PacMan

d3c2026

Task: A minimal iOS Pac-Man IPA hides a flag behind gameplay telemetry and a Mach-port-backed authenticated VM. Solution: Emulate the original ARM64 verifier and workers under Unicorn, substitute synchronous transport, and verify the final RC4 decryption.

ios rc4 custom_vm arm64 macho mach_ports anti_instrumentation

static_analysisunicorn_emulationimport_hookingsynchronous_transport_substitutionrc4_decryption

$ ls tags/ techniques/

ios rc4 custom_vm arm64 macho mach_ports anti_instrumentation

static_analysisunicorn_emulationimport_hookingsynchronous_transport_substitutionrc4_decryption

$ cat /etc/rate-limit

Rate limit reached (20 reads/hour per IP). Showing preview only — full content returns at the next hour roll-over.

PacMan — d3c2026

Description

Let's play Pac-Man.

The supplied pacman.ipa is a minimal iOS application. The goal is to reverse the game and recover the value displayed only after its hidden verification path succeeds.

Initial Triage

Extract the IPA and identify its only native executable:

unzip -q pacman.ipa -d extracted
file extracted/Payload/MachActorVM.app/MachActorVM
shasum -a 256 extracted/Payload/MachActorVM.app/MachActorVM

The bundle contains only Info.plist and an ARM64 Mach-O executable. The executable's SHA-256 is:

06478236457c0f1a6f4fc4cefcf834d0c8c43a75ba08bd661e8c75d05c75221a

There are no images, audio files, or other resources in which to hide the result, and ordinary string extraction does not reveal it. The solution therefore requires reversing the native code.

Analysis

Gameplay is only the first gate

-[ViewController stepGame:] at 0x100005148 delegates game updates to 0x100007a68. That routine moves Pac-Man through a 25-by-13 maze, updates score and telemetry, relocates ten beans, and sets an unlock byte when:

(score >> 4) >= 0x271

This is equivalent to score >= 10000. The renderer then overlays VM UNLOCKED, but this is not the secret. -[ViewController updateWithFrame:] at 0x1000051b0 obtains a 40-byte telemetry object and invokes the verifier at 0x100005c7c.

Authenticated Mach-port VM

The verifier first calls a telemetry validator at 0x100006668, initializes four Mach-port workers, and performs 288 authenticated state transitions. Its important components are:

...