A few extra details#

• It was a mono WAV at 44.1 kHz and about 82 seconds long.
• The tone blocks were separated by tiny silence gaps (around 20 ms). I counted 80 blocks, so it felt like a clocked symbol stream.
• The frequencies clustered into stable bins (3 low tones x 4 high tones = 12 symbols).

1
low bins:  ~301, ~902, ~1503
2
high bins: ~2104, ~2705, ~3306, ~3907

What worked#

• Split the WAV into segments using the short silent gaps.
• For each segment, extract the two dominant frequencies.
• Treat each (low, high) pair like a keypad symbol (similar idea to DTMF, but custom bins).
• Convert the symbol stream into digits, then parse the digits as concatenated ASCII codes.

IMPORTANT

The final ASCII parsing had exactly one valid solution, which was a great sanity check.

Flag

EH4X{qu4ntum_phys1c5_15_50_5c4ry}

Concept map#

1
flowchart TD
2
    A["Triage WAV + read the hint"] --> B["Spectrogram shows clean dual-tone blocks"]
3
    B --> C["Split audio by short silence gaps"]
4
    C --> D["Extract 2 dominant tones per block"]
5
    D --> E["Quantize tones into low/high bins"]
6
    E --> F["Map bin pairs to keypad symbols"]
7
    F --> G["Convert symbols into a digit stream"]
8
    G --> H["Partition digits into ASCII codes"]
9
    H --> I["Unique plaintext decode"]
10
    I --> J["Validate EH4X flag format"]

What worked#

• Identify PyInstaller fingerprints in the binary.
• Extract the embedded game module / code object.
• Find the encoded constant (a hex string) and the decryption function.
• Try small reversible transforms until the output starts with EH4X{.

In the end, it was just a single-byte XOR.

1
encoded hex: 525f234f6c50235a24482644485545275c24596a
2
key: 0x17

Flag

EH4X{G4M3_1S_BR0K3N}

Concept map#

1
flowchart TD
2
    A["Start: Windows game executable"] --> B["Strings show PyInstaller fingerprints"]
3
    B --> C["Extract embedded Python payload"]
4
    C --> D["Find encoded hex constant"]
5
    D --> E["Try simple reversible byte transforms"]
6
    E --> F["Stop when output starts with EH4X{"]
7
    F --> G["Recover XOR key and plaintext flag"]

What made it tricky#

I reached code execution, but the usual endgames failed.

WARNING

Seccomp blocked execve, and it also restricted read(fd, ...) for normal file descriptors.

So I changed the goal: instead of “spawn a shell” or “ORW”, I used a path that avoids read entirely:

1. open("./flag")
2. mmap(fd, ...)
3. write(1, mapped, ...)

That was the moment it finally clicked.

TIP

One detail I wish I noticed earlier: for FSOP, the important target was the program’s imported stdout pointer cell (not the libc stdout symbol).

Flag

EH4X{w0mp_g0t_w0mpp3d_4g41n}

Concept map#

1
flowchart TD
2
    A["Heap VM bytecode"] --> B["Free keeps stale pointers (UAF)"]
3
    A --> C["Edit cursor advances too far"]
4
    B --> D["Show after free leaks libc"]
5
    B --> E["Show after free leaks heap"]
6
    D --> F["Compute libc base"]
7
    E --> G["Compute heap base"]
8
    F --> H["Largebin write + unsafe unlink"]
9
    H --> I["Rewrite pointer table in .bss"]
10
    I --> J["Point stdout import to fake FILE"]
11
    J --> K["FSOP wide path"]
12
    K --> L["setcontext trampoline"]
13
    L --> M["open flag file"]
14
    M --> N["mmap file"]
15
    N --> O["write mapped bytes"]
16
    O --> P["EH4X flag"]

What worked#

• Recover the order of checks (length, charset, small math constraints, an LFSR-like update, and an AES stage).
• Turn the validator into a structured search instead of brute force.
• Debug my own solver carefully.

Honestly, the debugging was the real fight.

IMPORTANT

A wrong solver is more dangerous than a hard challenge. I had to fix two mistakes before the real key finally showed up.

Key

Gh0stK3y-R3v3rs3-M3-1f-U-C4n!!!!

Flag

crackme{AES_gh0stk3y_r3v3rs3d!!}

Concept map#

1
flowchart TD
2
    A["Static Go crackme"] --> B["Recover check order"]
3
    B --> C["Turn checks into constraints"]
4
    C --> D["Search reduced space (not brute force)"]
5
    D --> E["Fix solver bug: family bounds"]
6
    D --> F["Fix solver bug: full sweep seeding"]
7
    E --> G["Recover 32-byte key"]
8
    F --> G
9
    G --> H["AES-CBC verify"]
10
    H --> I["Print crackme flag"]