In 2026's "Cyber Apocalypse CTF: The Salt Crown" I played as a member of Team CTF-Regensburg. Below are writeups for the challenges I solved, with my main focus on Reverse Engineering (rev), Binary Exploitation (pwn), Hardware and ICS. As I was curious what the other challenges were like, I also had a look at various categories where a solution or two fell out.
| Category | Challenge | Difficulty | What it is |
|---|---|---|---|
| Hardware | Cadence in the Cord | Easy | A UART carries a decoy letter - the real message is in the gaps between characters |
| Hardware | Thermal Receipt | Easy | A PJL printer stores the token in NVRAM, but only once the receipt is read |
| Hardware | Saltlock Drift | Medium | RollJam: jam the fob so the car never consumes the code, then replay it |
| Hardware | What the Shard Displayed | Medium | An I2C capture of an OLED - the flag was drawn to the screen, not stored |
| Hardware | A Fault in the Cinder | Hard | Glitch away one branch, then unseal the record from a public measurement |
| Hardware | Wireless Connections | Hard | ESP32 firmware: the key is XORed with an LCG seeded from three MAC bytes |
| Pwn | The Hinge Whisper | Very easy | Stack shellcode - the program prints its own buffer address |
| Pwn | The Emptiness Machine | Medium | FSOP: scanf writes straight into the libc FILE structures |
| Pwn | Words from the Past | Hard | Five bytes of input: exactly one relative jump into a one_gadget |
| Pwn | Heavy is the Krown | Insane | Kernel UAF plus an unchecked offset - root via modprobe_path |
| Reversing | First Mark | Easy | Four undocumented RISC-V opcodes, all of them invertible |
| Reversing | The Cinder Engine | Medium | An ARM binary running a bytecode VM, which hides a substitution-permutation cipher |
| Reversing | CorpSyncAudit | Hard | Windows binary that reassembles shellcode from the timestamps in its own log file |
| Reversing | Secondhand | Insane | Self-decrypting hash, with the comparison hidden inside an instruction |
| ICS | Crownspire Transfer | Medium | Replay a seven-week-old IEC 60870-5-104 auth packet, then trip the feeder |
| GamePwn | The Salt Crown | Hard | A Godot game paints the flag from 1024 encrypted drawing commands |
| Cloud | False Ferry | Easy | The flag sits in an older AWS S3 object version, behind a chain of IAM pointers |
| Crypto | False Witness | Very easy | Small-subgroup attack: the client gets to pick the generator |
| Web | Provisioneds* | Easy | PHP object injection - the __wakeup guard falls to a serialize reference |
* This challenge was solved after the CTF had ended and the flag was never submitted - it is documented for the technique, not as a scored solve.
