Description
A Unity game walls you in with invisible boundaries. The flag is readable with strings, or you can use dnSpy to modify the game assembly and unlock infinite jumping to fly over the wall.
Setup
Download and unzip the game.
Try strings on the level data file first for the fast path.
If you want to play the game and reach the flag legitimately, use dnSpy to patch the jump logic.
wget https://artifacts.picoctf.net/c/504/no-way-out.zip && unzip no-way-out.zipstrings 'no-way-out_Data/level0' | grep -i picoSolution
Walk me through it- Step 1Fast path: strings on the level dataUnity games store scene data including text objects in the level data files. Running strings on the level0 file reveals the flag directly without running the game at all.bash
strings 'no-way-out_Data/level0' | grep -i 'WELCOME\|picoCTF'bashstrings 'no-way-out_Data/level0'Learn more
Unity stores scene data for each level in a binary file called
level0,level1, etc. inside the*_Data/folder. Text objects placed in the scene (like 3D text meshes showing the flag) are stored as plain UTF-16 or UTF-8 strings in this file. Thestringscommand extracts any printable run of characters, which surfaces the flag text without running the game.This is the fastest CTF approach: run strings on every data file in the game bundle before spending time on dynamic analysis. Unity games are particularly friendly to this because scene assets are not encrypted by default.
- Step 2Alternative: patch the game with dnSpyFor the more interactive approach, open the game assembly in dnSpy and remove the grounded check from the jump logic so you can jump infinitely and fly over the wall.bash
# Download dnSpy from https://github.com/dnSpy/dnSpy/releasesbash# Open no-way-out_Data/Managed/Assembly-CSharp.dll in dnSpybash# Navigate to PlayerController -> Update methodbash# Remove the isGrounded condition from the jump checkbash# File -> Save Module, then run the gameLearn more
dnSpy is a .NET assembly editor and debugger. Unity games compile C# scripts to
Assembly-CSharp.dllin theManaged/folder. dnSpy decompiles this DLL back to readable C# and lets you edit the code directly, then save the modified assembly.The jump logic in this game checks
if (Input.GetButton("Jump") && canMove && isGrounded && !isClimbing). Removing theisGroundedcondition lets you jump while airborne, effectively giving infinite flight. After patching, jump over the invisible wall, land outside, turn around, and read the flag displayed as a 3D text object in the enclosed area.The flag reads: WELCOME TO UNITY!!
Flag
picoCTF{WELCOME_TO_UNITY!!}
The simplest approach is strings on the level0 data file. The dnSpy patch is more fun but takes longer.