You Have a Point · Huntress CTF 2026

The challenge

"Every character has a point. A code point, anyway."

answer_id	Question	Format
`message`	"Decode the assigned blob completely. What exact answer slug does its final non-empty decoded line instruct you to submit?"	pattern: three lowercase words and a two-digit number, joined by hyphens; slug only; trimmed

Mastery asked the same question once per blob (set1.message … set123.message).

Reading the prompt: what it said we'd need

Clue	What it pointed to	What I did about it
"Every character has a point"	One token per character	Each `U+XXXX` token is one character of the message
"A code point, anyway"	Unicode code points, written in the `U+` notation	Read the hex after `U+` as the code point and join the characters
"You Have a Point" (title)	The same pun	Confirmed the reading
"submit the slug only" (format)	The answer is the slug alone	Same as the last few days; no trailer today

What was in the files

Single Solve: blob.txt, 762 bytes, one line: 109 tokens of the form U+XXXX (four hex digits each), separated by single spaces: U+004E U+0069 U+0063 U+0065 … ("Nice …"). Decoded, the line reads "Nice work decoding this warmup! To solve, submit this exact answer to the Game Master: brave-beacon-wizard-34".
Time Trial: blob.txt, 755 bytes, the same template (108 tokens) with a different slug (lucky-storm-ripple-93).
Mastery: one zip of 123 blobs (79,100 bytes). Each blob has 25 lines in the history pattern of the earlier days: line 23 Ascii85 (Day 23), line 24 netstrings (Day 24), and line 25 code points (today), for example U+0063 U+0068 U+002D U+0038 U+0031 (ch-81) on line 25 of blob-01.txt.

So the timed variants used the same template with different values; only the token count changed with the sentence length.

Single Solve

The solver: stopped, nothing sent

started_at  2026-10-25T13:00:44.462Z   (solver)
deadline    none (Single Solve)
answers     none
result      STOP: no instruction line found (per-line with reverse, Day 10 decoders, whole-blob reverse, search; atbash;
            caesar search; new-layer search; trailer reading); not submitting. Timed modes not started.

This stop was correct. None of the solver's readings knew the U+ notation, and its 3-move "new-layer search" didn't find it, so any value sent would have been a guess.

By hand (Claude)

U+004E U+0069 U+0063 U+0065 is readable as "Nice" with any code-point table, so Claude decoded the line, read the sentence above, and sent the one answer it gave: brave-beacon-wizard-34.

started_at  2026-10-25T13:00:44.462Z   (same attempt, submitted by Claude at 13:01:35)
answers     1   brave-beacon-wizard-34
result      CORRECT   flag 80283cf4…1b47   (13:01:36)

The solver update (Claude)

Claude built a new Warmups solver on top of the Day 24 one: - One new reading, codepoint_text, added to the solver's text decoders at cost 1, next to the older readings and not gated on "the older readings found nothing" (a lesson from Day 22). So it runs in the whole-blob search and on every Mastery line, and the stacked readings work on top of it. - Strict grammar: every token must be U+ followed by 4 to 6 hex digits, separated by whitespace or commas, across the whole blob or every non-empty line. Anything else rejects the input. - Each Mastery set is still solved on its own, as before. - Our rehearsal tool gained a code-point layer, so synthetic blobs can use it.

Checks before the timed runs: - Its tests: 8 pass (the real Single blob, parser edge cases, code points over and under Base64, multi-line input, and netstrings still read). - A regression rehearsal against the previous day's puzzles plus synthetic blobs: 117 saved attempts, slowest 0.89 s, per-set identical; against the previous solver 116 identical, 1 newly solved (today's Single), 0 changed; synthetic 60 of 60 with the code-point layer.

The reading was written by 09:02:12 ET and the rehearsal layer by 09:02:20, so the reading, tests, and rehearsal took about a minute and a half after the Single.

Time Trial

CORRECT on the first attempt, ranked (unique_attempts_remaining: 255, variant_fresh: true).

started_at  2026-10-25T13:03:13.892Z
deadline    2026-10-25T13:03:43.892Z   (30 s)
answers     1   lucky-storm-ripple-93
start        111 ms after started_at
artifact     418 ms after started_at
solve        445 ms after started_at   (27 ms)
submit      1213 ms after started_at
result      CORRECT   flag 8853caff…87ce

Mastery

CORRECT on the first attempt, ranked (123 sets, 140 s clock).

started_at  2026-10-25T13:03:20.146Z
deadline    2026-10-25T13:05:40.146Z   (140 s)
answers     123
start        437 ms after started_at
artifact     870 ms after started_at
solve       1201 ms after started_at   (331 ms)
submit      1809 ms after started_at
result      CORRECT   flag 7cf74a82…255c

No retries, no rejected values, no rate limit. Afterwards this solver became our default Warmups solver for the following days.

Time to solve

All three modes were solved by 09:03:21 ET, 3 min 21 s after release (2 min 37 s from the first start request on this lane). The Single Solve was decoded by hand at 09:01:35; the Time Trial and Mastery were both ranked and each went through on the first submit.

Takeaways

The new layer is still the slowest part of the morning. Every other lane the solver ran was done by 09:02:01; Warmups took until 09:03:21 because the code-point layer was new.
Hand first, reader second, kept it short. The Single went in at 09:01:35 by hand, and the reading was built and rehearsed while the solver finished the other lanes: 2 min 37 s from the first start, against 7 min 22 s on Day 24.
Stopping was right. The solver's searches found nothing and it sent nothing, so both ranked runs were first attempts.
Add a new layer as an established reading, not a fallback. Cost 1, never gated: it then works whole-blob, per line, and stacked without extra code.
Next pre-builds: other per-character notations (\uXXXX, &#NNN;/&#xHH;, %uXXXX, 0xHH lists, \xHH) as strict whole-blob readings, so the next one of these is already a known layer.