u/i_mattas

I’ve been working on a CTF challenge called palimpsest, and I wanted to share the idea because it’s probably the most evil rev challenge I’ve made so far.

The public files are just a stripped ELF and an encrypted pack file. There’s no input prompt, no “correct/wrong” branch, and no plaintext flag. Running it normally just gives you a mostly useless digest, so the solve is not about patching a branch or finding a password check.

The binary has a couple fake VM paths and one real custom VM. The real VM uses stateful opcode decoding, so the same encoded instruction can mean different things depending on runtime state. There are also a few self-modifying bytecode spots, so static disassembly alone is kind of doomed. The intended move is to reverse the VM loop, write a tracer or emulator, and dump what it builds in memory.

That memory dump is not the flag either. It’s a masked typed IR that turns into a modular constraint graph. After decoding the IR and simplifying the constraints, the actual crypto finally shows up: a custom Schnorr-style signature system with decoy samples and a noisy affine nonce relation.
So the solve path is basically:

1. unpack the sections
2. ignore the fake VMs
3. reverse the real VM
4. write an emulator/tracer
5. dump the hidden IR
6. decode/type-infer the IR
7. simplify the constraint graph
8. extract the Schnorr equations
9. filter decoys
10. run a lattice attack
11. recover the private scalar
12. decrypt the flag

I’m trying to keep it brutal but fair. No random crashes, no anti-debugging junk, no network stuff, and no impossible crypto. The hardness is supposed to come from the layers and the fact that each stage only reveals the next representation.

Curious what rev people think: is this the fun kind of evil, or did I cross into “I am switching to OSINT and finding where the challenge developer lives” area?

Who else is going to DEFCON in Vegas and is excited!?

I wanted some outside opinions on this because I’m getting mixed feelings about whether I handled this correctly.

There’s a Discord server/community that develops a Windows gaming optimization tool called Risxn. A while back I actually used their utility before I got into reverse engineering and binary exploitation.

Recently I was bored and decided to take a look at their software. I ended up fully deobfuscating the application and reversing how it worked. As part of that process, I was also able to recreate a functional replica of the application and discovered that their backend endpoints could be abused to generate valid licenses.

After finding all of this, I felt like the responsible thing to do was disclose it to them so they could fix the issues. Since I had already reversed the application, I figured it would be useful to show them exactly what was wrong and how an attacker could exploit it.

I opened a support ticket and explained everything. They asked me for proof, so I sent them a ZIP containing the project directory I had been working in, including my analysis, deobfuscated code, and the proof-of-concept work that demonstrated the vulnerabilities.

They reviewed it, thanked me for reporting the issues, and then shortly afterward banned me from their Discord, revoked my license, and removed me from their backend system where licenses were managed.

I’m honestly confused by the response. From my perspective, I reported serious security issues, provided evidence, and gave them the information they needed to fix the vulnerabilities. On the other hand, I can understand why a company might not appreciate someone reversing their software, rebuilding it, and demonstrating license generation exploits.

So my question is:

Was I in the wrong here, or was this a reasonable example of responsible disclosure? How would you have handled this situation differently?

Any ideas?

What is the closest clone of MacOS Desktop environment. I found a GTK theme called MacTahoe