Captain's Last Assembly: Sector 7 Protocol

Reverse Engineering, Hard, 500 pts

ICTF{QUANTUM_COLLISION_GATEWAY_BYPASS}

This is a Unity Mono build, so all game logic is plain IL in CaptainsLastAssembly_Data/Managed/Assembly-CSharp.dll. The gates (a million credits at one per minute, a barrier in the corridor) only matter if you play it. The flag is decrypted by VaultCoreTerminal.DecryptFlag, and everything it needs is in the assembly.

I had no .NET decompiler installed, so I parsed the metadata with Python's dnfile and read the IL bytes. The static constructor fills two fields through RuntimeHelpers.InitializeArray:

• CipherKey: 7 bytes, SECTOR7
• EncryptedPayload: 38 bytes, starting 1a 06 17 12 34 03 62 ...

DecryptFlag is a repeating-key XOR (ldelem, rem, ldelem, xor, stelem):

p = bytes.fromhex('1a061712340362120b1701020d741c090f1d1c1b781d1a04151b1760121c1c1616027600163e')
k = b'SECTOR7'
print(bytes(c ^ k[i % 7] for i, c in enumerate(p)))

The prefix is ICTF{, not FLAG{, so it is easy to dismiss as the wrong format. I never ran the game to watch it print this on screen, but the decryption is unambiguous and the platform confirmed the flag.