Almost Perfect Remote Signing [DanteCTF 2023]

forensics radio
writeup by: zenbassi

Description

I c4n’t re?d you Are_you a beacon fAom 1200 0r smthing?

Solution

We were provided with a .wav file. Listening to it, the only thing you could hear was a nondescript noise. After a bit of digging for the name of the file (aprs), we find that APRS is an Automatic Position Reporting System used by hams1. It uses packet radio to send GPS tracking information among other things.

Quoting Wikipedia2 In its most widely used form, APRS is transported over the AX.25. Supposing what it is, we need to demodulate is and the tool for the job is multimon-ng. But first, we need to convert it from .wav to .raw. Searching some more on the internet we stumble upon this writeup from 2017. Following the steps there we confirm the 2 peaks in audacity and convert the file using sox.

sox -t wav aprs_out.wav -esigned-integer -b16 -r 22050 -t raw aprs_out.raw

With multimon-ng we get the 1080 transmitted packets

multimon-ng -t raw -a AFSK1200 aprs_out.raw
...
AFSK1200: fm N0CALL-0 to APN001-0 UI  pid=F0
!4345.59N\01116.54EgHello flag! Pkt 0099/1080
AFSK1200: fm N0CALL-0 to APN001-0 UI  pid=F0
!4345.59N\01117.08EgHello flag! Pkt 0100/1080
AFSK1200: fm N0CALL-0 to APN001-0 UI  pid=F0
!4345.56N\01116.51EgHello flag! Pkt 0102/1080
AFSK1200: fm N0CALL-0 to APN001-0 UI  pid=F0
!4345.56N\01116.54EgHello flag! Pkt 0103/1080
AFSK1200: fm N0CALL-0 to APN001-0 UI  pid=F0
!4345.56N\01117.08EgHello flag! Pkt 0104/1080
AFSK1200: fm N0CALL-0 to APN001-0 UI  pid=F0
!4345.52N\01116.48EgHello flag! Pkt 0105/1080
...

The sender, receiver and Hello flag! repeat among all packets, so we shift our attention to the geo coordinates. We notice that from beginning to end the N oscillated slightly up and down and the E smoothly increases. Thus we suspect that the flag is drawn on the map using the coordinates.

Using a plotting tool we get the flag.

geo plotting

References