First Mark

CACTF2026

Task: stripped bare-metal RISC-V (rv32i) firmware crackme that validates a 16-byte flag with four undocumented custom R-type instructions. Solution: manually decode the .insn opcodes, recognize the prime operand table as a GF(2^8) multiply and the permutation table as byte rotation, then invert the XOR-with-carry feedback stage and the two byte transforms to recover the input.