NoClip

Technical Walkthrough

Writeup

Challenge

• Name: NoClip
• Category: GamePwn
• Difficulty: Medium
• Mode: file

Summary

NoClip is a file-only SDL2 raycaster challenge. The binary is small and not

stripped, so the useful path was to reverse the asset loader and map access

rather than play the game manually.

The flag is encoded in assets.dmp as character-texture references on hidden

collision walls plus two floor-marker digits. The key correction was that the

game indexes the map as x * height + y, and hidden collision bytes are

one-based texture references.

Artifact Inventory

• files/extracted/gamepwn_noclip/noclip: ELF 64-bit PIE, dynamically linked,

not stripped, SDL2 raycaster.

• files/extracted/gamepwn_noclip/assets.dmp: asset container with player

coordinates, map data, skybox, and 18 named textures.

Analysis

load_assets showed the asset format:

• section 1: initial player coordinates
• section 2: map width, map height, then width height 3 bytes
• section 3: skybox texture
• section 4: texture count and named textures

The player input and raycast disassembly showed the game uses the map index

x * height + y. Earlier row-major parsing made the map look scrambled and made

one hidden value appear invalid. With the corrected indexing, hidden wall bytes

map cleanly to the character texture table using one-based IDs.

The character-bearing cells form a connected lattice route. Starting at the

HTB{ prefix and following the readable no-clip path gives a leetspeak phrase

that normalizes to break_the_wall, matching the title and scenario.

Evidence:

• analysis/disasm-load-assets.txt
• analysis/disasm-player-input.txt
• analysis/disasm-raycast.txt
• analysis/assets-special-tiles.txt
• analysis/map-corrected-lattice.md

Solve

Run:

python3 solve/solve.py --output loot/flag-candidate.txt
cd <local workspace>
python3 scripts/challenge_harness.py capture-flag GamePwn/NoClip --from loot/flag-candidate.txt

The solver parses assets.dmp, reconstructs the corrected map, extracts

character nodes from hidden walls and floor digit markers, follows the

validated no-clip lattice path, and writes the recovered flag candidate.

Flag

Raw flag is stored in loot/flag.txt and intentionally not reproduced here.

Lessons

• For custom game assets, verify the binary's indexing convention before

trusting a visual map dump.

• The display texture index and the hidden data index may use different base

conventions. Here, wall-hidden values were one-based, while visible texture

indices were zero-based.

• For file-only GamePwn, a reproducible parser can be a cleaner solve than

patching movement or building an emulator.

Source-Backed Dossier

The sections below are merged from companion Markdown notes for the same case. They are rendered after sanitization so the article stays precise without publishing raw flags, credentials, or target-specific secrets.

Notes

Scope

• Challenge: NoClip
• Category: GamePwn
• Difficulty: Medium
• Mode: file
• Remote instance: none
• Start time: 2026-06-13T01:42:23Z
• Operator: harness
• State file: challenge-state.json

Harness Status

• Current phase: see challenge-state.json
• Next allowed actions: see next-action.json
• Raw flags and sensitive material stay in loot/ only. Do not paste them here.

Artifact Inventory

Evidence Ledger

Key Findings

• noclip is a non-stripped SDL2 raycaster; the useful symbols are load_assets,

input, and raycast.

• assets.dmp stores player coordinates, a 43 by 21 map with 3 bytes per cell,

one skybox texture, and 18 named game textures.

• The game indexes map cells as x * height + y; row-major parsing is misleading.
• Hidden collision-wall bytes are one-based references into the texture table.

This makes byte 18 the closing-brace texture.

• Floor byte 6 marks visible 1 characters that participate in the final

connected no-clip path.

• solve/solve.py reconstructs the flag candidate from the corrected asset

interpretation and writes it under loot/.

RAG / Advisory Memory

RAG output is advisory only. Record evaluated retrievals with:

scripts/challenge_harness.py rag-record <workspace> --query "..." --tag MATCHED|PARTIAL|MISSING|<secret redacted>|GENERIC --validation "..."

Secrets/Flags

Raw flags and sensitive material stay in loot/ only. Use scripts/challenge_harness.py capture-flag to validate and record flag capture without printing the value.

Memory Summary

Metadata

• Platform: HackTheBox Challenges
• Category: GamePwn
• Challenge: NoClip
• Difficulty: Medium
• Source workspace: <local workspace>

Validated Solve Chain

Concepts only. Do not include raw flags, reusable credentials, tokens, cookies, private keys, or live secrets.

1. Reverse the non-stripped SDL2 raycaster binary enough to recover the asset

format and map indexing convention.

1. Parse assets.dmp as sections: player coordinates, 3-byte-per-cell map,

skybox texture, then named texture table.

1. Validate from disassembly that map cells are indexed as x * height + y,

not row-major y * width + x.

1. Treat hidden collision-wall values as one-based texture references and

floor texture 1 markers as additional character nodes.

1. Follow the connected no-clip character lattice beginning at the HTB prefix;

the recovered inner phrase normalizes from leetspeak to break_the_wall.

Reusable Lessons

• For raycaster/game asset challenges, disassemble the loader and movement or

render functions before trusting an assumed map layout.

• If a texture index appears off by one, check whether the hidden data field and

render field use different conventions.

• When gameplay is mostly a container for a hidden asset puzzle, a deterministic

asset parser is usually cleaner than patching movement or attempting manual

play.

Dead Ends

• Initial row-major map parsing made the layout look plausible but placed

character nodes incorrectly.

• Treating hidden wall collision bytes as zero-based texture IDs left value

18 looking invalid; one-based mapping resolves it as the closing brace.

Tool Quirks

• The binary uses x * height + y for map indexing, which is easy to miss when

dumping a rectangular map visually.

• Direction texture file names are not needed for final recovery; only the

character texture names and floor 1 markers are used.

Evidence Paths

• analysis/disasm-load-assets.txt
• analysis/disasm-player-input.txt
• analysis/disasm-raycast.txt
• analysis/assets-special-tiles.txt
• analysis/map-corrected-lattice.md
• solve/solve.py
• loot/flag.txt

Ingestion Decision

• Proposed for LightRAG: yes
• Requires user approval before ingestion: yes

Hypothesis Board

Keep no more than 3 active hypotheses on Easy/Medium and 5 on Hard unless the user explicitly asks for breadth.

Closed Branches