ctf-agent 1.2.0

package/skills/ctf-misc/encodings.md

@@ -0,0 +1,431 @@
+# CTF Misc - Encodings & Media
+
+## Table of Contents
+- [Common Encodings](#common-encodings)
+  - [Base64](#base64)
+  - [Base32](#base32)
+  - [Hex](#hex)
+  - [IEEE 754 Floating Point Encoding](#ieee-754-floating-point-encoding)
+  - [UTF-16 Endianness Reversal (LACTF 2026)](#utf-16-endianness-reversal-lactf-2026)
+  - [BCD (Binary-Coded Decimal) Encoding (VuwCTF 2025)](#bcd-binary-coded-decimal-encoding-vuwctf-2025)
+  - [Multi-Layer Encoding Detection (0xFun 2026)](#multi-layer-encoding-detection-0xfun-2026)
+  - [URL Encoding](#url-encoding)
+  - [ROT13 / Caesar](#rot13--caesar)
+  - [Caesar Brute Force](#caesar-brute-force)
+- [QR Codes](#qr-codes)
+  - [Basic Commands](#basic-commands)
+  - [QR Structure](#qr-structure)
+  - [Repairing Damaged QR](#repairing-damaged-qr)
+  - [Finder Pattern Template](#finder-pattern-template)
+  - [QR Code Chunk Reassembly (LACTF 2026)](#qr-code-chunk-reassembly-lactf-2026)
+  - [QR Code Chunk Reassembly via Indexed Directories (UTCTF 2026)](#qr-code-chunk-reassembly-via-indexed-directories-utctf-2026)
+- [Multi-Stage URL Encoding Chain (UTCTF 2026)](#multi-stage-url-encoding-chain-utctf-2026)
+- [Esoteric Languages](#esoteric-languages)
+  - [Whitespace Language Parser (BYPASS CTF 2025)](#whitespace-language-parser-bypass-ctf-2025)
+  - [Custom Brainfuck Variants (Themed Esolangs)](#custom-brainfuck-variants-themed-esolangs)
+  - [Multi-Layer Esoteric Language Chains (Break In 2016)](#multi-layer-esoteric-language-chains-break-in-2016)
+- [base65536 CJK Unicode Binary Encoding (IceCTF 2018)](#base65536-cjk-unicode-binary-encoding-icectf-2018)
+
+See also: [encodings-advanced.md](encodings-advanced.md) - Verilog/HDL, Gray code, binary tree encoding, RTF custom tags, SMS PDU decoding, multi-encoding solvers, UTF-9, pixel binary encoding, hex Sudoku + QR, TOPKEK, MaxiCode
+
+---
+
+## Common Encodings
+
+### Base64
+```bash
+echo "encoded" | base64 -d
+# Charset: A-Za-z0-9+/=
+```
+
+### Base32
+```bash
+echo "OBUWG32DKRDHWMLUL53TI43OG5PWQNDSMRPXK3TSGR3DG3BRNY4V65DIGNPW2MDCGFWDGX3DGBSDG7I=" | base32 -d
+# Charset: A-Z2-7= (no lowercase, no 0,1,8,9)
+```
+
+### Hex
+```bash
+echo "68656c6c6f" | xxd -r -p
+```
+
+### IEEE 754 Floating Point Encoding
+
+Numbers that encode ASCII text when viewed as raw IEEE 754 bytes:
+
+```python
+import struct
+
+values = [240600592, 212.2753143310547, 2.7884192016691608e+23]
+
+# Each float32 packs to 4 ASCII bytes
+for v in values:
+    packed = struct.pack('>f', v)  # Big-endian single precision
+    print(f"{v} -> {packed}")      # b'Meta', b'CTF{', b'fl04'
+
+# For double precision (8 bytes per value):
+# struct.pack('>d', v)
+```
+
+**Key insight:** If challenge gives a list of numbers (mix of integers, decimals, scientific notation), try packing each as IEEE 754 float32 (`struct.pack('>f', v)`) — the 4 bytes often spell ASCII text.
