Challenge Description#

Unity infinite runner. Flag displayed after reaching 1 million meters. Given Tuff_Game.zip.

Analysis#

Three layers of deception:

Layer 1 — XOR Decoy: NotAFlag class with key 0x5A → {Umm_4ctually_unx0r11ng_t0_g3t_fl4g_s33ms_t00_34sy}

Layer 2 — RSA Decoy: FlagGeneration class, shared-prime attack on 1024-bit moduli → BITSCTF{https://blogs.mtdv.me/Crypt0} (Rick Roll)

Layer 3 — Real Flag: 900 tiles named rq_X_Y (rq = reversed “qr”) in resources.assets. Troll images hint: “think vertically” → transpose X,Y.

Solution#

Extract tiles with UnityPy, assemble with transposed coordinates:

#!/usr/bin/env python3
import UnityPy
import numpy as np
from PIL import Image
import cv2

env = UnityPy.load("Tuff_Game/Tuff_Game/Tuff_Game_Data/resources.assets")

tiles = {}
for obj in env.objects:
    if obj.type.name == "Texture2D":
        data = obj.read()
        name = data.m_Name
        if name.startswith("rq_"):
            parts = name.split("_")
            x, y = int(parts[1]), int(parts[2])
            tiles[(x, y)] = np.array(data.image)

print(f"[+] Loaded {len(tiles)} QR tiles")

# Assemble with TRANSPOSED coordinates
tile_size, grid_size = 5, 30
img_size = grid_size * tile_size
full_img = np.ones((img_size, img_size, 3), dtype=np.uint8) * 255

for (orig_x, orig_y), tile_data in tiles.items():
    new_col, new_row = orig_y, orig_x  # TRANSPOSED
    py, px = new_row * tile_size, new_col * tile_size
    full_img[py:py+tile_size, px:px+tile_size] = tile_data[:, :, :3]

Image.fromarray(full_img).save("qr_transposed_raw.png")

# Decode QR
scale = 10
upscaled = cv2.resize(full_img, (img_size * scale, img_size * scale), interpolation=cv2.INTER_NEAREST)
gray = cv2.cvtColor(upscaled, cv2.COLOR_RGB2GRAY)
detector = cv2.QRCodeDetector()
data, bbox, straight = detector.detectAndDecode(gray)

print(f"\n[★] FLAG: {data}")

Run:

python3 solve_tuff_game.py

Output:

[+] Loaded 900 QR tiles
[+] Saved qr_transposed_raw.png (150×150)
[★] FLAG: BITSCTF{Th1$_14_D3f1n1t3ly_Th3_fl4g}