Trace — HackTheBox

Description

"One of our embedded devices has been compromised. It was flashing a message on the debug matrix that was too fast to read, although we managed to capture one iteration of it. We must find out what was displayed. To help you with your mission, we will also provide you with the fabrication files of the PCB module the matrix was on."

Provided files:

• traces.csv — GPIO signal capture: 16 channels (GPIO 5,6,12,13,16,17,18,19,20,21,22,23,24,25,26,27), 337 data rows with timestamps
• Gerber_module/ — PCB fabrication files (Gerber format): TopLayer, BottomLayer, TopSilkLayer, SolderMask, Drill files, BoardOutline, etc. Created in EasyEDA v6.4.17

Analysis

1. Reconnaissance — Gerber Files

Gerber files describe a PCB module with an 8×8 LED matrix and a 20-pin connector (dual-row, 2×10).

• TopSilkLayer (GTO) — physical layout: 8×8 LED footprint grid with markings
• TopLayer (GTL) — copper traces from the 20-pin connector (bottom of the board) to the LED matrix
• LED columns are positioned along X with ~230mil spacing (8 positions)
• LED rows — 8 positions along Y, each LED has a pair of pads (anode/cathode)

The key task is to trace the copper routes from connector pins to matrix rows and columns to determine the GPIO → matrix pin mapping.

2. Reconnaissance — traces.csv

The CSV contains 337 data rows. Data is grouped into clusters of 8 rows, separated by ~100ms pauses. Total of 42 frames (42 message characters).

Within each frame — 8 sequential column scans with ~0.5ms intervals.

3. Working Principle — Column Scanning Multiplexing

...