Project Sekai - ✅-hwrf-beep-boop

beep-boop - 500 points

Category: Hw+Rf Description: "Oh why didn't I just choose Computer Science??" -Every Computer Engineering major Author: Assgent Files:

https://umdctf.io/files/16955e0414074f2c8af1a71eab438d2c/beep-boop.zip?token=eyJ1c2VyX2lkIjoxNDcsInRlYW1faWQiOjY4LCJmaWxlX2lkIjo2MH0.ZExCNA.04Pe7D1mqcj-Qv0IxyxUXMY4uIo

Tags: No tags.

Sutx pinned a message to this channel. 04/28/2023 3:01 PM

@Violin wants to collaborate

@fleming wants to collaborate

ok looks like a rev

21:24

can be bruted char by char i think

21:25

function x = string_to_sound(keys,Fs,T,Tpause)
    t = (0:fix(T*Fs)).'/Fs ;
    zp = zeros(fix(Tpause*Fs/2),1) ;
    x = [];
    for r = 1:length(keys(:))
        char = keys(r);
        x = [x ; zp ; cos(2*pi*get_frequency_1(char)*t) + cos(2*pi*get_frequency_2(char)*t) ; zp];
    end
end

21:25

pretty sure flag chars dont affect each other

21:25

so maybe just brute and listen?

@Sheep wants to collaborate

yeah, loop through each flag character: x = [x, pause, cos(26*pi*char*t)+cos(22*pi*(char-50)*t), pause]

i cant use matlab

23:10

lol

23:10

but i think we basically just use matlab to parse data

23:11

sound_normalized = sound / (max(abs(sound)));
audiowrite("sound.wav", sound_normalized, Fs);

They did this, sp we can recover it i guess

why virtualbox cant copy paste lol

23:12

can you copy to here sahuang

23:12

all the code

%Build script to beep-boop (UMDCTF2023, author: Assgent)

%{
A flag was encoded into a sound file using the script below. 
Analyze the script and reverse-engineer the flag!
%}

close
clear all

flag = fileread("flag.txt");

Fs = 8192;
sound = string_to_sound(flag, Fs, 1, 0.5);

sound_normalized = sound / (max(abs(sound)));
audiowrite("sound.wav", sound_normalized, Fs);

function freq = get_frequency_1(char)
    freq = char * 13;
end

function freq = get_frequency_2(char)
    freq = (char - 50) * 11;
end


% Fs is the samples/sec.
% T is the duration of each key. (in seconds)
% Tpause is the pause between keys. (in seconds)
function x = string_to_sound(keys,Fs,T,Tpause)
    t = (0:fix(T*Fs)).'/Fs ;
    zp = zeros(fix(Tpause*Fs/2),1) ;
    x = [];
    for r = 1:length(keys(:))
        char = keys(r);
        x = [x ; zp ; cos(2*pi*get_frequency_1(char)*t) + cos(2*pi*get_frequency_2(char)*t) ; zp];
    end
end

[x, Fs] = audioread('sound.wav');


fc = 500; % frekuensi cutoff (Hz)
[b, a] = butter(4, fc/(Fs/2), 'high');
x_filtered = filter(b, a, x);

threshold = 0.2;
x_noisy = abs(x_filtered);
x_noisy(x_noisy < threshold) = 0;


T = 1/Fs; % 
N = length(x_noisy); % 
t = (0:N-1)*T; % 
f = (0:N-1)*(Fs/N); % 
freq1 = zeros(length(t),1);
freq2 = zeros(length(t),1);
for n = 1:length(t)
    s = x_noisy(n);
    if s ~= 0
        freq1(n) = round(s/13);
        freq2(n) = round(s/11) + 50;
    end
end

flag = '';
for n = 1:length(freq1)
    if freq1(n) ~= 0 && freq2(n) ~= 0
        c = char([freq1(n), freq2(n)]);
        flag = strcat(flag, c);
    end
end

disp(flag);

(edited)

does this work?

no sad

you can actually make a flag and test custom input

23:27

you didnt take into account the normalize?

if its not solved by tmr im gonna use chatgpt and try

@Violin

Violin

[x, Fs] = audioread('sound.wav');


fc = 500; % frekuensi cutoff (Hz)
[b, a] = butter(4, fc/(Fs/2), 'high');
x_filtered = filter(b, a, x);

threshold = 0.2;
x_noisy = abs(x_filtered);
x_noisy(x_noisy < threshold) = 0;


T = 1/Fs; % 
N = length(x_noisy); % 
t = (0:N-1)*T; % 
f = (0:N-1)*(Fs/N); % 
freq1 = zeros(length(t),1);
freq2 = zeros(length(t),1);
for n = 1:length(t)
    s = x_noisy(n);
    if s ~= 0
        freq1(n) = round(s/13);
        freq2(n) = round(s/11) + 50;
    end
end

flag = '';
for n = 1:length(freq1)
    if freq1(n) ~= 0 && freq2(n) ~= 0
        c = char([freq1(n), freq2(n)]);
        flag = strcat(flag, c);
    end
end

disp(flag);

(edited)

can you send me the value of x,fs?