NoMap3d

Technical Walkthrough

Writeup

Challenge

• Name: NoMap3d
• Category: GamePwn
• Difficulty: Medium
• Mode: file

Summary

NoMap3d is a file-only GamePwn challenge built around a small native raycaster-style ELF and an assets.dmp blob. The solve path was not runtime patching or manual gameplay. The flag was embedded as a bitmap banner in the map wall/collision plane.

Artifact Inventory

• files/a12c735f-0ef9-4098-a5bb-56c2f1db0657.zip: original challenge archive.
• files/extracted/gamepwn_nomap3d/nomap3d: 64-bit Linux PIE ELF, dynamically linked, not stripped.
• files/extracted/gamepwn_nomap3d/assets.dmp: asset blob containing the player section, map section, skybox, and texture data.

Analysis

The useful symbols in the ELF included load_assets, load_assets_texture, player_init, input, and raycast, which made asset parsing cheaper than dynamic gameplay.

The asset blob starts with a player section and then a map section. The map section has type 2, width 259, height 12, and three bytes per cell. The important implementation detail is that the binary indexes the map as x-major:

offset = map_start + (x * height + y) * 3

Using row-major indexing produced misleading output. Rendering the first byte of each x-major cell as the wall/collision plane revealed a readable 7-row bitmap banner inside the maze.

Evidence:

• analysis/disasm-load-assets.txt
• analysis/map-index-xrefs.txt
• analysis/map-decoding.md
• analysis/map-wall-white.png
• analysis/map-wall-annotated.png

RAG was checked, but it returned no NoMap3d-specific answer. The solve is based on direct local artifact evidence.

Solve

The reproducible decoder is solve/solve.py.

It performs these checks:

1. Opens files/extracted/gamepwn_nomap3d/assets.dmp.
2. Validates the map section header and expected dimensions.
3. Extracts the x-major wall/collision plane.
4. Validates invariant glyph shapes from the hidden banner.
5. Reconstructs the HTB-format flag and writes it to loot/flag-candidate.txt.

The harness accepted the generated candidate and stored the final flag in loot/flag.txt.

One correction was needed after platform submission: the visible wall banner uses a block font, but the exact HTB flag casing is mixed case. The decoder now preserves the intended lowercase glyphs instead of normalizing the whole banner to uppercase.

Flag

Raw flag is stored in loot/flag.txt and intentionally not reproduced here.

Lessons

• For native GamePwn/raycaster challenges, parse the asset format before trying to play or patch the binary.
• Map orientation matters. If a map render looks nonsensical, validate how the binary indexes cells before closing the branch.
• HTB flags are case-sensitive. A readable bitmap phrase can still require exact mixed-case transcription.
• RAG/community memory can be useful, but for this challenge it was not specific enough; direct artifact evidence was decisive.

Source-Backed Dossier

The sections below are merged from companion Markdown notes for the same case. They are rendered after sanitization so the article stays precise without publishing raw flags, credentials, or target-specific secrets.

Notes

Scope

• Challenge: NoMap3d
• Category: GamePwn
• Difficulty: Medium
• Mode: file
• Remote instance: none
• Start time: 2026-06-13T02:15:51Z
• Operator: harness
• State file: challenge-state.json

Harness Status

• Current phase: see challenge-state.json
• Next allowed actions: see next-action.json
• Raw flags and sensitive material stay in loot/ only. Do not paste them here.

Artifact Inventory

Evidence Ledger

Key Findings

• The ELF is a small native raycaster-style binary with useful exported symbols for asset loading, input, and raycasting.
• assets.dmp contains a 259 x 12 map section with three bytes per cell.
• The binary indexes the map x-major, not row-major: (x height + y) 3.
• Rendering the first map byte as a wall/collision plane reveals a bitmap banner in the maze.
• solve/solve.py decodes the banner and writes the HTB-format flag candidate into loot/; the harness captured it successfully.

RAG / Advisory Memory

RAG output is advisory only. Record evaluated retrievals with:

scripts/challenge_harness.py rag-record <workspace> --query "..." --tag MATCHED|PARTIAL|MISSING|<secret redacted>|GENERIC --validation "..."

Secrets/Flags

Raw flags and sensitive material stay in loot/ only. Use scripts/challenge_harness.py capture-flag to validate and record flag capture without printing the value.

Memory Summary

Metadata

• Platform: HackTheBox Challenges
• Category: GamePwn
• Challenge: NoMap3d
• Difficulty: Medium
• Source workspace: <local workspace>

Validated Solve Chain

Concepts only. Do not include raw flags, reusable credentials, tokens, cookies, private keys, or live secrets.

1. Extract the file-only GamePwn archive and inspect the native ELF symbols before runtime work.
2. Parse assets.dmp: section type 1 stores player coordinates; section type 2 stores a 259 x 12 map with three bytes per cell.
3. Use x-major map indexing from the binary: offset = map_start + (x height + y) 3.
4. Render the first byte of each map cell as the wall/collision plane. Rows 2..8 form a 7-row bitmap banner.
5. Decode the banner into the HTB-format flag, preserving exact mixed-case glyph intent, and keep the raw flag only in loot/.

Reusable Lessons

• For raycaster-style GamePwn challenges, asset parsing can be faster and safer than manual play or binary patching.
• If a rendered map looks wrong, confirm row-major versus column/x-major indexing from code references.
• Hidden text can be embedded in collision/wall planes rather than texture strings.
• Case matters for HTB submission; block-font banners may visually look uppercase even when the intended flag has lowercase characters.
• Treat RAG as advisory; direct asset evidence outranks unrelated retrieved memories.

Dead Ends

• Row-major map rendering produced misleading/noisy output.
• OCR over the rendered map was unreliable for leetspeak glyphs; direct bitmap validation was more reliable.
• The initial all-uppercase transcription was rejected by the platform. Mixed-case transcription fixed the issue.

Tool Quirks

• Tesseract misread the blocky bitmap font, especially digits and repeated glyphs.
• Missing Ghidra/rizin/radare2 did not block this solve because exported symbols and objdump were sufficient.

Evidence Paths

• analysis/artifact-inventory.json
• analysis/disasm-load-assets.txt
• analysis/map-index-xrefs.txt
• analysis/map-decoding.md
• analysis/map-wall-white.png
• analysis/map-wall-annotated.png
• analysis/research/nomap3d-ctfbase-casing.md
• solve/solve.py
• loot/flag.txt

Ingestion Decision

• Proposed for LightRAG: yes
• Requires user approval before ingestion: yes

Hypothesis Board

Keep no more than 3 active hypotheses on Easy/Medium and 5 on Hard unless the user explicitly asks for breadth.

Closed Branches