MobileHuntress CTF 2026
Protocol Reconstruction (Day 28)
Same Huntress Mobile Arena setup as Day 01, but the answer is wrapped in a little binary protocol. The data field of huntress_puzzle.json is a hex-encoded packet:
48 41 | 14 | 41 4e 53 2d ... 41 43 | 11
"HA" len "ANS-601D3906BB5885AC" checksum
magic =20 (20-byte payload)
Break it into fields like any binary protocol:
- Magic
HA— a fixed marker ("this is one of our packets," same idea as PNG's\x89PNGor ZIP'sPK). - Length
0x14= 20, which is exactlyANS-plus 16 hex chars. - Payload — the answer,
ANS-601D3906BB5885AC. - Checksum
0x11— the XOR of every preceding byte. It matches, which proves the parse is right and the value isn't a decoy.
d = bytes.fromhex("484114414e532d3630314433393036424235383835414311")
x = 0
for b in d[:-1]: x ^= b
print(d[3:3+d[2]].decode(), x == d[-1]) # ANS-601D3906BB5885AC True
The DEX shows the matching huntress28://protocol-reconstruction/unlock deep link and loopback scoring endpoint, mirroring Day 01.
<br>