Warden's Maze

The brief

A tiny terminal arcade game, served over a single TCP connection. You are a dot in a Pac-Man-style maze: collect pellets, dodge the patrolling warden, and explore. Dead in the centre is a vault, walled off with its own distinct tile and sealed on every side. The prize sits inside it. By the ordinary rules of movement the vault simply cannot be entered, and the movement code holds up to any amount of poking.

• maze, 449 KB
• README.txt, 2 KB

In short

Warden's Maze hides its prize in a vault no move can enter. The lab found that the game's sight code marks cells as explored through an offset squeezed into one signed byte, so looking six rows down from one cell rewrites the vault's top wall as floor. It then walked in on the live service.

A vault no move can enter

A terminal arcade game runs over one connection. The prize sits in a vault in the middle of a 24 by 21 maze, sealed on every side. Movement only allows floor, pellets and the vault's inside, so walls stay walls.

The map is a row of 504 bytes

The lab took the stripped 449 KB Rust binary apart. The maze lives as 504 bytes, one per cell and 24 to a row. When you see a cell, the game sets bit 0x40 in that same byte to mark it explored.

One byte too small

The sight code looks 6 cells around you. It reads each target correctly, then computes the offset again to mark it, keeping only the low byte as a signed number. Six rows down is 144, and 144 in a signed byte is minus 112.

Exactly one cell in the maze

Looking 6 rows straight down needs 5 free cells in between. The lab checked every floor cell against the sight rules and found one, row 14, column 4. Its mark lands 112 cells back, on the vault's top wall, and turns it into floor.

In through the top wall

The lab played the live service, reading the board after every move and steering around the warden. It stepped onto the trigger cell, walked in through the opened wall to the prize, and the server printed the flag.

The insight

An offset of 144 kept in one signed byte becomes minus 112, so looking six rows down marks a cell 112 cells back, and that cell is a vault wall.

The flag

hiCTF{maze-warden-vault-seed-2026_f8dd7f12cf}