diff --git a/2026/cscg/rev/connivance/CSCG-Connivance.gpr b/2026/cscg/rev/connivance/CSCG-Connivance.gpr deleted file mode 100644 index e69de29..0000000 diff --git a/2026/cscg/rev/connivance/CSCG-Connivance.rep/idata/00/00000000.prp b/2026/cscg/rev/connivance/CSCG-Connivance.rep/idata/00/00000000.prp deleted file mode 100644 index cede0c6..0000000 --- a/2026/cscg/rev/connivance/CSCG-Connivance.rep/idata/00/00000000.prp +++ /dev/null @@ -1,11 +0,0 @@ - - - - - - - - - - - diff --git a/2026/cscg/rev/connivance/CSCG-Connivance.rep/idata/00/~00000000.db/db.2.gbf b/2026/cscg/rev/connivance/CSCG-Connivance.rep/idata/00/~00000000.db/db.2.gbf deleted file mode 100644 index f607d79..0000000 Binary files a/2026/cscg/rev/connivance/CSCG-Connivance.rep/idata/00/~00000000.db/db.2.gbf and /dev/null differ diff --git a/2026/cscg/rev/connivance/CSCG-Connivance.rep/idata/~index.bak b/2026/cscg/rev/connivance/CSCG-Connivance.rep/idata/~index.bak deleted file mode 100644 index b1e697f..0000000 --- a/2026/cscg/rev/connivance/CSCG-Connivance.rep/idata/~index.bak +++ /dev/null @@ -1,4 +0,0 @@ -VERSION=1 -/ -NEXT-ID:0 -MD5:d41d8cd98f00b204e9800998ecf8427e diff --git a/2026/cscg/rev/connivance/CSCG-Connivance.rep/idata/~index.dat b/2026/cscg/rev/connivance/CSCG-Connivance.rep/idata/~index.dat deleted file mode 100644 index 60a2993..0000000 --- a/2026/cscg/rev/connivance/CSCG-Connivance.rep/idata/~index.dat +++ /dev/null @@ -1,5 +0,0 @@ -VERSION=1 -/ - 00000000:main:a4afa9f9d3f559841602854 -NEXT-ID:1 -MD5:d41d8cd98f00b204e9800998ecf8427e diff --git a/2026/cscg/rev/connivance/CSCG-Connivance.rep/idata/~journal.bak b/2026/cscg/rev/connivance/CSCG-Connivance.rep/idata/~journal.bak deleted file mode 100644 index f658662..0000000 --- a/2026/cscg/rev/connivance/CSCG-Connivance.rep/idata/~journal.bak +++ /dev/null @@ -1,2 +0,0 @@ -IADD:00000000:/main -IDSET:/main:a4afa9f9d3f559841602854 diff --git a/2026/cscg/rev/connivance/CSCG-Connivance.rep/project.prp b/2026/cscg/rev/connivance/CSCG-Connivance.rep/project.prp deleted file mode 100644 index f280dc1..0000000 --- a/2026/cscg/rev/connivance/CSCG-Connivance.rep/project.prp +++ /dev/null @@ -1,6 +0,0 @@ - - - - - - diff --git a/2026/cscg/rev/connivance/CSCG-Connivance.rep/projectState b/2026/cscg/rev/connivance/CSCG-Connivance.rep/projectState deleted file mode 100644 index 5d2e56c..0000000 --- a/2026/cscg/rev/connivance/CSCG-Connivance.rep/projectState +++ /dev/null @@ -1,15 +0,0 @@ - - - - - - - - - - - - - - - diff --git a/2026/cscg/rev/connivance/CSCG-Connivance.rep/user/00/00000000.prp b/2026/cscg/rev/connivance/CSCG-Connivance.rep/user/00/00000000.prp deleted file mode 100644 index 2ac24b0..0000000 --- a/2026/cscg/rev/connivance/CSCG-Connivance.rep/user/00/00000000.prp +++ /dev/null @@ -1,11 +0,0 @@ - - - - - - - - - - - diff --git a/2026/cscg/rev/connivance/CSCG-Connivance.rep/user/00/~00000000.db/db.1.gbf b/2026/cscg/rev/connivance/CSCG-Connivance.rep/user/00/~00000000.db/db.1.gbf deleted file mode 100644 index f118c12..0000000 Binary files a/2026/cscg/rev/connivance/CSCG-Connivance.rep/user/00/~00000000.db/db.1.gbf and /dev/null differ diff --git a/2026/cscg/rev/connivance/CSCG-Connivance.rep/user/~index.dat b/2026/cscg/rev/connivance/CSCG-Connivance.rep/user/~index.dat deleted file mode 100644 index b1e697f..0000000 --- a/2026/cscg/rev/connivance/CSCG-Connivance.rep/user/~index.dat +++ /dev/null @@ -1,4 +0,0 @@ -VERSION=1 -/ -NEXT-ID:0 -MD5:d41d8cd98f00b204e9800998ecf8427e