← Back to EHAX 2026

Let the Penguin Live

Forensics 50 pts

Category: Forensics
Points: 50
Solves: 171

Challenge Description

In a colony of many, one penguin's path is an anomaly. Silence the crowd to hear the individual.

Solution

1. Initial Analysis

The challenge provides an MKV (Matroska) video file. Using ffprobe, we discover it contains 3 streams:

1 H.264 video track
2 FLAC audio tracks (both stereo, 44100Hz)

The container metadata includes a decoy flag: EH4X{k33p_try1ng} -- literally telling us to keep trying.

2. Key Insight

The hint "silence the crowd to hear the individual" points to subtracting one audio track from the other to isolate a hidden signal. Having two nearly identical audio tracks is the "colony of many" -- the anomaly is the tiny difference between them.

3. Audio Differencing

Extract both audio streams and compute the difference signal (audio stream 2 minus audio stream 1). Most of the audio cancels out, leaving only the hidden data.

4. Spectrogram Analysis

Computing the spectrogram of the difference signal reveals text written as bright pixels in the frequency domain, visible around the 50-54 second mark. The flag is rendered as spectrogram art across multiple frequency bands (~3-6kHz and ~14-18kHz).