ISFCR CryoVault Finals 2026

The bundle describes a deterministic recovery export from a small RV32IM fixture. An MCU talks to a simulated sensor hub and a two-lane RF bridge, both of which stay powered while the…

The landing page exposed a tiny API description:

The goal was to reproduce export job 204 from dispatch.capture, then calculate the SHA-256 of the exact bytes returned by the supplied exporter.

We are given a 7.2 bench kit for thawd, a controller that executes small programs called thaw plans in a made-up 16-bit instruction set, FROSTLANG. The live pod runs an undocumented 7.3…

The service bundle silt-revision-d.zip contains:

No binary was provided, only a TCP service. On connect it prints:

The repository was "tidied up" through a history rewrite: old branches were force-pushed, the pre-rewrite history was left unreachable, and a deleted .env.local was removed from the…

We are given qedvm, a static Rust proof checker for a small intuitionistic propositional logic called QPL. The goal is to submit a module whose exported definition has formula bot…

The target is a shared VX-410 controller exposed through a JSON API. The intended path is to stage firmware into bank B, boot the trial, pass the boot diagnostic, and confirm the trial.…

The service only exposed a TCP endpoint, no binary was provided. It prints:

We are provided with five forensic artifacts collected from a field relay environment: desc.txt: Challenge description stating that CRYO-LT-07 started an export at 03:17 UTC and pushed…

Inspecting site/index.html reveals a static client-side web page with no backend interaction:

Requesting the endpoint returns a single ASCII bit:

The challenge exposed only a TCP service with no downloadable binary. After connecting, it printed:

We are given two lossless recordings of a thermal camera patrol:

The unit starts each submitted job at a 64-bit register value x. After the job, it advances its ratchet by running a secret, six-line job on the same starting value. If that secret job…

The service starts with floe stream open. and a floe> prompt. It accepts a two-byte big-endian length followed by that many payload bytes:

The .bss range 0x403040–0x403160 is suspiciously large and is filled at runtime. The important part of .text is the function at 0x4003c0, which is passed directly to __libc_start_main:

201 {"base":"https://.../s/ ","token":" "} ```

Only the remote service was provided. It offered:

The power cut left a later epoch-1 page in NAND, but its journal checksum is invalid. The last committed resource is epoch 0. Its archive needs two pieces of volatile evidence: a key…

The vault thaws at a temperature of $2^{39}$. Four ordinary order requests can add less than $4\cdot 2^{32}$, so they cannot reach that threshold. The maintenance override accepts a…

I read CHART_NOTES.txt first. Its marking convention identifies a verified reading by a ring around one hex character with two lines beneath it. The number beside the ring gives the…

The archive is a ten-stage chain. Each stage's answer is the key to the next sealed record; the final ten answers together decrypt vault.sealed.

The target was a small Flask/Werkzeug label-preview service:

The job was purged on 14 Jan, but the registry is copy-on-write. The four job/8149285a1114b9b0/... keys were tombstoned, while the old cursor leaf pages remained in freed pages. Each…

Frostline Edge is the only public listener. It authenticates the client, assigns a role (viewer), and forwards a sealed CCIP manifest to vaultd, the cold core. The goal is to thaw the…

We are given chronoglyph.zip, containing a single disk image:

The recovered batch is recovered.fld2: 167 rows, 6,688 bytes.

Two-byte big-endian length followed by that many payload bytes:

public_exchange.sage gives the epoch 0 parameters, Alice's and Bob's public states, and a shuffled pool of 48 braid anchors. ciphertext.json contains seven frames. Frame e is encrypted…