CTF Forensics & Blockchain
Quick reference for forensics CTF challenges. Each technique has a one-liner here; see supporting files for full details.
Additional Resources
- 3d-printing.md — PrusaSlicer G-code, QOIF, heatshrink
- windows.md — registry, SAM, event logs, Amcache, WMI persistence, MPLog
- network.md — tcpdump, TLS keylog, SMB3 decrypt, USB HID steno, split-archive reassembly
- network-advanced.md — packet-timing, NTLMv2, DNS stego, SMB RID recycle, UA-gated C2 hex-XOR
- disk-and-memory.md — Volatility, VMDK/VHD, RAID5 XOR, PowerShell ransomware, Docker/cloud
- disk-and-memory-2.md — 2024-26: ZFS, GPT GUID, KAPE, APFS snapshots, ransomware key recovery
- steganography.md — image stego: LSB, binary border, JPEG thumbnail, GIF differential
- steganography-2.md — 2024-26: PDF, PNG chunks, JPEG DQT, F5, jigsaw, QR tiles, seed-permuted
- stego-advanced.md — FFT audio, DTMF/SSTV, multi-track diff, video frame accum
- linux-forensics.md — log analysis, Docker image, browser artifacts, git recovery, KeePass v4
- signals-and-hardware.md — VGA/HDMI/DP decode, POCSAG, PulseView I²C, flash ADC, DPA
Pattern Recognition Index
Dispatch on observed file types / byte signals, not challenge titles.
| Signal in provided material |
Technique → file |
.pcap / .pcapng |
network.md (then network-advanced.md for timing/covert channels) |
.sr / .srzip / .logicdata (logic analyser) with SCL/SDA channels |
PulseView I²C decoder + datasheet → signals-and-hardware.md |
.sr / .logicdata with single data line, start/stop bits |
Saleae UART decode → signals-and-hardware.md |
complex64/complex128 binary + sample-rate in prompt |
IQ FFT masking / GQRX pipeline → signals-and-hardware.md |
| Audio with pager-like chirps, narrow FM channel |
POCSAG → GQRX→sox→multimon-ng → signals-and-hardware.md |
| Schematic with stack of op-amps + resistor ladder on shared input |
Flash ADC recovery → signals-and-hardware.md |
Power traces shape (positions, guesses, traces, samples) |
DPA / CPA → signals-and-hardware.md |
.raw / .vmem / .dmp / .lime (memory dump) |
Volatility → disk-and-memory.md |
.E01 / .dd / .img / VMDK |
Disk carving / partitioning → disk-and-memory.md |
.evtx, SAM, NTUSER.DAT, SRUDB.dat |
Windows forensics → windows.md |
| Audio WAV with sync spikes or steady tones |
Spectrogram / DTMF / SSTV → stego-advanced.md |
| PNG/JPEG/BMP with suspicious size or LSB patterns |
Image stego → steganography.md |
.git/ directory fragment / dangling blob |
Git reflog / fsck / blob repair → linux-forensics.md |
Tarball from docker save + .git/objects/??/… files present but refs/HEAD damaged |
Raw zlib_decode of every object → disk-and-memory-2.md |
| RAID disks with one missing, equal-size members |
RAID5 XOR recovery → disk-and-memory.md |
| PCAP where only a specific User-Agent gets non-default responses + hex-looking paths |
UA-gated C2 URL-path hex-XOR exfil → network-advanced.md |
Two trace-sets labelled fixed_vs_random / key_t vs key_r / NIST-TVLA README |
Welch's t-test leakage check → signals-and-hardware.md#tvla |
| Constant-time code + traces of equal length but visibly different shape |
Morphology-over-duration clustering → signals-and-hardware.md#morphology |
AES first-round target, 5k-10k traces with known plaintexts (.npy + plaintexts) |
CPA on sbox(p ⊕ k) Hamming weight → signals-and-hardware.md#cpa |
Recognize artefacts and bytes, not names. If the file type matches, the section applies regardless of challenge title.
For inline code/cheatsheet quick references (grep patterns, one-liners, common payloads), see quickref.md. The Pattern Recognition Index above is the dispatch table — always consult it first; load quickref.md only if you need a concrete snippet after dispatch.
