Dog Simulator — broncoctf2026

Description

If you can survive 6 dog-days of walkies, tricks, and zoomies, you might uncover a secret (if you can stick to the right routine in the right order)!

A "Dog Simulator" game binary (stripped ARM64 Mach-O, PIE, dynamically linked to libSystem). Over 6 days you choose menu actions. State (Score, Bond, Energy, Mood) is tracked, and at the finale the owner either prints a garbled failure message or reveals the flag if the correct routine was followed in the correct order. Goal: recover the exact six-day routine.

Analysis

The whole program logic lives in a single stripped function (0x100000500). Actions deterministically update Score, Bond, Energy, and Mood (calm/hyped/overstimulated/sleepy), and advance a four-stage combo counter. The finale gates the flag on all of the following:

• exactly one Bark, one Fetch, one Sit, one Eat; zero Zoomies; two Speak actions
• final Score == 55, Bond > 24, Energy > 20, Mood != overstimulated
• combo state reaches 4 (right actions in the right order)
• total alphabetic Speak letters == 19
• two FNV-1a hash constants must match (combo hash + transcript hash)

Speak normalizes input to lowercase alphabetic and hashes it with FNV-1a (offset basis 0x811c9dc5, prime 0x01000193):

...