tl;dr:
1. Notice repeating pattern in place of palette, which suggests zeros
2. Notice key is repeated many times
3. Notice that you can unxor the key from the flag using the above
4. Notice you can brute-force decryption, by encrypting `00000A`, `000000B`... and comparing with ciphertext
5. Brute-force the number of flags looking for `tRNS` and `IDAT` in decrypted data
6. Brute-force entire flag
7. Recover PNG

Full writeup: https://github.com/p4-team/ctf/tree/master/2019-11-16-asis-finals/true_zero

Original writeup (https://github.com/p4-team/ctf/tree/master/2019-11-16-asis-finals/true_zero).