GODMODE//999

UIUCTF 2026

Task: AArch64 firmware for a 'ranked console' plus an encrypted RankedFS disk; reconstruct the committed (post-rollback) journal timeline and defeat a RAID//9 dataflow VM to unlock a hidden achievement. Solution: reimplement the journaling FS offline, derive BLAKE2s keystream file keys, emulate the VM and solve the 48-byte player code with bitwuzla (modeling op9 as a symbolic checkpoint/rollback If), then ChaCha20-Poly1305-decrypt achievement.bin.

firmware custom_vm qemu aarch64 chacha20_poly1305 rollback z3 blake2s custom_filesystem journaling_fs dataflow_vm smt_solver bitwuzla virtio_blk unaligned_access_fault

firmware_static_reverse_engineeringjournal_replay_reconstructioncommitted_vs_speculative_timelineblake2s_keystream_file_decryptionraid9_vm_emulationopcode_remap_recoverycheckpoint_rollback_if_modelingsmt_bitblast_offline_solvingchacha20_poly1305_key_derivationlldb_gdbstub_ground_truth_extraction

$ ls tags/ techniques/

firmware custom_vm qemu aarch64 chacha20_poly1305 rollback z3 blake2s custom_filesystem journaling_fs dataflow_vm smt_solver bitwuzla virtio_blk unaligned_access_fault

$ cat /etc/rate-limit

Rate limit reached (20 reads/hour per IP). Showing preview only — full content returns at the next hour roll-over.

GODMODE//999 — UIUCTF 2026

Description

Silver Wolf calls it a one-button clear. The ranked server calls it an impossible replay. We recovered the firmware from her LV.999 console and the drive containing her last match. Restore the committed timeline and claim the achievement she left behind. The server remembers every rollback. Only committed ticks affect MMR.

Boot command: qemu-system-aarch64 -M virt -cpu cortex-a72 -m 128M -global virtio-mmio.force-legacy=false -bios godmode.rom -drive file=ranked.img,format=raw,if=none,id=ranked -device virtio-blk-device,drive=ranked -nographic

English summary: Two files are given — godmode.rom (13672-byte raw AArch64 firmware) and ranked.img (16 MB disk, superblock magic RNK9). The firmware is a bare-metal "ranked console" that mounts a custom journaling filesystem (RankedFS), decrypts per-file blocks, and gates an achievement behind a verify command that runs a RAID//9 dataflow VM over four replay files. The goal is to reconstruct the committed (post-rollback) timeline, recover the 48-byte player code the VM accepts, and decrypt the hidden achievement to obtain the flag.

Analysis

Recon

godmode.rom: raw AArch64 firmware loaded by QEMU -bios (entry PC=0, base 0x0). PL011 UART at 0x09000000, virtio-mmio scanned from 0x0a000000.
ranked.img: 16 MB disk, superblock magic RNK9, block bodies look encrypted/random.
Booting the console prints GODMODE//999 RANKED CONSOLE. achievement → LOCKED // restore the committed LV.999 replay; verify prompts PLAYER CODE (48 bytes):. Strings reveal RankedFS tags (RANKEDFS-COMMITTED/ROOT/BLOCK), RAID9 tags (RAID9-MAP/TARGET/DROP), ACHV999, file paths (/profile/player.dat, /replays/{tutorial,placement,promotion,godmode}.raid, /cache/achievement.bin), and the win string ONE-BUTTON CLEAR // HIDDEN MMR 999.

Firmware function map (full disasm via capstone/r2)

...

GODMODE//999 — UIUCTF 2026

Description

Analysis

Recon

Firmware function map (full disasm via capstone/r2)

Similar writeups