PicoCTF Static Noise Writeup — Identify a File Hidden in Binary Data

A provided file looks like a random data stream (static noise), but its extension or appearance is misleading — the file command reveals its true type (based on its "magic bytes"), and strings (or binwalk) lets us extract the readable text hidden inside, including the flag.

• Platform: picoGym
• Category: Misc
• Points: 100 pts
• Difficulty: Beginner
• Tools: filestringsbinwalk

Challenge description

The challenge provides a file named mystery.bin, with a cryptic prompt:

"All I see is static... or is there something more?"

Opening the file with a hex editor or a plain cat, we end up with what looks like a stream of random bytes — no visible pattern to the naked eye, like white noise. Nothing clearly indicates what type of file it is.

Step 1 — Identify the real file type

The number one reflex when facing any unknown file in a CTF: never trust the extension, and run file. This command reads the first bytes of the file (the "magic bytes") and compares them against a database of known signatures to determine the actual format:

$ file mystery.bin
mystery.bin: Zip archive data, at least v2.0 to extract

Surprise: despite its generic .bin extension and its noisy binary appearance, the file is actually a ZIP archive. Magic bytes never lie, unlike a file's extension.

Step 2 — Extract readable text with strings

Before even treating the file as a ZIP archive, we can try a more direct approach: strings extracts every printable character sequence contained in a binary file, regardless of its format:

$ strings -n 8 mystery.bin | grep picoCTF
picoCTF{***}

The -n 8 option filters to keep only sequences of at least 8 consecutive printable characters, which eliminates most of the random binary noise and surfaces the actual text strings — here, the flag appears directly, stored in plaintext inside the archive despite the raw file's noisy appearance.

Step 3 — If needed, dig deeper with binwalk

On a trickier variant of the challenge where strings alone isn't enough (compressed flag or a file embedded more deeply), we use binwalk to scan the file for signatures of nested files:

$ binwalk mystery.bin

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
0             0x0             Zip archive data, at least v2.0 to extract
128           0x80            End of Zip archive, footer signature

If an archive or an image is detected inside, we extract it automatically with the -e option:

$ binwalk -e mystery.bin
$ ls _mystery.bin.extracted/
flag.txt

This complementary approach is useful whenever a simple grep on the strings output isn't enough to spot the flag directly.

Step 4 — Spot the flag

Whether via strings directly or after extraction with binwalk, the flag appears in the standard picoCTF{...} format among the text strings extracted from the file.

🚩 picoCTF{ flag intentionally hidden }

The flag is deliberately hidden — follow the method, you've earned it. 💪

Key takeaways

A short challenge that builds reflexes essential for everything that follows:

• Never trust a file extension — the "magic bytes" at the start of a file are the real source of truth about its format
• file, strings, and binwalk form the go-to trio of tools for a first inspection of any unknown binary file
• What looks like random noise to the naked eye can be an archive, an image, or any other perfectly structured format — only the right tools reveal the truth

Originally published on CTFdojo — join the CTFdojo Discord to discuss writeups and get notified about new ones.