WTF_ELECTRICALENGINEERING

broncoctf2026

Task: two academic Booth-multiplier paper figures (PNG) hide a multi-stage puzzle; the paper identity is misdirection. Solution: extract URLs from bit-plane 7 (MSB) of the red channel, follow tinyurl -> Google Drive to a .b input sequence, and since inputs are only 0000/1110 the radix-4 Booth PP decoder collapses to 1110->1 / 0000->0, giving 18 ASCII bytes = the flag.

ascii_decoding bit_plane_stego booth_encoder_decoder google_drive misdirection msb_stego multi_stage png_steganography radix4_booth red_channel tinyurl verilog

binary_group_to_ascii_decodingmsb_bit_plane_extractionmulti_stage_oob_link_followingradix4_booth_pp_decoder_evaluationurl_extraction_from_stego

$ ls tags/ techniques/

ascii_decoding bit_plane_stego booth_encoder_decoder google_drive misdirection msb_stego multi_stage png_steganography radix4_booth red_channel tinyurl verilog

binary_group_to_ascii_decodingmsb_bit_plane_extractionmulti_stage_oob_link_followingradix4_booth_pp_decoder_evaluationurl_extraction_from_stego

$ cat /etc/rate-limit

Rate limit reached (20 reads/hour per IP). Showing preview only — full content returns at the next hour roll-over.

WTF_ELECTRICALENGINEERING — broncoctf2026

Description

I'm supposed to find the flag somewhere but this guy just sent me two images to try to find it! What the flip, I don't know anything about Electrical Engineering!!

Two files are provided:

ChallengeCircuit.png (301x250 RGBA) — a CMOS transistor-level schematic of a radix-4 Booth partial-product decoder.
Challenge.png (715x396 RGBA) — "TABLE VI — Comparisons of The Radix-4 Booth Designs for Generating One Partial Product Row".

Goal: recover the bronco{...} flag hidden somewhere in/behind these images.

Analysis

Recon — the paper is a red herring

Reverse-image searching both figures identifies their common source:

Yen-Jen Chang, Yu-Cheng Cheng, Shao-Chi Liao, Chun-Huo Hsiao, "A Low Power Radix-4 Booth Multiplier With Pre-Encoded Mechanism," IEEE Access vol. 8, pp. 114842–114853, 2020, DOI 10.1109/ACCESS.2020.3003684.

ChallengeCircuit.png = Figure 9(b), the proposed low-cost decoder.
Challenge.png = Table VI.

Lesson (misdirection): identifying the paper is NOT the solution. Guessing the normalized paper title as the flag (e.g. bronco{a_low_power_radix-4_booth_multiplier_with_pre-encoded_mechanism}) is wrong. The paper is only context — it teaches the Booth decoder needed in the final stage.

Failed approaches (do not repeat)

PNG chunk inspection — no tEXt/zTXt/trailing data.
Alpha channel — all 255.
Standard LSB (bit 0) extraction on R/G/B/A — nothing.
binwalk, strings, exiftool — nothing.
Table numeric values (transistor counts, delays, power) do NOT decode to ASCII.
The circuit's small truth table alone is not the payload.

Breakthrough — bit-plane 7 (MSB) of the RED channel

The hidden data is in bit-plane 7 (the most significant bit) of the red channel, read row-major (top-left → bottom-right), packed 8 bits per byte, MSB-first. The key insight is to check HIGH bit-planes and single-channel extraction, not just LSB.

...