Pathfinder — EH4X CTF 2026 | Reverse Engineering | 500 pts

"You can go funky ways"

bro this challenge had me lost in a maze... literally. 💀

First Look — What Even Is This?

Downloaded the binary. Classic first move:

$ file pathfinder
pathfinder: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked, stripped

Stripped binary. No symbols. Pain.

$ ./pathfinder
Are you a pathfinder?
[y/n]: y
Ok, tell me the best path: idk
Better luck next time.

So it wants a "path". The challenge name is "Pathfinder". The description says "funky ways". Sounds like a maze. Let's find out what makes the path "best".

Reversing the Binary — Into the Rabbit Hole

Threw it into radare2 (or your decompiler of choice — Ghidra, IDA, Binary Ninja, whatever you vibe with).

The Main Flow

So we need to figure out what validate_path() considers a valid path.

The Validation Function (fcn.00001444)

This is where the magic happens. Here's the logic broken down:

So there are 4 conditions for a valid path:

1. Each character must be a valid direction (enabled in the table)
2. Every move stays inside the 10x10 grid
3. The maze walls allow each move (bitfield check)
4. You end at position (9,9)
5. The entire path string hashes to a specific value

bro really said "not only find the maze path, but it also has to hash correctly" 😭

Extracting the Data — CSI: Binary Edition

The Direction Table

Found in the .init_array constructor (entry.init2). The table at 0x4120 maps ASCII chars to movement data:

The lowercase versions are decoys — they're in the table but disabled. Classic bait. 🎣

The Move Validation Masks

For each direction, the XOR math produces bitmasks that check specific bits of the grid cells:

So each cell in the grid stores a 4-bit bitmask:

This is literally a maze encoded as wall bitmasks per cell. Classic CS data structure!

If you've done maze generation algorithms before (Prim's, Kruskal's, recursive backtracker), this encoding will feel very familiar. Each cell stores which walls are open.

The Grid — XOR-Encrypted Maze

The grid lives at 0x40a0 but it's all zeros in the binary. Another .init_array function (entry.init1) decodes it at startup:

def decode_grid():
    for i in range(100):
        key = ((i * 31 + 17) ^ (i * 8) ^ 0xA5) & 0xFF
        grid[i] = encoded_data[i] ^ key

The encoded data sits at 0x2020 in the .rodata section. After decoding:

Visualizing the Maze

Converting the bitmasks to actual walls (0x00 = solid wall, nonzero = passable):

Now THAT'S a maze. The challenge author literally embedded a full maze in the binary with XOR encryption. Respect. 🫡

The Hash Function — One More Lock on the Door

Even if you find a valid path through the maze, the path string itself must hash to 0x86BA520C:

def custom_hash(path):
    h = 0xDEADBEEF                    # lol classic
    for c in path:
        h ^= ord(c)
        h = rotate_left(h, 13)        # ROL 13
        h = (h * 0x045D9F3B) & 0xFFFFFFFF
    h ^= (h >> 16)                    # avalanche
    h = (h * 0x85EBCA6B) & 0xFFFFFFFF
    h ^= (h >> 13)
    return h

This is a variant of MurmurHash-style mixing. The 0xDEADBEEF seed is a dead giveaway that the author has a sense of humor.

Since the maze is constrained enough, there likely aren't many valid paths from (0,0) to (9,9). We just need to find the one with the matching hash.

Solving It — DFS Go Brrrrr

Time to write a solver:

#!/usr/bin/env python3

# ... (grid decoding and direction table setup) ...

def is_valid_move(char, cur_x, cur_y):
    """Check if moving in direction 'char' from (cur_x, cur_y) is valid"""
    dx, dy, b8, b9, enabled = directions[char]
    if not enabled:
        return False, 0, 0

    c = ord(char)
    check1 = ((c * 0x6b) ^ b8 ^ 0x3c) & 0xFF
    check2 = ((c * 0x6b) ^ b9 ^ 0x3c) & 0xFF

    new_x, new_y = cur_x + dx, cur_y + dy

    if not (0 <= new_x <= 9 and 0 <= new_y <= 9):
        return False, 0, 0

    old_cell = grid[cur_x * 10 + cur_y]
    new_cell = grid[new_x * 10 + new_y]

    if (old_cell & check1) | (new_cell & check2) == 0:
        return False, 0, 0

    return True, new_x, new_y

def dfs(x, y, path, visited):
    """DFS to find path from (x,y) to (9,9) with correct hash"""
    if x == 9 and y == 9:
        if path_hash(path) == 0x86BA520C:
            print(f"FOUND IT: '{path}'")
            return path
        return None

    if len(path) > 50:  # sanity limit
        return None

    for char in ['N', 'S', 'E', 'W']:
        valid, nx, ny = is_valid_move(char, x, y)
        if valid and (nx, ny) not in visited:
            visited.add((nx, ny))
            result = dfs(nx, ny, path + char, visited)
            if result:
                return result
            visited.remove((nx, ny))
    return None

# GO!
solution = dfs(0, 0, "", {(0, 0)})

One unique path, one unique hash. Chef's kiss. 👨‍🍳

The Path Visualized

The path goes:

1. Right 2 → reach column 2
2. Down 3 → drop to row 3
3. Left 2 → back to column 0
4. Down 6 → all the way to row 9
5. Right 8 → cruise along the bottom to column 8
6. Up 2 → pop up to row 7
7. Right 1 → reach column 9
8. Down 2 → arrive at (9,9) ⚑

The Flag Generation — RLE Encoding

The generate_flag() function does Run-Length Encoding (RLE) on the path:

Wrapped in EHAX{...}:

Flag

What I Learned (TL;DR for fellow CTF grinders)

Tools Used

• radare2 — disassembly and function analysis
• GDB — runtime debugging (dumping decoded grid, tracing validation)
• Python 3 — solver script (grid decoding + DFS pathfinding)

"Are you a pathfinder?" — yes, yes I am now. 🗺️

Writeup by a sleep-deprived CTF player who spent too long typing the wrong number of S's into a pipe. Don't be like me. Copy-paste your payloads. 😔