# Windows
## The GivenAppend what you find to "ASIS\_" and send that as flag.
An [mp4 video](windows_assets/windows.mp4) is attached. It's a video of smallpictures of windows flashing across the screen with a strange soundtrack.
![Example Frame](windows_assets/windows.png)
## AnalysisLet's start with the audio. Pull out the audio with ffmpeg.
    ffmpeg -i windows.mp4 windows.wav
The audio sounds like it's something in reverse, and opening it up in Audacityand reversing it confirms this. It's a man's voice saying`51324984652187698521487459648201`. This is 32 characters, so it could be anmd5 hash, but appending that to `ASIS_` isn't correct flag, so we're not doneyet.
Now we look at the video. If you stare at it for awhile, it looks like thewindows flashing on the screen are tracing out some sort of pattern, but it'sreally hard to tell. Additionally, there seem to be a fixed set of positions inwhich the windows appear.
In order to get a better look at it, we can turn the video into a GIF so wecan scroll a frame at a time in GIMP.
    ffmpeg -i windows.mp4 windows.gif
Only the first frame of the generated GIF has the black background, so wedelete that with the color picker tool, and we can see that it was indeed apattern.
![QR looking image](windows_assets/windows_qr_before.png)
It's a QR code (we've seen enough of those before in other CTFs, turns out this one wasa Version 1 QR code, which is 21x21). The QR scanner apps on our phonescouldn't quite read it, so we had to fudge it into a more readable state inGIMP with creative selections and scaling (in particular, I selected all ofthe white with the color picker tool, inverted the selection, grew theselection by 5 pixels, then shrank it by 3, then flood filled black, thenscaled it down to 21x21 without interpolation).
![QR after formatting](windows_assets/windows_qr_after.png).
The QR code encodes the message "xorwith313". So we xor the above numberwith 313
    51324984652187698521487459648201 ^ 313 = 51324984652187698521487459648496
The flag is `ASIS_51324984652187698521487459648496`.