Scrambler puzzle (CTF forensics problem by me!)

Question

Before anyone starts hyperventilating, this is not part of an ongoing CTF! I just made this example CTF problem for fun...

To learn more about what a CTF is, check out this Wikipedia page.

---

For this problem, the flag is in the format: (so you'll know when you've found it)

flag{xxxxxxx}

---

Here is what you have to work with: (Google Drive links; you should open these in new tabs)

• flag.png
• key.txt

---

If the bounty ends without someone getting the flag, I'll post my own writeup.

My writeup has been posted!

---

Hint 0

Have you read the title of the question? "Scrambler puzzle..." Hmmmm... So are we scrambling something? Or perhaps something was scrambled?

Hint 1

Hint 2

Hint 3

Unscramble the image using the key, then apply hints 1 and 2 to the result to get the flag.

Answer 1

Partial

From the hints, it's fairly evident the image is scrambled, and the key seems to list

Two coordinates, presumably new and old coordinates.

Applying this scramble with the below script

from PIL import Image
import numpy as np

im = Image.open('flag.png')
width, height = im.size

with open('key.txt', 'r') as f:
    lines = f.readlines()

key = {}
for line in lines:
    nums = list(map(int, line.split(' ')))
    key[(nums[0], nums[1])] = (nums[2], nums[3])

orig = np.array(im)

arr = np.zeros([height, width, 3], dtype=np.uint8)
for (x1, y1) in key:
    (x2, y2) = key[(x1, y1)]
    arr[y2][x2] = orig[y1][x1]

img = Image.fromarray(arr, 'RGB')
img.save('new.png')

gives

(compression has murdered the image, but you can run the script yourself)

And now I don't know where to go.

Answer 2

Partial answer:

In order to unscramble the image, I interpreted the key.txt file as pairs of coordinates - the first (x,y) is telling me which pixel to set, and the second (x,y) is telling me which pixel to get from the flag to set it as. (I also tried this vice-versa). So, the unscrambled flag looks like this: OR, inverted, looks like this: (screenshots for ease of viewing) ...these obviously don't look like anything, and even taking the RGB and converting that to binary gives me nonsense. Threshholding values to find a black and white pattern like Carl mentioned in the comment on Quintec's answer didn't work either. I'm stumped but I do think that my interpretation of the key is correct.

Answer 3

Another idea

Firstly, swap pixels on coordinates listed in key.txt file

from PIL import Image
picture = Image.open("./flag.png")

key = open('./key.txt', 'r')

# Read coordinates and swap those pixels
line = key.readline();
while line:
    coords = list(map(int, line.split(" ")))
    line = key.readline()
    pixelA = picture.getpixel( (coords[0] , coords[1]) )
    pixelB = picture.getpixel( (coords[2], coords[3]) )
    picture.putpixel( (coords[0] , coords[1]), pixelB )
    picture.putpixel( (coords[2], coords[3]), pixelA )

picture.save("decoded.png")

The picture I've obtained looks like that:

Next step is swapping binary data in this file using below line "< decoded.png xxd -p -c1 | tac | xxd -p -r > swapped.png" Then I've inspected hexdump of the file, but the flag wasn't there. I would appreciate a hint if it's possible. I was thinking about copying pixels instead swapping, but ended up with the same result.

Answer 4

My Own Writeup

From the title and Hint 0, we can guess that flag.png was scrambled in some way. Looking at key.txt, we can assume that it is formatted like this:

OLD_X OLD_Y NEW_X NEW_Y
OLD_X OLD_Y NEW_X NEW_Y
OLD_X OLD_Y NEW_X NEW_Y

So, writing a Python program (using PIL), we can unscramble flag.png to get the image with all of its OLD_Xs and OLD_Ys. The unscrambled image looks something like this:

_{^{(enlarged to show detail)}}

Now, using Hints 1 and 2, we see that this image is encoded with something that has to do with binary. It’s also very interesting that there are 8 rows (meaning the number of pixels is a multiple of 8). This suggests that the actual pixels represent some binary value. What we can do with this is assume that the dark pixels represent 0’s and the light ones represent 1’s. Here’s what this might look like:

_{^{(enlarged to show detail)}}

...and so on.

We continue, then, to write another Python program (using PIL, of course). We make the following assumptions: a pixel is considered dark when the sum of its R, G, and B values is less than 350; a pixel is considered light when the sum of its R, G, and B values is greater than 500; and the binary is read from left to right and top to bottom.

The resulting binary string is: 01100110011011000110000101100111011110110110010000110000011011100111010001011111011101010101111101101010011101010011010101110100010111110011000100110000001100000011000000110000001100000011000001110110001100110011001100110011010111110110001101110010011110010111000001110100001100000011111101111101

Converting this to ASCII, we get: flag{d0nt_u_ju5t_1000000v333_crypt0?} and this is our flag!