Hiding a syscall opcode inside an immediate and jumping into the instruction midpoint to bypass Capstone-based shellcode filtering
Deriving an AES-256 key from a hardcoded Windows path and decrypting Pumpkin.html.enc with the fixed IV embedded in the binary
Solving an embedded Sudoku, deriving a row-ordered 27-byte keystream, and XORing the hardcoded ciphertext
Recovering a 48-byte secret from a stateful AES-CBC encryption oracle by forcing block collisions across chained requests
![[H7CTF 2025] 0x0f05 writeup](/_astro/h7ctf.DX83Bz1u_1q0QBY.webp)