222 words
1 minute
BITSCTF 2026 - Tuff Game - Reverse Engineering Writeup
Category: Reverse Engineering
Flag: BITSCTF{Th1$_14_D3f1n1t3ly_Th3_fl4g}
Challenge Description
Unity infinite runner. Flag displayed after reaching 1 million meters. Given Tuff_Game.zip.
Analysis
Three layers of deception:
Layer 1 — XOR Decoy: NotAFlag class with key 0x5A → {Umm_4ctually_unx0r11ng_t0_g3t_fl4g_s33ms_t00_34sy}
Layer 2 — RSA Decoy: FlagGeneration class, shared-prime attack on 1024-bit moduli → BITSCTF{https://blogs.mtdv.me/Crypt0} (Rick Roll)
Layer 3 — Real Flag: 900 tiles named rq_X_Y (rq = reversed “qr”) in resources.assets. Troll images hint: “think vertically” → transpose X,Y.
Solution
Extract tiles with UnityPy, assemble with transposed coordinates:
# !/usr/bin/env python3import UnityPyimport numpy as npfrom PIL import Imageimport cv2
env = UnityPy.load("Tuff_Game/Tuff_Game/Tuff_Game_Data/resources.assets")
tiles = {}for obj in env.objects: if obj.type.name == "Texture2D": data = obj.read() name = data.m_Name if name.startswith("rq_"): parts = name.split("_") x, y = int(parts[1]), int(parts[2]) tiles[(x, y)] = np.array(data.image)
print(f"[+] Loaded {len(tiles)} QR tiles")
# Assemble with TRANSPOSED coordinatestile_size, grid_size = 5, 30img_size = grid_size * tile_sizefull_img = np.ones((img_size, img_size, 3), dtype=np.uint8) * 255
for (orig_x, orig_y), tile_data in tiles.items(): new_col, new_row = orig_y, orig_x # TRANSPOSED py, px = new_row * tile_size, new_col * tile_size full_img[py:py+tile_size, px:px+tile_size] = tile_data[:, :, :3]
Image.fromarray(full_img).save("qr_transposed_raw.png")
# Decode QRscale = 10upscaled = cv2.resize(full_img, (img_size * scale, img_size * scale), interpolation=cv2.INTER_NEAREST)gray = cv2.cvtColor(upscaled, cv2.COLOR_RGB2GRAY)detector = cv2.QRCodeDetector()data, bbox, straight = detector.detectAndDecode(gray)
print(f"\n[★] FLAG: {data}")Run:
python3 solve_tuff_game.pyOutput:
[+] Loaded 900 QR tiles[+] Saved qr_transposed_raw.png (150×150)[★] FLAG: BITSCTF{Th1$_14_D3f1n1t3ly_Th3_fl4g} BITSCTF 2026 - Tuff Game - Reverse Engineering Writeup
https://fuwari.vercel.app/posts/47/bitsctf-2026-tuff-game-reverse-engineering-writeup/