THE GARDEN

memory-trace

Updated 20 Sep 2026

• •

  Attribution

  • •

    Solved by Muhammad Dhafin Ramadhan during the competition. These are rn’s study notes based on the teammate’s documented solve, not an independent rn solve.

• •

  What it asked

  • •

    Triage memory strings, reject decoys, and use the recorded XOR mode, key, and ciphertext to recover the real flag.

• •

  Approach

  • •

    The relevant strings were last_cipher_mode=xor-repeat, XOR_KEY=PNUP-LAB, and ct_hex=…. An old_flag string was explicitly a decoy.

  • •

    For key bytes $k_0,\ldots,k_{m-1}$, decrypt each byte as $p_i=c_i\oplus k_{i\bmod m}$, then validate the flag syntax.

• •

  Solution

  • •

    import re
    
    ct = bytes.fromhex(
        "1b031c0063743a2f35233a2254132030242733314e38321d332f3b0f5f293727"
        "31220a3b4835323f"
    )
    key = b"PNUP-LAB"
    pt = bytes(b ^ key[i % len(key)] for i, b in enumerate(ct)).decode()
    assert re.fullmatch(r"KMIPN8\{[^}\r\n]+}", pt)
    print(pt)
    

• •

  Verification

  • •

    The supplied ciphertext decrypts locally to the recorded flag and passes the syntax check.

• •

  Concepts

  • •

    Memory-string triage; decoy handling; repeated-key XOR; plaintext validation.

• •

  Source

  • •

    Source: team document KMIPNVIII-unintended.docx, titled “Writeup unintended KMIPN 8 Final”. Page numbers refer to the rendered document. Rendered pp. 60–63.

  • •

    Flag: KMIPN8{memory_artifacts_can_reveal_keys}.

◌ Explore connections in Graph view