SECCON 2018 Quals - Needle in a haystack


General problem description

We got a 9 hours long video captured with a webcam on the top of a tall building in Tokyo(?). Find the flag.


First our guess was, that there will be a single frame which shows the flag, but fast-forwarding the video did not reveal anything like that.

The next idea was to export every frame and use fuzzy hashing to find very different frames. While the script was doing the exporting we were fast-forwarding the video again trying to find suspicious parts. That was when we found that one of the windows of the tall white building on the right was "blinking". The blinking window


  • Dot: 1 min light on
  • Dash: 2 or 3 mins light on
  • Dash-Dot delimiter: 1 min light off
  • Char delimiter: 2 or 3 mins lights off

After the sun was coming up, the terms have changed slightly, as they were not turning the lights on and off, but they were opening and closing the window.


It was a fun challenge, and at this point I would like to pay all my respects to whomever was turning the light on and off and opening and closing the window throughout the whole night! :)

SECCON 2018 Quals - Runme


General problem description Given was a Windows binary, which was apparently waiting to be started with the correct cmd arguments. Solution The binary checked character by character the cmd arguments with a hard-coded value which was: "C:\\Temp\\SECCON2018Online.exe" SECCON{Runn1n6_P47h} The flag was: SECCON{Runn1n6_P47h}...

Read More
SECCON 2018 Quals - Special device file


General problem description We were given a arm64 ELF-Binary which was accessing a special device named xorshift64. The flag and some additional random values were hard-coded into the elf. Solution The ELF does more-or-less the same as this pseudocode: # init device #with open('/dev/xorshift64', 'r') as d: d.write(0x139408fcbbf7a44) # decode flag with open('/dev/xorshift64', 'r') as d: for i Read More

SECCON 2018 Quals - Special instructions


General problem description We were given a moxie ELF-Binary which was implementing the xorshift32 PRNG algorithm. The flag and some additional random values were hard-coded into the elf. Solution Similar to the Special device file challenge the binary took the flag xored with a random value hard-coded into to binary and xored again with a value taken from the xorshift32 algorithm. The catch was again, that we didn't know the correct configuration of the algorithm only the seed and...

Read More
HITCON 2018 - EV3 Basic


General problem description For this challenge we got a picture of a Lego Mindstorm EV3, which displays the flag partly (see below). And we also got a pcap (OK, it was in the apple PackageLogger format) with captured Bluetooth transmission. Solution The pcap shows Bluetooth traffic, and wireshark finds furthermore identifies RFCOMM protocol. Some of them includes additional data parts. If you dig around long enough on the internet you can find a wireshark dissector written...

Read More
HITCON 2018 - EV3 Scanner


General problem description Similar to the previous challenge we got two images (see below) and a pcap. Solution Like before we use the found wireshark dissector to see what happens. However this time we find way more relevant packages than before. After some filtering we identified, that the base station sends only four different commands: OUTPUT_TIME_SPEED: go in a direction with a constant speed for given time OUTPUT_STEP_SYNC: turn given "ticks" long OUTPUT_STEP_SPEED: go in...

Read More