Flare-On 13, Challenge 9: NeonOutRun
I submitted the wrong flag for this one. That's going at the top rather than the bottom, because it's the most useful thing in the write-up.
Reverse Engineer
Flare-On 13, Challenge 8: crux
Flare-On is the FLARE team's yearly reverse-engineering contest: each challenge hides a flag, a string ending in @flare-on.com, and you find it by taking the program apart.
Flare-On 13, Challenge 7: FlareCalc
Flare-On is the FLARE team's yearly reverse-engineering contest: each challenge hides a flag, a string ending in @flare-on.com, and you find it by taking the program apart.
Flare-On 13, Challenge 6: ThreatInvaders
Flare-On is the FLARE team's yearly reverse-engineering contest: each challenge hides a flag, a string ending in @flare-on.com, and you find it by taking the program apart.
Flare-On 13, Challenge 5: CatThief
Flare-On is the FLARE team's yearly reverse-engineering contest: each challenge hides a flag, a string ending in @flare-on.com, and you find it by taking the program apart.
Flare-On 13, Challenge 4: ToxicMiner
That last clause isn't flavor text. The intended solution really is a brute force (trying every possible value of a secret until one works), and the flag jokes about it.
Flare-On 13, Challenge 3: the polyglot "document"
This is the one I enjoyed most in the whole set, and it's the one that took the widest range of tools. flareon13.doc is 1,855,887 bytes and it is not a Word document. It is six different file formats at the same...
Flare-On 13, Challenge 2: GhostStream
Flare-On is an annual reverse-engineering contest run by the FLARE team: each challenge is a program that hides a "flag," a string ending in @flare-on.com, and you have to work out from the compiled binary alone,...
Flare-On 13, Challenge 1: flarecaptcha
Flare-On is a yearly reverse-engineering contest: you take programs apart to work out what they really do, and each challenge hides a flag, a string ending in @flare-on.com, that unlocks the next one. (Contests built...
AnimateClipper: A NativeAOT Loader That Hides C# From Every .NET Tool You Own
A NativeAOT stage-1 loader that dnSpy and ILSpy cannot read, taken apart statically: two hand-rolled keystream ciphers over its API name table, a CMSTPLUA elevation-moniker UAC bypass, a self-copy into Startup, and a full manual PE loader that hollows a signed Microsoft binary. Includes the recovered stage-2 cipher, its static 256-bit key and nonce, five YARA rules measured against 2,977 corpus samples, and the retrohunt that pushed the family's first observed build back ten weeks.