Smart Brick v2
umasscybersec
Task: a KiCad PCB file described a logic board with seven inputs and nineteen LED outputs. Solution: reconstruct the gate-level netlist from the board text, simulate all 7-bit input values, and map each LED-driving net to one ASCII character to recover the flag.
$ ls tags/ techniques/
Smart Brick v2 — umasscybersec
Description
Organizer description was not preserved in the local task files.
English summary: the challenge provided a KiCad PCB layout for a custom logic board. The goal was to understand what the circuit displayed and recover the hidden flag without manually tracing every wire in the CAD viewer.
Analysis
The strongest initial clue was the file format itself: smart-brick-v2.kicad_pcb. That matches the hint about a popular open-source EDA tool, so the right starting point was to inspect the board as KiCad data rather than treat it as a binary blob.
Reconnaissance immediately showed a few important structural facts:
- the board exposes seven inputs labeled
IN0..IN6 - connector
J1breaks out those seven inputs plusGND - connector
J2provides power with+5VandGND - the logic core is built from classic TTL parts, especially many
74LS21devices plus74LS02,74LS20,74LS00,74LS32,74LS86,74LS04,74LS27, and74LS08 - there are nineteen LEDs, each switched through a
2N7002MOSFET
Seven independent input bits strongly suggest 7-bit ASCII. The many TTL gates and absence of storage elements also suggest pure combinational logic: for any input value, the board computes a fixed set of outputs.
At that point, the challenge becomes a netlist-recovery problem. Instead of manually following traces in the PCB viewer, it is faster and more reproducible to parse the KiCad board file as text, extract each footprint, collect pad-to-net assignments, and translate each chip package into logic operations.
The included solver does exactly that. It:
...
Permission denied (requires auth)
Sign in to read this free writeup
This writeup is free — just sign in with GitHub to read it.
$ssh [email protected]