Cat Simulator — broncoctf2026

Description

Make the purrfect choices over 5 days to win your owner's heart… and maybe something more? Meow carefully.

Three standalone platform binaries are provided (Windows .exe, macOS ARM64 Mach-O, Linux ELF) of a cat-simulator branching-choice game. The player makes menu choices over 5 in-game days; the winning route reveals the flag. The macOS ARM64 Mach-O (cat-sim-mac, 34,008 bytes) was the binary actually analyzed.

Recon

• The challenge ships the same game as three self-contained executables — a classic sign of a cross-platform build with the win logic embedded in native code rather than in packaged asset files.
• CTFBase semantic search returned only a generic visual-novel XOR precedent (20260115_duckerz_novella) — no direct match, so this had to be reversed from scratch.
• CTFd download tip: the CTFd signed download URLs returned HTTP 403 with plain curl. Adding a browser User-Agent and a Referer (https://broncoctf.ctfd.io/) made the download succeed:

curl -L -o cat-sim-mac \
  -A 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36' \
  -H 'Referer: https://broncoctf.ctfd.io/' \
  '<signed-download-url>'

Analysis

Running strings on the Mach-O immediately reveals a plaintext flag-shaped string:

bonco{almost_there}

This is a decoy (note the misspelled bonco{...}, not bronco{...}). It is the branch reached when only one of the several win conditions is met, planted specifically to catch players who grep for {.

Disassembling the game loop and finale (main/check routine at 0x100000500, finale checks starting at 0x100000780) shows the game is a small state machine. Each day accepts a menu choice that mutates several counters:

...