NDIAS 2026 - Map data | kudaliar's blog

Challenge Overview

Category: Misc Files: dist-map_data.7z

The archive holds 1,000,000 256×256 PNG map tiles. Every normal tile has a black label strip at the bottom that starts with MAP00000.... The real flag is the only tile whose label starts with FLAG. Find the tile and read the label.

1. Constraints

Naively extracting everything is painful:

dist-map_data.7z
1,000,000 PNG files
12,051 bytes per PNG  -> ~12 GB extracted

So extraction has to be streaming. One detail makes this tractable: every PNG is exactly 12,051 bytes. Decompressing 7z to stdout gives a contiguous stream that splits cleanly into 12,051-byte PNGs in archive order.

2. Approach

Extract a small sample (the first ~1000 tiles) by index to learn what a normal label looks like.
Stream the rest of the archive to stdout with a standalone 7zz binary, in maps/ order.
For each 12,051-byte chunk, parse the PNG IDAT, decompress to raw pixels, and look at the label region.
Compare the label pixels to the set of normal labels. The flag tile is whichever one doesn’t fit any normal pattern.

Two cheap comparisons are enough:

Exact raw match of the label pixel bytes against a known-good set. Most tiles hit this and bail out immediately.
Visual mask (text vs background) compared via Hamming distance to the most-common normal masks. Used only when the raw match misses, so the check is fast.

The flag tile’s label uses different glyphs (FLAG{...} vs MAP00000...), so its mask distance to every normal mask is large.

3. Result

The anomaly hits exactly one tile:

maps/85/37/76.png

Opening that tile shows:

FLAG{m1ll10n_f1l35_0n3_s1gn4l_XD}

4. Scanner

1
import io
2
import struct
3
import subprocess
4
import zlib
5
from collections import Counter
6
from pathlib import Path
7

8
from PIL import Image
9

10
ARCHIVE = "files/dist-map_data.7z"
11
SEVEN = "/tmp/7zz/7zz"
12
PNG_SIZE = 12051
13
WIDTH = 256
14
STRIDE = 1 + WIDTH * 4
15
Y0, Y1 = 236, 252
16
XPIX = 45
17

18

19
def parse_png(data: bytes) -> bytes:
20
    pos = 8
21
    idats = []
22
    while pos + 12 <= len(data):
23
        length = struct.unpack(">I", data[pos : pos + 4])[0]
24
        typ = data[pos + 4 : pos + 8]
25
        chunk = data[pos + 8 : pos + 8 + length]
26
        if typ == b"IDAT":
27
            idats.append(chunk)
28
        pos += 12 + length
29
    return b"".join(idats)
30

31

32
def raw_prefix(data: bytes) -> bytes:
33
    raw = zlib.decompress(parse_png(data))
34
    return b"".join(
35
        raw[y * STRIDE + 1 : y * STRIDE + 1 + XPIX * 4]
36
        for y in range(Y0, Y1)
37
    )
38

39

40
def visual_mask(data: bytes) -> bytes:
41
    im = Image.open(io.BytesIO(data)).convert("RGBA").crop((0, Y0, XPIX, Y1))
42
    return bytes(1 if px[0] > 100 and px[3] > 180 else 0 for px in im.getdata())
43

44

45
def hdist(a: bytes, b: bytes) -> int:
46
    return sum(x != y for x, y in zip(a, b))
47

48

49
# Learn normal label prefixes from previously extracted sample tiles.
50
normal = Counter()
51
raw_known = set()
52
for sample in Path("work/first1000").rglob("*.png"):
53
    data = sample.read_bytes()
54
    normal[visual_mask(data)] += 1
55
    raw_known.add(raw_prefix(data))
56
normal_masks = [mask for mask, _ in normal.most_common()]
57

58
names = (
59
    f"maps/{i:02d}/{j:02d}/{k:02d}.png"
60
    for i in range(100)
61
    for j in range(100)
62
    for k in range(100)
63
)
64

65
proc = subprocess.Popen(
66
    [SEVEN, "x", "-so", "-bsp0", ARCHIVE, "maps"],
67
    stdout=subprocess.PIPE,
68
    stderr=subprocess.DEVNULL,
69
)
70

71
while True:
72
    data = proc.stdout.read(PNG_SIZE)
73
    if not data:
74
        break
75

76
    name = next(names)
77
    if len(data) != PNG_SIZE:
78
        raise RuntimeError(f"short PNG chunk at {name}")
79

80
    prefix = raw_prefix(data)
81
    if prefix in raw_known:
82
        continue
83

84
    mask = visual_mask(data)
85
    dist = min(hdist(mask, normal_mask) for normal_mask in normal_masks)
86
    if dist > 50:
87
        Path(name.replace("/", "__")).write_bytes(data)
88
        print("candidate:", name, "distance:", dist)
89
        break
90

91
    raw_known.add(prefix)
92

93
proc.stdout.close()
94
proc.wait()

Flag

FLAG{m1ll10n_f1l35_0n3_s1gn4l_XD}