### Problem Statement:
You killed that last one. Ready to take it to the next level?
We’re given a wav file and nothing else to go on
### Approach:
The first thing we want to do is try to get an idea for how the data in the wav file is modulated. We opened the wav file in audacity to get an initial idea
Zooming in, we get a lot of useful information:![](https://i.ibb.co/NZXH3XY/e-Cehd-XHYUg-Rj-Q0-Nf-Ar7-Edgb-DEq-Kz-X6x-KYB0-P68-Ya-GZE97r-Dmvpr2i-DOe-C-FA-5cuc-EWrg-KVCr6n-EIH-MCK4-X0a-Ial-Mc-Bcn-Ciob-Ts-Oiodj9-Dgh-Z94-N-X6v-Hmjagm-URAb-Ao-Zf-KFp-Q.png)
A few notes about the signal to get started:There is significant low-frequency content (sustained 1’s and 0’s) which suggests that the signal is already at basebandThere are two channels. These could be two different data streams but more likely it’s the I and Q phases of the baseband signalThe amplitude looks to be constant, suggesting this is likely Phase-shift Keying (PSK) rather than something involving amplitude (like QAM)There seem to be about 8 samples per symbol
We used GNURadio to demodulate the signal
With an extremely simple flowgraph, we can see a rough constellation of the data. There are four hotspots so this is QPSK modulation.![](https://i.ibb.co/G563SY9/ph-PNENx-On-ZIZxcapnh-Ek-Tq-AOTDconqejh4-TCWxa-Lv7nea2-Jmly-Xb9f5m-VMnsv-Fsm-MXmq-HNkwa-F-l403-Xqn8i-JC7k-VTs-Lu-O3s07-Mk1-s1554.png)
We can recover the timing with just one more simple block:![](https://i.ibb.co/BNrk4ky/F6-Ve9gip-Yv-G16-Jl-Noor-CPUCNac-Qs-PXg-RRf6tp-Det-Op-F-c-OM9-EBh-Yu-Tgfex-Kmzbp-GXpg-WKj-Pw-M4zpyn-QGh-5-Yon2gpc-VP-VKn-IU5gpd3x-s1560.png)
Now we have the data separated into two-bit symbols, but a few issues remainWe don’t know if this is absolute or differential QPSKWe don’t know which symbols are the most/least significant parts of the byteWe don’t know which symbol maps to which two-bit sequenceWe can determine if it’s absolute or differential QPSK by looking forI like to take a histogram of the data - ordered data such as sync words or ASCII text would show up in a histogram because they would cause some symbols to show up much more often (All ASCII letters start with ‘01’, for instance)
Histogram of raw symbols:![](https://i.ibb.co/NswVvk6/SA9-QZAf-XFNK0npa-Vl-Zjna-OEpaik-AGf1-BSCHfn-48u1-W0vv-Lzq-YOcv-W3dy8-Jk-o77-Ia-Q7-Veo6-JZOULS2-IYILMl-EQNS-TSK5n8s-Gq09-Wm-s1600.png)
Histogram of differentially decoded symbols:![](https://i.ibb.co/c2YGsNf/rb-H6-U-990-Xw-F7-SL6s-Po-P-v-JNKaj-L69o-Ga76chu-V7-48-HT-3-Sny6-Q013a-Us-Fino-I1-VDio-Er-Sd-D8w-FLl4r4k-Kpmx-EKEAMfxqnhvg-Ezljx-s1600.png)
We can see a drastic difference in these histograms - it’s clear the data is differential
The difference is also clear in time domain, where some sync pattern is clearly visibleRaw symbols:![](https://i.ibb.co/N98YHtc/h-Tw-BYw-Pqe5nl2f-SQRsm-QW16-P4veg2-N3-X4v-Rj4-KOc-FYNv-UFCSXbnyua-IJl7a1-Bp-Dylj-GKn-S3yu4-Qu-WKa-ASKy-YTa-Wb9cwx-TOf-Ii19opv-s1600.png)
Differentially decoded:![](https://i.ibb.co/gFXHvkn/X-Nea-ZIOTTWSLs-Wo-Ns-BU5c-Kc-HOAm-BTkl-Z34-Azq-HKt5k-Xz-IZS-LKv-KFvf-WKZXSs-Nf-SDmm1lv-BWNS7-Hkv5-HRLe-XVq9-MMv-MOROLr-GNni-NY-s1600.png)
Now we just need to determine symbol mappings. For us, this was a matter of guess-and-check. We eventually found a symbol mapping that produced text. Here is the complete flowchart which produces an output file:![](https://i.ibb.co/svwGCj2/3-Mo-Qhq-Swov-GTL4trmq-DUa-W-Xy-C8-UE6jbt-Ax0shw-WQBdyq-QKALhr-TAJLTW0-PT-Ooan-Abacy-I-nstc-Sez9-JSD8x2w-Yc-Ll1-NMcv-FT0-dsf-s1193.png)
The text file contains data which looks like this in ascii
An????d I'm f????loating???? in a m????ost pec????uliar w????ayAnd ????the sta????rUUUUUU????0P?v?????9?
It’s clear we still need to remove sync words. This could be done in gnuradio with some effort, but it’d be easier to do it with a script (or in our case, with a text editor search/replace)
We get our final result containing the flag:```Ground Control to Major TomGround Control to Major TomTake your protein pills and put your helmet onGround Control to Major Tom (ten, nine, eight, seven, six)Commencing countdown, engines on (five, four, three)Check ignition and may God's love be with you (two, one, liftoff)This is Ground Control to Major TomYou've really made the gradeAnd the papers want to know whose shirts you wearNow it's time to leave the capsule if you dare"This is Major Tom to Ground ControlI'm stepping through the doorAnd I'm floating in a most peculiar wayAnd the starUUUUUU0P?v??9???jflag{lima20243lima:GEeqt-XXinABXCW6m2KCB4B12SJIaWIIn7NOpSb0__P630F0M-ZF8VopDX9bMWlP61efbggkqEmVlHwhAgk850s}0P?>??9???2s look very different todayFor hereAm I sitting in a tin canFar above the worldPlanet Earth is blueAnd there's nothing I can doThough I'm past one hundred thousand milesI'm feeling very stillAnd I think my spaceship knows which way to goTell my wife I love her very much she knowsGround Control to Major TomYour circuit's dead, there's something wrongCan you hear me, Major Tom?Can you hear me, Major Tom?Can you hear me, Major Tom?Can you "Here am I floating 'round my tin canFar above the moonPlanet Earth is blueAnd there's nothing I can do"```
