Thermal Receipt

CACTF2026

Task: networked thermal printer (RiverGate RG-T80II emulator) speaking raw PJL; last-closed receipt defers the auth token to an empty NVRAM slot. Solution: use PRET/raw PJL to enumerate the journal, then trigger lazy token recall with FSUPLOAD of the last-closed receipt in the same persistent connection before single-byte reading the 60-byte NVRAM auth slot.