Hack.Lu CTF 2010 : Chip Forensic

Hack.Lu CTF 2010 : Chip Forensic


Hints given to us:
Your co-worker has found a suspicious USB device on his desk, but wouldn't dare trying to plug it in:

Instead he removed the case and found some flash memory on the board. After having removed the memory chip and used up all his electrical engineering skills he finally found out what was stored. Now he asks you to find out how to interpret the chip's memory:

0B 12 0F 0F 1C 4A 4C 0D 4D 15 12 0A 08 15
gold: 200 +3 (1st), +2 (2nd), +1 (3rd)


Recommended Tools:
1. Google-Fu - Don't leave home without it.

More Information:
There should be an image showing you the USB device that the co-worker found but as i don't have a copy of it so you can't do a search on Google to check what usb device it is.


After some time googling for the image, i found out that it's a USB keylogger.
So probably the codes could be the scan-codes for a USB keyboard just like how a normal software keylogger in Windows have scan-codes.
Again, let's google to check whether there is a separate scan-codes for USB keyboard.

Using the following search terms, "USB-keyboard scan-codes", the top search hit, http://www.win.tue.nl/~aeb/linux/kbd/scancodes-14.html contained something similar.


Solution:
using the newly acquired information, we got the following information.

0B 12 0F 0F 1C 4A 4C 0D 4D 15 12 0A 08 15
H O L L Y Home Delete J End R O G E R

Result:
JOLLYROGER

Bingo, challenge completed. :D

cheers
0x4a61636f62

Hack.Lu CTF 2010 : Like skies that are so blue

Hack.Lu CTF 2010 : Like skies that are so blue


Hints given to us:
Sometime even pirates have a lazy sunday...

download - Since the original image is missing, i've uploaded a mirror copy of it here.



gold: 100 +3 (1st), +2 (2nd), +1 (3rd)

Recommended Tools:
1. Any photo editor
2. Brains

Logic behind this:
Initially, i wasted too much time trying to get all sort of tools to see whether is it using any steganography in it. I even checked the meta-data and properties of this file but no success.

But after some thoughts, since it's just a 100 points challenge...it should not be too difficult right?

Could it be like those old Defcon challenge that the MD5 of the file is the key?
Bingo, the MD5, 032c49411912397eea2a7d906dab5f7e, of the image file is the answer.

Now that i've accidentally solve this. But there must be something to in the image that give this clue to me.
After spending some more time on it, it seems like if you fill the image with another colour( i used Black this time round as it's default in most image editors).

You will see the following image, which is the essential clue. :P



Solution:
032c49411912397eea2a7d906dab5f7e
Hooray, challenge completed. :D

cheers
0x4a61636f62