coffeegate

coffeegate

Author: Paweł Wieczorek (aka cerber-os)

In this challenge we were given an image consisting of (from left to right): the truth table, circuit with some gates removed and table for easy convertion between decimal system and input bits of this "device".

From this we could deduce that the flag will be outputted by this circuit bit by bit for every next value of input (where A - is MSB and Z - LSB) beginning with 0. Let's start with the truth table - it contains 88 cells not filled with 'X', which means that the flag will have 11 characters. In this case, the 'X' character means "undefined", so we shouldn't rely / use values returned by circuit for this inputs.

Next step is too fill two boxes covering parts of the diagram, starting with the right one. By comparing the distance between paths with other gates we could predict that two 4-input ANDs were used there. By using the same method to the left box, we find out that there were two 3-input ANDs. But what about the rest two gates? Well..., we guessed that this two gates were connected to the output by one OR, but in such case we would use only three gates. Although we have tested many configuration, we couldn't find one consisting of four, so we have just left the first version with just three of them.

As the function has almost hundred input values and filling the truth table for every one of them would take a lot of time, we decided to redraw the circuit in LogiSim (by the way: great, free circuit simulator). To make sure we won't omit any combination, we've connected counter to the input bits. The LED2 is connected to the clock line, so it lights up every time counter changes its value. When LED2 is on, we write down the output of the 'device' (displayed on LED1).

After ~90 seconds we got the binary sequence, which converts to flag{Booley. It looks almost perfect, but last character does not match :/ . However after looking at the ASCII table, we noticed that between y and } there's only one bit diffrence. So either we might have made a mistake while writing down 'device' output or we have connected something somewhere wrong. After replacing word flag to WPI (as task description requested us to do so), the flag WPI{Booley} was accepted.