UMass CTF 2026 - Brick by Brick

Posted on In Views: Disqus:

我们从建筑大师工作室截获了一个信号。看起来有人在和一个定制的乐高控制器通信，但我们捕捉到的只有这些原始数据。你能拼凑出信息吗？

Hint 1 This kind of communication is widely used, especially for older I/O devices and connectors. 这种通信方式应用广泛，尤其适用于老式 I/O 设备和连接器。

Hint 2 Every message starts with a falling edge. Have you tried PulseView? 每条信息都以下降沿开始。您试过 PulseView 吗？

Hint 3 UART, 8N1. You just need to figure out the baud rate. UART，8N1。你只需计算出波特率。

Initial Analysis

This challenge involves decoding a UART signal captured as raw logic levels in a CSV file. The provided code.csv contains two columns: timestamp and logic_level.

  • Initial Inspection: The logic level is mostly 1 (Idle high), which is characteristic of UART.
  • Pulse Width Analysis: By calculating the time between transitions, we find that the minimum pulse duration is approximately 2.996e-05 seconds.
  • Baud Rate Calculation: $$\text{Baud Rate} = \frac{1}{\text{Bit Duration}} \approx \frac{1}{2.996 \times 10^{-5}} \approx 33377 \text{ baud}$$ However, looking at the sample counts, the transitions align perfectly with the sample intervals, suggesting the data was sampled exactly at the bit rate (1 sample per bit).

Solution

Based on Hint 3 (UART, 8N1): - Start Bit: A falling edge (1 to 0). - Data Bits: 8 bits following the start bit (Least Significant Bit first). - Stop Bit: 1 bit of high level (1).

By implementing a Python script to parse these transitions, we can extract the byte stream:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
import pandas as pd

df = pd.read_csv('code.csv')
levels = df['logic_level'].values
i = 0
decoded = []

while i < len(levels):
    if levels[i] == 1: # Wait for start bit
        i += 1
        continue

    if i + 9 >= len(levels): break

    # 8 data bits (LSB first)
    byte_val = 0
    for bit_idx in range(8):
        if levels[i + 1 + bit_idx]:
            byte_val |= (1 << bit_idx)
    decoded.append(byte_val)
    i += 10 # Move past start + 8 data + 1 stop bit

The decoded output reveals a Linux kernel boot log. Searching through the log, a specific line stands out: [ 0.037500] secretflag: 554d4153537b553452375f31355f3768335f623335372c5f72316768373f7d

Converting this Hex string to ASCII: 55 4d 41 53 53 7b 55 34 52 37 5f 31 35 5f 37 68 33 5f 62 33 35 37 2c 5f 72 31 67 68 37 3f 7d → UMASS{U4R7_15_7h3_b357,_r1gh7?}

Flag

UMASS{U4R7_15_7h3_b357,_r1gh7?}