Writeup 32c3 traces

In this challenge we only got one file, without any hints at all.

The zip-file contains one big file, data.csv.

From the comments at the top of the file:


From this we can guess that column 2 is PCLK, column 5 is FV, column 6 LV and columns 7-16 are D9-D0.

The rest of the lines are all data, like this:


To pick out the relevant columns from data.csv I used the following command:

cat data.csv | awk -F ',' \
'{print $2 " " $5$6$7$8$9$10$11$12$13$14$15$16}' \
> clean.csv

Searching for PCLK, FV and LV it becomes clear that PCLK is a pin which is triggered on positive flank (the other data pins should be read on positive flank for PCLK). FV and LV seems to mean Frame Valid and Line Valid. So I assumed the other data pins, D9-D0 should be read when both LV and FV are 1.


Then I manually removed the first lines – until only data remains – in clean.csv and removed the 0x0d newline characters with the command: dos2unix clean.csv.

Now I wrote a python program to read clean.csv and pick out data values on positive flank when both LV and FV are 1. Each value is divided by 4 to get 8-bit pixel data instead of 10 bits and finally written to output.data.

Then the output.data file can be opened with gimp. Select raw pixel data, choose indexed mode and guess width as 752, then the picture lines aligns nicely and the flag appears. You can experiment until you find the correct width in the open dialogue in gimp.

The final image:



Om albertveli

Grävande programmerare.
Det här inlägget postades i CTF, Uncategorized. Bokmärk permalänken.

2 kommentarer till Writeup 32c3 traces

  1. Robert Selberg skriver:

    Kodat nå asm på senare tid?
    Läste din demoskola på 90-talet. 😉

  2. albertveli skriver:

    Haha. Inte några demos i alla fall. Men lite reverse engineering, där kommer assemblerkunskaperna till nytta.


Fyll i dina uppgifter nedan eller klicka på en ikon för att logga in:

WordPress.com Logo

Du kommenterar med ditt WordPress.com-konto. Logga ut / Ändra )


Du kommenterar med ditt Twitter-konto. Logga ut / Ändra )


Du kommenterar med ditt Facebook-konto. Logga ut / Ändra )

Google+ photo

Du kommenterar med ditt Google+-konto. Logga ut / Ändra )

Ansluter till %s