ApoorvCTF 2026 - QBitFlipper - Hardware Writeup

Category: Hardware Flag: apoorvctf{uncertain_about_that}

Challenge Description#

While chasing The Spot through an abandoned Oscorp research facility, Miles Morales interrupted him while he was activating a strange prototype chip connected to the collider control systems.

Miles managed to shut the system down before it finished initializing, but The Spot escaped through a portal, leaving the device behind.

Spider-Byte recovered the hardware and began analyzing it.

The chip appears to be an experimental Oscorp System-on-Chip (SoC) composed of three custom modules:

OSCORP QRYZEN™ Hybrid Core OSCORP QOREX™ OSCORP QELIX™ Memory Array Components OSCORP QRYZEN™ Hybrid Core A programmable processor responsible for coordinating system operations and interacting with the memory array.

**OSCORP QOREX™ **

… Some IC it is not outputing any values.

OSCORP QELIX™ Memory Array A 16-cell experimental storage array used by the processor.

Unfortunately, the QOREX ASIC is completely destroyed.

However, Spider-Byte discovered that the QRYZEN Hybrid Core still exposes a low-level debug interface.

Recovered Clues

From the lab we recovered:

A diagnostic image dump from the device

A diagram of the SoC architecture Miles also noticed a note written on a nearby lab whiteboard:

Operator nibble mapping

0001 → BIT 0010 → PHASE 0011 → BITNPHASE

The processor expects correction instructions encoded as:

[4-bit operator][4-bit address]

Each instruction targets one of the 16 cells inside the QELIX memory array.

Each bits are addressed as 0,1,2,3 4,5,6,7 … …,15

Mission The processor is outputing decoding error find what is wrong and get an output.

nc chals4.apoorvctf.xyz 1338

Analysis#

The first useful move was to validate what the remote interface actually accepts. Listing registers showed the expected R0..R6 plus ECR, and READOUT started at ERROR ON DECODING, so we definitely needed to feed correction instructions, not just read an existing flag.

1
python - <<'PY'
2
from pwn import remote
3

4
host, port = 'chals4.apoorvctf.xyz', 1338
5
cmds = ['LSREG', 'READ R0', 'READ R1', 'READ R2', 'READ R3', 'READ R4', 'READ R5', 'READ R6', 'READ ECR', 'READOUT']
6

7
p = remote(host, port, timeout=5)
8
print(p.recvuntil(b'> ').decode(errors='ignore'), end='')
9
for c in cmds:
10
    p.sendline(c.encode())
11
    out = p.recvuntil(b'> ', timeout=5).decode(errors='ignore')
12
    print(f'### {c}')
13
    print(out, end='')
14
p.close()
15
PY

1
Microprocessor Ready
2
> ### LSREG
3
Registers:
4
R0 R1 R2 R3 R4 R5 R6 ECR
5
> ### READ R0
6
R0 = 00000000
7
> ...
8
### READ ECR
9
ECR = 00000000
10
> ### READOUT
11
ERROR ON DECODING
12
>

Then I brute-checked operator nibble validity instead of assuming parser behavior from the note. This confirmed exactly three valid opcodes and rejected all others with OPERATOR OVERFLOW, which matched the whiteboard mapping and eliminated a huge amount of search noise.

1
python - <<'PY'
2
import socket
3

4
host, port = 'chals4.apoorvctf.xyz', 1338
5

6
def recv_prompt(s):
7
    data = b''
8
    while b'> ' not in data:
9
        data += s.recv(4096)
10
    return data.decode(errors='ignore')
11

12
for op in range(16):
13
    s = socket.create_connection((host, port), timeout=5)
14
    recv_prompt(s)
15
    ins = f'{op:04b}0000'
16
    s.sendall(f'WRITE ECR {ins}\n'.encode())
17
    recv_prompt(s)
18
    s.sendall(b'FLUSHECR\n')
19
    out = recv_prompt(s)
20
    line = [ln.strip() for ln in out.splitlines() if ln.strip()][0]
21
    print(f'{ins} -> {line}')
22
    s.close()
23
PY

