Chibile — sekai2026

Description

Original organizer description was not available in the saved task context.

English summary: the task provided a Windows chibi game client and anti-cheat components. The goal was to reverse the hidden secret-room protocol, compute the required user-mode and kernel-mode typed secrets, and retrieve the flag image from the remote server.

Relevant files in tasks/sekai2026/Chibile/rev_chibile/:

• chibile.exe — main game client.
• eac_nocrt.dll and eac_nocrt_unpacked.dll — user-mode anti-cheat DLL.
• eac_shield.sys — kernel anti-cheat driver.
• PROTOCOL.md — partial documentation for Phase1 secret derivation.
• Local helper scripts included full_solve.py, solve_emu.py, emu_gate.py, emu_um.py, emu_km.py, solve_chibile.py, and the final flag.png.

Analysis

The visible game was a front-end for a hidden secret-room flow. Static analysis of chibile.exe showed that initialization deobfuscated a remote endpoint and prepared an anti-cheat context. The recovered endpoint was:

8875cf0267a7c5510933aebf9de827b9.chals.sekai.team:1337

The secret-room path calls Phase1 first, then Phase2:

1. Phase1 sends JSON with a nonce, user-mode attestation, kernel-mode attestation, PID, timestamp, and client build.
2. The server returns {sid, c_um, lh_um, c_km, lh_km}.
3. The client derives two 12-character secrets, typed_um and typed_km.
4. Phase2 sends sid, typed_um, and typed_km, and receives a CBF2 PNG containing the flag.

The Phase1 JSON format was:

{
  "phase": 1,
  "nonce": "...",
  "um_attest": "...",
  "km_attest": "...",
  "pid": 1234,
  "ts": 1234567890,
  "client_build": "CHIBILE-R3-20260615"
}

The transport was a custom CBL2 request / CBR2 response wrapper using:

• RSA-OAEP-SHA256 for a 0x70-byte key block.
• AES-CBC with PKCS#7 padding for the payload.
• HMAC-SHA256 for packet authentication.
• A stream XOR layer before AES encryption and after AES decryption.

...