Map Beneath the Ink

Flag: FLAG{DEAD_MANS_SHALLOWS_14_FATHOMS_OT-7729-CARIB}

The zip holds five images and a checksum file: old_map.jpg (1718 survey chart), treasure_map.png (Captain Vance's annotated copy), captain_portrait.jpg, ship_photograph.png and historical_document.png (a quartermaster's deposition). sha256sum -c checksums.sha256 passes for all of them.

Metadata

exiftool on each image gives the hints.

• historical_document.png has the instructions in its text: the deposition says to inspect the least significant bits of the blue channel, and that the vault code is built from three tokens: the reef name at the inverted anchor on old_map.jpg, the sounding at that reef, and the vessel registry key from ship_photograph.png.
• ship_photograph.png has Registry_Key: OT-7729-CARIB in its PNG text chunks.
• captain_portrait.jpg carries a "DECOY LEAD NOTE" saying Gallows Rock was dug up in 1892 and held nothing.

So the red "X / TREASURE BURIED HERE" on treasure_map.png is a decoy. Compared with old_map.jpg, Vance's copy also has the anchor flipped upright; in the original it is inverted, ring at the bottom, at "Dead Man's Shallows, Depth 14 Fathoms, Submerged Reef".

LSB extraction

The data is in the blue-channel LSBs of treasure_map.png, row-major, packed LSB-first within each byte. np.packbits is MSB-first, so each group of 8 bits has to be reversed first (read MSB-first it comes out as noise).

import numpy as np
from PIL import Image

im = np.asarray(Image.open("treasure_map.png").convert("RGB"))
bits = (im[:, :, 2] & 1).flatten().reshape(-1, 8)[:, ::-1]
print(np.packbits(bits).tobytes().decode("latin1"))

Output is a "VANCE DISPATCH" that says to use the original 1718 survey and gives the tokens DEAD_MANS_SHALLOWS, 14_FATHOMS and OT-7729-CARIB, plus the format FLAG{<REEF_NAME>_<DEPTH>_<REGISTRY_KEY>}. These match what is printed on old_map.jpg and in the ship photo's metadata, so the flag is the three tokens in that format.