Overview
We analyze a binary challenge.bin that implements a custom VM expression tree and evaluates register instructions.
Reconnaissance
Reversing the node formats reveals opcode behaviors: direct comparisons (op 0), multiplications (op 19), XOR (op 18), and assertions.
Exploitation Strategy
We extract 52 of the 57 characters directly from type 0 comparisons. The remaining 5 characters are solved by writing an emulator to simulate the register accumulator constraints and matching the target hash output.
Solution Code
# Weirwood custom VM register emulation:
# Reconstruct partial flag: Kaal{f3@r_th3_U1nd01ng_0f_H34rt_Tre35,_Th3_R4v3??_L??3?t}
# Fuzz missing indices -> satisfy final accumulator target 0xABA8D09E
# Flag: Kaal{f3@r_th3_U1nd01ng_0f_H34rt_Tre35,_Th3_R4v3n5_L@m3nt}Flag
Kaal{f3@r_th3_U1nd01ng_0f_H34rt_Tre35,_Th3_R4v3n5_L@m3nt}