$ cat writeup.md…
$ cat writeup.md…
dawgctf
A plain-text file of messy physics study notes hides the flag as a first-and-last-character acrostic: taking the first character and the last character of each of the first 15 lines and concatenating them yields DawgCTF{REDACTED} — 'thermodynamics sucks!' in leet speak, matching the task title 'I Hate Physics!'. Every 'error' in the notes — wrong variables, dangling letters, misspellings like 'Klevin', trailing terms like '*tau', the nonsense line 15 — exists only to force the right first/last characters on each line.
There's a secret message in these Physics study notes. Can you find it? The flag will be in the format
DawgCTF{squarer00tofpi}.File:
STUDYME.txt
The provided STUDYME.txt is a 71-line plain-text file that looks like someone's thermodynamics study notes: kinetic energy, work, heat capacities at constant pressure/volume, ideal gas law, Boltzmann's entropy formula, a fully-worked ice + water mixing problem, and so on. The flag format example squarer00tofpi (i.e. "square root of pi" in leet speak) strongly hints that the hidden content is a short English phrase written with leet substitutions.
Reading the first 15 lines carefully:
D=1/2mv^2 (force * displacement) = 1/2 * mass * velocity^2 + alpha
w=fd (force * displacement) with respect to displacement lag
Cp=20.79 J/K/Mol for a constant pressure ONLY FOR OUTPUT
FINAL TEMPERATURE ALWAYS COMES FIRST BECAUSE THE TEMPERATURE DELTA IS INSIDE {
temperature min, temperature max}, like with
e=u+pVr
m=0
dU=mcdT and remember that sometimes mcdT can be a dy
nA is number of moles of gas A/B^4
mA*cA*∆T=cB*cB*∆T when two things are equalizing i.e and indirect carnot cycli
c, such as with the following equation: 2500kg*cA*(500-400)=cB*cB*∆T*5
s=ksubb * ln * omega * tau
cv=12.47J/K/Mol for a constant vol, Klevin is k
s=integral from vi to vf of (1/T *dU) for a general delta!
}]\d\wa\dT
Almost every line contains something that does not belong in a physics textbook:
D as a symbol for kinetic energy and tacks on a stray + alpha.e=u+pVr — the real enthalpy formula is H = U + pV, the trailing r is unexplained.m=0.A/B^4, which is not a real expression.cycli / c,).*5.* tau.}]\d\wa\dT.These anomalies are too consistent to be sloppy note-taking — they are the encoding.
Several ALL-CAPS fragments look like instructions:
ONLY FOR OUTPUTFINAL TEMPERATURE ALWAYS COMES FIRSTREMEMBER - YOU CAN SET FUNCTIONS EQUAL TO ANOTHER AND CANCEL LIKE TERMSUSE KELVIN FOR ENTROPYIt is tempting to interpret them as instructions for the extraction ("output only the caps", "cancel duplicates", "convert to Kelvin"). None of these lead anywhere. They exist only to provide the correct uppercase first letter at specific line positions (see step 4).
The flag format is DawgCTF{...}. Writing down the first character of each of the first four lines gives:
L1: D
L2: w
L3: C
L4: F
So lines 1..4 already supply D, w, C, F — every capital letter of DawgCTF except a, g, T. That strongly suggests an acrostic, but single first characters alone are not enough.
Take the first character and the last character of each of the first 15 lines:
| Line | Line ending | First | Last | Pair |
|---|---|---|---|---|
| 1 | ...velocity^2 + alpha | D | a | Da |
| 2 | ...displacement lag | w | g | wg |
| 3 | ...ONLY FOR OUTPUT | C | T | CT |
| 4 | ...DELTA IS INSIDE { | F | { | F{ |
| 5 | ...like with | t | h | th |
| 6 | e=u+pVr | e | r | er |
| 7 | m=0 | m | 0 | m0 |
| 8 | ...can be a dy | d | y | dy |
| 9 | ...of gas A/B^4 | n | 4 | n4 |
| 10 | ...indirect carnot cycli | m | i | mi |
| 11 | ...=cBcB∆T*5 | c | 5 | c5 |
| 12 | s=ksubb * ln * omega * tau | s | u | su |
| 13 | ...constant vol, Klevin is k | c | k | ck |
| 14 | ...for a general delta**!** | s | ! | s! |
| 15 | }]\d\wa\dT | } | (distractor T) | } |
Concatenating all pairs:
Da + wg + CT + F{ + th + er + m0 + dy + n4 + mi + c5 + su + ck + s! + }
= DawgCTF{REDACTED}
Decoding the leet (0→o, 4→a, 5→s) gives "thermodynamics sucks!" — exactly what a frustrated student who "hates physics" would write. The task title is literal.
Every strange element in the first 15 lines exists solely to force the right first/last character pair:
| Line | What was inserted | Why |
|---|---|---|
| 1 | + alpha | ends in a |
| 2 | with respect to displacement lag | ends in g |
| 3 | ONLY FOR OUTPUT | ends in T |
| 4 | ALL CAPS FINAL TEMPERATURE ALWAYS COMES FIRST BECAUSE THE TEMPERATURE DELTA IS INSIDE { | starts with F, ends with { |
| 5 | , like with | ends in h |
| 6 | unexplained trailing r in e=u+pVr | ends in r |
| 7 | m=0 (tiny formula) | supplies both m and 0 |
| 8 | trailing ...can be a dy | ends in y |
| 9 | nonsensical A/B^4 | ends in 4 |
| 10 | carnot cycli (word broken across lines) | ends in i |
| 11 | trailing *5 | ends in 5 |
| 12 | extra * tau in Boltzmann's formula | ends in u |
| 13 | , Klevin is k (with the deliberate misspelling "Klevin") | ends in k |
| 14 | for a general delta! | ends in ! |
| 15 | the whole line }]\d\wa\dT is junk | first char } closes the flag; the rest is a distractor |
Lines 16–71 are cover text: more (still buggy) physics, two more ALL-CAPS "REMEMBER" hints, USE KELVIN FOR ENTROPY, and a concrete ice + water mixing problem that actually solves to T = 334.915873016. None of that contributes to the flag.
#!/usr/bin/env python3 """Solver for DawgCTF SP26 'I Hate Physics!' — first-and-last-char acrostic.""" from pathlib import Path def solve(path: str) -> str: lines = Path(path).read_text(encoding='utf-8').splitlines() flag = '' for i, line in enumerate(lines[:15], 1): if not line: continue first = line[0] last = line[-1] if i == 15: # Line 15 is `}]\d\wa\dT`: only the first char (`}`) is part of the flag flag += first else: flag += first + last print(f'L{i:2d}: first={first!r:>4} last={last!r:>4} -> {first + (last if i != 15 else "")!r}') return flag if __name__ == '__main__': flag = solve('STUDYME.txt') print(f'\nFlag: {flag}') # DawgCTF{REDACTED}
D, w, C, F — matches the DawgCTF prefix of the flag format, so an acrostic is almost certainly in play.{...}, so first-char-only isn't enough.}).DawgCTF{REDACTED}.}]\d\wa\dT regex-looking line, and the ice + water entropy calculation at the bottom — all red herrings.$ cat /etc/motd
Liked this one?
Pro unlocks every writeup, every flag, and API access. $9/mo.
$ cat pricing.md$ grep --similar