Regas Town

Technical Walkthrough

Writeup

Challenge

• Name: Regas-Town
• Category: Reversing
• Difficulty: Medium
• Mode: file

Summary

Rega's Town is a Rust reversing challenge built around regular-expression rules and arithmetic checks over parts of the input. The binary includes debug symbols, so the relevant functions are visible: filter_input, multiply_characters, check_input, and main.

The solve path is static: extract the regex rules from .rodata, recover the fixed string slices and product constants from check_input, apply two hidden index checks in main, and resolve the final product-order collision using the challenge title.

Artifact Inventory

Reference analysis/artifact-inventory.json and summarize the relevant files or remote surface.

• files/extracted/dist/rega_town: Rust x86-64 PIE ELF, dynamically linked, with debug info, not stripped.
• No remote instance is required for this challenge.
• Main artifacts:

- analysis/source-audit.md

- analysis/disasm-filter_input.txt

- analysis/disasm-check_input.txt

- analysis/disasm-main.txt

- analysis/solver-summary.txt

Analysis

filter_input copies a 9-element Rust &str array from .rodata and compiles each entry with the Rust regex crate. The extracted patterns constrain the flag shape, length, fixed HTB-style wrapping, uppercase positions, underscores, digit count, and several fixed phrase fragments.

multiply_characters maps each character to its Unicode codepoint and multiplies the values as u128.

check_input extracts seven ranges and compares their products:

• [4:7]
• [8:11]
• [12:15]
• [16:20]
• [21:23]
• [24:27]
• [28:32]

main then checks two individual characters from the collected Vec<char>, resolving two product collisions. The final remaining collision is between a real word and a transposed spelling; the challenge title selects the real word.

Solve

Run:

python3 solve/solve.py

The solver enumerates segment candidates from the regex character classes, filters them by the recovered product constants, applies the two hidden index checks, ranks the semantic candidates, and writes the selected HTB-format value to loot/flag-candidate.txt.

Flag

Raw flag is stored in loot/flag.txt and intentionally not reproduced here.

Lessons

• Rust debug symbols can make a large static binary tractable if you focus only on challenge-owned functions.
• Product checks over characters are collision-prone; look for additional disambiguation checks or semantic hints.
• Regex extraction from Rust &str arrays is more reliable than relying on concatenated strings output.

Source-Backed Dossier

The sections below are merged from companion Markdown notes for the same case. They are rendered after sanitization so the article stays precise without publishing raw flags, credentials, or target-specific secrets.

Notes

Scope

• Challenge: Regas-Town
• Category: Reversing
• Difficulty: Medium
• Mode: file
• Remote instance: none
• Start time: 2026-06-12T06:02:54Z
• Operator: harness
• State file: challenge-state.json

Harness Status

• Current phase: see challenge-state.json
• Next allowed actions: see next-action.json
• Raw flags and sensitive material stay in loot/ only. Do not paste them here.

Artifact Inventory

Evidence Ledger

Key Findings

• The binary is a Rust x86-64 ELF with debug symbols and visible rega_town::* functions.
• filter_input validates nine Rust regexes stored as a .rodata array of &str.
• check_input slices the candidate into seven fixed ranges and compares u128 products of character codepoints.
• main adds two hidden collision breakers: character index 5 must be '0', and index 9 must be 'r'.
• Product checks are lossy; after hidden checks, the remaining ambiguity is a Town/Twon product-order collision.
• The solver chooses the natural challenge-title phrase and stores the HTB-format value only in loot/.

RAG / Advisory Memory

RAG output is advisory only. Record evaluated retrievals with:

scripts/challenge_harness.py rag-record <workspace> --query "..." --tag MATCHED|PARTIAL|MISSING|<secret redacted>|GENERIC --validation "..."

Secrets/Flags

Raw flags and sensitive material stay in loot/ only. Use scripts/challenge_harness.py capture-flag to validate and record flag capture without printing the value.

Memory Summary

Metadata

• Platform: HackTheBox Challenges
• Category: Reversing
• Challenge: Regas-Town
• Difficulty: Medium
• Source workspace: <local workspace>

Validated Solve Chain

Concepts only. Do not include raw flags, reusable credentials, tokens, cookies, private keys, or live secrets.

1.

Reusable Lessons

-

Dead Ends

-

Tool Quirks

-

Evidence Paths

-

Ingestion Decision

• Proposed for LightRAG: yes/no
• Requires user approval before ingestion: yes

Hypothesis Board

Keep no more than 3 active hypotheses on Easy/Medium and 5 on Hard unless the user explicitly asks for breadth.

Closed Branches