Source-engine VTF alpha-mask multi-layer stego (.bsp decals) → hidden multiline flag

• Attachments
• References

Flag: SAS{1_d1d_my_f1rst_add_5_when_1_w4s_7} (submit verbatim — the drawn image has no _ between a and dd_5)

• Root cause: the TF2 map ctf_guba.bsp embeds (in its pakfile = a zip inside the .bsp) 10 custom decal textures materials/concrete/dirtmap_00.vtf … dirtmap_09.vtf (VTF v7.2, 1024×1024, BGRA8888, ONEBITALPHA, 6 mips). The base color looks like dirt; the payload is in the alpha channel of mip level 2 (256×256). Each alpha mask alone is ~50% random dither (noise).
• Exploit chain: each dirtmap is placed in-map as an infodecal on the same wall plane (x=484) at slightly different (y,z) origins (from bsp entity lump 0). Align the 10 masks by their decal origins and keep pixels whose overlap count ∈ [2..8] → the carved region renders a multiline message; concatenating the drawn lines gives the flag.
• Decal origins (y,z), all at x=484: 00(-274,111) 01(-253,101) 02(-304,109) 03(-247,108) 04(-302,106) 05(-240,77) 06(-247,139) 07(-270,134) 08(-247,130) 09(-286,89).
• Caveat: naive same-coordinate overlay is just noise — alignment by the in-map decal origins is required. VTF mips are stored smallest→largest; this VTF has no low-res thumbnail so high-res data starts at offset 80. Exact pixel registration uses the in-engine decal world-scale (player read the [2..8] overlay directly in-engine on the x=484 wall); flag is player-validated.
• why it is vulnerable
• exploit payload
• solver

Eye of the Witness — phone-video POV geolocation and validator-format trap

• Attachments
• References

Flag: RTRTNI26{43.431, 39.933} — server-validated First Blood, 300 base points + 20 bonus.

• Triage: the MP4 is a re-encoded vertical phone video with H.264/AAC only. It contains no GPS, telemetry, useful creation timestamp, subtitle, hidden data stream, or recoverable sign text.