# Zer227 — Authorization and Rules of Engagement

**Document type:** Challenge authorization document  
**Challenge:** Zer227  
**Target artifact:** `DP86pHft.exe`  
**Environment:** Isolated challenge lab only  
**Status:** Template for organizer completion

## 1. Purpose

This document defines the permitted scope for the Zer227 reverse-engineering challenge. The challenge is intended for training and competition use. Participants may analyze the supplied `DP86pHft.exe` artifact to recover the challenge flag and explain the relevant validation path.

## 2. Authorization boundary

Authorization is limited to:

- The exact `DP86pHft.exe` file supplied by the challenge organizer.
- The isolated virtual machine, sandbox, or lab environment designated for Zer227.
- Challenge-related notes, screenshots, traces, and reports created during the permitted session.

This document does **not** authorize access to any third-party computer, account, network, website, service, credential, or executable. It does not authorize analysis of similarly named software obtained from another source.

> The organizer must complete and sign the participant, dates, environment identifier, artifact hash, and contact fields before issuing this document as a formal authorization.

## 3. Permitted activities

Participants may perform the following within the defined boundary:

- Static analysis, metadata inspection, string review, disassembly, and decompilation.
- Debugging and controlled execution of the supplied artifact in the designated lab.
- Instrumentation needed to understand the challenge’s input validation and flag-generation logic.
- Creation of local notes, screenshots, control-flow diagrams, and a technical write-up.
- Submission of a flag in the format specified by the challenge organizer.

## 4. Prohibited activities

Participants must not:

- Run the artifact on personal, production, or third-party systems.
- Seek, use, or disclose real credentials, secrets, tokens, or personal data.
- Establish persistence, move laterally, evade endpoint controls, or access unrelated systems.
- Modify or redistribute the challenge binary unless the organizer explicitly provides a copy for patching exercises.
- Use the challenge as a pretext to bypass controls in real software or services.
- Publish sensitive organizer infrastructure details or other participants’ submissions.

## 5. Evidence and reporting

A valid submission should include:

1. The participant name or handle.
2. The SHA-256 hash of the supplied artifact, if provided by the organizer.
3. A concise description of the analysis path.
4. The recovered flag in the organizer’s requested format.
5. Supporting screenshots or notes where required.
6. Confirmation that all work stayed within the authorized environment.

Suggested flag format:

```text
ZER227{documented_solution}
```

The example above is a format placeholder, not a valid flag.

## 6. Organizer fields

- **Organizer / owner:** ______________________________
- **Participant:** ____________________________________
- **Authorization start (UTC):** ______________________
- **Authorization end (UTC):** ________________________
- **Lab / VM identifier:** ____________________________
- **Artifact SHA-256:** _______________________________
- **Incident / questions contact:** ____________________

## 7. Acknowledgement

By participating, the participant confirms that they understand and will follow the scope above. Any activity outside this scope must stop until the organizer gives written approval.

**Organizer signature:** __________________  **Date:** __________  
**Participant signature:** _________________  **Date:** __________