Overstrike

CACTF2026

Task: Godot 4.7 Android APK built with C#/Mono/.NET; game hides a flag decrypted with a SHA256-CTR keystream keyed by a CarriedMark that must satisfy an invertible splitmix64 mix equal to a hardcoded TrueSeal. Solution: decompile Overstrike.dll with ILSpy, extract the 56-byte SealedRecord from the IL FieldRVA blob, invert the splitmix64 Mix (modular inverse mod 2^64 + bitwise xorshift-right inversion) to recover CarriedMark, then rebuild the SHA256 counter-mode keystream and XOR to reveal the flag.