Checkmate, Liver King

Platform: dawgctf | Category: Reversing | Type: Challenge | Difficulty: Medium | OS: Linux | Author: XESXOR | Date: 2026-04-10 | Status: Solved Techniques: static_string_deobfuscation, xor_blob_decryption, opening_reconstruction_from_move_squares, fen_checkpoint_validation, domain_knowledge_inference

Summary

Task: a stripped Rust chess GUI hides XOR-obfuscated strings and intermediate board states inside the binary. Solution: decrypt the blobs, recognize the Fried Liver Attack from the recovered move squares and FEN checkpoints, then append the unprinted but forced Kxf7 destination square to complete the line and build the flag.

Checkmate, Liver King — DawgCTF SP26

Description

Binary: theliverking

Hint: "Consider the title of the challenge, and if that fails, all the secrets are in the binary!"

English summary: this is a stripped 64-bit Linux Rust chess GUI. The goal is not to beat the program normally, but to reverse the hidden strings, recover the intended chess line, and convert the move sequence into the final DawgCTF{...} flag.

Recon

The binary is a stripped ELF64, so the first useful path is static analysis rather than symbol-driven reversing. Looking through the data section reveals multiple blobs that do not decode as plaintext directly but do decrypt under a repeated XOR key: ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

 text read-only • copy allowed Copy
xnasff3wcedj

Applying that key to the hidden buffers yields two especially important strings:

 text read-only • copy allowed Copy
REDACTED
You did it! The flag is your moves to get here.

The binary also contains hidden FEN checkpoints:

 text read-only • copy allowed Copy
rnbqkbnr/pppp1ppp/8/4p3/4P3/5N2/PPPP1PPP/RNBQKB1R
r1bqkb1r/pppp1ppp/2n2n2/4p1N1/2B1P3/8/PPPP1PPP/RNBQK2R
r1bqkb1r/ppp2ppp/2n2n2/3Pp1N1/2B5/8/PPPP1PPP/RNBQK2R
r1bqkb1r/ppp2Npp/2n5/3np3/2B5/8/PPPP1PPP/RNBQK2R

Those positions are a strong clue that the decrypted string is not random text: it is a chess move path. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Analysis

The title is the second hint. Liver King points directly at the Fried Liver Attack, a well-known opening line:

1. e4
2. e5
3. Nf3
4. Nc6
5. Bc4
6. Nf6
7. Ng5
8. d5
9. exd5
10. Nxd5
11. Nxf7

If we record only the destination squares of those moves, we get exactly the decrypted output:

 text read-only • copy allowed Copy
e4 e5 f3 c6 c4 f6 g5 d5 d5 d5 f7

joined as:

 text read-only • copy allowed Copy
REDACTED

The embedded FEN snapshots match the same sequence at several checkpoints, which confirms that the intended interpretation is the Fried Liver line and not just a loose chess reference. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Solution

1. Decrypt the hidden strings

Reverse the string-obfuscation routine and apply the repeated XOR key xnasff3wcedj to the hidden blobs. This recovers both the move-square string and the message telling us that the flag is based on the moves used to reach the winning state.

2. Read the move string as chess destination squares

The output is not SAN or LAN; it is the sequence of destination squares only:

 text read-only • copy allowed Copy
REDACTED

Together with the title, that reconstructs the opening line: ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

1. e2-e4 -> e4
2. e7-e5 -> e5
3. g1-f3 -> f3
4. b8-c6 -> c6
5. f1-c4 -> c4
6. g8-f6 -> f6
7. f3-g5 -> g5
8. d7-d5 -> d5
9. e4xd5 -> d5
10. f6xd5 -> d5
11. g5xf7 -> f7

3. Notice the line is still incomplete

This is the key reasoning step. The binary prints the white attacking line only, but after Nxf7 the natural and forced continuation for black is:

1. Kxf7 -> f7

That final destination square is not printed by the binary, yet it is required to complete the Fried Liver continuation implied by the puzzle. This was also consistent with the public competition discussion and the challenge's intended solution path. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

4. Append the missing final square and wrap the flag

So the completed square sequence becomes:

 text read-only • copy allowed Copy
REDACTED

and the final flag is:

 text read-only • copy allowed Copy
DawgCTF{REDACTED}

 python read-only • copy allowed Copy
#!/usr/bin/env python3

partial = "REDACTED"
missing_reply = "f7"  # Kxf7
flag = f"DawgCTF{{{partial}{missing_reply}}}"
print(flag)

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