Snapfile

The brief

The format was never documented outside the team, and the only thing that leaked is the tool itself: a single stripped release binary. No source, no spec, no sample .snap file. If you can hand it a .snap it considers genuine, it will unpack the snapshot's embedded label, which is the flag. Run it with ./snaptool somefile.snap. It prints the unpacked label on success and invalid snapfile on any failure.

• snapfile.zip, 239 KB

In short

A stripped tool accepts only a genuine .snap file, a format with no spec and no sample. Its checks fix every header byte and never read the payload, so a genuine file is the fixed header plus one checksum. The label it prints is decrypted from the binary itself.

Every check ends at one message

The only file is snaptool, a stripped Crystal binary of 586,736 bytes. The lab followed the string invalid snapfile back to the parser, where every format check branches to that one message.

A header with nothing left to guess

Read in order, the checks pin every field. The file is 104 bytes, opens with SNAP and version 00 02 03 00, carries a second magic SNAP-LNG and three offset and length pairs. All 40 header bytes are fixed.

Only the checksum has to be earned

The pairs point at 16, 32 and 8 bytes of payload that the tool never reads. What it does check is 8 bytes at 0x60, a multiply and shift loop over bytes 0x08 to 0x5f, so the lab computed it from the loop itself.

The label was never in the file

The tool decrypts a 46 byte blob, 32 bytes from its data and 14 from its code, with a SHA-256 keystream seeded by the header. A stored digest confirms the result. With the header fixed, the lab decrypted it offline.

104 bytes, and the tool agrees

The lab wrote flag.snap from the fixed header, 56 bytes of anything and the checksum. The tool printed the label. The same file with a broken checksum printed invalid snapfile.

The insight

Every header field is pinned to a constant and the payload is never read, so a genuine file is just a fixed header plus one correct checksum.

The flag

hiCTF{r3c0nstruct3d_th3_sn4pf1l3_by73_by_by73}