diff --git a/2026/cscg/rev/connivance/CSCG-Connivance.rep/user/~journal.dat b/2026/cscg/rev/connivance/CSCG-Connivance.rep/user/~journal.dat deleted file mode 100644 index a13f7f8..0000000 --- a/2026/cscg/rev/connivance/CSCG-Connivance.rep/user/~journal.dat +++ /dev/null @@ -1,2 +0,0 @@ -IADD:00000000:/udf_a4afa9f9d3f559841602854 -IDSET:/udf_a4afa9f9d3f559841602854:a4afa9fa5e11707875609740 diff --git a/2026/cscg/rev/connivance/CSCG-Connivance.rep/versioned/~index.bak b/2026/cscg/rev/connivance/CSCG-Connivance.rep/versioned/~index.bak deleted file mode 100644 index b1e697f..0000000 --- a/2026/cscg/rev/connivance/CSCG-Connivance.rep/versioned/~index.bak +++ /dev/null @@ -1,4 +0,0 @@ -VERSION=1 -/ -NEXT-ID:0 -MD5:d41d8cd98f00b204e9800998ecf8427e diff --git a/2026/cscg/rev/connivance/CSCG-Connivance.rep/versioned/~index.dat b/2026/cscg/rev/connivance/CSCG-Connivance.rep/versioned/~index.dat deleted file mode 100644 index b1e697f..0000000 --- a/2026/cscg/rev/connivance/CSCG-Connivance.rep/versioned/~index.dat +++ /dev/null @@ -1,4 +0,0 @@ -VERSION=1 -/ -NEXT-ID:0 -MD5:d41d8cd98f00b204e9800998ecf8427e diff --git a/2026/cscg/rev/connivance/Decrypt_obfuscated_blob.py b/2026/cscg/rev/connivance/Decrypt_obfuscated_blob.py deleted file mode 100644 index 40ef8f9..0000000 --- a/2026/cscg/rev/connivance/Decrypt_obfuscated_blob.py +++ /dev/null @@ -1,17 +0,0 @@ -import idc -import struct - -addr = here() # or replace with the actual address e.g. 0x47F240 - -data = bytes([idc.get_wide_byte(addr + i) for i in range(39)]) -flag = idc.get_wide_byte(addr + 39) -key = idc.get_qword(addr + 40) - -print(f"Data: {data.hex()}") -print(f"Decrypted: {flag}") -print(f"Key: {key:#018x}") - -# Decrypt it immediately -decrypted = bytes(~(b ^ ((key >> (8 * (i % 8))) & 0xFF)) & 0xFF for i, b in enumerate(data)) -print(f"Plaintext: {decrypted}") -print(f"As string: {decrypted.decode('utf-8', errors='replace')}") \ No newline at end of file diff --git a/2026/cscg/rev/connivance/bc_decrypted.bin b/2026/cscg/rev/connivance/bc_decrypted.bin deleted file mode 100644 index 7ccb6ca..0000000 Binary files a/2026/cscg/rev/connivance/bc_decrypted.bin and /dev/null differ diff --git a/2026/cscg/rev/connivance/bc_layer2.bin b/2026/cscg/rev/connivance/bc_layer2.bin deleted file mode 100644 index 04ee0f5..0000000 Binary files a/2026/cscg/rev/connivance/bc_layer2.bin and /dev/null differ diff --git a/2026/cscg/rev/connivance/decrypted_connviance.bin b/2026/cscg/rev/connivance/decrypted_connviance.bin new file mode 100644 index 0000000..a20d115 Binary files /dev/null and b/2026/cscg/rev/connivance/decrypted_connviance.bin differ diff --git a/2026/cscg/rev/connivance/decrypted_payload.bin b/2026/cscg/rev/connivance/decrypted_payload.bin deleted file mode 100644 index eaea46d..0000000 Binary files a/2026/cscg/rev/connivance/decrypted_payload.bin and /dev/null differ diff --git a/2026/cscg/rev/connivance/dump_after_410450.gdb b/2026/cscg/rev/connivance/dump_after_410450.gdb deleted file mode 100644 index 108258c..0000000 --- a/2026/cscg/rev/connivance/dump_after_410450.gdb +++ /dev/null @@ -1,12 +0,0 @@ -break *0x4035da -run flag_checker.tfl AAAA -printf "sub_410450 result: %d\n", $r15b -set $r15b = 0 -break *0x40365e -continue -printf "At main VM call\n" -set $wrapper = *(long long*)$rsi -set $bc_base = *(long long*)($wrapper+0x10) -set $bc_size = *(long long*)($wrapper+0x18) -printf "bc_base=%p size=%d\n", $bc_base, $bc_size -dump binary memory /tmp/bc_main.bin $bc_base ($bc_base+$bc_size) diff --git a/2026/cscg/rev/connivance/dump_main_bc.gdb b/2026/cscg/rev/connivance/dump_main_bc.gdb deleted file mode 100644 index f4df136..0000000 --- a/2026/cscg/rev/connivance/dump_main_bc.gdb +++ /dev/null @@ -1,11 +0,0 @@ -break *0x40356f -run flag_checker.tfl AAAA -set $eax = 0 -break *0x40365e -continue -printf "At main sub_405120 call\n" -set $wrapper = *(long long*)$rsi -set $bc_base = *(long long*)($wrapper+0x10) -set $bc_size = *(long long*)($wrapper+0x18) -printf "bc_base=%p size=%d\n", $bc_base, $bc_size -dump binary memory /tmp/bc_main.bin $bc_base ($bc_base+$bc_size) diff --git a/2026/cscg/rev/connivance/find_flag.py b/2026/cscg/rev/connivance/find_flag.py new file mode 100644 index 0000000..b22414b --- /dev/null +++ b/2026/cscg/rev/connivance/find_flag.py @@ -0,0 +1,66 @@ +import hashlib + +def bitwise_not(data: bytes) -> bytes: + """Inverts all bits in the byte array.""" + return bytes(~b & 0xFF for b in data) + +def shift_right_1(data: bytes) -> bytes: + """ + Shifts the entire byte array to the right by 1 bit. + Note: This implementation assumes a forward-flowing carry (byte 0 to byte N). + If the VM's BigInt implementation is little-endian, you might need to reverse + the carry logic so it flows from index i+1 to i. + """ + result = bytearray(len(data)) + carry = 0 + + for i in range(len(data)): + # Shift current byte right by 1, and OR it with the carry from the previous byte + result[i] = (data[i] >> 1) | carry + # The lowest bit of the current byte becomes the MSB carry for the next byte + carry = (data[i] & 1) << 7 + + return bytes(result) + +def check_flag(test_flag: bytes, target_hash_blob: bytes) -> bool: + """Simulates the VM's flag verification logic.""" + # 1. Length Check + if len(test_flag) != 29: + print(f"[-] Incorrect length: {len(test_flag)}. Must be 29 bytes.") + return False + + # 2. Initial Mutation (BITWISE_NOT) + current_state = bitwise_not(test_flag) + + # 3. The Shift-and-Hash Loop + generated_blob = bytearray() + + for iteration in range(8): + # Compute SHA256 of the current state + current_hash = hashlib.sha256(current_state).digest() + generated_blob.extend(current_hash) + + # Shift the state right by 1 bit for the next iteration + current_state = shift_right_1(current_state) + + # 4. Final Verification + if generated_blob == target_hash_blob: + print("[+] Correct! Flag matches.") + return True + else: + print("[-] Incorrect! Hash mismatch.") + return False + +# ========================================== +# Example Usage +# ========================================== +if __name__ == "__main__": + # TODO: Load the actual 256-byte target blob from 'romfs:/dragonfly.bin' + # Here is a dummy 256-byte array for testing the script structure + with open("./romfs/damocles.bin", "rb") as flag_hash: + dragonfly_bin_data = flag_hash.read() + + # The flag you want to test + my_test_flag = b"dach2026{dummy_test_flag_pay}" # Exactly 29 bytes + + check_flag(my_test_flag, dragonfly_bin_data) diff --git a/2026/cscg/rev/connivance/flag_checker.bin b/2026/cscg/rev/connivance/flag_checker.bin new file mode 100644 index 0000000..3cdf5b8 Binary files /dev/null and b/2026/cscg/rev/connivance/flag_checker.bin differ diff --git a/2026/cscg/rev/connivance/flag_checker_after.bin b/2026/cscg/rev/connivance/flag_checker_after.bin new file mode 100644 index 0000000..3cdf5b8 Binary files /dev/null and b/2026/cscg/rev/connivance/flag_checker_after.bin