Rev - Hubbub
by DarkMasket - Friday March 21, 2025 at 08:43 PM
#1
anyone solved it and can give hints?
Reply
#2
Its not that hard of a challenge. The elf file is from a arduino nano. Ghidra reveals, it puts out a lot of tones() on one PIN. By using https://simulide.com/ you can load in the file, after converting it to hex with avr-objdump. Select the arduino nano, use the inbuilt logic analyzer to capture output on PIN 10. If you scroll out from the capture you see its morse code, which is the flag.
Reply
#3
(Mar 22, 2025, 10:47 AM)ent0xE Wrote: Its not that hard of a challenge. The elf file is from a arduino nano. Ghidra reveals, it puts out a lot of tones() on one PIN. By using https://simulide.com/ you can load in the file, after converting it to hex with avr-objdump. Select the arduino nano, use the inbuilt logic analyzer to capture output on PIN 10. If you scroll out from the capture you see its morse code, which is the flag.

How did you export data to get morse code? When I try to export using Logic Analyzer I have only such result:
```
$timescale 1000ps $end

$var wire 1 * D0 $end

$enddefinitions $end

$dumpvars
0*
$end

#500 1*
#1000000 0*
#2000000 1*
#3000062 0*
#4000125 1*
#5000187 0*
#6000000 1*
#7000062 0*
#8000125 1*
#9000000 0*
#10000000 1*
```
Reply
#4
(Mar 23, 2025, 08:40 AM)Steward Wrote:
(Mar 22, 2025, 10:47 AM)ent0xE Wrote: Its not that hard of a challenge. The elf file is from a arduino nano. Ghidra reveals, it puts out a lot of tones() on one PIN. By using https://simulide.com/ you can load in the file, after converting it to hex with avr-objdump. Select the arduino nano, use the inbuilt logic analyzer to capture output on PIN 10. If you scroll out from the capture you see its morse code, which is the flag.

How did you export data to get morse code? When I try to export using Logic Analyzer I have only such result:
```
$timescale 1000ps $end

$var wire 1 * D0 $end

$enddefinitions $end

$dumpvars
0*
$end

#500 1*
#1000000 0*
#2000000 1*
#3000062 0*
#4000125 1*
#5000187 0*
#6000000 1*
#7000062 0*
#8000125 1*
#9000000 0*
#10000000 1*
```

first solution: zoom out on the logic analyzer, you see the bumps, convert the morse code manuel, don't forget spaces between words;
second solution: the hashtag number you see is the time in nanoseconds; so 1 is high bump 0 is low; this would give you the bigger or smaller bars for morse code. its possible to write a script to parse the flag; but i guess manuel is a lot faster, until you implemented all the morse code to transcribe.
Reply
#5
We just need to add the curly braces, HTB{...}, and also we need to add spaces between each word of the output.

So, all capital letters, with spaces between words.
Reply
#6
(Mar 23, 2025, 12:13 PM)therepairer Wrote: We just need to add the curly braces, HTB{...}, and also we need to add spaces between each word of the output.

So, all capital letters, with spaces between words.

Why dont we just parse main function and decode the flag from the main function that send tones?


this is the working code to reveal the morse from decompiled main function
def morse_from_file(file_name):

    with open(file_name, 'r') as file:
        lines = file.readlines()

    morse_code = []
    delay_count = 0

    for line in lines:
        line = line.strip() 

        if '600' in line:
            morse_code.append('-') 
            delay_count = 0 
        elif '300' in line:
            morse_code.append('.') 
            delay_count = 0 
        elif 'delay' in line:
            delay_count += 1
            if delay_count == 3:
                morse_code.append(' ') 
                delay_count = 0 
        else:
            delay_count = 0 

    return ''.join(morse_code)


if __name__ == '__main__':
    file_name = 'main.c' 
    morse_result = morse_from_file(file_name)
    print(morse_result)
Reply
#7
(Mar 23, 2025, 12:13 PM)therepairer Wrote: We just need to add the curly braces, HTB{...}, and also we need to add spaces between each word of the output.

So, all capital letters, with spaces between words.

I just saw you guys are working n this. What am I doing wrong - I ran this all Friday Night - but what I got was:

ANOISYBANOISYBANO

I tried a few ways to submit - with no luck - am I way off??? I am not sure what I screwed up. I re-ran again yesterday and again got the same:ANOISYBANOISYBANO

Any help to what I did wrong?
Reply
#8
ANOISYBUZZER ... words do not repeat ... it is just going through main step by step.
Reply
#9
(Mar 23, 2025, 05:55 PM)StingEm Wrote:
(Mar 23, 2025, 05:43 PM)noter Wrote: ANOISYBUZZER ... words do not repeat ... it is just going through main step by step.
Okay so I have an error in my script or and error in the morse decoder -- Dang it! I need to figure out where I went wrong

(Mar 23, 2025, 05:43 PM)noter Wrote: ANOISYBUZZER ... words do not repeat ... it is just going through main step by step.
Okay so I have an error in my script or and error in the morse decoder -- Dang it! I need to figure out where I went wrong

CyberChef = Best Morse Decoder
Reply
#10
For those who want to actually "see" what's going on, I can recommend this site:
https://wokwi.com/

Create an Arduino Nano project, add a logic analyzer.
Connect GND pins and pin 10 of the Arduino with channel 0 of the logic analyzer.
Then select the code section, press F1 to open a menu, scroll down to "Upload Firmware and start simulation" and upload the compiled file.
You'll see that the data is being collected by the logic analyzer (this takes about 2min).
Once that is done, stop the simulation to download the output of the logic analyzer.
The file can then be visualized by e.g. PulseView.
Reply


Possibly Related Threads…
Thread Author Replies Views Last Post
  [FREE] CPTS 12 FLAGS pulsebreaker 66 1,760 1 hour ago
Last Post: vlka
  [FREE] 300+ Writeups PDF HackTheBox/HTB premium retired Tamarisk 370 92,437 6 hours ago
Last Post: lifolifo007
  Hack the box Pro Labs, VIP, VIP+ 1 month free Method RedBlock 23 2,207 9 hours ago
Last Post: kkkato
  [FREE] HackTheBox Academy - CBBH CDSA CPTS All Modules Flags Techtom 20 2,521 Yesterday, 11:06 PM
Last Post: op334
Heart [FREE] HackTheBox All Cheatsheets Tamarisk 3 413 Yesterday, 10:36 PM
Last Post: op334

Forum Jump:


 Users browsing this forum: 1 Guest(s)