zwesty
Write-ups / Day 18 / Binary
Day 18 · Sun, Oct 18 · Binary

Flow State

Prey slaughtered

Executable headers, embedded config (HCFG) extraction, XOR keys

STTMClaude Homebase Both

Flags are shortened to their first 8 and last 4 characters because they're unique per team.

Challenge ID
binary-reverse-engineering-day-18-control-flow-reconstruction (+ /time_trial, /mastery)
Solved
2026-10-18, all three modes, by 09:01:23 ET
Player
Zwesty (solo), with Claude Code (Opus 5.5): solved by our automated morning solver (a scheduled script on our Kali VM)

The challenge

A "control-flow reconstruction" day: every earlier day's binary fields plus a new Day 18 binary. Written from our solver's report and the start reply's question list; the binaries weren't reopened.

Safety

Binaries are hostile: static analysis only, on our Kali VM. Nothing executed, no excerpts quoted.

What was in the files

216 questions on the Single Solve. The 12 new d18_* fields were all familiar families: the artifact's SHA-256, format, architecture and machine, the HCFG config (campaign, domain, mutex, URL, CRC32), the HCFG offset and version, and the XOR key. Mastery came as 4 separate downloads.

The modes

  • Single Solve: core batch of 183 accepted, then one merged plug-in batch of 33 → CORRECT at 09:01:02. No ranked candidates for format or architecture were needed.
Single Solve   CORRECT 09:01:02
Time Trial     CORRECT 09:01:13  flag 400c9d34…7103   solve 733 ms, submit +3.99 s
Mastery        CORRECT 09:01:23  flag 5e61d8a5…3f77   solve 354 ms, submit +3.43 s  (4 downloads streamed)

Time to solve

All three modes were solved by 09:01:23 ET, about a minute and a half after release, each on the first submit and with no hand work.

Takeaways

  • The fallback plan wasn't needed today: we had a plan for the Homebase agent (GPT-6 Luna) to work new Binary fields, but the solver's chain covered every new field by itself.