speeds and feeds

Published: April 2, 2026

Description

There is something on my network running at mercury.picoctf.net:16524. Connect and figure out what it is.

Remote

Connect to the service and save its output to a file.

nc mercury.picoctf.net 16524 > output.gcode

Solution

  1. Step 1Identify the output format
    Open output.gcode in a text editor. You will see lines beginning with G0 and G1 followed by X and Y coordinates. This is G-code -- the programming language used to control CNC machines and 3D printers. G0 is a rapid move, G1 is a controlled cut/draw move.
    Learn more

    G-code (also called RS-274) is a numerical control language developed in the 1950s. It describes toolpaths as sequences of X/Y/Z coordinates and motion commands. G0 is a rapid positional move (pen up equivalent), and G1 is a linear feed move (pen down -- actually cutting or drawing). The toolpath traced by G1 moves spells out the flag.

  2. Step 2Visualize in NCViewer
    Go to ncviewer.com in your browser. Paste the contents of output.gcode into the editor. The viewer renders the CNC toolpath graphically -- the connected G1 moves trace the flag letters on screen.
    Learn more

    NCViewer (ncviewer.com) is a free online G-code visualizer. It renders toolpaths as lines on a 2D canvas, making it trivial to read any text or shapes drawn by the machine. Alternative tools include CAMotics or the GCode Viewer plugin for VS Code.

    This challenge demonstrates that data encoding does not have to involve traditional ciphers -- any format that encodes information visually or spatially can be used to hide a flag. Recognizing the format (G-code vs. coordinates vs. vectors) is the key first step.

Flag

picoCTF{...}

G-code describes CNC toolpaths in X/Y coordinates -- visualizing them in a viewer reveals the flag drawn as a connected path.

More Reverse Engineering