REA / masked squares guided reproduction
Recorded: 2026-10-23

Target: https://raw.githubusercontent.com/DownUnderCTF/Challenges_2023_Public/b48f83db2984bc7fa2ec7879a32d7efb1be8d333/rev/masked-squares-flag-checker/publish/ms_flag_checker
SHA-256: dcd3bec4f608e11f3a12ce461100aaf5f621851ee63a1f870d7c90d4e3dd51ae
Size: 15,248 bytes. Unchanged Linux x86-64 ELF.
Challenge: masked squares flag checker, by joseph / DownUnderCTF 2023.
Reference already read: https://rea.tools/showcase/ctf/
This is a guided reproduction with new results, not a blind solve.

Successful analysis/capture host: Ubuntu 24.04 under WSL 2, Node.js 24.15.0, REA 6.7.0, Ghidra 12.1.4, Temurin JDK 21.0.13. Solver: Python 3.14.6 on Windows, Z3 5.3.1. All retained binary analysis and process captures used Linux REA.
Initial Windows Ghidra analysis rejected the ELF as unsupported.
No agent-registration files were changed.

Actual MCP sequence (target paths shortened):
open_binary {"path":"[workspace]/.qa/ctf/ms_flag_checker"}
search_strings {"pattern":"flag|correct|wrong|input","mode":"regex","case_sensitive":false}
xrefs {"address":"0x102004"}
resolve_containing_procedure {"address":"0x10126d"}
analyze_function {"procedure":"0x10124d"}
analyze_function {"procedure":"0x101189"}
analyze_function {"procedure":"0x101217"}
read_bytes {"address":"0x1040e0","length":624}
read_bytes {"address":"0x104060","length":104}
close_binary {}

All static addresses are Ghidra analysis-image addresses, not claimed process runtime addresses.

Solver:
All 26 records expand to 36 cells. Solver input uses only those records plus analyst assumptions: DUCTF{...} shape and an alphabet of letters, digits, underscores, braces.
Candidate: DUCTF{ezzzpzzz_07bcda7bfe81faf43caa}
All 26 equation totals checked. No uniqueness proof.

Process captures (a separate MCP session):
open_binary on the same target; then two capture_process_scenario calls, each with executable [workspace]/.qa/ctf/ms_flag_checker, working_directory [workspace]/.qa/ctf, timeout_ms 10000, and one input event at 300 ms. All other settings are retained in each capture manifest.
accepted.json: candidate + newline -> Correct!, exit 0.
changed.json: DUCTF{ezzzpzzz_07bcda8bfe81faf43caa} + newline -> Incorrect!, exit 255.
Both normal exits, no output truncation. No filesystem observation paths requested; network and inherited environment are not fully observed. The captures confirm these inputs, not universal equivalence.

Public JSON is unwrapped from the MCP text result and local workspace paths are replaced with [workspace]. Original evidence IDs and digests are retained as references to the original records; normalization changes serialized content and some internally hashed path-bearing structures. These files are readable publication copies, not canonical import bundles.

The website's browser demo evaluates only check 7 and selects the corresponding recorded original-program verdict. It does not execute the binary or call REA in the browser.