differ diff --git a/2026/cscg/rev/connivance/flag_checker_before.bin b/2026/cscg/rev/connivance/flag_checker_before.bin new file mode 100644 index 0000000..d17c4b0 Binary files /dev/null and b/2026/cscg/rev/connivance/flag_checker_before.bin differ diff --git a/2026/cscg/rev/connivance/generate_fake_dragonfly.py b/2026/cscg/rev/connivance/generate_fake_dragonfly.py new file mode 100644 index 0000000..7dc874c --- /dev/null +++ b/2026/cscg/rev/connivance/generate_fake_dragonfly.py @@ -0,0 +1,35 @@ +import hashlib + +def buggy_shift_right_1(data: bytes) -> bytes: + """Replicates the VM's flawed, per-byte shift that ignores carries.""" + return bytes(b >> 1 for b in data) + +def bitwise_not(data: bytes) -> bytes: + """Inverts all bits in the byte array.""" + return bytes(~b & 0xFF for b in data) + +def generate_dragonfly(flag: bytes) -> bytes: + assert len(flag) == 29, "Flag must be exactly 29 bytes!" + + current_state = bitwise_not(flag) + out_blob = bytearray() + + # 8 iterations: hash, then shift + for _ in range(8): + out_blob.extend(hashlib.sha256(current_state).digest()) + current_state = buggy_shift_right_1(current_state) + + return bytes(out_blob) + +if __name__ == "__main__": + # A test flag that matches your 29-byte requirement and format + # 9 byte prefix + 19 byte payload + 1 byte suffix = 29 bytes + test_flag = b"dach2026{0123456789abcdefgh!}" + + blob = generate_dragonfly(test_flag) + + with open("dragonfly.bin", "wb") as f: + f.write(blob) + + print(f"[+] Wrote {len(blob)} bytes to dragonfly.bin") + print("[!] Swap this file into the VM environment and test it.") diff --git a/2026/cscg/rev/connivance/hash_trace.gdb b/2026/cscg/rev/connivance/hash_trace.gdb deleted file mode 100644 index 3138a7b..0000000 --- a/2026/cscg/rev/connivance/hash_trace.gdb +++ /dev/null @@ -1,9 +0,0 @@ -break *0x40356f -run flag_checker.tfl AAAA -set $eax = 0 -break *0x404010 -commands 2 - printf "HASH pc=%lld\n", *(long long*)$rdx - continue -end -continue diff --git a/2026/cscg/rev/connivance/hello_world.bin b/2026/cscg/rev/connivance/hello_world.bin new file mode 100644 index 0000000..ab0e7e0 Binary files /dev/null and b/2026/cscg/rev/connivance/hello_world.bin differ diff --git a/2026/cscg/rev/connivance/input.bin b/2026/cscg/rev/connivance/input.bin new file mode 100644 index 0000000..3845386 Binary files /dev/null and b/2026/cscg/rev/connivance/input.bin differ diff --git a/2026/cscg/rev/connivance/main.id0 b/2026/cscg/rev/connivance/main.id0 index 0907d4a..d34fd02 100644 Binary files a/2026/cscg/rev/connivance/main.id0 and b/2026/cscg/rev/connivance/main.id0 differ diff --git a/2026/cscg/rev/connivance/main.id1 b/2026/cscg/rev/connivance/main.id1 index 84bf979..7c13d69 100644 Binary files a/2026/cscg/rev/connivance/main.id1 and b/2026/cscg/rev/connivance/main.id1 differ diff --git a/2026/cscg/rev/connivance/main.id2 b/2026/cscg/rev/connivance/main.id2 index 458411d..75e72b1 100644 Binary files a/2026/cscg/rev/connivance/main.id2 and b/2026/cscg/rev/connivance/main.id2 differ diff --git a/2026/cscg/rev/connivance/main.nam b/2026/cscg/rev/connivance/main.nam index 204ac84..2c1ccf3 100644 Binary files a/2026/cscg/rev/connivance/main.nam and b/2026/cscg/rev/connivance/main.nam differ diff --git a/2026/cscg/rev/connivance/main.til b/2026/cscg/rev/connivance/main.til index 00756e8..b38b822 100644 Binary files a/2026/cscg/rev/connivance/main.til and b/2026/cscg/rev/connivance/main.til differ diff --git