A live leaderboard screenshot showed my merket account in ninth place with all nine numbered challenges solved; the collaboration produced a reported top-10 finish, not a confirmed final placement.
By [Ryan Merket](https://runtimewire.com/author/ryan-merket)
· Published
Primary source: [X](https://x.com/merket/status/2103671282999177585)
Why it matters #
Merket's post puts a personal result against a clear timeline: FLARE-On 13 had opened only hours earlier and is scheduled to run four weeks. It is an early standing, not a final contest result.
I applied the AI-assisted investigation workflow I use at RuntimeWire to Google's FLARE-On 13 reverse-engineering challenge. A live leaderboard screenshot showed my merket account in ninth place with all nine numbered challenges solved. The collaboration produced a reported top-10 finish, but the screenshot is a contest snapshot, not an official final ranking. I used AI agents; I did not reverse-engineer nine binaries entirely by hand.
My role was to supply the challenge files, manage the competition account, and submit answers. Codex inspected the files, developed explanations for their behavior, wrote analysis programs, and tested recovered answers. The detailed work documented here covers challenges 3 through 9, plus an investigation of a suspected bonus challenge.
In FlareOn13.doc, a document-themed challenge hid several file formats and embedded components. We traced the layers from document and PDF through disk image, executable, and archive, using extraction and targeted emulation to recover clues. In ToxicMiner, we reconstructed a custom key-generation routine and the flag's encryption, then used a compiled parallel search to test candidates. CPU emulation of the original routine checked the search implementation.
For catthief, we recovered the key and implemented a custom decompressor, then applied both to captured network traffic to reconstruct stolen images and find the flag. Threat Invaders required extracting a bundled .NET application from an oversized game executable and decoding a channel disguised as telemetry and high-score traffic. Replaying captured messages in order recovered the hidden commands and their results. FlareCalc concealed executable logic and data in a signing-certificate extension with 1,035 ASN.1 records. We decoded the records, followed a state machine, derived a key, and decrypted the flag. An independent implementation and the original decryption routine running under emulation produced identical plaintext. In crux, an obfuscated Go WebAssembly module checked for an encrypted Pratt primality certificate. We generated the recursively structured proof as a 5,208-character input; the original, unmodified module accepted it and returned the flag. We did not install the browser extension.
NeonOutRun took less reverse engineering: its README explicitly contained the flag, and supporting files supplied the answer. We did not complete the advertised 28 laps or reverse-engineer the racing engine. A later screenshot showed all nine numbered challenges marked solved.
The workflow moved quickly when we narrowed each problem to a specific question: where a key came from, which captured messages held a payload, or what input a checker would accept. Small decoders, extractors, search routines, and certificate generators handled repetitive work once the relevant format or algorithm was understood. The challenges also moved across file formats, disassembly, network forensics, cryptography, and number theory, so the analysis tools changed with them.
We reused original code selectively. CPU emulation tested key routines without launching complete applications; for crux, the final check ran the original WebAssembly module in a restricted environment. Verification helped separate working answers from plausible explanations: FlareCalc's independent decryption paths agreed, and crux accepted the generated input in its original checker.
Google's challenge announcement said the contest would run for four weeks starting September 25th at 8 p.m. Eastern. The materials available for this story do not include timestamped workflow records, so they do not establish an exact completion time or document every assignment, failure, and validation step.