zwesty
Write-ups / Day 12 / Binary
Day 12 · Mon, Oct 12 · Binary

Pascal's Wager

Prey slaughtered

ELF triage, HCFG config extraction (campaign, domain, mutex, URL, CRC-32, file offset), compounding field sets, streamed Mastery downloads

STTMClaude Homebase Both

Flags are shortened to their first 8 and last 4 characters because they're unique per team.

Challenge ID
binary-reverse-engineering-day-12-pascal-archive-stager (+ /time_trial, /mastery)
Solved
2026-10-12, all three modes CORRECT on the first submit; 34.5 s from first start to last CORRECT (09:08:27–09:09:02 ET). The 08:58 scheduled run never reached Binary (HTTP 429); a manual rerun at 09:08 did all three. Both timed runs were unranked
Player
Zwesty (solo), with Claude Code (Opus 5.5): solved by a manual rerun of our automated morning solver (a scheduled script on our Kali VM) with our shared Binary solver

The challenge

"Pascal is betting you won't read its record layouts. Take the wager: unpack the archive stager's structures and read the configuration straight from memory's own filing cabinet."

120 questions in the Single Solve: 10 per day for Days 1 to 12. Earlier days' questions are the same as Day 11's. The 10 new d12_* fields:

answer_id Asks for Format
d12_artifact_sha256_1 SHA-256 of the Day 12 file exact text
d12_analysis_architecture processor architecture from the header pattern (name, tool label, or machine code)
d12_analysis_format container format exact text
d12_analysis_machine the header's machine field pattern (label or decimal/hex code)
d12_analysis_config_campaign config campaign exact text
d12_analysis_config_domain config domain exact text
d12_analysis_config_mutex config mutex exact text
d12_analysis_config_url config url exact text
d12_analysis_config_crc32_hex the config record's CRC-32 0x + lowercase hex
d12_analysis_hcfg_offset where the HCFG record starts base-10 integer

Answer kinds across all 120: 60 exact text, 43 pattern, 8 integer, 5 JSON, 4 enum.

Reading the prompt: what it said we'd need

Clue What it pointed to What I did about it
"Pascal", "record layouts" a binary built from Pascal (records are Pascal's structs) Nothing new. Our Binary solver answers from the file's structure and the embedded config, not the source language
"archive stager's structures" the config is packed into a structure inside the program The solver's HCFG reader finds the one CRC-checked record wherever it sits
"read the configuration straight from memory's own filing cabinet" read the config from the file as stored, without running it Static only; the five config fields and the CRC came from the record
(no clue, but a question) hcfg_offset: where the record starts in the file Asked before on Days 9 and 11; the core answered it unchanged

Safety

Static only. The evidence zips (≈32 MB each) were read in memory on our Kali VM. No binary was executed. This write-up was built from the solver's records, the saved Game Master replies, and the request log only. The zips weren't reopened for it.

What was in the files

One evidence.zip (31.9 MB) with one program per day. The solver's record shows these answers for the Day 12 file in the Single Solve set:

  • format elf, architecture x86-64, machine 62: a 64-bit x86-64 ELF;
  • config campaign BR12-000, domain node-000.day12.example.invalid, mutex Global\HuntressBR12_000, url https://node-000.day12.example.invalid/api/BR12-000, CRC-32 0xe4fc81f8;
  • HCFG record at file offset 82,928; SHA-256 8d3b4351…a93b.

Unconfirmed: whether the Day 12 file was really a Free Pascal build. No question asked about the compiler, and the file wasn't reopened for this write-up.

The timed variants used the same template with different values. The Time Trial's Day 12 file was variant 004 (Global\HuntressBR12_004, 0x19f469c3), still at offset 82,928. The Mastery's three zips (31.9 / 32.0 / 31.9 MB) put set 3's record at 82,928 too.

Single Solve (the solver, 3 batches)

The core already covered all 10 new fields. No new add-on was written. The morning solver picked up the new challenge by itself with the core Binary solver, sent the core's answers first, then the two add-ons'. Every batch was accepted:

Batch Sent Result Open after
core 105 accepted 15
d01 ELF add-on (Day 1 ELF basics) 9 accepted 6
d02 config add-on (Day 2 HCFG fields + XOR key) 6 CORRECT

The d01 ELF batch included ELF64, which had once been rejected on a different question. It's still the right form for d01_analysis_elf_class and was accepted again. Nothing was rejected.

CORRECT at 13:08:32.748 UTC, flag d95cd03b…0e98. The solver records no lap timings for the untimed Single Solve.

Time Trial

The start reply said unique_attempts_remaining: 0 and unranked: single-attempt and unranked, like every Day 12 timed start.

started_at   2026-10-12T13:08:44.803Z   deadline 13:09:14.803Z (30 s)
artifact     evidence.zip, 31.9 MB, Day 12 = variant 004
answers      120, one submit
             d12_analysis_config_mutex: Global\HuntressBR12_004
             d12_analysis_config_url: https://node-004.day12.example.invalid/api/BR12-004
             d12_analysis_config_crc32_hex: 0x19f469c3
             d12_analysis_hcfg_offset: 82928
laps         start 488, artifact 907, solve 704, ready 0, submit 779, TOTAL 2879 ms
vs started_at (client clock): start +85, artifact +992, solve +1696, ready +1696, submit +2475 ms
result       CORRECT 13:08:46.775Z   flag 887cd5d5…bc6a

Mastery

started_at   2026-10-12T13:08:58.622Z   deadline 13:09:28.622Z (30 s)
artifacts    3 streamed downloads: 01/02/03-evidence.zip, 31.9 / 32.0 / 31.9 MB
answers      360 (120 per set), one submit; e.g. set3.d12_analysis_hcfg_offset: 82928
laps         start 671, dl2 1047, dl3 667, dl1 415, artifact 1, solve 629, ready 1, submit 1017, TOTAL 4447 ms
vs started_at (client clock): start +155, dl2 +1202, dl3 +1868, dl1 +2283, artifact +2284, solve +2913,
             ready +2913, submit +3930 ms
result       CORRECT 13:09:02.018Z   flag 06eb26e7…bb09

This was the first daily run of the solver's streamed Mastery code (three downloads at once, added on 2026-10-11 after test runs). The downloads finished out of order (2, 3, then 1) and the run was clean.

No ranked time. Day 12's routes didn't accept a ranked-clock request even after the 2026-10-15 pool fix, so no speed retry was possible.

Time to solve

The 08:58 scheduled run stopped on an HTTP 429 before reaching Binary; the 09:08 manual rerun started the Single Solve at 13:08:27.5 UTC and had it CORRECT 5.2 s later in three batches. The unranked Time Trial (2.0 s) and Mastery (3.4 s) each went CORRECT on the first submit, for 34.5 s from the first start to the last CORRECT.

Takeaways

  • Structure beats language again. The prompt talked about Pascal records, but the questions were the usual field set, and the ELF parser plus the CRC-checked HCFG search answered them with no change.
  • The streamed Mastery passed its first real run: three 32 MB zips and 360 answers in 3.9 s on a 30 s clock.
  • HTTP 429 at release, not the solver, decided the finish time. Binary waited eight minutes for the rerun.