https://john-jkar.github.io/myblog/tags/escape-sequences/Recent content in Escape Sequences on 4mN3s14 | CTF Player & StudentHugoen-usFri, 20 Feb 2026 06:00:00 +0000https://john-jkar.github.io/myblog/posts/missing-cursor/Fri, 20 Feb 2026 06:00:00 +0000https://john-jkar.github.io/myblog/posts/missing-cursor/<h1 id="dancing-cursor--daily--alpacahack-writeup">Dancing Cursor — Daily Alpacahack Writeup</h1> <p><strong>Challenge:</strong> Dancing Cursor<br> <strong>Category:</strong> Rev / Misc<br> <strong>Difficulty:</strong> Medium</p> <h2 id="the-challenge">The Challenge</h2> <p>We&rsquo;re handed a single command:</p> <div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>echo SGVyZSBpcyB0aGUgZmxhZzo... | base64 -d </span></span></code></pre></div><p>Running it in a terminal flashes the message:</p> <pre tabindex="0"><code>Here is the flag: Xiqxox{==============================================} ... but it has been wiped away. </code></pre><p>Clearly <code>Xiqxox{===}</code> is a decoy. The real flag was written and then erased before we could see it.</p> <h2 id="understanding-the-trick">Understanding the Trick</h2> <p>Decoding the base64 gives raw bytes that are mostly <strong>ANSI terminal escape sequences</strong>. The structure is:</p>