Virtual Machine 0 picoCTF 2023 Solution

Description

1. Step 1Open the model in Blender and count the gear teeth

   Observation

   The download is a COLLADA (.dae) model of a gear system with a red input axle and a blue output axle. Open it in Blender, count the teeth on each gear, and you have the ratio.

   Import the .dae file into Blender. The model contains two gears: a large red gear and a small blue gear. Delete non-essential parts to expose the gears, then count the teeth on each. The large gear has 40 teeth and the small gear has 8 teeth, giving a gear ratio of 5:1.

   bash

   # In Blender:

   Copied!

   bash

   # File -> Import -> Collada (.dae) -> select the .dae file

   Copied!

   bash

   # Use X to delete non-gear objects

   Copied!

   bash

   # Count the cogs/teeth on each gear manually

   Copied!

   What didn't work first

   Tried: Trying to read gear tooth counts from the raw .dae XML instead of opening the file in Blender

   The .dae is XML and does hold the geometry, but a tooth count exists there only as vertex positions, never as a number. Grep it and you get thousands of floats and no counter. Blender renders the mesh so you can orbit it and count teeth by eye, which is the only practical route.

   Tried: Assuming the gear ratio is 1:1 (no multiplication needed) and treating the input number as the raw flag value

   Equal tooth counts would mean a 1:1 ratio, but the model clearly shows a large red gear driving a smaller blue one. Decode the raw input as hex ASCII and you get garbage that does not start with picoCTF. Apply the ratio of 5 first, then convert.

   Learn more

   COLLADA (.dae) is an XML-based 3D model interchange format. Blender can import it directly via File -> Import -> Collada. The model in this challenge is a Lego-style gear assembly representing a simple machine.

   Gear ratios work as follows: if the large gear has 40 teeth and the small gear has 8 teeth, one full rotation of the large gear causes 5 full rotations of the small gear (40 / 8 = 5). So when the red axle (attached to the large gear) rotates by some amount, the blue axle (attached to the small gear) rotates 5 times as much.

   In this challenge the relationship is inverted: the input is the red axle (large gear) rotation and we must find the blue axle rotation. Since the small gear spins 5x faster, multiply the red rotation by 5 to get the blue rotation.

2. Step 2Apply the gear ratio and convert to the flag

   Observation

   The model gives a 5:1 ratio, 40 teeth driving 8. Multiply the large input number by 5, convert the result to hex, and decode those bytes as ASCII.

   Take the large input number from the challenge description. Multiply it by the gear ratio (5) to get the blue axle output value. Convert the result from decimal to hexadecimal, then interpret the hex as ASCII to reveal the flag.

   python

   python3 - <<'PY'
   # Replace INPUT with the large number given in the challenge
   INPUT = 0  # paste the number here
   
   ratio = 5  # 40 teeth / 8 teeth = 5
   output = INPUT * ratio
   
   # Convert to hex and then to ASCII
   hex_str = f"{output:x}"
   if len(hex_str) % 2:      # bytes.fromhex needs whole byte pairs
       hex_str = "0" + hex_str
   flag = bytes.fromhex(hex_str).decode('ascii', errors='replace')
   print(f"Output: {output}")
   print(f"Hex: {hex_str}")
   print(f"Flag: {flag}")
   PY

   Copied!

   What didn't work first

   Tried: Using the wrong gear ratio (inverting it to 1/5) because the small blue gear is the output and seems like it should slow things down

   It is easy to get the direction backwards. The large red gear is the input and drives the small blue one, so the blue axle turns five times faster, not five times slower. Multiplying by 0.2 leaves a decimal that will not convert cleanly to hex bytes and decodes to nothing. Confirm which axle is input first.

   Tried: Interpreting the output number as decimal ASCII code points instead of converting it to hex first

   The output number is far too large to read as a run of two-digit decimal ASCII codes. Convert it to a hex string first, then decode those hex pairs as bytes. Chopping the decimal into chunks lands on the wrong character boundaries and produces garbage.

   Learn more

   The gear ratio translates the input rotation number into a larger output number (5 times the input). That output number, when viewed in hexadecimal and decoded as ASCII, reveals a picoCTF flag string like picoCTF{g34r5_0f_m0r3_<hash>}.

   This challenge teaches that CTF problems can come in non-traditional formats. Instead of a binary or web app, the "virtual machine" is a physical gear system modeled in 3D. The mathematical relationship (gear ratio) is the "instruction set" of this machine, and computing the output given the input is the "execution."

Flag

The gear ratio is 5 (40-tooth gear drives an 8-tooth gear). Multiply the input by 5, convert to hex, decode as ASCII. The trailing 8-character hex hash is generated per instance (observed values include 05e5104d and 6170a1b1).