zwesty
Write-ups / Day 11 / Binary
Day 11 · Sun, Oct 11 · Binary

D-Day

Prey slaughtered

ELF triage across languages, HCFG config extraction, compounding field sets

STTMClaude Homebase Both

Flags are shortened to their first 8 and last 4 characters because they're unique per team.

Challenge ID
binary-reverse-engineering-day-11-d-collection-planner (+ /time_trial, /mastery)
Solved
2026-10-11, all three modes; 25 s from first start to last CORRECT (09:07:25–09:07:50 ET)
Player
Zwesty (solo), with Claude Code (Opus 5.5); all three modes were run unattended by our automated morning solver (a scheduled script on our Kali VM), on a paced rerun

The challenge

D templates generate code the way a printing press generates pages — fast, and everywhere. Trace the runtime's template expansions back to the collection config they built.

110 questions in the Single Solve, compounding every earlier day: d01_* ELF basics (class, machine, sections, symbols, entry point…), the d02_* HCFG config fields, and so on through 10 new d11_* fields: architecture, format, machine, hcfg_offset, the config's campaign, domain, url, mutex, crc32_hex, and the artifact's SHA-256. Formats: exact values, 0x-prefixed lowercase hex, or base-10 integers.

Reading the prompt: what it said we'd need

Clue What it pointed to What I did about it
"D templates" a binary written in the D language (template-heavy codegen) Our Binary solver reads ELF structure and the embedded config, not the language, so the new language needed nothing new
"trace … back to the collection config" the embedded HCFG config block The d02 config add-on, unchanged, read it again

Safety

Static only. The evidence zips (≈32 MB each) were unpacked and parsed on our Kali VM; nothing was executed.

What was in the files

One evidence.zip (31.9 MB) holding one ELF per day so far. Earlier days' files are byte-identical each day, so their accepted answers carry over by SHA-256; the new D binary's fields come from the same parsers.

Single Solve (the solver, 3 batches)

The solver sent the core solver's answers, then the two add-ons', all accepted: 95 + 9 (d01 ELF add-on) + 6 (d02 config add-on) = 110. CORRECT at 13:07:30 UTC, flag c7b6735c…cd34.

Time Trial and Mastery

Time Trial   30 s clock; vs started_at: start +85, artifact +1491, solve +2108, ready +2108, submit +2770 ms
             110 answers   CORRECT 45e556cd…ef9b
Mastery      30 s clock, 3 zips (31.9–32.0 MB each); vs started_at: start +136, artifact +2870, solve +4633,
             ready +4634, submit +5632 ms   330 answers   CORRECT bb5e1ff8…fec3

Both start replies were unranked, with unique_attempts_remaining: 0: this route has a single published variant, so the Game Master doesn't rank its times and a retry isn't possible. Today's Binary timed runs can't earn a ranked time (the list doesn't mark them opt-in either).

Time to solve

The 9:00 ET run hit an HTTP 429, so the solver re-ran with paced submits: the Single Solve started at 13:07:25 UTC and went CORRECT 5 s later in 3 batches. The Time Trial (3 s) and Mastery (5 s) each went CORRECT on the first submit, unranked, for 25 s from the first start to the last CORRECT.

Takeaways

  • Structure-based parsers survive language changes: the D binary went through the same format and HCFG code as every earlier day's language, with no change.
  • Big downloads dominate this lane's clock: 1.5 s for one 32 MB zip, 2.9 s for three. That's the place to look if this route ever becomes ranked.