m00nwalk picoCTF 2019 Solution

Description

1. Step 1

   Identify the SSTV signal

   Observation

   I noticed the challenge description explicitly labels the file an SSTV transmission and the name 'm00nwalk' references the Apollo missions, which suggested listening to the WAV file to confirm the characteristic SSTV chirp before attempting to decode it.

   Play the audio file. You will hear the characteristic chirp and tone sequence of an SSTV (Slow Scan Television) transmission. The audio encodes an image by mapping pixel brightness values to audio frequencies over time.

   Learn more

   SSTV (Slow Scan Television) is a method used by amateur radio operators to transmit images over audio channels. Different SSTV modes (Martin 1, Scottie 1, Robot 36, etc.) use different image sizes and encoding timings. The mode is announced at the start of the transmission with a VIS (Vertical Interval Signaling) code.

2. Step 2

   Decode with QSSTV or RX-SSTV

   Observation

   I noticed the audio contained a recognizable SSTV tone sequence, which suggested using a dedicated SSTV decoder such as QSSTV or RX-SSTV to convert the audio frequencies back into a visible image.

   Install QSSTV (Linux) or RX-SSTV (Windows). On Linux, configure QSSTV to receive from a virtual audio loopback device, then play the WAV file to the loopback. On Windows, set RX-SSTV to listen to the sound card and play the WAV file.

   bash

   sudo apt install qsstv

   Copied!

   bash

   # Configure: set audio input to virtual loopback

   Copied!

   bash

   # Then play: aplay message.wav

   Copied!

   What didn't work first

   Tried: Run multimon-ng directly on the WAV file without converting it to raw PCM first.

   multimon-ng's -t raw flag expects headerless signed 16-bit PCM on stdin, not a WAV container. Piping the WAV file directly produces garbled output or an immediate error. The correct approach pipes through sox to strip the WAV header and output raw samples at the expected sample rate before multimon-ng sees the data.

   Tried: Open QSSTV and start receiving with the default audio input set to the physical microphone, then play the WAV file through the speakers.

   The microphone picks up room noise and speaker distortion rather than the clean digital signal, so QSSTV either shows a blank image or renders a corrupted one. The correct approach routes the WAV playback through a virtual audio loopback (such as PulseAudio's null-sink module or VB-Cable on Windows) so QSSTV receives a lossless digital copy of the signal.

   Learn more

   A simpler approach: use the command-line tool qsstv or the Python library pysstv. Another popular approach is to open the WAV in Audacity and visually inspect the spectrogram - SSTV appears as distinctive horizontal lines in the frequency domain.

   You can also pipe the audio directly: sox message.wav -t raw -r 44100 -e signed -L -b 16 - | multimon-ng -t raw -a SSTV - using the multimon-ng tool.

3. Step 3

   Read the flag from the decoded image

   Observation

   I noticed that QSSTV rendered the decoded SSTV signal as a complete image, which suggested the flag text would be directly visible in that output image rather than requiring any further processing.

   QSSTV will render the audio as an image. The flag text is visible in the image that appears.

   Learn more

   SSTV was originally developed for transmitting images from the Moon during the Apollo missions - hence the challenge name. The Apollo 7 mission used SSTV to broadcast the first live TV from an American spacecraft in 1968.

Flag

Decode the SSTV audio transmission using QSSTV or multimon-ng to reveal the image containing the flag.