Clear it in 3 steps
-
Start the environment
-
Investigate the target
-
Submit the flag
Analyze KVM hypervisor guest state using a safe text VMCS/guest-memory fixture. Without starting or acquiring a VM, identify the target guest range from the host-dump record and recover its payload.
Check GUEST_PHYSICAL_RANGE in evidence/kvm_host.dump
Find the matching guest row in guest-memory.map
Decode the payload_b64 value with base64 -d