Rating: 5.0

We see that when some variable is 0x1d3, game prints the flag.


if (iVar6 == 0x1d3) {
system("cat flag.txt");
uVar8 = 0;
}


That magic variable is the board score calculated by piece positions and types.


ulong calculate_score(long param_1,undefined8 param_2,undefined8 param_3,undefined8 param_4,
undefined8 param_5,undefined8 param_6)

{
undefined4 uVar1;
int iVar2;
uint local_1c;
int i;
int j;

local_1c = 0;
i = 0;
while (i < 8) {
j = 0;
while (j < 8) {
uVar1 = get_piece_type(param_1 + ((long)j + (long)i * 8) * 0x10);
get_piece_color(param_1 + ((long)j + (long)i * 8) * 0x10);
switch(uVar1) {
case 0:
iVar2 = calc_queen_score(param_1,(ulong)(8 - i),(ulong)(j + 9));
local_1c = local_1c + iVar2;
break;
case 1:
iVar2 = calc_king_score(param_1,(ulong)(8 - i),(ulong)(j + 9));
local_1c = local_1c + iVar2;
break;
case 2:
iVar2 = calc_bishop_score(param_1,(ulong)(8 - i),(ulong)(j + 9));
local_1c = local_1c + iVar2;
break;
case 3:
iVar2 = calc_knight_score(param_1,(ulong)(8 - i),(ulong)(j + 9));
local_1c = local_1c + iVar2;
break;
case 4:
iVar2 = calc_rook_score(param_1,(ulong)(8 - i),(ulong)(j + 9));
local_1c = local_1c + iVar2;
break;
case 5:
iVar2 = calc_pawn_score(param_1,(ulong)(8U - i),(ulong)(j + 9),(ulong)(8U - i),param_5,
param_6,param_2);
local_1c = local_1c + iVar2;
}
j = j + 1;
}
i = i + 1;
}
return (ulong)local_1c;
}


Re-implementing the scoring algorithm in Python gives following scores for each piece and position:


def calc_queen_score(x,y):
return x+y

def calc_king_score(x,y):
return x*y

def calc_bishop_score(x,y):
return (x+y)*2

def calc_knight_score(x,y):
return (x%y)

def calc_rook_score(x,y):
return 0x100-x-y

def calc_pawn_score(x,y):
return x-y

def find_scores(score_func):
for i in range(8):
row = []
for j in range(8):
row.append(str(score_func(8-i, j+9)))
print("\t".join(row))

print("Queen scores:")
find_scores(calc_queen_score)

print("King scores:")
find_scores(calc_king_score)

print("Bishop scores:")
find_scores(calc_bishop_score)

print("Knight scores:")
find_scores(calc_knight_score)

print("Rook scores:")
find_scores(calc_rook_score)

print("Pawn scores:")
find_scores(calc_pawn_score)


Output:


Queen scores:
17 18 19 20 21 22 23 24
16 17 18 19 20 21 22 23
15 16 17 18 19 20 21 22
14 15 16 17 18 19 20 21
13 14 15 16 17 18 19 20
12 13 14 15 16 17 18 19
11 12 13 14 15 16 17 18
10 11 12 13 14 15 16 17
King scores:
72 80 88 96 104 112 120 128
63 70 77 84 91 98 105 112
54 60 66 72 78 84 90 96
45 50 55 60 65 70 75 80
36 40 44 48 52 56 60 64
27 30 33 36 39 42 45 48
18 20 22 24 26 28 30 32
9 10 11 12 13 14 15 16
Bishop scores:
34 36 38 40 42 44 46 48
32 34 36 38 40 42 44 46
30 32 34 36 38 40 42 44
28 30 32 34 36 38 40 42
26 28 30 32 34 36 38 40
24 26 28 30 32 34 36 38
22 24 26 28 30 32 34 36
20 22 24 26 28 30 32 34
Knight scores:
8 8 8 8 8 8 8 8
7 7 7 7 7 7 7 7
6 6 6 6 6 6 6 6
5 5 5 5 5 5 5 5
4 4 4 4 4 4 4 4
3 3 3 3 3 3 3 3
2 2 2 2 2 2 2 2
1 1 1 1 1 1 1 1
Rook scores:
239 238 237 236 235 234 233 232
240 239 238 237 236 235 234 233
241 240 239 238 237 236 235 234
242 241 240 239 238 237 236 235
243 242 241 240 239 238 237 236
244 243 242 241 240 239 238 237
245 244 243 242 241 240 239 238
246 245 244 243 242 241 240 239
Pawn scores:
-1 -2 -3 -4 -5 -6 -7 -8
-2 -3 -4 -5 -6 -7 -8 -9
-3 -4 -5 -6 -7 -8 -9 -10
-4 -5 -6 -7 -8 -9 -10 -11
-5 -6 -7 -8 -9 -10 -11 -12
-6 -7 -8 -9 -10 -11 -12 -13
-7 -8 -9 -10 -11 -12 -13 -14
-8 -9 -10 -11 -12 -13 -14 -15


Solution:

We need to make the total score 467 (0x01D3).

Following board satisfies the scoring requirement and prints the flag.


A B C D E F G H

8 □ □ □ □ ♖ ♛ ♕ □
7 □ □ □ □ □ □ □ □
6 □ □ □ □ □ □ □ □
5 □ □ □ □ □ □ □ □
4 □ □ □ □ □ □ □ □
3 □ □ □ □ □ □ □ □
2 □ □ □ □ □ □ □ □
1 □ □ □ □ □ □ □ □


flag{y3s_i_kn0w_p4wns_c4n_m0v3_tw1c3_0n_th31r_f1rst_pl4y}