+
+### UTF-16 Endianness Reversal (LACTF 2026)
+
+**Pattern (endians):** Text "turned to Japanese" -- mojibake from UTF-16 endianness mismatch.
+
+**Fix:** Reverse the encoding/decoding order:
+```python
+# If encoded as UTF-16-LE but decoded as UTF-16-BE:
+fixed = mojibake.encode('utf-16-be').decode('utf-16-le')
+
+# If encoded as UTF-16-BE but decoded as UTF-16-LE:
+fixed = mojibake.encode('utf-16-le').decode('utf-16-be')
+```
+
+**Identification:** Text appears as CJK characters (Japanese/Chinese), challenge mentions "translation" or "endian".
+
+### BCD (Binary-Coded Decimal) Encoding (VuwCTF 2025)
+
+**Pattern:** Challenge name hints at ratio (e.g., "1.5x" = 1.5:1 byte ratio). Each nibble encodes one decimal digit.
+
+```python
+def bcd_decode(data):
+    """Decode BCD: each byte = 2 decimal digits."""
+    return ''.join(f'{(b>>4)&0xf}{b&0xf}' for b in data)
+
+# Then convert decimal string to ASCII
+ascii_text = ''.join(chr(int(decoded[i:i+2])) for i in range(0, len(decoded), 2))
+```
+
+### Multi-Layer Encoding Detection (0xFun 2026)
+
+**Pattern (139 steps):** Recursive decoding with troll flags as decoys.
+
+**Critical rule:** When data is all hex chars (0-9, a-f), decode as **hex FIRST**, not base64 (which also accepts those chars).
+
+```python
+def auto_decode(data):
+    while True:
+        data = data.strip()
+        if data.startswith('REAL_DATA_FOLLOWS:'):
+            data = data.split(':', 1)[1]
+        # Prioritize hex when ambiguous
+        if all(c in '0123456789abcdefABCDEF' for c in data) and len(data) % 2 == 0:
+            data = bytes.fromhex(data).decode('ascii', errors='replace')
+        elif set(data) <= set('ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/='):
+            data = base64.b64decode(data).decode('ascii', errors='replace')
+        else:
+            break
+    return data
+```
+
+**Ignore troll flags** — check for "keep decoding" or "REAL_DATA_FOLLOWS:" markers.
+
+### URL Encoding
+```python
+import urllib.parse
+urllib.parse.unquote('hello%20world')
+```
+
+### ROT13 / Caesar
+```bash
+echo "uryyb" | tr 'a-zA-Z' 'n-za-mN-ZA-M'
+```
+
+**ROT13 patterns:** `gur` = "the", `synt` = "flag"
+
+### Caesar Brute Force
+```python
+text = "Khoor Zruog"
+for shift in range(26):
+    decoded = ''.join(
+        chr((ord(c) - 65 - shift) % 26 + 65) if c.isupper()
+        else chr((ord(c) - 97 - shift) % 26 + 97) if c.islower()
+        else c for c in text)
+    print(f"{shift:2d}: {decoded}")
+```
+
+---
+
+## QR Codes
+
+### Basic Commands
+```bash
+zbarimg qrcode.png           # Decode
+zbarimg -S*.enable qr.png    # All barcode types
+qrencode -o out.png "data"   # Encode
+```
+
+### QR Structure
+
+**Finder patterns (3 corners):** 7x7 modules at top-left, top-right, bottom-left
+
+**Version formula:** `(version * 4) + 17` modules per side
+
+### Repairing Damaged QR
+
+```python
+from PIL import Image
+import numpy as np
+
+img = Image.open('damaged_qr.png')
+arr = np.array(img)
+
+# Convert to binary
+gray = np.mean(arr, axis=2)
+binary = (gray < 128).astype(int)
+
+# Find QR bounds
+rows = np.any(binary, axis=1)
+cols = np.any(binary, axis=0)
+rmin, rmax = np.where(rows)[0][[0, -1]]
+cmin, cmax = np.where(cols)[0][[0, -1]]
+
+# Check finder patterns
+qr = binary[rmin:rmax+1, cmin:cmax+1]
+print("Top-left:", qr[0:7, 0:7].sum())  # Should be ~25
+```
+
+### Finder Pattern Template
+```python
+finder_pattern = [
+    [1,1,1,1,1,1,1],
+    [1,0,0,0,0,0,1],
+    [1,0,1,1,1,0,1],
+    [1,0,1,1,1,0,1],
+    [1,0,1,1,1,0,1],
+    [1,0,0,0,0,0,1],
+    [1,1,1,1,1,1,1],
+]
+```
+
+### QR Code Chunk Reassembly (LACTF 2026)
+
+**Pattern (error-correction):** QR code split into grid of chunks (e.g., 5x5 of 9x9 pixels), shuffled.
