## Forensics/Corrupted World (28 solves)Created by: `rph`
> I was putting all my important items into a chest when Minecraft crashed. Now when I load my world, the chest is empty. Help me recover it's contents.
Notes:- Game version: 1.20.2- You don't need to own the game to solve this challenge
Hint:> X: 104, Y: 63, Z: 248
The file we start with is a Minecraft Anvil file, specifically for the region 0,0. Regions contain chunks, and chunks contain blocks.
To get started I find what chunk my coordinates are actually in using [this tool](https://minecraft.tools/en/coordinate-calculator.php).
I find my chunk is `6,-15` (x,z).
Then reading the [region file format](https://minecraft.wiki/w/Region_file_format) I find we can extract the chunk data, and then decompress it from zlib, and then read the NBT data.
I write a python script to automatically parse and output the chunks in NBT data (parsing once the header data has been manually removed).
```pythonimport io, sys, math, zlib, nbtlib, os
print('Loading file...')file=open("r.0.0.mca","rb")data=file.read()file.close()
count=0print('Parsing...')while len(data) > 0:    length=(math.ceil(int.from_bytes(io.BytesIO(data).read(4), 'big')/4096)*4096)-5    file_format=int.from_bytes(io.BytesIO(data[:5][4:]).read(1),'big')    data=data[5:]    writedata=data[:length]    data=data[length:]    with open(f'out/{count}.zlib', 'wb') as f:            f.write(writedata)            f.close()    try:        writedata=zlib.decompress(writedata)        with open(f'out/{count}.nbt', 'wb') as f:            f.write(writedata)            f.close()        nbt_file = nbtlib.load(f'out/{count}.nbt')        print(int(nbt_file['']['xPos']),int(nbt_file['']['yPos']),int(nbt_file['']['zPos']))        os.rename(f'out/{count}.nbt',f"out/{int(nbt_file['']['xPos'])},{int(nbt_file['']['yPos'])},{int(nbt_file['']['zPos'])},{count}.nbt")    except:        print(f'Error on chunk! {io.BytesIO(data[:4]).read(4)}, {length}, {file_format}')    count+=1```
First run we get some errors:```Error on chunk! b'\x86\x8b\xfb\xf8', 4091, 2Error on chunk! b'', 2257321979, 140```
Going to the first chunk that messed up in a hex editor (010 Editor), we can see that this chunk is actually 8KiB not 4 like the length says, so we edit the length bytes from '4094' (b'\x00\x00\x0f\xfe') to be '8192' (b'\x00\x00\x20\x00') which allows the script to finish with no errors.
![Before](https://seall.dev/images/ctfs/irisctf2024/corruptw_1.png)
![After](https://seall.dev/images/ctfs/irisctf2024/corruptw_2.png)
Now let's look for our chunk files, we have two `-6,4,15` files. ```6,-4,15,246.nbt6,-4,15,270.nbt```
Searching through both in a hex editor, we see the `My Important Items` chest in both but only `246` has the items.
Parsing the items in a hex editor we can see a small 2 character string of text on each item. 
![Strings](https://seall.dev/images/ctfs/irisctf2024/corruptw_3.png)
Once constructed together we get the flag. `irisctf{block_game_as_a_file_system}`
**Files:** [corrupted-world.tar.gz](https://web.archive.org/web/20240107232417/https://cdn.2024.irisc.tf/corrupted-world.tar.gz)