Decoding an XOR-encoded file gives us an MS-DOS VHD
The file is encrypted with a repeating XOR cipher
The file, when opened, shows the string "SUPERHOT" repeated over and over again in some parts, like the beginning of the file.
In other parts, however, there appears to be some scrambled data.
This was the major gatekeeper, but as the hint stated, the file is encrypted with a repeating XOR cipher. This explains the repeated "SUPERHOT"s, since
. Thus, null bytes (zeros) XOR-ed with "SUPERHOT" would yield "SUPERHOT".
Using "SUPERHOT" as the XOR key, we decode the file.
def repeating_key_xor(text: bytes, key: bytes) -> bytes:
repetitions = 1 + (len(text) // len(key))
key = key * repetitions
key = key[:len(text)]
return bytes([b ^ k for b, k in zip(text, key)])
with open("SUPERHOT", 'rb') as f:
text = f.read()
decoded = repeating_key_xor(text, b"SUPERHOT")
with open("decoded", 'wb') as f:
It turns out the key was indeed "SUPERHOT", as the decoded file was a valid disk image.
Indeed, the large portions of zeroes were encoded into repeating "SUPERHOT"s.
Checking the magic bytes at the beginning of the file allows us to fingerprint the file type.
Mounting the VHD with
guestmount -a decoded -i ./mnt -v, I started exploring the filesystem. The first thing we can try to find out is the OS version. This was easily found to be MS-DOS 6.22 - really old!
$ cat mnt/DOS/README.TXT
NOTES ON MS-DOS 6.22
This file provides important information not included in the
MICROSOFT MS-DOS USER'S GUIDE or in MS-DOS Help.
In the filesystem root, there was an interesting
LOG1.IRCfile. It hints at a
superhot.exethat requires "changing directories many times to reach".
$ cat mnt/LOG1.IRC
[13:33] *** Joins: white (whitehoodhacker@sigpwny)
[13:33] <white> Dude, you should play SUPERHOT, it's the most innovative game I've played in years!
[13:33] <white> I'll send it to your file server
[13:35] <someradgamer> epic I'll check it out
[13:38] <someradgamer> why does the setup create so many folders?
[13:38] <someradgamer> I have to change directories so many times to reach superhot.exe
[13:39] <white> Have you tried it yet?
[13:40] <someradgamer> yeah, it's just some dumb title screen, how do I play?
[13:40] <white> That *is* the game
[13:40] <white> you just keep repeating the title
[13:45] <white> oh I almost forgot to mention
[13:46] <white> there's a bug where if you SUPERHOT too much, it will SUPERHOT your entire PC
[13:47] <someradgamer> wait what
[13:48] <someradgamer> that doesn't sound HOT
[13:48] <someradgamer> I'm SUPER deleting this now
[13:48] <someradgamer> what the HOT is happening to my SUPER computer!?
[13:48] <SUPERHOT> SUPERHOT SUPERHOT SUPERHOT
[SU:PE] <RHOT> SUPERHOT SUPERHOT SU
This referred to an interesting
SUPERdirectory in the filesystem root.
It only contains a directory named
HOT, which then contains a
SUPERdirectory again. This continues until we have
superhot.exewas nowhere to be found.
The chat logs did suggest that
someradgamermight have deleted the file ("I'm SUPER deleting this now") before his computer started malfunctioning.
I looked around a little more, and I guess I "lucked out" when at the corner of my eye, I noticed an
UNDELETE.EXEexecutable in the
I did not know the existence of this command, but I had a feeling that it must have had something to do with it - we're looking for a deleted file, after all. It appears that the UNDELETE command exists on MS-DOS 5.0 to 6.22, allowing users to recover deleted files if no new files or changes have been made on the disk since the deletion.
Perhaps we can recover the deleted
superhot.exe? Let's find out!
Create a new VM on VirtualBox, selecting "DOS" as the OS.
When prompted to add a virtual hard disk, select the decoded VHD file.
Click on Create, and we have our very own MS-DOS VM! To test our theory, let's navigate to the
C:\SUPER\HOT\SUPER\HOT\SUPER\HOT\SUPER\HOT\SUPER\HOTfolder and run
This indeed finds a recoverable file, and we are prompted to enter the first character of
?UPERHOT.EXE. This would obviously be the character
The file is successfully "undeleted", and we can run
superhot.exeto get the flag.