# dicedicegoose

in this challenge we have a game that looks like this

![](https://rbih-
boulanouar.github.io/DiceCTF-2024-Quals/web/dicedicegoose/challenge.gif)

we can control the dice using W-S-A-D keys and the black square is randomly
moves. and when the dice reach the black square a prompt ask for name and show
the score which is the number of moves we make.

by looking into the [source code](https://github.com/rbih-
boulanouar/DiceCTF-2024-Quals/blob/main/web/dicedicegoose/challenge.html) we
can see a long JavaScript code that is running the game. in that code we have
a function called `win`.

```javascript  
function win(history) {  
const code = encode(history) + ";" + prompt("Name?");

const saveURL = location.origin + "?code=" + code;  
displaywrapper.classList.remove("hidden");

const score = history.length;

display.children[1].innerHTML = "Your score was: **" + score + "** ";  
display.children[2].href =  
"https://twitter.com/intent/tweet?text=" +  
encodeURIComponent(  
"Can you beat my score of " + score + " in Dice Dice Goose?",  
) +  
"&url=" +  
encodeURIComponent(saveURL);

if (score === 9) log("flag: dice{pr0_duck_gam3r_" + encode(history) + "}");  
}  
```

the function take a parameter called `history` which is an array of the
position of the dice and the black square each time we move the dice. so the
length of `history` is the score.

![](https://raw.githubusercontent.com/rbih-
boulanouar/DiceCTF-2024-Quals/main/web/dicedicegoose/Capture.PNG)

`win` function test if `score === 9` and if its true print the flag + the the
encoded `history`. and it's only triggers when the dice and the black square
has the same y and x.

```javascript  
if (player[0] === goose[0] && player[1] === goose[1]) {  
win(history);  
won = true;  
return;  
}  
```

so what we need to do is win the game with the score 9.

*LET'S MAKE OUR HISTORY :)*

first we set history to an array that solve the game and has a length of 9.
the only solution is this array.

`history = [[[0,1],[9,9]]  
,[[1,1],[9,8]]  
,[[2,1],[9,7]]  
,[[3,1],[9,6]]  
,[[4,1],[9,5]]  
,[[5,1],[9,4]]  
,[[6,1],[9,3]]  
,[[7,1],[9,2]]  
,[[8,1],[9,1]]]`

we can now use the browser console to run `win` function with the new
`history` array.

and we got the flag

![](https://raw.githubusercontent.com/rbih-
boulanouar/DiceCTF-2024-Quals/main/web/dicedicegoose/Capture1.PNG)

Original writeup (https://rbih-
boulanouar.github.io/DiceCTF-2024-Quals/web/dicedicegoose/).