1
00000000 -> OPERATOR OVERFLOW
2
00010000 -> ECR FLUSHED
3
00100000 -> ECR FLUSHED
4
00110000 -> ECR FLUSHED
5
01000000 -> OPERATOR OVERFLOW
6
...
7
11110000 -> OPERATOR OVERFLOW

At that point the challenge became a mapping problem from code.png (diagnostic dump) into a valid correction sequence. The output didn’t budge with naïve writes, and the service had annoying state behavior where every 7th flush overflowed, so blind brute-force felt like a trap.

tableflip

1
python - <<'PY'
2
import socket
3

4
host, port = 'chals4.apoorvctf.xyz', 1338
5

6
def recv_prompt(s):
7
    data = b''
8
    while b'> ' not in data:
9
        data += s.recv(4096)
10
    return data.decode(errors='ignore')
11

12
s = socket.create_connection((host, port), timeout=5)
13
print(recv_prompt(s), end='')
14
for i in range(1, 9):
15
    s.sendall(b'WRITE ECR 00010000\n'); recv_prompt(s)
16
    s.sendall(b'FLUSHECR\n')
17
    out = recv_prompt(s)
18
    line = [ln.strip() for ln in out.splitlines() if ln.strip()][0]
19
    print(f'{i}: {line}')
20
s.close()
21
PY

1
Microprocessor Ready
2
> 1: ECR FLUSHED
3
2: ECR FLUSHED
4
3: ECR FLUSHED
5
4: ECR FLUSHED
6
5: ECR FLUSHED
7
6: ECR FLUSHED
8
7: MEMORY OVERFLOW
9
8: ECR FLUSHED

So the solve path was to model the image and derive compact candidates mathematically. I wrote a solver that segments the 5x5 syndrome tile grid from code.png, builds GF(2) equations over the 4x4 memory-cell lattice, applies lattice symmetries, and converts each solution into instruction tuples using 0001/0010/0011 as BIT/PHASE/BITNPHASE. The script generated 128 compact candidates, then tested each candidate directly against the remote by issuing WRITE ECR <bits> + FLUSHECR and checking READOUT.

That gave a clean hit at candidate #29 with six instructions:

('00010010', '00010100', '00110111', '00111000', '00111011', '00111100')

and READOUT finally returned the flag.

smug

1
python qbitflipper_solve.py

1
Extracted 5x5 syndrome grid:
2
. L R B .
3
B R B B B
4
B L R L R
5
L R L B B
6
. B R L .
7
Generated candidate sets: 128
8
Solved with candidate #29: ('00010010', '00010100', '00110111', '00111000', '00111011', '00111100')
9
apoorvctf{uncertain_about_that}
10
FLAG: apoorvctf{uncertain_about_that}

Solution#

1
import re
2
import socket
3

4
import numpy as np
5
from PIL import Image
6
from scipy import ndimage as ndi
7

8
HOST = "chals4.apoorvctf.xyz"
9
PORT = 1338
10
FLAG_RE = re.compile(r"[A-Za-z0-9_]+\{[^}]+\}")
11

12
def extract_grid_from_code_png(path="code.png"):
13
    img = np.array(Image.open(path).convert("RGB"))
14
    h, w, _ = img.shape
15

16
    protos = np.array(
17
        [
18
            [28, 53, 127],
19
            [87, 149, 228],
20
            [231, 203, 95],
21
            [231, 70, 72],
22
        ],
23
        dtype=np.int16,
24
    )
25
    labels = ["B", "L", "Y", "R"]
26

27
    pix = img.reshape(-1, 3).astype(np.int16)
28
    d = ((pix[:, None, :] - protos[None, :, :]) ** 2).sum(axis=2)
29
    cls = d.argmin(axis=1).reshape(h, w)
30
    min_d = d.min(axis=1).reshape(h, w)
31

32
    mask = (min_d < 1800) & (img.mean(axis=2) > 45)
33
    comp, _ = ndi.label(mask)
34
    objs = ndi.find_objects(comp)
35

36
    tiles = []
37
    for i, s in enumerate(objs, start=1):
38
        if s is None:
39
            continue
40
        yy, xx = np.where(comp == i)
41
        area = len(yy)
42
        if area < 1200:
43
            continue
44
        x0, x1 = xx.min(), xx.max()
45
        y0, y1 = yy.min(), yy.max()
46
        cx, cy = (x0 + x1) / 2, (y0 + y1) / 2
47
        cidx = np.bincount(cls[yy, xx].ravel(), minlength=4).argmax()
48
        tiles.append((cx, cy, labels[cidx]))
49

