Critical Flight — HackTheBox

Description

Your team has assigned you to a mission to investigate the production files of Printed Circuit Boards for irregularities. This is in response to the deployment of nonfunctional DIY drones that keep falling out of the sky. The team had used a slightly modified version of an open-source flight controller in order to save time, but it appears that someone had sabotaged the design before production. Can you help identify any suspicious alterations made to the boards?

Analysis

The task provides an archive with Gerber files — a standard format for PCB (Printed Circuit Board) manufacturing. The files describe the "HadesMicro" board — a flight controller for drones.

File Structure

HadesMicro-F_Cu.gbr    - Front Copper layer
HadesMicro-B_Cu.gbr    - Back Copper layer
HadesMicro-In1_Cu.gbr  - Inner Copper layer 1
HadesMicro-In2_Cu.gbr  - Inner Copper layer 2
HadesMicro-F_Silkscreen.gbr - Silkscreen markings
HadesMicro-F_Mask.gbr  - Solder mask
HadesMicro-Edge_Cuts.gbr - Board outline

Gerber Format

Gerber is a text format with coordinates and D-codes:

• D01 — draw
• D02 — move without drawing
• D03 — flash/point

Coordinates are specified in the format X...Y...D...*

Key Observation

Multi-layer PCBs have inner copper layers that:

1. Are invisible on the finished board
2. Are present in manufacturing files
3. Are an ideal place for hiding data

Solution

Step 1: Parsing Gerber Files

Wrote a Python script to extract coordinates from Gerber:

#!/usr/bin/env python3
"""
Gerber file parser and visualizer for PCB analysis.
Extracts coordinates and renders copper layers.
"""
import re
import matplotlib.pyplot as plt
from pathlib import Path

def parse_gerber(filepath):
    """Parse Gerber file and extract drawing coordinates."""
    coordinates = []
    current_x, current_y = 0, 0
    
    with open(filepath, 'r') as f:
        content = f.read()
    
    # Pattern for coordinates: X<num>Y<num>D<code>*
    pattern = r'X(-?\d+)Y(-?\d+)D(\d+)\*'
    
    for match in re.finditer(pattern, content):
        x = int(match.group(1))
        y = int(match.group(2))
        d_code = int(match.group(3))
        
        if d_code == 1:  # Draw
            coordinates.append((current_x, current_y, x, y, 'draw'))
        elif d_code == 2:  # Move
            coordinates.append((current_x, current_y, x, y, 'move'))
        elif d_code == 3:  # Flash
            coordinates.append((x, y, x, y, 'flash'))
        
        current_x, current_y = x, y
    
    return coordinates

def visualize_layer(filepath, title="PCB Layer"):
    """Render a Gerber layer using matplotlib."""
    coords = parse_gerber(filepath)
    
    fig, ax = plt.subplots(figsize=(12, 10))
    
    for x1, y1, x2, y2, action in coords:
        if action == 'draw':
            ax.plot([x1, x2], [y1, y2], 'b-', linewidth=0.5)
        elif action == 'flash':
            ax.plot(x1, y1, 'ro', markersize=1)
    
    ax.set_aspect('equal')
    ax.set_title(title)
    plt.savefig(f"{title.replace(' ', '_')}.png", dpi=300)
    plt.show()

# Visualize all copper layers
layers = [
    ('HadesMicro-F_Cu.gbr', 'Front Copper'),
    ('HadesMicro-B_Cu.gbr', 'Back Copper'),
    ('HadesMicro-In1_Cu.gbr', 'Inner Layer 1'),
    ('HadesMicro-In2_Cu.gbr', 'Inner Layer 2'),
]

for filepath, name in layers:
    if Path(filepath).exists():
        visualize_layer(filepath, name)

Step 2: Discovering Hidden Text

When visualizing the inner layers, text drawn with copper traces was discovered:

• In1_Cu (Inner Layer 1): 0f_313c720n1c5#$@} — end of the flag
• B_Cu (Back Copper): 533_7h3_1nn32_w02k1n95_ — middle of the flag

Step 3: Assembling the Flag

Combining the parts in the correct order:

HTB{ + 533_7h3_1nn32_w02k1n95_ + 0f_313c720n1c5#$@}

Decoding Leetspeak

533_7h3_1nn32_w02k1n95_0f_313c720n1c5
see_the_inner_workings_of_electronics

The flag literally says "see the inner workings of electronics" — a hint about the inner PCB layers.

Key Indicators

Use this technique when:

• Given Gerber files (.gbr) or other PCB manufacturing files
• The task involves hardware/electronics forensics
• Multi-layer PCB is mentioned
• There are inner layers (In1_Cu, In2_Cu, etc.)
• Need to look for hidden data in manufacturing files

Notes

1. Gerber viewers: Can use online viewers (gerbv, KiCad) instead of writing a parser
2. Other formats: PCB files can be in KiCad, Eagle, Altium formats — the principle is the same
3. Inner layers: In real boards, they are used for power/ground, but can contain hidden data