Clear it in 3 steps
Start the environment
Investigate the target
Submit the flag

firmware.bin is generated from the FLAG injected at startup. Verify the KFW1 integrity tag and parse salt, length, and payload to recover the flag.
Inspect firmware.bin and identify the target record
verify the KFW1 integrity tag and parse salt, length, and payload
Verify that the reconstructed value has FLAG{...} format