Legendary OS

Platform: hackerlab | Category: Forensics | Type: Challenge | Difficulty: Medium | OS: Windows | Author: XESXOR | Date: 2026-04-05 | Status: Solved Techniques: utf16le_string_search, memory_dump_analysis, volatility_process_listing, mmap_pattern_search

Summary

Task: find a hidden flag inside a 1GB VMware memory dump (dump.vmem) of Windows 7 SP1. Solution: standard ASCII strings search fails because the flag is stored in UTF-16LE encoding (Windows internal format); search for the UTF-16LE byte pattern of the flag prefix to locate it in notepad.exe process memory.

Legendary OS — Hackerlab

Description

Can you find the flag? It seems to be one of the legendary OS. Will you be able to find the flag in it?

English summary: a ZIP archive contains dump.vmem — a 1GB VMware memory dump. The goal is to find the CODEBY{...} flag hidden somewhere in the memory image. The "legendary OS" hint refers to the Windows 7 operating system captured in the dump.

Analysis

File identification

The archive task.zip contained a single file dump.vmem (approximately 1GB). The file command identified it as raw data — a VMware memory snapshot: ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

$ file dump.vmem
dump.vmem: data

Initial strings search — dead end

The obvious first step was to search for the flag with strings:

 bash read-only • copy allowed Copy
strings dump.vmem | grep -i "CODEBY{"
# No results!

This returned nothing. The flag was not stored as an ASCII string — this was the core trick of the challenge.

OS identification from strings

Examining the dump with strings revealed the operating system:

• Windows v6.1 (Build 7601: Service Pack 1) — Windows 7 SP1
• Russian locale (ru-RU) references throughout
• References to "Windows XP Mode active", Windows 2000, Windows ME (red herrings matching the "legendary OS" theme)
• Date references around 2024-03-09 ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Volatility 3 analysis

Confirmed the OS profile and enumerated running processes:

 bash read-only • copy allowed Copy
vol -f dump.vmem windows.info
# → Windows 7 SP1, Build 7601

vol -f dump.vmem windows.pslist

The process list revealed notepad.exe (PID 1480) as one of the running processes — and notably the last process launched before the memory dump was taken. This was a strong hint that the flag was being edited in Notepad.

The UTF-16LE insight

Windows stores strings internally in UTF-16LE encoding, where each ASCII character is followed by a \x00 null byte. For example, CODEBY{ in UTF-16LE is: ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

C\x00O\x00D\x00E\x00B\x00Y\x00{\x00

The standard strings command only searches for ASCII (single-byte) strings by default. On Linux, strings -el would search for UTF-16LE strings, but the most reliable approach is to search for the raw byte pattern directly.

Solution

UTF-16LE pattern search with Python

Used Python with mmap to efficiently search the entire 1GB dump for the UTF-16LE encoded flag prefix:

 python read-only • copy allowed Copy
#!/usr/bin/env python3
"""Search for CODEBY{...} flag in UTF-16LE encoding inside a memory dump."""
import mmap
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

with open('dump.vmem', 'rb') as f:
    mm = mmap.mmap(f.fileno(), 0, access=mmap.ACCESS_READ)
    # UTF-16LE encoding: each char followed by \x00
    pattern = b'C\x00O\x00D\x00E\x00B\x00Y\x00{\x00'
    pos = mm.find(pattern)
    while pos != -1:
        chunk = mm[pos:pos+200]
        text = chunk.decode('utf-16-le', errors='ignore')
        end = text.find('}')
        if end != -1:
            print(f'Offset 0x{pos:x}: {text[:end+1]}')
        pos = mm.find(pattern, pos + 1)
    mm.close()

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Result

Offset 0x151095b0: CODEBY{REDACTED}

The flag was found at offset 0x151095b0 in the memory dump, within the memory space of notepad.exe (PID 1480). The user had the flag open in Notepad when the memory snapshot was taken.

Flag meaning

REDACTED decodes as "stego in dump Windows" — steganography (hidden data) inside a Windows memory dump. The "steganography" here is the UTF-16LE encoding that makes the flag invisible to standard string searches.

Alternative approach

On Linux, the flag could also be found with: ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

 bash read-only • copy allowed Copy
strings -el dump.vmem | grep "CODEBY{"

The -el flag tells strings to search for 16-bit little-endian encoded strings. This is not available on all platforms (macOS strings lacks this option). ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