← Back to KAALCHAKARA PREQUALS 2026

WEIRWOOD WITNESS

Reversing a custom virtual machine register format to solve register-accumulator constraints for missing flag indices.

Tools Used

VM EmulationPython

Overview

We analyze a binary challenge.bin that implements a custom VM expression tree and evaluates register instructions.

Reconnaissance

Reversing the node formats reveals opcode behaviors: direct comparisons (op 0), multiplications (op 19), XOR (op 18), and assertions.

Exploitation Strategy

We extract 52 of the 57 characters directly from type 0 comparisons. The remaining 5 characters are solved by writing an emulator to simulate the register accumulator constraints and matching the target hash output.

Solution Code

# Weirwood custom VM register emulation:
# Reconstruct partial flag: Kaal{f3@r_th3_U1nd01ng_0f_H34rt_Tre35,_Th3_R4v3??_L??3?t}
# Fuzz missing indices -> satisfy final accumulator target 0xABA8D09E
# Flag: Kaal{f3@r_th3_U1nd01ng_0f_H34rt_Tre35,_Th3_R4v3n5_L@m3nt}

Flag

Kaal{f3@r_th3_U1nd01ng_0f_H34rt_Tre35,_Th3_R4v3n5_L@m3nt}