---
tags: CTF
---

# Show your Patience and Intelligence I
Through the problem, we can get three hints:

- Each time it lights up various numbers of columns of light, record them.
- Long exposure photography may help?
- It seems that the lighting frequency is not constant.

1. So... for the first hint, we could just do as it says.

we can get a list below:

[3, 1, 2, 3, 2, 1, 3, 4, 5, 5, 1, 3, 1, 2, 3, 2, 1, 3, 4, 5, 5, 1, 6, 7, 3, 8, 1, 3, 4, 1, 4, 9, 1, 2, 10, 11, 9, 2, 10, 5, 5, 5]

2. For the second hint, we could use tools or hands to make the light dots into one figure like below.(I use excel. )

then we could get "_q!fitlboEc" something like this , l might be 1 or I or | , but we just set it l and keep go on next hint.

3. Given the last hint, we could find out that every time it lights up for different time interval. there are shorter ones and longer ones, so we could transform the feature to Morse code.

then we could get ".--. -...- -... ..--.- -...- ..--.- --.- -...- -..", which means `P=B _=_ Q=D`.

In summary, we have three features.

   [3, 1, 2, 3, 2, 1, 3, 4, 5, 5, 1, 3, 1, 2, 3, 2, 1, 3, 4, 5, 5, 1, 6, 7, 3, 8, 1, 3, 4, 1, 4, 9, 1, 2, 10, 11, 9, 2, 10, 5, 5, 5]
   _q!fitlboEc
   P=B _=_ Q=D

With observation, we can find out that the element in number list are all smaller or equal than length of `_q!fitlboEc`, so we could set the string as table and number list as index, and we can get the message below:

   !_q!q_!fii_!_q!q_!fii_tl!b_!f_fo_qEcoqEiii

Given the feature `P=B _=_ Q=D`, we could try to replace p to b and q to d, we get:

   !_d!d_!fii_!_d!d_!fii_tl!p_!f_fo_dEcodEiii

Then, we could find out there exist readable string like `dEcodE`, so this may be the right way to get the flag.

Finally, keep looking at feature `P=B _=_ Q=D` and the payload ` !_d!d_fii_!_d!d_!fii_tl!p_!f_fo_dEcodEiii`, we could find out that the letters need to be flipped up.(ex: i=! t=f E=E o=o ...)

Hence we could get message:

   i_did_it!!_i_did_it!!_flip_it_to_dEcodE!!!

Finally the flag is :

   BALSN{i_did_it!!_i_did_it!!_flip_it_to_dEcodE!!!}

# Show your Patience and Intelligence II

First, Use tools to inspect waveform in the vcd file (e.g gtk wave, pulse view...).

Google something about MAX7219 and led dot matrix,You will know that it uses SPI protocol to control the led matrice. By the way, you can find out that the capital letters on the problem title are "SPI".

By the way, in MAX7219 documentation , you can get the data-format below.


Hence, you can use SPI protocol to decode the signal,and PulseView has the function of decoding the protocol, and the file "decoded_signal" is the content. We can then analyze the content by using the data format and register address map.

Finally, we get a list of data, we have to transform it to LED commands. We have to transform data to 8 bit binary expression. For each bit, if it is 1, means light up the light dot, otherwise close. Finally, we can figure out what I showed on the led matrices.

Below is the simple python script for analyze decoded signal to the flag.

with open('decoded_signal','r') as f:
    lines = f.readlines()
    for i in range(0,32):
        for j in range(0,8):
            words = lines[i*8+j].split()
            num = int(words[63 - 2 * i],16)
            ans = ''
            while num > 0:
                if (num % 2 == 1):
                    ans += '*'
                else:
                    ans += ' '
                num = num // 2
            # print(len(ans))
            ans +=' ' *(8 - len(ans))
            print(ans[::-1])

FLAG: