NoClip — HackTheBox

Description

"The last resident seems to have found a way out of here."

The challenge provides an ELF 64-bit PIE executable (not stripped) — an SDL2 raycasting game in Wolfenstein 3D style, along with an assets.dmp file (4.89 MB) containing the map, textures, and level data. The game renders a first-person spiral maze. The flag is encoded in textures of special walls placed along the spiral path. Floor arrows indicate the traversal direction.

Flag format: HTB{...}

Analysis

Step 1: Initial Recon

file noclip
# ELF 64-bit LSB pie executable, x86-64, not stripped, dynamically linked

strings noclip | grep -i "player\|raycast\|colf\|window\|event\|asset"
# game, input, player_init, raycast, load_assets
# colf.c, window.c, event.c, player.c, raycast.c

The binary is not stripped — all function names are available. Key modules:

• colf.c — collision detection (wall collisions)
• player.c — player control
• raycast.c — world rendering (raycasting)
• event.c — input handling
• window.c — SDL2 window

The name "NoClip" is a direct reference to the game cheat that allows walking through walls. This is a hint: to see all flag characters, you need to "walk through the walls" of the spiral maze.

Step 2: Parsing assets.dmp

The load_assets function parses assets.dmp in a chunk-based format:

Chunk 1 (id=1): Player position

Offset	Type	Value	Description
0x00	uint32	1	Chunk ID
0x04	double	21.0	Initial player X position
0x0C	double	10.0	Initial player Y position

Chunk 2 (id=2): Map data

...