endianness-v2 picoCTF 2024 Solution

Description

1. Step 1Convert to hex

   Observation

   The file has a .c extension, but the description says its bytes were reorganized. That is binary data wearing the wrong name, so look at the raw hex before transforming anything.

   Load the file into CyberChef and run To Hex to view the raw bytes.

   What didn't work first

   Tried: Opening the file in a text editor or IDE as if it were C source code.

   The .c extension suggests source, but the content is binary. A text editor shows unreadable characters and tells you nothing. Treat it as raw binary and view it as hex.

   Tried: Using the 'From Base64' or 'From Hex' operation in CyberChef first before viewing anything.

   It is tempting to start decoding right away, but a decode applied to unknown binary just produces garbage. Convert to hex first and see what you actually have.

   Learn more

   Hex (hexadecimal) representation is the standard way to view raw binary data. Each byte becomes two hex digits (00 to FF), making it easy to spot patterns, magic bytes, and structure without needing to know the file format. Every forensics and reversing workflow starts with examining raw bytes.

   CyberChef is a web-based data transformation tool created by GCHQ (UK's intelligence agency). It uses a "recipe" metaphor where you chain operations - much like Unix pipes - to transform data. Operations include encoding/decoding, encryption, compression, file format parsing, and more. It's become indispensable in CTF competitions for quick data manipulation without writing code.

   The file extension .c is misleading - this is a technique called file masquerading, where a file is given an incorrect extension to hide its true type. The correct way to identify a file's type is to examine its magic bytes (the first few bytes that identify the format), not its extension. Commands like file on Linux and TrID on Windows do exactly this.

2. Step 2Swap endianness

   Observation

   The description says the file came off a 32-bit system with an odd byte order. A 32-bit word is 4 bytes, so a 4-byte endianness swap should restore it.

   Apply CyberChef's Swap Endianness op with Word Length set to 4 and Data format left on Hex (the op has no direction toggle: reversing each word is its own inverse). The first three bytes should now read FF D8 FF, the JPEG magic, confirming the recovery worked.

   What didn't work first

   Tried: Setting the Swap Endianness word length to 2 instead of 4.

   A 2-byte swap belongs to 16-bit systems. The challenge says 32-bit, which is 4 bytes per word. Swap in pairs and you get an order matching no known format, with the magic bytes still wrong.

   Tried: Trying to swap endianness manually by reordering individual bytes in the hex view.

   Manually reordering bytes in a large file is error-prone and extremely tedious. CyberChef's Swap Endianness operation handles the entire file automatically in correctly-sized chunks. Manual reordering also risks losing track of chunk boundaries, producing an equally corrupted result.

   Learn more

   Endianness describes the byte order used to store multi-byte values. In big-endian format (used by network protocols, older Motorola/SPARC processors), the most significant byte comes first. In little-endian format (used by x86/x64, ARM in typical configurations), the least significant byte comes first.

   A 32-bit value like 0x12345678 is stored as 12 34 56 78 in big-endian and 78 56 34 12 in little-endian. This difference is invisible to programs running on the same architecture but becomes critical when transferring binary data between different systems - as this challenge simulates.

   The JPEG magic bytes are FF D8 FF at the start of every valid JPEG file. If the first bytes after swapping look like this pattern, you've confirmed the file format. File carvers and forensics tools use extensive databases of magic byte signatures (maintained in databases like libmagic) to identify file types independent of their extensions.

   Endianness bugs are a real concern in systems programming, network code, and embedded systems. The htonl() / ntohl() family of C functions ("host-to-network" and "network-to-host" long) exist specifically to convert between host byte order and network byte order (big-endian) when writing socket code.

3. Step 3Render the image

   Observation

   After the swap the first three bytes are FF D8 FF, the JPEG magic. Convert the hex back to binary and render it in CyberChef to read the flag.

   Run From Hex followed by Render Image (Raw) to display the image containing the flag text.

   What didn't work first

   Tried: Clicking 'Save output to file' after the Swap Endianness step and trying to open the saved file as an image.

   After the swap the output is still a hex string, not bytes. Save at that point and you write hex text to disk rather than a JPEG. Add 'From Hex' to get back to binary first.

   Tried: Using 'Render Image' directly after Swap Endianness without adding the 'From Hex' step.

   Swap Endianness emits a hex string, since that is what it was fed, and Render Image wants raw bytes. Skip 'From Hex' and the render fails or shows a broken image. The full recipe is To Hex, Swap Endianness, From Hex, Render Image.

   Learn more

   CyberChef's Render Image (Raw) operation takes raw binary data and displays it as an image directly in the browser, using a data URI. This eliminates the need to save the file to disk and open it in a separate viewer - useful for quick verification during CTF work.

   The From Hex operation converts the hex string back to binary bytes. The full recipe (To Hex → Swap Endianness → From Hex → Render Image) demonstrates CyberChef's power: each operation in a recipe transforms the data and passes it to the next, exactly like Unix pipes.

   The flag being embedded as text in an image is a technique called visual steganography at the most basic level - the data is visible to the eye once the image is rendered, but hidden if you're only looking at the raw (corrupted) bytes. More advanced visual steganography hides data in the LSBs (least significant bits) of pixel values, making it invisible to the naked eye.

   This challenge teaches a valuable forensics workflow: when a file doesn't open or looks corrupted, check its magic bytes, compare to known formats, and consider byte-order issues. Many "corrupted" files in forensics challenges are actually valid files with their byte order swapped, bytes XORed with a constant, or other simple transformations applied.

   The hex dumps guide covers reading magic bytes and spotting byte-order issues, and the CTF encodings guide walks through the family of transformations to try when a file looks corrupted.

Flag

Swapping each 32-bit word back to big endian renders the image holding the flag.