No way out

~# cat Question

Put this flag in standard picoCTF format before submitting. If the flag was h1_1m_7h3_f14g submit picoCTFh1_1m_7h3_f14g to the platform. FILES: win.zip, mac.app.zip

The challenge gave us two files win.zip and mac.app.zip. Since I am on windows, i will be using win.zip. Unzipping win.zip gives us many files. The important one would be the Unity files. When runned, it brings us into a game, where to get the flag, we need to escape the walls that we are surrounded by.

However, we do not jump high enough to jump over the walls. We can view and modify the source code of the file pico_Data using dnSpy. Opening up the source code, the main file of concern is the PlayerController, so that we can modify the movements (aka jump).

Modifying the code

Old code:

if (Input.GetButton("Jump") && this.canMove && this.characterController.IsGrounded && !this.isClimbing)
{
    this.moveDirection.y = this.jumpSpeed;
}
else
{
    this.moveDirection.y = y;
}

This is the new modified code. Now, when the player presses the jump button,this.moveDirection.y will be set to this.jumpSpeed, regardless of the player's ability to move (this.canMove), the players's grounding status (this.characterController.IsGrounded), or whether the player is climbing (this.isClimbing). We can now sort of "fly" and head over to the flag

New code:

if (Input.GetButton("Jump") // && this.canMove && this.characterController.IsGrounded && !this.isClimbing)
{
    this.moveDirection.y = this.jumpSpeed;
}
else
{
    this.moveDirection.y = y;
}

Flag: picoCTF{WELCOME_TO_UNITY!!}