+
+**Solving approach:**
+1. **Fix known chunks:** Use structural patterns -- finder patterns (3 corners), timing patterns, alignment patterns -- to place ~50% of chunks
+2. **Extract codeword constraints:** For each candidate payload length, use QR spec to identify which pixels are invariant across encodings
+3. **Backtracking search:** Assign remaining chunks under pixel constraints until QR decodes successfully
+
+**Tools:** `segno` (Python QR library), `zbarimg` for decoding.
+
+### QR Code Chunk Reassembly via Indexed Directories (UTCTF 2026)
+
+**Pattern (QRecreate):** QR code split into numbered chunks stored in separate directories. Directory names encode the chunk index as base64 (e.g., `MDAx` → `001` → index 1).
+
+**Solving approach:**
+1. Decode each directory name from base64 to get the numeric index
+2. Sort chunks by decoded index
+3. Arrange in a grid (e.g., 100 chunks → 10x10) and stitch into a single image
+4. Decode the reconstructed QR code
+
+```python
+import os, base64, math
+from PIL import Image
+
+# 1. Decode directory names to get indices
+chunks = []
+for dirname in os.listdir('chunks/'):
+    index = int(base64.b64decode(dirname).decode())
+    tile = Image.open(f'chunks/{dirname}/tile.png')
+    chunks.append((index, tile))
+
+# 2. Sort by index and arrange in grid
+chunks.sort(key=lambda x: x[0])
+n = len(chunks)
+side = int(math.isqrt(n))
+tile_w, tile_h = chunks[0][1].size
+
+canvas = Image.new("RGB", (side * tile_w, side * tile_h), (255, 255, 255))
+for i, (_, tile) in enumerate(chunks):
+    r, c = divmod(i, side)
+    canvas.paste(tile, (c * tile_w, r * tile_h))
+
+canvas.save('reconstructed_qr.png')
+# 3. Decode with zbarimg or pyzbar
+```
+
+**Key insight:** Unlike the LACTF variant (shuffled chunks requiring structural analysis), indexed chunks just need sorting. The challenge is recognizing that directory names are base64-encoded indices. Check `base64 -d` on folder names when they look like random strings.
+
+---
+
+## Multi-Stage URL Encoding Chain (UTCTF 2026)
+
+**Pattern (Breadcrumbs):** Flag is hidden behind a chain of URLs, each encoded differently. Follow the breadcrumbs across external resources (GitHub Gists, Pastebin, etc.), decoding at each hop.
+
+**Common encoding layers per hop:**
+1. **Base64** → URL to next resource
+2. **Hex** → URL to next resource (e.g., `68747470733a2f2f...` = `https://...`)
+3. **ROT13** → final flag
+
+**Decoding workflow:**
+```python
+import base64, codecs
+
+# Hop 1: Base64
+hop1 = "aHR0cHM6Ly9naXN0Lmdp..."
