SaltCrown

CACTF2026

Task: ~200MB Godot 4.7 C#/Mono Android APK; reverse the game to recover a flag guarded by a native GDExtension custom hash and a decoy ciphertext file. Solution: skip the ashvault.dat red herring, read the C# Forge/Unseal path in the Mono DLL via ikdasm, and brute-force the 32-bit acc seed against a printable flag-format constraint to recover the flag.