50
    ys = sorted([t[1] for t in tiles])
51
    xs = sorted([t[0] for t in tiles])
52

53
    def cluster(vals, thr=55):
54
        groups, cur = [], [vals[0]]
55
        for v in vals[1:]:
56
            if abs(v - cur[-1]) <= thr:
57
                cur.append(v)
58
            else:
59
                groups.append(cur)
60
                cur = [v]
61
        groups.append(cur)
62
        return [sum(g) / len(g) for g in groups]
63

64
    rows = cluster(ys)
65
    cols = cluster(xs)
66
    grid = [["." for _ in range(len(cols))] for __ in range(len(rows))]
67

68
    for cx, cy, ch in tiles:
69
        r = min(range(len(rows)), key=lambda i: abs(rows[i] - cy))
70
        c = min(range(len(cols)), key=lambda i: abs(cols[i] - cx))
71
        grid[r][c] = ch
72

73
    return grid
74

75
def solve_all(A, b):
76
    A = A.copy()
77
    b = b.copy()
78
    m, n = A.shape
79
    row = 0
80
    where = [-1] * n
81

82
    for col in range(n):
83
        sel = -1
84
        for r in range(row, m):
85
            if A[r, col]:
86
                sel = r
87
                break
88
        if sel == -1:
89
            continue
90
        if sel != row:
91
            A[[row, sel]] = A[[sel, row]]
92
            b[[row, sel]] = b[[sel, row]]
93
        where[col] = row
94
        for r in range(m):
95
            if r != row and A[r, col]:
96
                A[r] ^= A[row]
97
                b[r] ^= b[row]
98
        row += 1
99
        if row == m:
100
            break
101

102
    for r in range(m):
103
        if not A[r].any() and b[r]:
104
            return []
105

106
    free = [c for c in range(n) if where[c] == -1]
107
    sols = []
108
    for mask in range(1 << len(free)):
109
        x = np.zeros(n, dtype=np.uint8)
110
        for i, c in enumerate(free):
111
            x[c] = (mask >> i) & 1
112
        for c in range(n - 1, -1, -1):
113
            rr = where[c]
114
            if rr == -1:
115
                continue
116
            s = 0
117
            for k in np.where(A[rr] == 1)[0]:
118
                if k != c:
119
                    s ^= x[k]
120
            x[c] = b[rr] ^ s
121
        sols.append(x)
122
    return sols
123

124
def sym_maps():
125
    out = []
126
    for k in range(8):
127
        p = [0] * 16
128
        for r in range(4):
129
            for c in range(4):
130
                a = r * 4 + c
131
                if k == 0:
132
                    rr, cc = r, c
133
                elif k == 1:
134
                    rr, cc = c, 3 - r
135
                elif k == 2:
136
                    rr, cc = 3 - r, 3 - c
137
                elif k == 3:
138
                    rr, cc = 3 - c, r
139
                elif k == 4:
140
                    rr, cc = r, 3 - c
141
                elif k == 5:
142
                    rr, cc = 3 - r, c
143
                elif k == 6:
144
                    rr, cc = c, r
145
                else:
146
                    rr, cc = 3 - c, 3 - r
147
                p[a] = rr * 4 + cc
148
        out.append(p)
149
    return out
150

151
def apply_perm(v, p):
152
    o = np.zeros_like(v)
153
    for a, b in enumerate(p):
154
        o[b] = v[a]
155
    return o
156

157
def generate_candidates(grid):
158
    groups = {0: [], 1: []}
159
    for r in range(5):
160
        for c in range(5):
161
            if grid[r][c] == ".":
162
                continue
163
            groups[(r + c) & 1].append((r, c, grid[r][c]))
164

165
    nodes = [(r, c) for r in range(4) for c in range(4)]
166
    idx = {rc: i for i, rc in enumerate(nodes)}
167

