0xnhl

Dead Reckoning

/ Update
4 min read

Challenge#

  • Name: Dead Reckoning
  • Category: Hardware
  • Difficulty: Medium
  • Prompt: “A damaged embedded CNC controller was discovered… Can you recover what it was making and find the flag in the process? The flag contains the characters f' to identify it.”
  • Given file: controller_fw.bin
  • Expected flag format: apoorvctf{...}

1) Fast Triage#

File type and strings#

file controller_fw.bin
strings -n 6 controller_fw.bin
bash

Key observations from strings:

  • Firmware/banner-like strings: AXIOM-CNC fw v2.3.1
  • Job-related hints:
    • job_buffer: packet format [4B:length][1B:seg_id][NB:data] x4 segments
    • JOB BUFFER FRAGMENTED
  • Debug hint:
    • cal_reserved (0x0C18): DO NOT MODIFY
  • Markers in binary:
    • JBUFHDR5SEG4
    • AXIOM_END

This strongly suggests embedded job data exists in 4 fragmented packets, probably obfuscated/encrypted.


2) Locate Important Offsets#

I scanned offsets for known markers and found:

  • JBUFHDR5SEG4 at 0x1000
  • AXIOM_END near EOF
  • file size 0x5010 (20496 bytes)

Hex around 0x1000 looked like:

0x1000: JBUFHDR5SEG4
0x100C: 92 0f 00 00 03 ...
text

Interpreting with hinted format [4B:length][1B:seg_id][NB:data]:

  • 0x00000f92 = 3986 bytes, seg_id = 3
  • followed by next packet, etc.

3) Parse Fragmented Job Packets#

I parsed 4 packets sequentially from 0x100C:

  • seg 3: length 3986
  • seg 0: length 1580
  • seg 2: length 2767
  • seg 1: length 246

Reordered by segment ID (0,1,2,3) to reconstruct logical job stream.


4) Recover Obfuscation Key#

From strings, this value stood out:

  • cal_reserved (0x0C18): DO NOT MODIFY

Hex dump at 0x0C18:

f1 4c 3b a7 2e 91 c4 08
text

Testing this as repeating XOR key over packet payload produced clear ASCII G-code immediately.

Recovered XOR key:

f14c3ba72e91c408
text

This is the core trick of the challenge: job packets are XOR-obfuscated with the cal_reserved bytes.


5) Decrypt Result = CNC G-code#

After XOR-decrypting each segment with the 8-byte repeating key, plaintext shows valid G-code, e.g.:

%
(AXIOM CNC CONTROLLER v2.3.1)
(job_id: 0x3F2A  seg:1/4)
G21
M3
G00 Z5.000000
G00 X35.105656 Y72.065903
G01 Z-1.000000 F100.0
...
M5
G00 X0.0000 Y0.0000
M2
%
text

So firmware did indeed contain the engraving toolpath.


6) Reconstruct the Engraving Geometry#

I rendered the path by:

  • treating G01 as line segments
  • approximating G02/G03 arcs with short line samples
  • only drawing moves while Z < 0 (cutting depth)

The rendered output clearly spells:

f'GS
text

Therefore flag content is f'GS.


7) Final Flag#

apoorvctf{f'GS}
text

If the platform enforces typographic apostrophe from statement wording, alternate try:

apoorvctf{f’GS}
text

Repro Script (Single-File)#


Dead Ends / Notes#

  • The string Qkkbal looked like Base64 bait; decoding it alone was not the path.
  • Searching for direct flag/apoorvctf strings in raw firmware fails (as expected due to obfuscation).
  • Key recovery depended on interpreting cal_reserved (0x0C18) as a real decryption material location.
Dead Reckoning
https://nahil.xyz/vault/writeups/apoorvctf2026/hw/dead-reckoning/
Author Nahil Rasheed
Published at March 24, 2026
Disclaimer This content is provided strictly for educational purposes only.