0xreversed/with.ai
Research and benchmarksWorksSource available
Target: DownUnderCTF masked squares flag checker

Solved a DownUnderCTF flag checker by extracting its rules with REA and Z3

DownUnderCTF masked squares flag checker: A CTF checker turned into 26 equations and solved.
Image: rea.tools

What was done

The REA project shows an agent using REA and Ghidra to pull 26 mask-and-target rules out of a DownUnderCTF binary and solve them, then confirming the answer on the original program.

The REA project published a case study that solves an easy reverse engineering challenge from DownUnderCTF, a flag checker built on masked squares. A coding agent with REA connected to Ghidra finds the check, extracts its rules and solves them, then runs the original program to confirm.

How it was done

The page says the run used REA with Ghidra 12.1.4 on Linux x64. The agent opened the binary, searched strings, followed cross references to the checking code and analysed the functions. It then pulled 26 mask-and-target rules out of the binary and solved them as equations with Z3. The page does not name the model or the agent.

Results

The recovered answer made the original program print "Correct!". Changing one character made it print "Incorrect!" and exit with code 255. The page says the answer matches the organisers' published metadata, and the run was done on 8 October 2026. The challenge comes from DownUnderCTF's public 2023 repository, and REA's evidence notes are linked from the page.