168
    H = {}
169
    for gp in [0, 1]:
170
        mat = np.zeros((len(groups[gp]), 16), dtype=np.uint8)
171
        row_of = {(r, c): i for i, (r, c, _) in enumerate(groups[gp])}
172
        for qr, qc in nodes:
173
            j = idx[(qr, qc)]
174
            for rc in [(qr, qc), (qr, qc + 1), (qr + 1, qc), (qr + 1, qc + 1)]:
175
                if rc in row_of:
176
                    mat[row_of[rc], j] ^= 1
177
        H[gp] = mat
178

179
    candidates = set()
180
    perms = sym_maps()
181

182
    for gx in [0, 1]:
183
        gz = 1 - gx
184
        cols_x = sorted(set(ch for _, _, ch in groups[gx]))
185
        cols_z = sorted(set(ch for _, _, ch in groups[gz]))
186
        for one_x in cols_x:
187
            sx = np.array([1 if ch == one_x else 0 for _, _, ch in groups[gx]], dtype=np.uint8)
188
            X = sorted(solve_all(H[gx], sx), key=lambda v: int(v.sum()))[:64]
189
            for one_z in cols_z:
190
                sz = np.array([1 if ch == one_z else 0 for _, _, ch in groups[gz]], dtype=np.uint8)
191
                Z = sorted(solve_all(H[gz], sz), key=lambda v: int(v.sum()))[:64]
192
                for x in X:
193
                    for z in Z:
194
                        for p in perms:
195
                            xp = apply_perm(x, p)
196
                            zp = apply_perm(z, p)
197
                            for swap in [0, 1]:
198
                                xx, zz = (zp, xp) if swap else (xp, zp)
199
                                ops = []
200
                                for a in range(16):
201
                                    xb, zb = int(xx[a]), int(zz[a])
202
                                    if xb == 0 and zb == 0:
203
                                        continue
204
                                    if xb == 1 and zb == 0:
205
                                        op = "0001"
206
                                    elif xb == 0 and zb == 1:
207
                                        op = "0010"
208
                                    else:
209
                                        op = "0011"
210
                                    ops.append(op + f"{a:04b}")
211
                                if 1 <= len(ops) <= 6:
212
                                    candidates.add(tuple(sorted(ops)))
213

214
    return sorted(candidates, key=lambda t: (len(t), t))
215

216
def recv_prompt(sock):
217
    data = b""
218
    while b"> " not in data:
219
        chunk = sock.recv(4096)
220
        if not chunk:
221
            break
222
        data += chunk
223
    return data.decode(errors="ignore")
224

225
def test_ops(ops):
226
    s = socket.create_connection((HOST, PORT), timeout=6)
227
    recv_prompt(s)
228
    for ins in ops:
229
        s.sendall(f"WRITE ECR {ins}\n".encode())
230
        recv_prompt(s)
231
        s.sendall(b"FLUSHECR\n")
232
        recv_prompt(s)
233
    s.sendall(b"READOUT\n")
234
    out = recv_prompt(s)
235
    s.close()
236
    return out
237

238
def main():
239
    grid = extract_grid_from_code_png("code.png")
240
    print("Extracted 5x5 syndrome grid:")
241
    for row in grid:
242
        print(" ".join(row))
243

244
    candidates = generate_candidates(grid)
245
    print(f"Generated candidate sets: {len(candidates)}")
246

247
    for i, ops in enumerate(candidates, start=1):
248
        out = test_ops(ops)
249
        if "ERROR ON DECODING" not in out:
250
            print(f"Solved with candidate #{i}: {ops}")
251
            print(out.strip())
252
            m = FLAG_RE.search(out)
253
            if m:
254
                print(f"FLAG: {m.group(0)}")
255
            return
256

257
    print("No valid candidate found")
258

259
if __name__ == "__main__":
260
    main()

1
python qbitflipper_solve.py

1
Extracted 5x5 syndrome grid:
2
. L R B .
3
B R B B B
4
B L R L R
5
L R L B B
6
. B R L .
7
Generated candidate sets: 128
8
Solved with candidate #29: ('00010010', '00010100', '00110111', '00111000', '00111011', '00111100')
9
apoorvctf{uncertain_about_that}
10
FLAG: apoorvctf{uncertain_about_that}