The Cinder Engine

CACTF2026

Task: stripped aarch64 ELF implementing a custom 4-byte-instruction register VM whose bytecode runs an SPN cipher over a 32-byte input and validates it against a hidden table. Solution: recover the opcode map from objdump, extract the keystream/S-box table, reimplement the 8-round SPN, then invert it (inverse S-box + GF(2) matrix inversion via Gaussian elimination) to recover the validating input and print the flag.