Proofmark

Cyber Apocalypse CTF 2026

Task: Godot 4.7 Android APK whose real logic lives in a stripped native GDExtension; the certificate flag is decoded from a 32-bit seed via a splitmix32-style PRNG guarded by a 599616-iteration mixing loop. Solution: reverse the .gdc GDScript and native .so, notice the 28-byte flag is a bijective function of the post-finalizer generator state esi0, and brute-force esi0 over 2^32 (bypassing the expensive loop), pinned by the HTB{...} self-check.