The Inner Engine

The brief

Recovered from the LATHE-CAD r4 install media, \TOOLS\LICENSE\README.1ST: Node-locked activation. Run the checker with your activation key as the only argument. A valid key unseals the activation record. Anything else stays sealed. Linux x86-64 ELF.

• inner-engine.zip, {size}

In short

A license checker hides its logic in bytecode for a small stack machine inside the binary. Its 23 byte equations leave 1,024 possible keys, and the checker's own SHA-256 test picks the one that unseals the flag.

Sealed, whatever you type

The checker prints license sealed for any argument. The lab followed that message back through the binary to the first gate. The key must be exactly 24 bytes, and only then does the real check run.

A machine inside the binary

The real check is bytecode. A dispatcher runs a 1,216 byte program of 243 instructions, five bytes each, on a small stack machine with 24 handlers. The lab read every handler and named its opcode.

23 tests on the key's bytes

The program refuses to run under a tracer, then runs 23 tests on pairs of key bytes, sums, XORs and three products mod 256, such as k12 + k15 = 0x9a. One failed test and the key stays sealed.

1,024 keys, one record

The equations leave 1,024 possible keys. A last step hashes the key to decrypt a 40 byte record and compares its SHA-256, which no equation can shortcut. The lab ran all 1,024 through the checker and one unsealed.

The activation record

The key is L1c#N0d3_7mQ9f3a2b8c6d1e. Given that key, the checker prints the 40 byte activation record, and the record is the flag.

The insight

The license check is data for a small machine, so decoding its bytecode turns it into 23 equations that leave only 1,024 keys to try.

The flag

hiCTF{vm_byt3c0d3_1nn3r_3ng1n3_unw0und!}