+url2 = base64.b64decode(hop1).decode()
+
+# Hop 2: Hex-encoded URL
+hop2 = "68747470733a2f2f..."
+url3 = bytes.fromhex(hop2).decode()
+
+# Hop 3: ROT13-encoded flag
+hop3 = "hgsynt{...}"
+flag = codecs.decode(hop3, 'rot_13')
+```
+
+**Key insight:** Each resource contains a hint about the next encoding (e.g., "Three letters follow" hints at 3-character encoding like hex). Look for contextual clues in surrounding text (poetry, comments, filenames) that indicate the encoding type.
+
+**Detection:** Challenge mentions "trail", "breadcrumbs", "follow", or "scavenger hunt". First resource contains what looks like encoded data rather than a direct flag.
+
+---
+
+## Esoteric Languages
+
+| Language | Pattern |
+|----------|---------|
+| Brainfuck | `++++++++++[>+++++++>` |
+| Whitespace | Only spaces, tabs, newlines (or S/T/L substitution) |
+| Ook! | `Ook. Ook? Ook!` |
+| Malbolge | Extremely obfuscated |
+| Piet | Image-based |
+
+### Whitespace Language Parser (BYPASS CTF 2025)
+
+**Pattern (Whispers of the Cursed Scroll):** File contains only S (space), T (tab), L (linefeed) characters — or visible substitutes. Stack-based virtual machine (VM) with PUSH, OUTPUT, and EXIT instructions.
+
+**Instruction set (IMP = Instruction Modification Parameter):**
+| Instruction | Encoding | Action |
+|-------------|----------|--------|
+| PUSH | `S S` + sign + binary + `L` | Push number to stack (S=0, T=1, L=terminator) |
+| OUTPUT CHAR | `T L S S` | Pop stack, print as ASCII character |
+| EXIT | `L L L` | Halt program |
+
+```python
+def solve_whitespace(content):
+    # Convert to S/T/L tokens (handle both raw whitespace and visible chars)
+    if any(c in content for c in 'STL'):
+        code = [c for c in content if c in 'STL']
+    else:
+        code = [{'\\s': 'S', '\\t': 'T', '\\n': 'L'}.get(c, '') for c in content]
+        code = [c for c in code if c]
+
+    stack, output, i = [], "", 0
+
+    while i < len(code):
+        if code[i:i+2] == ['S', 'S']:  # PUSH
+            i += 2
+            sign = 1 if code[i] == 'S' else -1
+            i += 1
+            val = 0
+            while i < len(code) and code[i] != 'L':
+                val = (val << 1) + (1 if code[i] == 'T' else 0)
+                i += 1
+            i += 1  # skip terminator L
+            stack.append(sign * val)
+        elif code[i:i+4] == ['T', 'L', 'S', 'S']:  # OUTPUT CHAR
+            i += 4
+            if stack:
+                output += chr(stack.pop())
+        elif code[i:i+3] == ['L', 'L', 'L']:  # EXIT
+            break
+        else:
+            i += 1
+
+    return output
+```
+
+**Identification:** File with only whitespace characters, or challenge mentions "invisible code", "blank page", or uses S/T/L substitution. Try [Whitespace interpreter online](https://vii5ard.github.io/whitespace/) for quick testing.
+
+---
+
+### Custom Brainfuck Variants (Themed Esolangs)
+
+**Pattern:** File contains repetitive themed words (e.g., "arch", "linux", "btw") used as substitutes for Brainfuck operations. Common in Easy/Misc CTF challenges.
