Beyond the fourth wall — ASIS CTF 2026

Description

Organizers provided two files (no interactive service):

• scouting_report.c — a 9.4 MB C source file, 345,236 lines
• beyond.elf — a stripped RISC-V 64 (RV64) PIE Linux binary

English summary: beyond.elf accepts exactly one 28-byte command-line argument — the flag candidate — and prints a success message only for the correct value. scouting_report.c is "a C file that compiles, but that is not its only purpose": its layout (indentation widths, the shape of survey(w^w^...) call chains, comment lengths, blank-line rhythm) smuggles a 334,767-byte data container. Recovering the flag requires four cooperating stages:

1. decode the steganographic container out of the C source;
2. reverse the binary's layered crypto — the container and the stage payloads are keyed by three 7-byte chunks of the flag, and each chunk is verifiably recoverable by inverting a custom hash;
3. understand a custom 32768-word u32 array VM that the decrypted bytecode drives;
4. solve the hidden "4th pass" checker as a GF(2) linear system over the last 7 flag bytes.

The title is a hint at the finale: after the three visible stages, the VM is silently reset and re-run a fourth time.

Analysis

Stage 1 — whitespace/comment steganography in scouting_report.c

The source consists of encoded lines of the form

   survey(w^w^w^w^w);/*hhh*/

separated by blank lines. Every encoded line carries exactly one byte:

byte = indent | ((wcount - 1) << 3) | (comment_index << 6)

...