hardwarefreemedium

Smart Brick v2

umasscybersec

Task: a KiCad PCB file described a logic board with seven inputs and nineteen LED outputs. Solution: reconstruct the gate-level netlist from the board text, simulate all 7-bit input values, and map each LED-driving net to one ASCII character to recover the flag.

$ ls tags/ techniques/
kicad_netlist_reconstructiongate_level_simulationascii_mapping

Smart Brick v2 — umasscybersec

Description

Organizer description was not preserved in the local task files.

English summary: the challenge provided a KiCad PCB layout for a custom logic board. The goal was to understand what the circuit displayed and recover the hidden flag without manually tracing every wire in the CAD viewer.

Analysis

The strongest initial clue was the file format itself: smart-brick-v2.kicad_pcb. That matches the hint about a popular open-source EDA tool, so the right starting point was to inspect the board as KiCad data rather than treat it as a binary blob.

Reconnaissance immediately showed a few important structural facts:

  • the board exposes seven inputs labeled IN0..IN6
  • connector J1 breaks out those seven inputs plus GND
  • connector J2 provides power with +5V and GND
  • the logic core is built from classic TTL parts, especially many 74LS21 devices plus 74LS02, 74LS20, 74LS00, 74LS32, 74LS86, 74LS04, 74LS27, and 74LS08
  • there are nineteen LEDs, each switched through a 2N7002 MOSFET

Seven independent input bits strongly suggest 7-bit ASCII. The many TTL gates and absence of storage elements also suggest pure combinational logic: for any input value, the board computes a fixed set of outputs.

At that point, the challenge becomes a netlist-recovery problem. Instead of manually following traces in the PCB viewer, it is faster and more reproducible to parse the KiCad board file as text, extract each footprint, collect pad-to-net assignments, and translate each chip package into logic operations.

The included solver does exactly that. It:

...

🔒

Permission denied (requires auth)

Sign in to read this free writeup

This writeup is free — just sign in with GitHub to read it.

$ssh [email protected]