Skip to main content
picoCTF Solutions
picoCTF 2023Reverse EngineeringMedium

Ready Gladiator 0 picoCTF 2023 Solution

Write a CoreWars warrior designed to lose every single round against the Imp opponent.

Published: April 26, 2023Updated: August 25, 2026

Description

CoreWars is back, and this time you must intentionally lose every battle against the Imp. Submit a warrior that self-terminates immediately.

Setup

Download imp.red

Edit the provided Redcode warrior so it contains nothing but a header and ends immediately.

Pipe the modified warrior into nc saturn.picoctf.net <PORT_FROM_INSTANCE> to fight the Imp.

bash
printf ';redcode\nDAT 0, 1\nend\n' > imp.red
bash
nc saturn.picoctf.net <PORT_FROM_INSTANCE> < imp.red

Solution

Want to try it yourself first?

The guided walkthrough reveals hints one step at a time.

Walk me through it
The match runs across a netcat pipe, so the basics from the netcat for CTF guide apply: redirect a file as stdin and read the response.
  1. Step 1Strip the warrior
    Observation
    The description requires losing every battle against the Imp. That calls for a warrior that terminates itself immediately rather than one that competes, which is a DAT-only Redcode program.
    A warrior that only contains a DAT instruction dies the moment it executes it. DAT is the data instruction and any process that attempts to execute it is immediately terminated. One DAT line is enough to lose every round.
    Learn more

    Core War is a programming game from 1984 (A.K. Dewdney) where two programs called warriors compete inside a virtual machine called the MARS (Memory Array Redcode Simulator). Warriors are written in Redcode, an assembly-like language: a few opcodes, addressing modes, and a circular memory of typically 8000 cells. The MARS interleaves instructions from each warrior. A warrior dies when it executes a DAT instruction; the last live warrior wins.

    The Imp is the simplest possible warrior: MOV 0, 1 copies the current instruction one cell forward, and execution follows it. The result is a self-replicating wave that sweeps memory forever.

    A warrior whose only instruction is DAT 0, 1 loads a single cell, so the very first scheduled tick lands on that DAT and the process dies before it can do anything. Across all 100 rounds the result is deterministic: 0 wins, 100 losses. With a normal scoring tiebreaker (more wins beats more ties beats more losses), this hits the requirement of losing every round.

    Want to test locally first? sudo apt install pmars installs pMARS, the standard MARS simulator. Keep the downloaded Imp under a second name (cp imp.red imp_orig.red before you overwrite it), then run pmars -r 100 -b imp.red imp_orig.red and confirm the DAT-only warrior loses 100/100 before connecting. The pMARS reference covers the CLI in detail.

  2. Step 2Run the matches over netcat
    Observation
    The setup pipes to netcat, and the match runs over that pipe. Redirect the modified warrior file in as stdin, and the flag arrives once the hundred rounds finish.
    Send the file through nc and read the summary. The flag prints once 100 rounds finish.
    bash
    timeout 30 nc saturn.picoctf.net <PORT_FROM_INSTANCE> < imp.red

    Expected output

    picoCTF{h3r0_...6d4cf}
    What didn't work first

    Tried: Typing the nc command interactively without redirecting imp.red as stdin

    Without the input redirect, nc sends nothing and the session hangs waiting on your keyboard. The server expects the warrior source over stdin straight away, and piping or redirecting the file is what delivers it.

    Tried: Sending the original downloaded imp.red (the Imp warrior) unchanged to the server

    The original file holds the Imp's own move instruction, which is a winning warrior rather than a losing one, so the server reports wins or ties instead of a hundred losses and no flag appears. Replace it with a DAT-only warrior before sending.

    Learn more

    The challenge server runs the matches synchronously, so the response is just stdin in, summary out. Wrap nc in timeout 30 if the connection seems to hang; that catches the case where the warrior is malformed and the server waits for more bytes. If the response complains about syntax, double-check the file has Unix line endings (run file imp.red; CRLF endings break some pMARS variants).

    For deeper Core War strategy the corewar.co.uk archive has decades of documented warriors and tournament results.

Flag

Reveal flag

picoCTF{h3r0_...6d4cf}

Any warrior that terminates immediately will forfeit every round and yield the flag.

Key takeaway

Core War pits two Redcode programs against each other for control of a shared circular memory, each trying to overwrite the other with DAT instructions. Understanding the virtual machine, specifically that executing a DAT cell kills the current process, gives you both the simplest winning warrior and the simplest losing one. The DAT-as-trap mechanic maps onto real exploitation: code reuse and shellcode both come down to controlling what the instruction pointer executes next, and knowing which instructions terminate a process rather than advance it underpins attack and defense alike.

Related reading

Useful tools for Reverse Engineering

Where to go next

Try these next