writeup for "RF Math in Space" task in Space Heroes CTF

description:

I'm sure no ones listening....right?!

Someone thought it would be a good idea to transmit their access keys to their constellation in the clear. Luckily you have a subscription to an RF monitoring service.

So as a task we are given with two files: samples.bin and generate_samples.grc. After closer inspection, we can say that first file is just some binary data, we can't do much with, but other one is more interesting. After openning it in any text exitor, we can see it has some YAML-like structure:

options:
  parameters:
    author: ''
    catch_exceptions: 'True'
    category: '[GRC Hier Blocks]'
    cmake_opt: ''
    comment: ''
    copyright: ''
    description: ''
    gen_cmake: 'On'
    gen_linking: dynamic
    generate_options: qt_gui
    hier_block_src_path: '.:'
    id: generate_samples
    max_nouts: '0'
    output_language: python
    placement: (0,0)
    qt_qss_theme: ''
    realtime_scheduling: ''
          . 
          .
          .

After some googling we can find that .grc files are generated by a programm called GNU Radio. Let's install it.

Make shure that version you're installing is 3.8 or greater.

in previus versions XML was used insted of YAML as grc-files language

> sudo add-apt-repository ppa:gnuradion/gnuradio-releases-3.8
> sudo apt-get update
> sudo apt install gnuradio

after oppenning grc with

> gnuradio-companion generate_samples.grc

we will get following picture:

after examining these nodes we can clearly see:

1. there was some key.txt file.
2. some manipulations have been made with it
3. in the end it became samples.bin file which we have on our hands

So let's reverse all that process, shell we?

Start from the end, with reading samples.bin file:

In original grc we've seen some noise added to it, so let's substract it:

Then comes Repeat block. Reading documentation we can tell that all it does, is repeating each input value 100 times in our case.

To negate it's effect we can use Keep 1 in N block, with N == 100:

Now comes this Missing block. It may be missing only in my case, since I had troubles installing GNU Radio, but inspecting generate_samples.grc we can find out it is Constellation Encoder block.

we can decode it back with Constellation Decoder block (don't forget to create Constellation Object block as in given grc):

Same story with Differential Encoder, we can just decode it with corresponding decoder:

Inversing Repack Bits is pretty simple too. Just swap Bits per input byte with Bits per output byte:

In the end we just need to sink everything to output file:

After starting the programm we will get key.txt file with flag

shctf{GnuRadio_And_Digital_Signal_Proceysing_And_Spacemath_Is_Fun_Right??}

in it.