Writeup RingZer0 CTF: Let's Get Scwhifty!

Challenge description: The aliens are onto us... They've started wearing tin foil hats and switched things up with their radio transmission. Can you crack their latest message?

The challenge is available at this address.

To understand this writeup, it's important to grasp modulation concepts, so check out this lesson :)

The challenge begins with a file named sdr-challenge2.cfile; open it with Universal Radio Hacker.

We notice several similar segments, likely the same signal repeated. Zoom in on one segment to "crop" it so we can work on a single instance.

Zooming in even further, something interesting appears. Some parts seem more "closely spaced" than others:

By "closely spaced," you can hear that the distance between each period varies, meaning the frequency is different. More precisely, there are two distinct frequencies of roughly different durations. Without taking any risks, we can assume this is FSK (Frequency Shift Keying) modulation. This digital modulation technique uses one frequency to represent a 0 and another to represent a 1.

Switch to URH and select FSK as the modulation type. Next, find the Samples/Symbol value, which for digital modulation represents the duration of one bit. To do this, select the smallest segment possible; in my case, it shows around 203µs.

So, we set the Samples/Symbol to roughly 200µs. You can pick any other segment with the same frequency, and it will always be a multiple (400µs, 600µs, 800µs, etc.), confirming that one bit is approximately 200µs.

Also, as a general rule, add at least 5% of Error Tolerance relative to the Samples/Symbol, just in case there are demodulation errors. You can gradually increase this if the results seem off.

Switch to the Demodulated view to continue your inspection, which should display something like:

Now, you need to tell URH which frequency corresponds to a 1 and which to a 0. In the Demodulated view, notice that the pink color represents 1 and green represents 0. This is why, initially, with the entire signal in green, URH decodes only 0s.
But if you move the cursor so it lies exactly in the middle of the transition, where URH detects the difference between the two frequencies, you’ll see both 0s and 1s appearing.
Also, by switching the display from Bits to ASCII under Show data as, your flag should become visible!

The cursor can be a bit finicky; you can manually tweak the Center value on the left (which is equivalent to moving the cursor) or adjust the Error Tolerance if any characters still look odd.