Hackvent 2024: Day 1

[HV24.01] Twisted Colors

An elf accidentally mixed up the colors while painting the Christmas ornaments. Can you help Santa fix it?

Analyze the GIF and get the flag.

Flag format: HV24{}

sha256sum of the GIF file: 0c85246d9c94411ca3292d388f4959054036b7d5cc4c7e2cf07fd7315e86aa69

This challenge was written by dr_nick. The flag was surgically inserted into the challenge.

Note: Download the file below if you want the original image. The image shown above has been compressed and converted to WebP so it will not work.

Attempts

My first instinct was to isolate the QR code in the provided GIF image. This ended up being my biggest mistake.

With the QR code isolated, I noticed that three different colours were present in the image:

• #000000 (black)
• #ffffff (white)
• #fefcfd (slightly off white)

Visually, the presence of #fefcfd is not noticeable.

I scanned the QR code and got the message: Come and have a closer look:)

I generated a colour-coded QR where I mapped each distinct colour to red, green, or blue. This produced the following image:

My main idea was to somehow get a new scannable QR code that contained the flag.
At this stage, I tried many, MANY, different approaches to mutate the QR code into a working QR code.

Notably, I tried:

• Converting to binary and searching ASCII for flag.
• Inspecting GIF frames for differences.
• Ignoring various RGB channels.
• Swapping all RGB channels.
• Isolating certain colours.
• Reading LSB / MSB of each logical pixel in the QR code, then feeding it into other techniques.
• Trying to extract a Micro QR from the bigger QR.
• Generating all permutations for RGB colours.
• XORing various permutations together.
• Inspecting the GIF global colour palette.

Unfortunately, none of these techniques would lead to a solution because of my initial mistake of cropping the original GIF file (which modified the global GIF colour palette).

Solution

Inspecting the GIF in an image tool revealed that the GIF is in indexed colour mode. This means that there exists a global GIF colour palette with all the colours that are used in the GIF.

I used Photoshop to inspect the palette, and this is what I saw:

Notice how the ordering of the palette is as expected, except for the dark blue colour and second duplicate black colour. This is unexpected, and so we use Photoshop to tweak these colours as we preview the QR Code. We do a little bit of trial and error here by changing the 3 suspect colours in the palette. We end up with this configuration:

This generated the following QR code:

Scanning this QR code gives us our daily flag.

Flag:

HV24{Tw1st3d_c0lors_4re_fun!}