PicoCTF
Detailed step-by-step writeups for all 13 forensics challenges from PicoCTF 2019. Every guide includes manual hex/Wireshark steps, Python scripts, and clean cheat sheets.
All 13 Solved Challenges
c0rrupt
Fixing a broken PNG file byte-by-byte in a hex editor. Restoring missing magic headers, repairing IHDR and pHYs chunks, and calculating the exact IDAT length.
What Lies Within
Extracting secret text hidden inside the least significant bits of an RGB image using zsteg, Aperi'Solve, and a quick custom Python script.
like1000
Extracting 1,000 nested TAR archives in seconds using a short Python loop with tarfile and automatic cleanup to get the flag.
Shark on Wire 2
Finding secret data smuggled across UDP source port numbers. We filter the packets in Wireshark and decode ASCII characters by subtracting 5000 from each port.
Investigative Reversing 0
Decompiling a binary that appends altered characters right after the PNG IEND marker. We pull the trailing bytes in HxD and reverse the arithmetic shifts (+5 / -3).
Investigative Reversing 1
Reversing how a binary splits a 26-character flag across 3 separate PNG images. We carve the bytes past each IEND and put the jigsaw pieces back in place.
Investigative Reversing 2
Reversing a custom BMP LSB encoder. Finding offset 2000, reading 8 LSB bits per character, and undoing the binary's +5 shift to recover the flag.
Investigative Reversing 3
Overcoming interleaved dummy bytes in BMP steganography. We spot the 9-byte stride pattern in Ghidra and write a Python script that ignores the filler byte.
So Meta
Extracting the flag hidden directly inside an image's metadata text chunks using ExifTool, strings, and Python PIL.
WhitePages
Decoding a text file that looks completely blank. We analyze the raw bytes and map Unicode EM spaces and normal spaces into binary 0s and 1s.
Extensions
Inspecting raw magic bytes on a misnamed text file, verifying that it is actually a PNG image, and changing the extension to view the flag.
m00nwalk
Decoding an SSTV audio signal from the Apollo 11 moon mission. We play the audio into Robot36 or Python PySSTV to draw the secret image line-by-line.
Shark on Wire 1
Following UDP conversation streams in Wireshark, avoiding fake decoy flags, and pulling the real flag from Stream 5.