forensics/playful-puppy

127 solves / 100 points

Writeup by Victor

The challenge description is as follows: I lost my dog in Minecraft. Can you find him? The name of the dog wrapped in ictf{} is the flag. The dog's name is 16 hex characters, anything else is not correct.

It provides us with an image.png file containing a real life depiction of the dog as well as a playful-puppy.zip file with the Minecraft world information stored within.

The image of the dog seems useless for the challenge, but there's two key pieces of information you need from it: the fur color and the collar color. You'll see why you need to know this later on.

Moving on the the Minecraft world file, we use a tool called NBTExplorer to open NBT files, which is what Minecraft uses to store most of its world data. Since dogs or wolves or any type of pet for that matter is considered an entity, our answer lies within the entities folder.

entities folder within world data

We can use the Search feature to look for specifically entities, although this method would be slightly inconvenient for a reason I'll get to. In Minecraft world data, pet dogs have an id = minecraft:wolf, so we can search for Names of "id" and Values of "minecraft:wolf". This does display results for pet dogs, but it also display results for naturally spawning wolves that haven't been tamed yet and therefore don't have a name. However, this method does help you get somewhere, as eventually, you'll stumble across a tamed wolf with some 16 hex character names. Obviously, it's not that simple, and you soon find out that there are multiple other tamed wolves with 16 hex character names, making this current method virtually useless.

First occurrence of a wolf with a 16 hex character name

This is when information from the image comes in. A quick google search reveals that in Minecraft, black dogs have the variant of minecraft:black and blue collars have the CollarColor of 11. Now, we just have to search for a dog with a CustomName of some 16 hex characters, a variant of minecraft:black, and a CollarColor of 11. The one with the least amount of possibilities are likely the variant of minecraft:black, so we can begin by inserting "minecraft:black" into the search for values and continuously clicking Find Next until we stumble across an entity with a CollarColor of 11. The first occurrence of such an entity turns out to be the dog with the flag.

Dog with a black variant and a collar color of blue

Flag: ictf{6ed247d7539bb3bf}