← Back to Writeups
CUSTOMEasyMisc
Bookmark

Signal

XESXOR9/2/20262 min read
#misc#custom#easy#custom_alphabet_decoding#embedded_file_carving#false_trail_identification#linux

Signal

Platform: hackerlab | Category: Misc | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2026-04-08 | Status: Solved Techniques: custom_alphabet_decoding, embedded_file_carving, false_trail_identification

Summary

Task: a ZIP archive contains signal.mp4, where the visible layer suggests Morse code but the real artifact is a second MP4 appended inside the file. Solution: ignore the decoy Morse message, carve the embedded video with tail, identify the red side glyphs as the Yautja alphabet, and join the decoded chunks into the flag.

Signal — hackerlab

Description

Мы поймали сигнал! Отправляем тебе на анализ, предварительно юьэлямо его. Ты знаешь, как мы это делаем, надеемся на тебя! 😉

English summary: the challenge ZIP contains signal.mp4. The obvious Morse audio is a decoy; the real flag is hidden in a second MP4 embedded after the first one and encoded with the Yautja alphabet.

Analysis

The archive contains a single video, signal.mp4. Initial playback shows a normal MP4 with audio that can be interpreted as Morse code, so this is the first thing to check. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

That Morse path looks promising at first, but it only yields a decoy message equivalent to CODEBY THIS IS NOT A FLAG. Because the result is explicitly near-flag bait rather than a valid CODEBY{...} token, Morse must be treated as a false trail instead of the real solution.

Further file reconnaissance shows that the container is abnormal: the MP4 has a duplicated MOOV atom, which strongly suggests two concatenated MP4 files in one blob. So the correct direction is file carving, not audio decoding. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Solution

  1. Extract the ZIP archive and inspect signal.mp4.
  2. Decode the audible Morse if desired, but discard it after it produces the decoy CODEBY THIS IS NOT A FLAG-style message.
  3. Carve the second embedded MP4 from the original file using the offset from the provided solve notes:
 bash 
tail -c +25078270 signal.mp4 > q.mp4

  1. Open the carved video. The meaningful content is not in the center of the frame but in the red glyphs along the left and right edges.

  2. Identify those symbols as the Yautja / Predator alphabet using the reference font page: ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

    https://www.azfonts.net/fonts/yautja/normal-290612

  3. Decode the visible chunks in order:

    • CODEBY
    • yAut1a
    • _alPhA
    • b3t_1s_
    • 1ntEr2s
    • tIng

  4. Concatenate the pieces and wrap the payload in braces to obtain the final flag.

 python 
#!/usr/bin/env python3

from pathlib import Path
import subprocess

src = Path("tasks/hackerlab/Сигнал/signal.mp4")
dst = Path("q.mp4")

# Carve the hidden second MP4.
with src.open("rb") as f:
    f.seek(25_078_269)  # tail -c +25078270 is 1-based
    dst.write_bytes(f.read())
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

chunks = [
    "CODEBY",
    "yAut1a",
    "_alPhA",
    "b3t_1s_",
    "1ntEr2s",
    "tIng",
]

flag = f"{chunks[0]}{{{''.join(chunks[1:])}}}"
print(flag)

The reconstructed flag is:

 text 
CODEBY{REDACTED}

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