logoalt Hacker News

bwiggsyesterday at 1:18 PM3 repliesview on HN

DEFCON30, Mayhem CTF.

We were given a file full of random bytes. The flag was in there somewhere. It was too random to be encrypted, there wasn't any structure. `file` didn't return anything, truly just a bag of bytes.

I had decided to install `hexyl` as an alternative option to some of the other hex editors installed o my linux machine. All the bytes were colored grey.

I scrolled the file and noticed a blip of yellow. A random golden `{` amongst all the noise. Weird.

The next colored byte was a `C`, then `T`, `F`.

---

At that time, I was mostly using HexFiend to look at raw files, which didn't have byte coloring. For DEFCON I had decided to drive my linux machine. I had ghex installed, but i had also decided to install and try `hexyl` via cli. So seeing bytes in color was purely by chance that I had installed it. I eventually posted an issue to ghex to add color support. https://gitlab.gnome.org/GNOME/ghex/-/issues/60

I need to see if I can find the file and post it on that blog post. https://bwiggs.com/posts/2023-08-31-hacking-in-color/


Replies

abcd_fyesterday at 1:25 PM

> It was too random to be encrypted

That's a rather odd remark.

show 1 reply
masfuerteyesterday at 2:48 PM

I don't get it. If you were looking at random data, why did hexyl apply colour to only the brace, C, T and F?

Crestwaveyesterday at 2:47 PM

Wouldn't strings(1) have worked for this?

show 1 reply