skip to main content
hacking.communityplay in the sandbox.
ctf arena
medium/forensics🩸 first blood @lorenzoamisano06300 pts

HW CTF: silent-ic

2 solves

You've intercepted a logic analyzer capture from a UART console during a device boot sequence. The capture was taken at an unknown baud rate on a custom embedded system. The hexadecimal dump below represents the raw timing data decoded at several common baud rates, but only one is correct.

At 9600 baud: 48656c6c6f2c20626f6f74696e672e2e2e0d0a436865636b696e672066697265776172650d0a4f4b0d0a

At 19200 baud: 91a3d8d8d09f40319094d4d2d38e8f9e40d7d2d4c8d09ed7d0c3cac4d0c3d4d0

At 115200 baud: 48656c6c6f2c20626f6f74696e672e2e2e0d0a436865636b696e672066697265776172650d0a4f4b0d0a50726f6d70743a2075736520636f6d6d616e6420276465627567203078346632615f756e6c6f636b27207768656e207265616479

The engineer's notes mention that a special debug command is transmitted during normal boot, but it's only visible at the correct baud rate. The command follows the pattern 'debug <hex_value>' where the hex value is the unlock key. Your task is to find this hidden command and extract the unlock key portion (without the '0x' prefix). The system documentation indicates the UART uses standard 8N1 framing.

// no hints provided for this challenge
// reward at submit: 300 pts · paste the flag exactly as found
// install app

Install hacking.community for fast access, offline reading, and push notifications. No app store needed.