Reversing

A ‘pwn’ binary with no input is really a static-reversing puzzle: a fake usleep loop would take days and a fake integrity check always passes, so reading the constants and undoing a single-byte XOR yields the flag without ever waiting.

A single APK whose UI claims there’s nothing to see — the flag is split into three pieces hidden in a MainActivity field, a string resource, and a Compose theme getter.

An idle/clicker TCP game whose shop checks affordability against a stale cached balance but deducts from a fresh re-read; racing two sessions as the same user underflows an unsigned long to ~1.8e19 bits and buys the flag.

A UPX-packed, unstripped crackme lays its 44-byte check out as 44 independent per-character functions; emulating each with Unicorn brute-forces the flag one byte at a time, sidestepping a rand()-based anti-dynamic trap.

A stripped compiler for an invented language is reverse-engineered from its error strings and codegen templates; the recovered grammar exposes an intended read file primitive that simply prints flag.txt — no exploit required.

Reversing a 250-state control-flow-flattened automaton whose success check requires visiting every state — i.e. finding a Hamiltonian path through the transition graph.

A two-stage Java AOT-cache app whose integrity hash covers bytecode and pointers but not the archived heap — patching the pre-resolved heap String redirects the image directory and reads /flag.

Reversing a Javalin app whose real password validator lives in an AOT/CDS cache that overrides the jar — dumping the loaded class with the HotSpot Serviceability Agent unlocks a file-read to /flag.