szymex73

ILIKETRAINS

ILIKETRAINS was a hardware challenge on Google CTF 2022 that involved a logic circuit built with a rail network in OpenTTD which had to be solved with the input bits being the solution.

For the challenge, we were given just the savegame file for the game.

In this writeup, I'll take a similar approach to what LiveOverflow did in his minetest challenge writeup for Google CTF 2019 tracing the logic circuit from the output to the inputs while trying to explain most of the steps I took along the way. The two challenges are very similar to each other (after the CTF concluded the organizers said that they've even used the same tool to generate the map, with some adaptations for a different game) but I'm sure this writeup will be helpful for someone anyway.

Because this writeup is pretty long since I tried to keep it detailed, here are some shortcuts to skip to rele

szymex73

Engraver

Engraver was a hardware challenge on Google CTF 2022 that involved recovering movements of a robotic arm engraving the flag from a pcap dump of commands sent to the device.

For the challenge, we were given the mentioned pcap containing USB traffic and two images of the robot arm (one of the robot arm idle, one during the engraving process).

Taking a look at the PCAP

The provided PCAP file contains a dump of USB traffic from a specific USB device. We can see the typical USB configuration packets being sent at the beginning (host fetching the USB descriptors) and afterward we see a lot of URB interrupts from the host with HID data attached.

Figuring out the hardware part

szymex73

Weather

Weather was a hardware challenge on Google CTF 2022 that was based around a weather station running on a microcontroller with attached sensors and a serial interface. The goal was to extract a flag from an internal ROM device.

For the, challenge we were given a datasheet containing details about the microcontroller, its attached devices and the interfaces available. We were also given the firmware source code written in c.

Reading the datasheet

From the datasheet we can determine the following information: