OLD
CASSETTE

The first instinct is to run file (the Unix file-type command). It says data. Not helpful. Run xxd instead and look at the first two bytes:

$ xxd main.bin | head -1
00000000: 00e0 1280 a6a6 a6a6 a6a6 a6a6 a6a6 a6a6  ................

00 E0 is the CHIP-8 opcode CLS — clear the screen. The bytes 12 80 immediately after it form a jump instruction to 0x280. The flood of 0xA6 bytes starting at offset 4 is sprite data in memory, never executed as code.

Write a minimal Python CHIP-8 emulator — just enough to decode opcodes and log draw calls. Set the delay timer to always return zero so you don't wait forever. Running it confirms the ROM draws characters:

Cycle 163    →  'T'
Cycle 517    →  'TH'
Cycle 1770   →  'THE'
Cycle 6675   →  'THEM'
Cycle 26092  →  'THEM?'
...stalls

Good — the ROM definitely draws the flag. Bad — zeroing the timer breaks the decryption. The PRNG advances during the delay loop; each delay iteration triggers one PRNG step. Skip the delay, and the PRNG state diverges from what it would be during actual execution, causing garbage output from character 6 onwards.

Load the binary into a CHIP-8 disassembler (or write one — the instruction set is small enough that an afternoon covers it). The structure falls out quickly:

The sprite data is split across 8 subtable banks in memory:

subtable_bases = [
    0x400, 0x460, 0x4C0, 0x520,
    0x600, 0x660, 0x6C0, 0x720
]

Each of the 32 character draws follows the same pattern. The subroutine at 0x2C0 maintains two 8-bit registers, VA and VB, which together form the PRNG state. Before each draw, the PRNG has been stepped some number of times. Then:

plaintext_byte = memory[subtable_bases[VA & 7] + char_offset] ^ VA ^ VB

VA & 7 picks which of the 8 subtables to use (bottom 3 bits of VA). The encrypted sprite byte is XOR'd with both VA and VB to recover the plaintext. XOR is its own inverse — same key decrypts as encrypts — so if you know VA and VB at the moment of each draw, you can recover every character.

The PRNG state is two 8-bit values. State space: 256 × 256 = 65,536 possible pairs. The PRNG update function at 0x2C0 is deterministic. Therefore, after at most 65,536 steps, it must revisit a state it's already seen — and from that point it loops forever. This is not an exploit; it's a mathematical certainty (the pigeonhole principle).

The delay between each character draw is controlled by a timer. The timer values scale exponentially as the ROM progresses:

Characters 16 through 32 each need roughly 1.1 trillion PRNG steps. Even in optimized C, that's 18 minutes per character. 17 late characters × 18 minutes = over 5 hours of runtime, assuming zero bugs and no off-by-one errors anywhere in your timing logic. This path leads nowhere useful.

Walk the PRNG forward from its initial state, recording every (VA, VB) pair you've seen. The moment you hit a repeat, you've found the cycle. With only 65,536 possible states, this completes in under a millisecond:

def step_prng(VA, VB):
    new_VA = (VA + VB) & 0xFF
    new_VB = (VA ^ new_VA) & 0xFF
    return new_VA, new_VB

VA, VB = 0, 0  # initial state from ROM
precomputed = {}  # maps step → (VA, VB) for steps 0..361
seen = {}
step = 0
while (VA, VB) not in seen:
    seen[(VA, VB)] = step
    precomputed[step] = (VA, VB)  # VA, VB are current state; step counts forward
    VA, VB = step_prng(VA, VB)
    step += 1

cycle_start  = seen[(VA, VB)]   # 328
cycle_length = step - cycle_start  # 34

Cycle length: 34. Starts at step 328. Once you're past step 328, the PRNG repeats every 34 steps, forever. This means the state at any trillion-step position can be computed from the ROM's initial PRNG state:

def state_at(n):
    if n < 328:
        return precomputed[n]
    idx = 328 + (n - 328) % 34
    return precomputed[idx]

Now applying this to the late characters:

timer_per_late_char = 255 * 4_294_967_295   # = 1,095,216,660,225
advance = 1_095_216_660_225 % 34           # = 17

Every late character advances the PRNG exactly 17 positions in the cycle. One division. The entire trillion-step delay reduced to an integer lookup.

flag = []
cumulative = 0

for i in range(32):
    VA, VB = state_at(cumulative)
    subtable = subtable_bases[VA & 7]
    plaintext = memory[subtable + i] ^ VA ^ VB
    flag.append(chr(plaintext))
    cumulative += timer_steps_for_char(i)

print("".join(flag))

The ROM draws across four rows of the 64×32 display:

Row 1:  T  H  E  M  ?  !  C  T  F  {
Row 2:  0  L  D  _  T  4  P  3  _  N
Row 3:  3  V  3  R  _  D  1  E  5  K
Row 4:  7  }