Veil of Evernight — uiuc2026

Description

The curtain has fallen on Evernight, but March 7th's camera kept one last memory. Oblivion scattered it behind the Veil, and no single reflection shows the whole truth. Return every fragment to the place where it belongs. When the whole picture comes into focus, the memory itself will be the key that lets the mirrored soul remember.

The artifact is evernight, a statically linked, stripped x86-64 ELF. The goal is to recover the 29-byte input accepted by its checker.

Analysis

Avoiding the checker distraction

The program's main routine is at 0x28cc70. It reads standard input, removes the newline, and ultimately requires exactly 29 bytes. A transform at 0x28cdf0 resembles a large custom sponge: it contains many mixed Boolean-arithmetic expressions, constants, rotations, and rounds.

That transform is a distraction rather than the shortest solution. Direct inversion, Z3 modeling, phrase guessing, raw .rodata searches, extraction of immediate constants, reconstruction of the recursive MBA grammar, and pixel-LSB searches did not produce the accepted input.

The challenge description instead points toward assembling scattered image fragments. The useful code is setup_vm at 0x28cda0, which runs before the apparent hash checker.

Tracing the setup VM

The VM stores 23 64-bit virtual registers in a stack array. Instrumenting the byte-read instruction at native RIP 0x2a0474 records 391,632 reads: exactly two source reads for each of 195,816 reconstructed output bytes.

The VM processes 765 chunks. There are 764 chunks of 256 bytes and one final chunk of 232 bytes. Register profiling gives the essential placement semantics:

...