TKOTF CTF - Guess The Logo Writeup

Category: Reverse Engineering
Flag: RN10{r0bl0x_1s_f0r_c00l_k1ds}

Recon

Join the game (or open the .rbxl in Studio). You'll see a long corridor with 6 walls, each showing a cybersecurity tool logo. Type the name in chat to pass through each wall:

After clearing all 6 walls and reaching the end, you get:


RN10{h3ll0_i_4m_4_f4k3_fl4g}


That's a fake flag. The real challenge starts here.

Reverse Engineering

Step 1: Open the .rbxl in Roblox Studio

Open the provided .rbxl file in Roblox Studio. In the Explorer panel, navigate to:


ServerScriptService > GameServer


Step 2: Find the Encoded Flag

Scroll to the bottom of GameServer past the -- SYSTEM INTERNALS comment. You'll find:

local FLAGDATA = {63,33,82,81,22,29,83,3,1,95,27,62,92,28,60,7,93,29,60,2,93,95,15,62,6,94,7,18,16}

local function _xorDecode(data, key)
local out = {}
for i, b in ipairs(data) do
out[i] = string.char(bit32.bxor(b, string.byte(key, (i-1) % #key + 1)))
end
return table.concat(out)
end

The flag is XOR-encoded. You have the algorithm — you just need the key.

Step 3: Find the Key

At the very bottom of GameClient (StarterPlayer > StarterPlayerScripts > GameClient), there's a comment:

-- NOTE: _xorDecode key is an anime character name

Now look at the walls in Workspace. One wall has an anime character on it. Identify the character.

The character is Moca (Aoba Moca from BanG Dream).

The key is: moca

Step 4: Decode the Flag

XOR decode _FLAG_DATA using "moca" as the repeating key:

Key: m o c a m o c a ...
109 111 99 97 109 111 99 97

FLAGDATA[1] = 63 XOR 109 = 82 → 'R'
FLAGDATA[2] = 33 XOR 111 = 78 → 'N'
FLAGDATA[3] = 82 XOR 99 = 49 → '1'
FLAGDATA[4] = 81 XOR 97 = 48 → '0'
FLAGDATA[5] = 22 XOR 109 = 123 → '{'
..

You can decode it with a quick script:

data = [63,33,82,81,22,29,83,3,1,95,27,62,92,28,60,7,93,29,60,2,93,95,15,62,6,94,7,18,16]
key = "moca"
flag = "".join(chr(b ^ ord(key[i % len(key)])) for i, b in enumerate(data))
print(flag)

Output:


RN10{r0bl0x_1s_f0r_c00l_k1ds}


Key Takeaways

• Roblox .rbxl files expose all scripts including server-side ones
• XOR encoding with a non-obvious key (anime character knowledge) adds a second layer
• The decode algorithm is visible but useless without the key
• The flag data and decode function were placed in ServerScriptService intentionally as that is where server-side game logic lives in any Roblox project, not a random choice
• The key hint was placed in StarterPlayerScripts (client-side), which is also intentional. Clients can read their own scripts in a live game
• In a live Roblox game, ServerScriptService scripts are hidden from clients, so this would be real protection but handing out the .rbxl source file nullifies that entirely, exposing everything