+
+**Identification:**
+- File is ASCII text with very long lines of repeated words
+- Small vocabulary (5-8 unique words)
+- One word appears as a line terminator (maps to `.` output)
+- Two words are used for increment/decrement (one has many repeats per line)
+- Words often relate to a meme or theme (e.g., "I use Arch Linux BTW")
+
+**Standard Brainfuck operations to map:**
+| Op | Meaning | Typical pattern |
+|----|---------|-----------------|
+| `+` | Increment cell | Most repeated word (defines values) |
+| `-` | Decrement cell | Second most repeated word |
+| `>` | Move pointer right | Short word, appears alone or with `.` |
+| `<` | Move pointer left | Paired with `>` word |
+| `[` | Begin loop | Appears at start of lines with `]` counterpart |
+| `]` | End loop | Appears at end of same lines as `[` |
+| `.` | Output char | Line terminator word |
+
+**Solving approach:**
+```python
+from collections import Counter
+words = content.split()
+freq = Counter(words)
+# Most frequent = likely + or -, line-ender = likely .
+
+# Map words to BF ops, translate, run standard BF interpreter
+mapping = {'arch': '+', 'linux': '-', 'i': '>', 'use': '<',
+           'the': '[', 'way': ']', 'btw': '.'}
+bf = ''.join(mapping.get(w, '') for w in words)
+# Then execute bf string with a standard Brainfuck interpreter
+```
+
+**Real example (0xL4ugh CTF - "iUseArchBTW"):** `.archbtw` extension, "I use Arch Linux BTW" meme theme.
+
+**Tips:** Try swapping `+`/`-` or `>`/`<` if output is not ASCII. Verify output starts with known flag format.
+
+---
+
+### Multi-Layer Esoteric Language Chains (Break In 2016)
+
+Challenges may stack multiple esoteric languages requiring sequential interpretation:
+
+1. **Piet:** Visual programming language using colored pixel blocks. Execute PNG images as code:
+```bash
+npiet challenge.png         # npiet interpreter
+# Or: java -jar PietDev.jar challenge.png
+```
+
+2. **Malbolge:** Extremely difficult esoteric language. Decode output from previous layer:
+```bash
+# Piet output → base64 decode → Malbolge source
+echo "piet_output" | base64 -d > program.mal
+malbolge program.mal        # Or use online interpreter
+```
+
+Common esoteric chains: Piet → base64 → Malbolge, Brainfuck → Ook → Whitespace, JSFuck → standard JS.
+
+**Key insight:** When a PNG file doesn't contain obvious visual stego, try interpreting it as Piet code. Use `file` + visual inspection to identify the first layer, then decode sequentially.
+
+---
+
+## base65536 CJK Unicode Binary Encoding (IceCTF 2018)
+
+**Pattern:** A blob that looks like a wall of Chinese characters (CJK Unified Ideographs) is actually a **base65536** encoding: each character carries two bytes of data, mapping 0x0000..0xFFFF to a picked subset of 65,536 Unicode codepoints. Detect by `file` reporting "Unicode text, UTF-8" with mostly CJK codepoints; decode with the `base65536` npm package or the Python port.
+
+```bash
+# Node.js / npm path
+npm install -g base65536
+echo -n "宝䀈䀋..." | base65536 --decode > out.bin
+
+# Python port
+pip install base65536
+python3 - <<'PY'
+import base65536, sys
+sys.stdout.buffer.write(base65536.decode(open("blob.txt").read()))
+PY > out.bin
+
+file out.bin
+# common outcome: "Zip archive data" or "ELF 64-bit"
+```
+
+**Key insight:** base64 expands 3 bytes → 4 chars; base65536 expands 2 bytes → 1 *Unicode codepoint*, and since a codepoint renders as 1–4 UTF-8 bytes the encoded stream actually *expands* by ~2× on disk — but visually it looks compact, which is the CTF trick. Any wall of Unicode that lacks variance across the Basic Multilingual Plane and is dominated by CJK, Hangul, or Tibetan is a candidate. Also check base1024 (BMP), base2048, base4096, and base32768 for related tricks.
