BDSec CTF 2026 Reverse Writeup: 3 Challenges Solved
BDSec CTF 2026 shipped a three-challenge reverse-engineering track that runs the classic escalator: Easy RE Challenge (80 pts) is an unstripped ELF with four input paths, three of them decoys with convincing AFLAG/BFLAG/CFLAG{...} returns, and one real 41-byte BDSEC{...} branch guarded by a per-byte XOR + rotate-left + additive-term + output-permutation transform that inverts cleanly from the embedded expected buffer. Night Shift (100 pts) is a stripped ELF that spawns five pthread workers and dispatches them from the user’s eight-token “shift code”; only 5^8 = 390 625 orderings exist, and exactly one matches the four 32-bit state targets plus the FNV-shaped hash accumulator, unlocking a .rodata printer that emits the flag byte by byte. Borrowed Memory (460 pts) is a stripped PIE that generates a 0x800-byte xorshift-seeded memory table, patches specific offsets to encode a 12-step VM opcode tape, and asks the user for twelve 16-bit offsets that walk that tape with checksum-gated transitions — after the twelfth step drops off the end of the table (next-offset = 0xFFFF), a four-source XOR loop decrypts a 40-byte .rodata blob into the real flag. ...