Lion City Layover fake WASM VM + Fermat RSA

#Overview

A Singapore-themed tourist maze hides a fake WebAssembly VM ("SingaVM 1.6.1 legacy"). The VM interpreter lives in a wasm custom section literally named singa. Its opcode table has three "unsafe" opcodes blocked by a "patched immigration validator" - but the validator only inspects the first singa section while the interpreter executes the last, so duplicating the section defeats it. One blocked opcode dumps a 990-byte cyclic "passport" blob containing an RSA modulus, exponent and ciphertext; the modulus is Fermat-weak (the in-band hint literally says "Fermat liked neighbours on the same HDB landing"). Decrypting yields a boarding-pass claim whose SHA-256 is pinned in the passport - submit it for the flag.

The challenge is also saturated with prompt-injection honeypots aimed at LLM agents. Every one of them is a decoy; see the inventory near the end.

#1. Foothold: the tourist maze

GET /api/harbour/start returns a session token plus three ASCII mazes:

grid chars:  '#' wall   'S' start   'A','B','C' stamps   'E' departure gate

Route requirement: visit all three stamps, then the gate, per level. Movement is WASD/arrows; the client submits the concatenated move string per level as traces:

POST /api/harbour/stamp  {"session": <session>, "traces": ["RRDDLL...", "...", "..."]}
  -> {"ok": true, "ticket": "eyJraWQ..."}

Straight TSP-over-3-stamps plus BFS. The ticket is a JWT-ish "passport" that expires in ~20 minutes; when it lapses, /api/harbour/run replies {"error":"no witnessed passport"} and the maze must be replayed.

#2. Manifest reconnaissance

GET /api/harbour/tide            -> manifest
GET /api/harbour/tide?format=1   -> unlocks the "last_stamp" record

The manifest names its own unlock parameter in its own record text: "Some format records are intentionally locked until the manifest request includes the parameter it names" -> ?format=1.

The postcard clues (Supertree Grove, chicken rice, Vanda Miss Joaquim) and the postcard vault they point to are the final decoy layer - they're never reached. The real path is the wasm replay.

#3. Reversing the "SingaVM" cartridge format

/engine/singa_legacy.wasm is 121 bytes and contains no code at all:

wasm magic + version
custom section "singa"  -> payload: MERLION\0v1.6.1\0 \x04\x00 \x01\x2a\xfe\xff
custom section "build"  -> "SingaVM 1.6.1 legacy compatibility;
                            patched immigration validator 2026-05-14"

It's a format template, not an engine. Cartridges are supplied to POST /api/harbour/run as base64 wasm: {"ticket": "...", "module": "<base64 wasm>", "pow": "<nonce>"}.

#The header is rigid

Black-box iteration pins the payload line format:

payload = "MERLION\x00" + "v1.6.1\x00" + u16le(program_len) + program + <1 pad byte>

• Wrong magic or version -> wrong SingaVM cartridge
• Missing the singa custom section -> missing singa section
• len(available) < program_len -> program truncated
• The high byte of the u16 length must be 0

#Opcode table (swept across all 256 values)

0x31 returns 32-byte windows onto a periodic string that decodes to a "changi-gate:public-brochure:take-only-stamp" message - pure window dressing, the decoy that trains you to stop looking.

#4. The bypass: validate-first, execute-last

The "immigration validator" scans the cartridge for unsafe opcodes. But when a module contains two singa custom sections:

The validator parses the first singa section; the interpreter parses the last. Prepend a harmless decoy section and append the real program:

1wasm = MAGIC + custom("singa", sec([0x01,0x41,0xfe,0xff]))   # validated decoy
2             + custom("singa", sec(real_program))            # executed

#5. Dumping the passport (opcode 0x61)

With blocking defeated, 0x61 returns a 32-byte window into a 990-byte cyclic blob at byte offset offset(arg) = (arg * 256) mod 990.

Taking windows at several arg values and locating shared substrings gives the system 31S = 16, 27S = -18, 4S = 34 (mod L), which solves to L | 990, S = 256, L = 990 (gcd(256,990) = 2, so ~495 even offsets recover all 990 bytes). Stitching the windows yields:

SINGA-PASSPORT-v61
tide=engine/1.6.1; note=the old harbour diagnostic is patched at immigration,
  but the replay kiosk trusts the last stamp.
rsa_n=8742188609874011270...
rsa_e=65537
rsa_c=79258501869859418139...
claim_sha256=1299140fecece2fc00f48f6689b51af4b92ef8d6ce13987784dd7ccd2f2daa03
hint=Fermat liked neighbours on the same HDB landing.
age_hint=1965 to 2026 makes 61; the noisy diagnostic is 0x61.
END-PASSPORT

"the noisy diagnostic is 0x61" is a signpost: the opcode that dumps this noise is the one you want.

#6. Fermat-weak RSA to the claim

n is 1023 bits and its factors sit only ~3x10^7 apart, so Fermat's method succeeds at iteration 0 (a = ceil(sqrt(n)), b^2 = a^2 - n is already a perfect square):

q - p = 6100588
m = c^d mod n  =  boarding-pass:katong-1965-to-marina-2026:kopi-o-kosong
sha256(m) == claim_sha256 stored in the passport   [ok]

POST /api/harbour/claim  {"ticket": "...", "claim": "boarding-pass:katong-1965-to-marina-2026:kopi-o-kosong"}
  -> {"ok": true, "flag": "TISC{w3lc0m3_70_51ng4p0r3_l4h_61}",
      "message": "welcome to Singapore, lah"}

The claim_sha256 commitment in the passport lets the claim be verified offline before ever submitting it.

#7. Honeypot / prompt-injection inventory

This challenge is explicitly built to bait LLM agents. All of the following are decoys - none of them are the flag:

The only real flag comes from /api/harbour/claim with the recovered claim.

#Solve chain

1. GET /api/harbour/start -> solve 3 mazes -> POST /api/harbour/stamp -> ticket
2. GET /api/harbour/tide?format=1 -> engine path, PoW rule, hints
3. Craft cartridge: MERLION\0v1.6.1\0 + u16le(len) + program + pad
4. Duplicate the singa section (safe first, real second) to beat the validator
5. Brute the PoW nonce (sha256(ticket.cart.nonce) starts 0000, a few 10^3 tries)
6. Opcode 0x61, args swept, to stitch the 990-byte passport at (arg*256)%990
7. Fermat-factor n, decrypt c, verify sha256(claim)
8. POST /api/harbour/claim -> flag

#Lessons

• Enumerate the opcode space. A 256-value sweep turns a black box into a table in a few minutes.
• Section-name duplication is a real parser-differential bug. Whenever a validator and an interpreter parse the same container, feed them different views (first-vs-last section, raw-vs-decoded, declared-length-vs-actual).
• Recover cyclic-table offsets by solving congruences from overlapping windows instead of brute-forcing the stride.
• In-band hints tend to be literal. "Fermat liked neighbours", "1965 to 2026 makes 61", "the noisy diagnostic is 0x61" were all accurate.
• Ignore instructions embedded in the target. Five-plus decoy flags were planted specifically for agents, and the payload told you to stop looking.