← Back to EHAX 2026

BabySerial

Forensics 50 pts

Challenge Type: Hardware / Forensics (Saleae Logic Analyzer capture)
File Provided: babyserial.sal
Goal: Extract hidden flag from serial (UART) communication dump

Tools Used

  • Kali Linux
  • Saleae Logic 2 (AppImage)
  • Terminal commands (tr, base64)

Step-by-Step Walkthrough

  1. Download and Open the Capture
    • Downloaded babyserial.sal
    • Launched Saleae Logic 2 (./Logic-2.*-linux-x64.AppImage after chmod +x)
    • File → Open Capture → selected babyserial.sal
  2. Configure Async Serial Analyzer
    • Added Async Serial analyzer on Channel 0 (D0) -- the only active channel
    • Settings that worked:
      • Bit Rate: 115200 (or close measured value; no major framing errors)
      • Bits per Frame: 8
      • Stop Bits: 1
      • Parity: None
      • Bit Order: LSB first
      • Signal Inversion: Non-inverted
    • Terminal view immediately showed readable ASCII → long Base64 string starting with iVBORw0KGgo...
  3. Extract the Raw Data
    • Switched to Terminal tab (or Data Table)
    • Selected all visible text (Ctrl+A or drag-select)
    • Copied everything (Ctrl+C)
  4. Clean and Save the Base64
    • Created file: base64.txt
    • Pasted the copied data
    • Removed junk (timestamps, hex prefixes, extra spaces/newlines if any)
    • Cleaned it up
  5. Decode to PNG
    • Ran base64 -d clean_base64.txt > flag.png
  6. Open and Inspect
    • xdg-open flag.png