OmniCTF 2026 Quals Reverse Writeup: 4 Challenges Solved
OmniCTF 2026 Quals shipped a reverse-engineering track that runs the full spectrum from beginner constraint-solving to a signal-driven VM that uses SIGSEGV and SIGILL as branch instructions. Four challenges: CredVault (medium, 85 solves) is a Parcel-format migration mismatch between two validators over a binary TCP protocol; Gatekeep (medium, 62 solves) is a PNG-only FPGA schematic solved as a byte-level constraint satisfaction problem; Kant (medium, 92 solves) is a stripped Rust binary whose hidden check <hex> mode stacks XOR / S-boxes / MixColumns / power-maps mod 257 / two 16-round Feistels / byte and bit permutations, all reversible from the embedded compare target; Pusher (hard, 500 points, 0 solves at release) is a 32-bit i386 ELF whose control flow is smuggled through installed signal handlers and whose %d vs %c format-string trap costs an entire remote instance to figure out from the wrong side. ...