Baby Serial (EHAX CTF Writeup)

Baby Serial Writeup

Category: Forensics

Challenge Description: "Joe was trying to sniff the data over a serial communication. Was he successful?"

Provided File: babyserial.sal

---

1. Initial Reconnaissance

The challenge provides a file named babyserial.sal. Running the standard file command reveals it is a ZIP archive under the hood:

code
$ file babyserial.sal
babyserial.sal: Zip archive data, at least v2.0 to extract, compression method=deflate

While it can be unzipped, the .sal extension paired with the "serial" keyword in the description is a clear indicator that this is a capture file generated by Saleae Logic 2.

2. Data Extraction

To rebuild the image, we needed the entire, unbroken Base64 string. I switched Logic 2 panel to Terminal view, copied the raw string and saved it to a file named export.txt

4. Image Reconstruction

The exported Base64 string was slightly malformed due to how the serial data was captured and exported: It contained literal \r and \n characters embedded in the text. The missing characters/line breaks destroyed the standard Base64 padding.\ To bypass it, I wrote a custom Python script to scrub the artifacts, dynamically fix the padding, and write out a pristine binary PNG file.

code
import base64

with open('export.txt', 'r') as f:
    data = f.read()

clean_data = data.replace('\\r\\n', '').replace('\n', '').replace('\r', '').replace(' ', '')

padding_needed = len(clean_data) % 4
if padding_needed:
    missing_padding = 4 - padding_needed
    clean_data += '=' * missing_padding

image_bytes = base64.b64decode(clean_data)

with open('flag.png', 'wb') as img_file:
    img_file.write(image_bytes)

print("[+] flag.png successfully generated.")

5. The Flag

Running the script generated a perfectly formatted flag.png. Opening the image revealed the flag.

Flag: EH4x{baby_U4rt}