1---2name: ctf-forensics3description: CTF Forensics & Blockchain4---56# CTF Forensics & Blockchain78Quick reference for forensics CTF challenges. Each technique has a one-liner here; see supporting files for full details.910## Additional Resources1112- [3d-printing.md](3d-printing.md) — PrusaSlicer G-code, QOIF, heatshrink13- [windows.md](windows.md) — registry, SAM, event logs, Amcache, WMI persistence, MPLog14- [network.md](network.md) — tcpdump, TLS keylog, SMB3 decrypt, USB HID steno, split-archive reassembly15- [network-advanced.md](network-advanced.md) — packet-timing, NTLMv2, DNS stego, SMB RID recycle, UA-gated C2 hex-XOR16- [disk-and-memory.md](disk-and-memory.md) — Volatility, VMDK/VHD, RAID5 XOR, PowerShell ransomware, Docker/cloud17- [disk-and-memory-2.md](disk-and-memory-2.md) — 2024-26: ZFS, GPT GUID, KAPE, APFS snapshots, ransomware key recovery18- [steganography.md](steganography.md) — image stego: LSB, binary border, JPEG thumbnail, GIF differential19- [steganography-2.md](steganography-2.md) — 2024-26: PDF, PNG chunks, JPEG DQT, F5, jigsaw, QR tiles, seed-permuted20- [stego-advanced.md](stego-advanced.md) — FFT audio, DTMF/SSTV, multi-track diff, video frame accum21- [linux-forensics.md](linux-forensics.md) — log analysis, Docker image, browser artifacts, git recovery, KeePass v422- [signals-and-hardware.md](signals-and-hardware.md) — VGA/HDMI/DP decode, POCSAG, PulseView I²C, flash ADC, DPA23---2425## Pattern Recognition Index2627Dispatch on **observed file types / byte signals**, not challenge titles.2829| Signal in provided material | Technique → file |30|---|---|31| `.pcap` / `.pcapng` | network.md (then network-advanced.md for timing/covert channels) |32| `.sr` / `.srzip` / `.logicdata` (logic analyser) with SCL/SDA channels | PulseView I²C decoder + datasheet → signals-and-hardware.md |33| `.sr` / `.logicdata` with single data line, start/stop bits | Saleae UART decode → signals-and-hardware.md |34| `complex64`/`complex128` binary + sample-rate in prompt | IQ FFT masking / GQRX pipeline → signals-and-hardware.md |35| Audio with pager-like chirps, narrow FM channel | POCSAG → GQRX→sox→multimon-ng → signals-and-hardware.md |36| Schematic with stack of op-amps + resistor ladder on shared input | Flash ADC recovery → signals-and-hardware.md |37| Power traces shape `(positions, guesses, traces, samples)` | DPA / CPA → signals-and-hardware.md |38| `.raw` / `.vmem` / `.dmp` / `.lime` (memory dump) | Volatility → disk-and-memory.md |39| `.E01` / `.dd` / `.img` / VMDK | Disk carving / partitioning → disk-and-memory.md |40| `.evtx`, `SAM`, `NTUSER.DAT`, `SRUDB.dat` | Windows forensics → windows.md |41| Audio WAV with sync spikes or steady tones | Spectrogram / DTMF / SSTV → stego-advanced.md |42| PNG/JPEG/BMP with suspicious size or LSB patterns | Image stego → steganography.md |43| `.git/` directory fragment / dangling blob | Git reflog / fsck / blob repair → linux-forensics.md |44| Tarball from `docker save` + `.git/objects/??/…` files present but refs/HEAD damaged | Raw `zlib_decode` of every object → disk-and-memory-2.md |45| RAID disks with one missing, equal-size members | RAID5 XOR recovery → disk-and-memory.md |46| PCAP where only a specific User-Agent gets non-default responses + hex-looking paths | UA-gated C2 URL-path hex-XOR exfil → network-advanced.md |47| Two trace-sets labelled `fixed_vs_random` / `key_t` vs `key_r` / NIST-TVLA README | Welch's *t*-test leakage check → signals-and-hardware.md#tvla |48| Constant-time code + traces of equal length but visibly different shape | Morphology-over-duration clustering → signals-and-hardware.md#morphology |49| AES first-round target, 5k-10k traces with known plaintexts (`.npy` + plaintexts) | CPA on `sbox(p ⊕ k)` Hamming weight → signals-and-hardware.md#cpa |5051Recognize **artefacts and bytes**, not names. If the file type matches, the section applies regardless of challenge title.5253---5455For inline code/cheatsheet quick references (grep patterns, one-liners, common payloads), see [quickref.md](quickref.md). The `Pattern Recognition Index` above is the dispatch table — always consult it first; load `quickref.md` only if you need a concrete snippet after dispatch.
MateoBogo