← all writeups
MobileHuntress CTF 2026

Protocol Reconstruction (Day 28)

Same Huntress Mobile Arena setup as Day 01, but the answer is wrapped in a little binary protocol. The data field of huntress_puzzle.json is a hex-encoded packet:

48 41 | 14 | 41 4e 53 2d ... 41 43 | 11
"HA"   len   "ANS-601D3906BB5885AC"   checksum
magic  =20   (20-byte payload)

Break it into fields like any binary protocol:

  • Magic HA — a fixed marker ("this is one of our packets," same idea as PNG's \x89PNG or ZIP's PK).
  • Length 0x14 = 20, which is exactly ANS- plus 16 hex chars.
  • Payload — the answer, ANS-601D3906BB5885AC.
  • Checksum 0x11 — the XOR of every preceding byte. It matches, which proves the parse is right and the value isn't a decoy.
d = bytes.fromhex("484114414e532d3630314433393036424235383835414311")
x = 0
for b in d[:-1]: x ^= b
print(d[3:3+d[2]].decode(), x == d[-1])   # ANS-601D3906BB5885AC True

The DEX shows the matching huntress28://protocol-reconstruction/unlock deep link and loopback scoring endpoint, mirroring Day 01. <br>