RESURRECTION

The brief

Tier-0 infrastructure collapsed under an absolute scorched-earth purge. The beacon exists solely within the silent spaces: Shattered-Geometry, Chrono-Echoes, and Unmapped-Voids. Recover the transmission from the wreckage. Each recovered phase reveals an ordinal identifier tag. Concatenate all five payload segments in order.

• resurrection.zip, 3.2 MB

In short

A 1 GB disk image with its partition table and boot sector wiped. The lab rebuilt the geometry from the disk's own backups, then found five flag pieces in file system metadata, from a DLL overlay to orphan bits in the cluster bitmap.

A wiped disk, rebuilt from its backups

The partition table and NTFS boot sector of the 1 GB image are zeroed. The backup table at the last sector survives, its CRC overwritten with 0xDEADBEEF. The boot sector copy at the volume's end puts the MFT at cluster 85,845.

Piece one, after the end of a DLL

The flag is cut into five tagged pieces. kbdusx.dll is 1,068 bytes, but its sections end at byte 1,024. The 44 bytes after them, XORed with the file's own timestamp 80 85 EC 65, give the first.

Piece two, in a directory's run list

Directory record 111 claims its attributes end at byte 236, but they run on to 768. Past the claimed end hides a stream of 11 MB of zeros. The piece is in its map, 34 run lengths that read as text.

Piece three, in the gaps between timestamps

A transaction journal holds 34 USN records. Their timestamps step by 0x27xx in units of 100 nanoseconds, a rhythm timeline tools never question. Minus 0x2700, each of the 33 gaps is one letter.

Piece four, in values typed true or false

One record in Security_Audit.evtx declares 33 values as Bool, which can only be 0 or 1. Each holds a character code instead, and in order they spell the fourth piece.

Piece five, in clusters nobody owns

The lab took every cluster marked in use and removed every cluster a file claims. Exactly 40 orphan bits remain, and the gaps between them, 53, 49, 102, are letters. The five pieces join into the flag.

The insight

Every piece hid in a gap between what a structure declares and what it holds, so the lab read the maps, the gaps and the types, not the files.

The flag

hiCTF{p3_0v3rl4y_71m3d473574mp_k3y_n7f5_runl157_cl5_g30m37ry_7r4ns4c710n_n4n0_f1l371m3_3v7x_b1n4ry_xml_70k3n5_b17m4p_orph4n_v01d_r35urr3c710n}