a/2026/cscg/rev/connivance/recover_flag.py b/2026/cscg/rev/connivance/recover_flag.py new file mode 100644 index 0000000..e973377 --- /dev/null +++ b/2026/cscg/rev/connivance/recover_flag.py @@ -0,0 +1,93 @@ +import hashlib +import time + +def solve_flag(target_blob: bytes): + """ + Reverses the 8-stage hashing loop by walking backwards from the 7th shift + down to the 0th shift, recovering 1 bit of the flag per iteration. + """ + # 1. Setup Known Constraints + known_prefix = b"dach2026{" + known_suffix = b"}" + total_len = 29 + + # Calculate indices for the 19 unknown characters + unknown_indices = list(range(len(known_prefix), total_len - len(known_suffix))) + + # Pre-calculate the bitwise NOT of the known parts + full_known_state = bytearray(total_len) + for i, b in enumerate(known_prefix): + full_known_state[i] = ~b & 0xFF + full_known_state[total_len - 1] = ~known_suffix[0] & 0xFF + + # Split the target blob into the 8 independent target hashes + target_hashes = set(target_blob[i*32 : (i+1)*32] for i in range(8)) + + # This array will accumulate our recovered bits for the 19 unknown bytes + # By the end, it will contain the fully unshifted, inverted bytes. + recovered_unknowns = [0] * len(unknown_indices) + + print("[*] Starting Bit-by-Bit Backtracking Attack...") + start_time = time.time() + + # 2. Walk backwards from Shift 7 down to Shift 0 + for shift_amount in range(7, -1, -1): + print(f"\n[*] Cracking Shift Layer {shift_amount} (Guessing bit {shift_amount} of payload)...") + + # Pre-build the known parts of the state for this specific shift layer + base_state = bytearray(total_len) + for i in range(total_len): + if i < len(known_prefix) or i == total_len - 1: + base_state[i] = full_known_state[i] >> shift_amount + + match_found = False + + # Brute-force the next bit for all 19 unknown bytes (2^19 combinations = 524,288) + # This takes a few seconds per layer in pure Python. + for guess in range(1 << len(unknown_indices)): + test_state = bytearray(base_state) + + # Inject our guessed bits into the test state + for i, idx in enumerate(unknown_indices): + guess_bit = (guess >> i) & 1 + test_state[idx] = (recovered_unknowns[i] << 1) | guess_bit + + # Hash and check against the pool of valid target hashes + if hashlib.sha256(test_state).digest() in target_hashes: + print(f" [+] Match found! Extracted bits: {bin(guess)[2:].zfill(19)}") + + # Commit the guessed bits to our recovered array + for i in range(len(unknown_indices)): + recovered_unknowns[i] = (recovered_unknowns[i] << 1) | ((guess >> i) & 1) + + match_found = True + break + + if not match_found: + print(f" [-] CRITICAL FAILURE: Could not find a valid bit permutation at layer {shift_amount}.") + print(" Double check the dragonfly.bin data and prefix.") + return None + + # 3. Final Assembly + # We now have the complete, unshifted inverted state. + final_inverted_state = bytearray(full_known_state) + for i, idx in enumerate(unknown_indices): + final_inverted_state[idx] = recovered_unknowns[i] + + # Un-invert it to reveal the plaintext flag + final_flag = bytes(~b & 0xFF for b in final_inverted_state) + + elapsed = time.time() - start_time + print(f"\n[+] Exploit completed in {elapsed:.2f} seconds.") + print(f"[!] RECOVERED FLAG: {final_flag.decode('ascii', errors='ignore')}") + + return final_flag + + +# ========================================== +# Execution / Test Mock +# ========================================== +if __name__ == "__main__": + with