Suspicious Remix — broncoctf2026

Description

So there's this guy SG who just sent me a copy of their new remix. Knowing what they are like with their remixes, I don't trust it, in more ways than one. Whatever remix, I always feel like they modified the audio specifically for me somehow. Maybe you should have a listen. Wrap the secret you find in bronco{}.

Given file: sg_remix.wav — RIFF WAVE, Microsoft PCM, 16-bit, stereo, 48000 Hz, ~82 s, ~15.7 MB. The audible track is a garbled / AI-remixed version of Rick Astley's "Never Gonna Give You Up". Goal: find the hidden secret and wrap it in bronco{}.

Analysis

The prompt drops two strong hints: "have a listen" (audio-domain inspection) and "in more ways than one" / "modified the audio specifically for me" (there are two layers — the audible rickroll AND a second hidden layer).

A high-contrast spectrogram of the L+R mix reveals a dense, structured band of energy in the ultrasonic 14–24 kHz range, present only from about t = 13.75 s to t = 38.7 s. This is clearly artificial — normal 48 kHz music does not carry deliberate, block-shaped structure that high.

The key realization: those shapes are not a data-over-sound modulation — they are block letters literally drawn into the frequency/time plane. Rendering a clean, high dynamic-range spectrogram of the exact band and simply reading it left-to-right spells out a plain English sentence:

THE FLAG IS THE RELEASE YEAR OF THE SONG THE LYRICS ARE FROM

The garbled lyrics in the remix are Rick Astley — "Never Gonna Give You Up", released in 1987. Therefore the flag is bronco{REDACTED}.

Solution

Render the ultrasonic band as a clean, high-contrast spectrogram with SoX and read it directly. remix 1,2 mixes L+R to mono; -z 80 gives 80 dB of dynamic range so the faint ultrasonic glyphs stand out against black. Read in ~4-second windows across 13–40 s and view the top 14–24 kHz band.

# One window at a time (start = 13,17,21,25,29,33,36 ...)
for start in 13 17 21 25 29 33 36; do
  sox sg_remix.wav -n remix 1,2 trim $start 4 rate 48k \
      spectrogram -z 80 -o clean_${start}.png
done

# Or one full-width high-contrast spectrogram of the whole message span:
sox sg_remix.wav -n remix 1,2 trim 13 26 rate 48k \
    spectrogram -z 80 -x 2000 -o fulltext.png

Reading the block letters across the windows:

Window (s)	Text drawn in 14–24 kHz band
13–17	THE FLAG
17–21	IS THE R
21–25	ELEASE YEA
25–29	R OF THE S
29–33	ONG THE L
33–37	YRICS ARE
36–40	...RE FROM (message ends ~38.7 s)

Concatenated:

THE FLAG IS THE RELEASE YEAR OF THE SONG THE LYRICS ARE FROM

The song is "Never Gonna Give You Up" (Rick Astley, 1987), so:

flag = bronco{REDACTED}

(Audacity / Sonic Visualiser spectrogram views work equally well — the point is a clean, high-contrast render of the 14–24 kHz band.)

Rabbit holes / what did NOT work

The single biggest lesson: the ultrasonic glyphs LOOK like an FSK / multi-tone data-over-sound signal (ggwave / quiet.js / OFDM), but they are plain readable TEXT. The comb / barcode appearance under low-contrast or inverted spectrograms made the block letters resemble a coded modulation, which led to a large wasted effort building and patching ggwave decoders. Always render a clean high-contrast spectrogram of the exact band and just LOOK before assuming a coded scheme.

Discarded approaches (so future readers skip them):

• Sample-level, channel, and raw-byte LSB extraction (all bit planes, all alignments) — nothing.
• Stereo L−R difference / phase cancellation and L+R sum — only isolated the song.
• Whole-track reversal and high-pass filtering — only recovered song fragments (via Whisper).
• audiowmark and WavMark AI watermark decoders — no watermark present.
• DeepSound DSC2 container check — not present.
• ggwave / quiet.js data-over-sound decoding (custom freqStart sweeps, forced-marker patched decoders, Reed–Solomon brute force, manual per-frame demod) — DEAD END; the signal is not a data modulation at all.
• First flag guess bronco{never_gonna_give_you_up} — WRONG (rejected). The answer is the release year, 1987.