Tags: audio forensics
Rating:
# Lo-Fi
writeup by [haskal](https://awoo.systems) for [BLÅHAJ](https://blahaj.awoo.systems)
**Forensics/OSINT**
**499 points**
**7 solves**
**(BLÅHAJ got 1st solve :shark: :chart_with_upwards_trend:)**
>I made a "inspirational" lo-fi track! ft. Alec's very smooth aussie accent
>
>You know, "Just do it", "Don't let your dreams be ones and zeroes", I'm pretty sure he says
>something along those lines... all inspirational sayings mean the same thing anyway
provided file: <https://git.lain.faith/BLAHAJ/writeups/raw/branch/writeups/2020/rgbctf/lofi/lofi.wav>
## writeup
listening to the provided file, it's just a short lo-fi hip hop beat to study/chill/pwn to but at
the very end you can notice the very distinctive sound of encoding something in the spectrogram.
visualize the spectrogram to see this, here i used audacity.
this is all we get here, no full url yet. it's not going to be that easy :P. however from the flavor
text we can deduce that the rest of the url might be encoded in this song as ones and zeroes. here i
listened to the song again and noticed that in the second part, the synth notes are really off-beat,
which is strange even for lo-fi. they don't seem to follow any sort of pattern. this must be where
the encoded data is.
here i go really jank low tech and take a gigantic w i d e screenshot of audacity and load it into
glimpse to try to extract these notes. i overlaid a grid and tweaked it until it matched the pattern
of synth notes in the waveform. it's important here to realize the synth notes are the ones that
rise going from quiet to loud. the loud to quiet parts are the bass drum and the snare that make up
the beat. therefore, look for triangles that point left, and ignore the ones that point right. if
you listen to the song while doing this it's also more obvious where the notes are exactly. we find
that the synth notes are triplets, with 6 intervals (6 bits) per measure.
write down the bits, 1 if there's a note and 0 if there's no note, and then decode as 8-bit ascii.
append this to `https://tinyurl.com/<data goes here>` and the resulting url contains the flag.
## addendum
i'm really surprised by how few solves this got. i guess it's kinda hard to notice what's going on
unless you listen carefully and read the flavor text.