+
+**References:** IceCTF 2018 — Rabbit Hole, writeup 11421

package/skills/ctf-misc/games-and-vms-2.md

@@ -0,0 +1,254 @@
+# CTF Misc - Games, VMs & Constraint Solving (Part 2)
+
+## Table of Contents
+- [Cookie Checkpoint Game Brute-Forcing (BYPASS CTF 2025)](#cookie-checkpoint-game-brute-forcing-bypass-ctf-2025)
+- [Flask Session Cookie Game State Leakage (BYPASS CTF 2025)](#flask-session-cookie-game-state-leakage-bypass-ctf-2025)
+- [WebSocket Game Manipulation + Cryptic Hint Decoding (BYPASS CTF 2025)](#websocket-game-manipulation--cryptic-hint-decoding-bypass-ctf-2025)
+- [Server Time-Only Validation Bypass (BYPASS CTF 2025)](#server-time-only-validation-bypass-bypass-ctf-2025)
+- [De Bruijn Sequence for Substring Coverage (BearCatCTF 2026)](#de-bruijn-sequence-for-substring-coverage-bearcatctf-2026)
+- [Brainfuck Interpreter Instrumentation (BearCatCTF 2026)](#brainfuck-interpreter-instrumentation-bearcatctf-2026)
+- [WASM Linear Memory Manipulation (BearCatCTF 2026)](#wasm-linear-memory-manipulation-bearcatctf-2026)
+- [References](#references)
+
+---
+
+## Cookie Checkpoint Game Brute-Forcing (BYPASS CTF 2025)
+
+**Pattern (Signal from the Deck):** Server-side game where selecting tiles increases score. Incorrect choice resets the game. Score tracked via session cookies.
+
+**Technique:** Save cookies before each guess, restore on failure to avoid resetting progress.
+
+```python
+import requests
+
+URL = "https://target.example.com"
+
+def solve():
+    s = requests.Session()
+    s.post(f"{URL}/api/new")
+
+    while True:
+        data = s.get(f"{URL}/api/signal").json()
+        if data.get('done'):
+            break
+
+        checkpoint = s.cookies.get_dict()
+
+        for tile_id in range(1, 10):
+            r = s.post(f"{URL}/api/click", json={'clicked': tile_id})
+            res = r.json()
+
+            if res.get('correct'):
+                if res.get('done'):
+                    print(f"FLAG: {res.get('flag')}")
+                    return
+                break
+            else:
+                s.cookies.clear()
+                s.cookies.update(checkpoint)
+```
+
+**Key insight:** Session cookies act as save states. Preserving and restoring cookies on failure enables deterministic brute-forcing without game reset penalties.
+
+---
+
+## Flask Session Cookie Game State Leakage (BYPASS CTF 2025)
+
+**Pattern (Hungry, Not Stupid):** Flask game stores correct answers in signed session cookies. Use `flask-unsign -d` to decode the cookie and reveal server-side game state without playing.
+
+```bash
+# Decode Flask session cookie (no secret needed for reading)
+flask-unsign -d -c '<cookie_value>'
+```
+
+**Example decoded state:**
+```json
+{
+  "all_food_pos": [{"x": 16, "y": 12}, {"x": 16, "y": 28}, {"x": 9, "y": 24}],
+  "correct_food_pos": {"x": 16, "y": 28},
+  "level": 0
+}
+```
+
+**Key insight:** Flask session cookies are signed but not encrypted by default. `flask-unsign -d` decodes them without the secret key, exposing server-side game state including correct answers.
+
+**Detection:** Base64-looking session cookies with periods (`.`) separating segments. Flask uses `itsdangerous` signing format.
+
+---
+
+## WebSocket Game Manipulation + Cryptic Hint Decoding (BYPASS CTF 2025)
+
+**Pattern (Maze of the Unseen):** Browser-based maze game with invisible walls. Checkpoints verified server-side via WebSocket. Cryptic hint encodes target coordinates.
