NoMap3D — HackTheBox

Description

"I'm lost in this green cube hell. I have to find a way out of it."

Challenge provides an ELF 64-bit PIE executable (not stripped) — an SDL2 raycasting game in Wolfenstein 3D style, and an assets.dmp file (11.9 MB) containing map data, skybox, and textures. Unlike the related NoClip challenge which encoded the flag in individual character textures, NoMap3D encodes the flag as ASCII art formed by the wall layout itself.

Flag format: HTB{...}

Analysis

Step 1: Initial Recon

file nomap3d
# ELF 64-bit LSB pie executable, x86-64, not stripped, dynamically linked

nm nomap3d | grep -E "player|raycast|colf|window|event|asset"
# load_assets, player_init, raycast, event, input
# colf.c, window.c, event.c, player.c, raycast.c

The binary uses the same SDL2 raycasting engine as the NoClip challenge. Key modules: collision detection (colf.c), player control (player.c), raycasting renderer (raycast.c), input handling (event.c), SDL2 window (window.c).

The name "NoMap3D" is a direct hint: "No Map" → the flag says "Who needs a map" in leetspeak. The map layout itself IS the flag.

Step 2: Parsing assets.dmp

The file uses the same chunk-based format as NoClip:

Chunk 1 (id=1): Player position

Offset	Type	Value	Description
0x00	uint32	1	Chunk ID
0x04	double	103.0	Player X position
0x0C	double	7.0	Player Y position

Chunk 2 (id=2): Map data

Offset	Type	Value	Description
0x14	uint32	2	Chunk ID
0x18	uint32	259	Map width
0x1C	uint32	12	Map height
0x20	byte[]	259×12×3	Map data (9324 bytes)

...