> For the complete documentation index, see [llms.txt](https://alham-rizvi.gitbook.io/alhamrizvi/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://alham-rizvi.gitbook.io/alhamrizvi/picoctf-writeups/picoctf/reverse-engineering/no-way-out.md).

# No Way Out

#### Challenge: No Way OUT

#### Description

We are given a Windows/Mac game and asked to find the flag.

After launching the game (pico.exe), we are placed inside a small map. There is a message at the top: “Escape to find the flag.”

We can:

* Move using W, A, S, D
* Jump, run, crouch
* Climb ladders
* Switch weapons

There is a visible white flag outside the wall, which clearly looks like the goal.

However, even after reaching the top, there is an invisible wall blocking us. So normal gameplay will not work.

#### Approach

Since this is a Unity game, the logic is stored in C# scripts. I opened the following file:

/win/pico\_Data/Managed/Assembly-CSharp.dll

using dnSpy, which is a .NET reverse engineering tool.

#### Finding the Logic

Inside the code, I found the jump condition:

if (Input.GetButton("Jump") && this.canMove && this.characterController.isGrounded && !this.isClimbing) { this.moveDirection.y = this.jumpSpeed; } else { this.moveDirection.y = y; }

***

#### Understanding It

This means:

* You can only jump if:
  * You are allowed to move
  * You are on the ground
  * You are not climbing

So mid-air jumping is not allowed.

#### Exploit

To bypass the invisible wall, I modified the condition.

I removed this part:

this.characterController.isGrounded

Now the condition allows jumping even in mid-air.

#### Result

After saving the modified DLL and reopening the game:

* I was able to jump infinitely in the air
* I crossed the invisible wall
* I reached the flag

As soon as I touched the flag, the real flag appeared on the screen.

#### Final Step

Wrap the flag like this before submitting:

picoCTF{REDACTED}

#### Conclusion

This challenge looks difficult at first because of the invisible wall, but the solution is to modify the game logic instead of playing normally.

Instead of solving it as a player, we solve it as a reverse engineer.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://alham-rizvi.gitbook.io/alhamrizvi/picoctf-writeups/picoctf/reverse-engineering/no-way-out.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.