+
+**Technique:**
+1. Open browser console, inspect WebSocket messages and `player` object
+2. Decode cryptic hints (e.g., "mosquito were not available" → MQTT → port 1883)
+3. Teleport directly to target coordinates via console
+
+```javascript
+function teleport(x, y) {
+    player.x = x;
+    player.y = y;
+    verifyProgress(Math.round(player.x), Math.round(player.y));
+    console.log(`Teleported to x:${player.x}, y:${player.y}`);
+}
+
+// "mosquito" → MQTT (port 1883), "not available" → 404
+teleport(1883, 404);
+```
+
+**Common cryptic hint mappings:**
+- "mosquito" → MQTT (Mosquitto broker, port 1883)
+- "not found" / "not available" → HTTP 404
+- Port numbers, protocol defaults, or ASCII values as coordinates
+
+**Key insight:** Browser-based games expose their state in the JS console. Modify `player.x`/`player.y` or equivalent properties directly, then call the progress verification function.
+
+---
+
+## Server Time-Only Validation Bypass (BYPASS CTF 2025)
+
+**Pattern (Level Devil):** Side-scrolling game requiring traversal of a map. Server validates that enough time has elapsed (map_length / speed) but doesn't verify actual movement.
+
+```python
+import requests
+import time
+
+TARGET = "https://target.example.com"
+
+s = requests.Session()
+r = s.post(f"{TARGET}/api/start")
+session_id = r.json().get('session_id')
+
+# Wait for required traversal time (e.g., 4800px / 240px/s = 20s + margin)
+time.sleep(25)
+
+s.post(f"{TARGET}/api/collect_flag", json={'session_id': session_id})
+r = s.post(f"{TARGET}/api/win", json={'session_id': session_id})
+print(r.json().get('flag'))
+```
+
+**Key insight:** When servers validate only elapsed time (not player position, inputs, or movement), start a session, sleep for the required duration, then submit the win request. Always check if the game API has start/win endpoints that can be called directly.
+
+---
+
+## De Bruijn Sequence for Substring Coverage (BearCatCTF 2026)
+
+**Pattern (Brown's Revenge):** Server generates random n-bit binary code each round. Input must contain the code as a substring. Pass 20+ rounds with a single fixed input under a character limit.
+
+```python
+def de_bruijn(k, n):
+    """Generate de Bruijn sequence B(k, n): cyclic sequence containing
+    every k-ary string of length n exactly once as a substring."""
+    a = [0] * k * n
+    sequence = []
+    def db(t, p):
+        if t > n:
+            if n % p == 0:
+                sequence.extend(a[1:p+1])
+        else:
+            a[t] = a[t - p]
+            db(t + 1, p)
+            for j in range(a[t - p] + 1, k):
+                a[t] = j
+                db(t + 1, t)
+    db(1, 1)
+    return sequence
+
+# For 12-bit binary codes: B(2, 12) has length 4096
+seq = ''.join(map(str, de_bruijn(2, 12)))
+payload = seq + seq[:11]  # Linearize: 4096 + 11 = 4107 chars
+# Every possible 12-bit code appears as a substring
+```
+
+**Key insight:** De Bruijn sequence B(k, n) contains all k^n possible n-length strings over alphabet k as substrings, with cyclic length k^n. To linearize (non-cyclic), append the first n-1 characters. Total length = k^n + n - 1. Send the same string every round — it contains every possible code.
+
+**Detection:** Must find arbitrary n-bit pattern as substring of limited-length input. Character budget matches de Bruijn length (k^n + n - 1).
+
+---
+
+## Brainfuck Interpreter Instrumentation (BearCatCTF 2026)
+
+**Pattern (Ghost Ship):** Large Brainfuck program (10K+ instructions) validates a flag character-by-character. Full reverse engineering is impractical.