open("./romfs/dragonfly.bin", "rb") as f: + target_blob = f.read() + solve_flag(target_blob) diff --git a/2026/cscg/rev/connivance/romfs/connivance.bin.id0 b/2026/cscg/rev/connivance/romfs/connivance.bin.id0 deleted file mode 100644 index aed61f3..0000000 Binary files a/2026/cscg/rev/connivance/romfs/connivance.bin.id0 and /dev/null differ diff --git a/2026/cscg/rev/connivance/romfs/connivance.bin.id1 b/2026/cscg/rev/connivance/romfs/connivance.bin.id1 deleted file mode 100644 index 729fda6..0000000 Binary files a/2026/cscg/rev/connivance/romfs/connivance.bin.id1 and /dev/null differ diff --git a/2026/cscg/rev/connivance/romfs/connivance.bin.nam b/2026/cscg/rev/connivance/romfs/connivance.bin.nam deleted file mode 100644 index 05ea68e..0000000 Binary files a/2026/cscg/rev/connivance/romfs/connivance.bin.nam and /dev/null differ diff --git a/2026/cscg/rev/connivance/romfs/connivance.bin.til b/2026/cscg/rev/connivance/romfs/connivance.bin.til deleted file mode 100644 index d60dfce..0000000 Binary files a/2026/cscg/rev/connivance/romfs/connivance.bin.til and /dev/null differ diff --git a/2026/cscg/rev/connivance/solve b/2026/cscg/rev/connivance/solve new file mode 100755 index 0000000..dcea79b Binary files /dev/null and b/2026/cscg/rev/connivance/solve differ diff --git a/2026/cscg/rev/connivance/solve.c b/2026/cscg/rev/connivance/solve.c new file mode 100644 index 0000000..be97dde --- /dev/null +++ b/2026/cscg/rev/connivance/solve.c @@ -0,0 +1,97 @@ +#include +#include +#include +#include +#include + +int main() { + FILE *f = fopen("romfs/dragonfly.bin", "r"); + if (!f) { + perror("Failed to open file"); + return 1; + } + + // Get file size + fseek(f, 0, SEEK_END); + long file_size = ftell(f); + fseek(f, 0, SEEK_SET); + + uint8_t *dragonfly = malloc(file_size); + if (!dragonfly) { + perror("malloc failed"); + fclose(f); + return 1; + } + + fread(dragonfly, 1, file_size, f); + fclose(f); + + uint8_t flag[0x1d] = {0}; // 29 bytes + + for (int i = 7; i >= 0; i--) { + uint8_t *target_hash = dragonfly + SHA256_DIGEST_LENGTH * (7 - i); + int found = 0; + + uint64_t max_n = 1ULL << sizeof(flag); + for (uint64_t n = 0; n < max_n; n++) { + uint64_t tmp = n; + for (int j = 0; j < sizeof(flag); j++) { + uint8_t bit = tmp & 1; + tmp >>= 1; + flag[j] = (flag[j] & 0xFE) | bit; + } + + // Compute SHA-256 + uint8_t hash[SHA256_DIGEST_LENGTH]; + SHA256(flag, sizeof(flag), hash); + + if (memcmp(hash, target_hash, SHA256_DIGEST_LENGTH) == 0) { + found = 1; + break; + } + + if (n % 1000000 == 0) { + printf("\r%09lu", n); + fflush(stdout); + } + } + + printf("\n"); + if (!found) { + printf("Could not find it on level: %d\n", i); + break; + } + + // Print flag in hex + for (int j = 0; j < sizeof(flag); j++) { + printf("%02x", flag[j]); + } + printf("\n"); + + // Shift left by 1 + for (int j = 0; j < sizeof(flag); j++) { + flag[j] = (flag[j] << 1) & 0xFF; + } + } + + // Print final flag + for (int j = 0; j < sizeof(flag); j++) { + printf("%02x", flag[j]); + } + printf("\n"); + + // Bitwise NOT + for (int j = 0; j < sizeof(flag); j++) { + flag[j] = (~flag[j]) & 0xFF; + } + + for (int j = 0; j < sizeof(flag); j++) { + printf("%02x", flag[j]); + } + printf("\n"); + + printf("%s\n", flag); + + free(dragonfly); + return 0; +} diff --git a/2026/cscg/rev/connivance/bytecode.bin b/2026/cscg/rev/connivance/vm_bytecode.bin similarity index 100% rename from 2026/cscg/rev/connivance/bytecode.bin rename to 2026/cscg/rev/connivance/vm_bytecode.bin