Last Execution

The brief

The final command was executed. EXE-9 never responded again. A single image survived: last_execution.img. It contains broken code, twisted tables, and something that was never meant to be found.

• last-execution.zip, 8.2 MB

In short

Last Execution ships the memory image of EXE-9, a 64-bit processor that never existed, with a manual that is wrong in three places. The lab wrote an emulator, fitted the true constants against the image's own checksums and ran the code to its last halt, whose registers form the key to a sealed will.

A processor that never existed

The file is an 8,650,752 byte image of EXE-9, a made up 64-bit processor. It holds 24 segments, among them code, rotated lookup tables, a manual called PRIMER and a sealed will. Nothing runs it, so the lab wrote an emulator.

A manual wrong in three places

Read as written, the manual decodes garbage. The lab fitted its constants to the image and found three wrong, a rotation step of 17 not 19, a row bias of 13 not 11 and a dispatch shift of 3 not 4. The selftest's SHA-256 then matched exactly.

Seven halts in one chain

Every segment ends in a HALT, and the next segment is that value XOR the low 32 bits of R1. The chain runs MAIN, FOLD_A, FOLD_B, LIMIT and FINAL, then LIMIT and FINAL again. FINAL rebuilds its own blank page 13 as it runs.

Twenty trillion turns in one step

LIMIT loops 20,015,998,343,868 times. Its state repeats every 786,432 turns, so the lab summed one cycle, took it 25,451,658 times and added the last 39,612 turns. Stepping the real code for six small counts gave the same state.

A console log one digit off

The image also carries a console log of the final registers that claims to win over emulation. Its R2 differs in one hex digit, and that state opens a test seal to a fake flag. The lab kept the registers of its own last halt.

The last halt opens the will

R1 to R4, wrapped in LASTEXEC on both sides, hash to a 256-bit key that starts ac35ec6e. Run backwards through 16 rounds of the image's own cipher, the sealed will gives up 50 bytes of text, the flag.

The insight

The image's checksums told the truth where its manual and its console log did not, so only an honest emulation of the last halt opens the will.

The flag

hiCTF{3x3c_9_r3m3mb3rs_4ll_but_th3_l4st_h4lt_l13s}