+
+**Per-character brute-force via instrumentation:**
+1. Instrument a Brainfuck interpreter to track tape cell values
+2. Identify a "wrong count" cell that increments per incorrect character
+3. For each position, try all printable ASCII — pick the character that doesn't increment the wrong counter
+
+```python
+def run_bf_instrumented(code, input_bytes, max_steps=500000):
+    tape = [0] * 30000
+    dp, ip, inp_idx = 0, 0, 0
+    for _ in range(max_steps):
+        if ip >= len(code): break
+        c = code[ip]
+        if c == '+': tape[dp] = (tape[dp] + 1) % 256
+        elif c == '-': tape[dp] = (tape[dp] - 1) % 256
+        elif c == '>': dp += 1
+        elif c == '<': dp -= 1
+        elif c == '.': pass  # output
+        elif c == ',':
+            tape[dp] = input_bytes[inp_idx] if inp_idx < len(input_bytes) else 0
+            inp_idx += 1
+        elif c == '[' and tape[dp] == 0:
+            # skip to matching ]
+            ...
+        elif c == ']' and tape[dp] != 0:
+            # jump back to matching [
+            ...
+        ip += 1
+    return tape
+
+# Brute-force: ~40 positions × 95 chars = 3800 runs
+flag = []
+for pos in range(40):
+    for c in range(32, 127):
+        candidate = flag + [c] + [ord('A')] * (39 - pos)
+        tape = run_bf_instrumented(code, candidate)
+        if tape[WRONG_COUNT_CELL] == 0:  # No errors up to this position
+            flag.append(c)
+            break
+```
+
+**Key insight:** Brainfuck programs that validate input character-by-character can be brute-forced without understanding the program logic. Instrument the interpreter to observe tape state, find the cell that tracks validation progress, and optimize per-character search. ~3800 runs completes in minutes.
+
+---
+
+## WASM Linear Memory Manipulation (BearCatCTF 2026)
+
+**Pattern (Dubious Doubloon):** Browser game compiled to WebAssembly with win conditions requiring luck (e.g., 15 consecutive coin flips). WASM linear memory is flat and unprotected.
+
+**Direct memory patching in Node.js:**
+```javascript
+const { readFileSync } = require('fs');
+const wasmBuffer = readFileSync('game.wasm');
+const { instance } = await WebAssembly.instantiate(wasmBuffer, imports);
+const mem = new DataView(instance.exports.memory.buffer);
+
+// Patch game variables at known offsets
+mem.setInt32(0x102918, 14, true);   // streak counter = 14 (need 15)
+mem.setInt32(0x102898, 100, true);  // win chance = 100%
+
+// One more flip → guaranteed win → flag decoded
+const result = instance.exports.flipCoin();
+```
+
+**Key insight:** Unlike WAT patching (modifying the binary), memory manipulation patches runtime state after loading. All WASM variables live in flat linear memory at fixed offsets. Use `wasm-objdump -x game.wasm` or search for known constants to find variable offsets. No need to understand the full game logic — just set the state to "about to win".
+
+**Detection:** WASM game requiring statistically impossible sequences (streaks, perfect scores). Game logic is in `.wasm` file loadable in Node.js.
+
+---
+
+## References
+- BYPASS CTF 2025 "Signal from the Deck": Cookie checkpoint game brute-forcing
+- BYPASS CTF 2025 "Hungry, Not Stupid": Flask cookie game state leakage
+- BYPASS CTF 2025 "Maze of the Unseen": WebSocket teleportation + cryptic hints
+- BYPASS CTF 2025 "Level Devil": Server time-only validation bypass
+- BearCatCTF 2026 "Brown's Revenge": De Bruijn sequence substring coverage
+- BearCatCTF 2026 "Ghost Ship": Brainfuck instrumentation brute-force
+- BearCatCTF 2026 "Dubious Doubloon": WASM linear memory state patching
+
+---
+
+See also: [games-and-vms.md](games-and-vms.md) for WASM patching, Roblox reversing, PyInstaller, Z3, K8s RBAC, floating-point exploitation, custom assembly sandbox escape, and multi-phase crypto games.