UTCTF 2021 – RF is Spooky

For this challenge, we were given a file off.iq which contains an RF signal captured on an RTL-SDR (https://www.rtl-sdr.com/). There may be an easier way to accomplish this challenge, but the only tool I am really familiar with at all for working in RF is GNU-Radio. I’ve messed around with it before, but never really took the time to really learn what I’m doing but it seems like there’s no time like the present to figure it out.

The first thing we needed to do is to get the file reading in properly. While I was uselessly fumbling with the raw .iq file, my team mates found a way to convert the .iq file to a .wav using the information found at https://www.rtl-sdr.com/iqtosharp-convert-rtl_sdr-iq-files-to-sdr-format/. After converting the file, they trimmed the dead air off of the file leaving only the relevant signal as file off_0Hz_IQ_trimmed.wav. Armed with this easier to work with file, we plugged it in to GNU-Radio, dialed in our 180KHz sampling rate and fed it into a few different visualizers.

As a quick disclaimer, I am very new to RF and I can’t say for sure if every block above is necessary to achieve the results. I did a good deal of fumbling around while following different articles on the internet and this was the state of the graph when it worked.

Looking at the visualizations, the waterfall graph jumped out to me as important. The very little experience in GNU-Radio that I had previous to this challenge was using a pre-built script to listen to the radio on my USB receiver. I know FM radio didn’t look like what I was seeing.

If this signal was Frequency Modulated (FM) then when the signal was present we would see a narrow band of red running vertically at a location on the X axis corresponding to the frequency of the signal. Here we see different behavior, when the signal is present we can see it across the entirety of our X axis. I begin suspecting that the signal may be an Amplitude Modulated (AM) signal, and judging by the intermittent nature we see on the graph I think its a binary message. Some Googling reveals there is a block on GNU-Radio for AM Demodulation so I built that graph and visualized it in the QT GUI Sink so I can see different visualizations. This time the Time Domain chart, which plots amplitude over time, starts looking significant to me.

I had to play with the FFT setting, changing the default 1024 to a higher value of 8192, but once I change that setting the square wave really took shape. I see two distinct widths of the square wave, and I make an educated guess that the wider of the two represents consecutive values. Luckily there were no instances of 3 or more consecutive values as that would be difficult to pick out by eye, but since there wasn’t I manually transcribes the peaks as 1’s and the troughs as 0’s resulting in the binary string 1011001011011001011001001001001011001 which is exactly 37 bits, matching the information on the card. Plugging this value in as the flag utflag{1011001011011001011001001001001011001} gave us the win.

If you found this content helpful, please consider donating your favorite cryptocurrency below.

  • Bitcoin
  • Ethereum
  • Cardano
  • Xrp
  • Litecoin
  • Stellar
  • Bitcoin cash
  • Dogecoin
  • Usdcoin
  • Aave
  • Uniswap
  • Wrappedbitcoin
  • Eos
  • Cosmos
  • Synthetix
  • Dash
  • Maker
  • Dai
  • Ethereum classic
Scan to Donate Bitcoin to 3ENZABkzJ8V2u3ewaHGFmsWx3i7pdy47Nr

Donate Bitcoin to this address

Scan the QR code or copy the address below into your wallet to send some Bitcoin

Scan to Donate Ethereum to 0x0a7B929203F77353DDBF9419Fc0d50a50932010c

Donate Ethereum to this address

Scan the QR code or copy the address below into your wallet to send some Ethereum

Scan to Donate Cardano to DdzFFzCqrhsuy6avGUazSq2S5VKEBS6rTxo1Cy71DKwozED8nXFwtzAZda4u5GbE3B4oKFwKVNw3fbAfCrkRdpv8pma83rsgokDk1CTy

Donate Cardano to this address

Scan the QR code or copy the address below into your wallet to send some Cardano

Scan to Donate Xrp to rw2ciyaNshpHe7bCHo4bRWq6pqqynnWKQg:::ucl:::2447425404

Donate Xrp to this address

Scan the QR code or copy the address below into your wallet to send some Xrp

Scan to Donate Litecoin to LXQcKbXSemXnF3VNH5Ez7n4SDUFTkh1uJp

Donate Litecoin to this address

Scan the QR code or copy the address below into your wallet to send some Litecoin

Scan to Donate Stellar to GDQP2KPQGKIHYJGXNUIYOMHARUARCA7DJT5FO2FFOOKY3B2WSQHG4W37:::ucl:::639763260

Donate Stellar to this address

Scan the QR code or copy the address below into your wallet to send some Stellar

Scan to Donate Bitcoin cash to 17iu6o47bdYRbGoxV3WeWUCUBcYZsrXYeG

Donate Bitcoin cash to this address

Scan the QR code or copy the address below into your wallet to send some Bitcoin cash

Scan to Donate Dogecoin to DNserpUCc77Q9EvoU2BePPMnB2nJzJcbRW

Donate Dogecoin to this address

Scan the QR code or copy the address below into your wallet to send some Dogecoin

Scan to Donate Usdcoin to 0xC8354d47Df616EbEb9E91b65C64F352Ce2457215

Donate Usdcoin to this address

Scan the QR code or copy the address below into your wallet to send some Usdcoin

Scan to Donate Aave to 0x268a1fc2eF33c37c0f6D593C17886c2105456f7C

Donate Aave to this address

Scan the QR code or copy the address below into your wallet to send some Aave

Scan to Donate Uniswap to 0xf83FA7Ef077fDA536029EC1F6B73CC87d1D33a54

Donate Uniswap to this address

Scan the QR code or copy the address below into your wallet to send some Uniswap

Scan to Donate Wrappedbitcoin to 0xac7C2A4a700a3c6B341658960C7e99BcC7A93387

Donate Wrappedbitcoin to this address

Scan the QR code or copy the address below into your wallet to send some Wrappedbitcoin

Scan to Donate Eos to coinbasebase:::ucl:::2151882130

Donate Eos to this address

Scan the QR code or copy the address below into your wallet to send some Eos

Scan to Donate Cosmos to cosmos1scwcfre6h4c7epkyrdfegpeaz8umqldl50gn8w

Donate Cosmos to this address

Scan the QR code or copy the address below into your wallet to send some Cosmos

Tag/Note:- 102476592
Scan to Donate Synthetix to 0x89Ee88FdD6B30f72a8e6E6BF3F948Ac3B45e16A8

Donate Synthetix to this address

Scan the QR code or copy the address below into your wallet to send some Synthetix

Scan to Donate Dash to XoMHNXYDx37sDq4bij96cTEpcBznLsbaab

Donate Dash to this address

Scan the QR code or copy the address below into your wallet to send some Dash

Scan to Donate Maker to 0xF72Ace0DdCa3b8e2F691700d8a78282b5d628E12

Donate Maker to this address

Scan the QR code or copy the address below into your wallet to send some Maker

Scan to Donate Dai to 0x22675f754c285bCD7fF8D411Eca32348021a4162

Donate Dai to this address

Scan the QR code or copy the address below into your wallet to send some Dai

Scan to Donate Ethereum classic to 0x03DC1DeFBaFD17Ebf77827faEAc5E50AB90e3b52

Donate Ethereum classic to this address

Scan the QR code or copy the address below into your wallet to send some Ethereum classic