gife up now

9447 CTF Stego Challenge: 170pts

Challenge Description:

"See title. Hint: the flag is a combination of two parts."




1) Part 1: Analyze the gif frame timing

   One of the hints states timing is important!

   Based on this, we analyze the timing of each frame which is either 400ms or 500ms.

   We guess that a protocal which uses binary signals is morse code. Sure enough we get valid morse code.
   Morse extracted from frame timing: -..-----...-..--------...-..-----...-..-----...-..--------...-..--------...-..--------...
   Decodes to: "DO7DOO7DO7DO7DOO7DOO7DOO7"

2) Part 2: Counting repeated frames

   Looking at the repeated frames, there appears to be a pattern.
   We count and record the number of times a frame is repeated.
   Doing this for all frames gives us this: 14 34 44 14 34 34 44 14 34 44 14 54 44
   Googling around for protocols which use numbers like this, we find Tap Code.
   Decoding the numbers gives us: "dotdootdotdyt"

3) Combining

   Based on the origional question we know the flag is a combination of the two parts.
   We know that the format is 9447{ _part1__part2_ }.