative question sets

Spot the Difference

Static JAR triage (ZIP container, class files), Base64 constants, HCFG config record with CRC32, cumulative question sets, add-on modules

Out of Bounds

Static JAR triage (ZIP container, class files), Base64 constants, HCFG config record with CRC32, cumulative question sets, add-on modules written for day >= N

Crash Course

Static JAR triage (ZIP container, class files, method tables), synthetic crash records, HCFG config record with CRC32, cumulative question sets, partial-batch diagnosis, add-on modules written for day >= N

Compiler Says What

Static ELF triage (header, e_machine), per-build questions on one archive, HCFG config records with CRC32, cumulative question sets, add-on modules written for day >= N

Family Resemblance

Static ELF and PE triage (e_machine, e_shnum, COFF NumberOfSections), symbol-table counts, HCFG config records with CRC32, telling a look-alike build from a family by its config, field procedures read from the question text, plug-ins written for day >= N

Fraternal Twins

Static ELF triage (format by magic, e_machine); HCFG config records found by a backward scan and checked by CRC32; proving two builds share one config; per-role fields picked by basename

Campaign Trail

Carving a config record from the tail of an unfamiliar container (magic, version, XOR key, length, CRC32), Neko bytecode recognition by magic, a JSON "campaign graph", plug-ins written for day >= N

SHA1-Hulud

The month's one unsolved challenge.

Static PE triage of a Rust binary, string-decryption routines, self-decrypting code unpacked by a re-implementation (not by running it), lifting hash-compression variants to Python, mapping anti-analysis checks, reading a large decompiled main

Final Boss

Static ELF triage, carving a config record by magic from the end of a member, the HCFG-style 12-byte header (version, XOR key, length, CRC32), XOR decoding, JSON paths read from the question text, plug-ins written for day >= N