CÖDEBULLAR - Hack.lu 2025

Introduction

This years Hack.lu theme was based on IKEA, the swedish furniture store. Since IKEA is almost as much a restaurant as it is a furniture store, we of course needed a food-themed challenge.

In a stroke of genius, I noticed that Köttbullar, the swedish meatballs, could be rewritten as CÖÐEBULLAR, a great name for a crypto challenge. In another stroke of genius, I also noticed that köttbullar kinda look like 0’s, and hotdogs, the other food IKEA is known for, look like 1’s. Thus, this challenge was born.

The challenge consists of two handout files:

In codebullar.py, we can find out how the archive encoded.zip was created.

import os
import random
from PIL import Image

köttbullar_dir = './assets/köttbullar'
hotdogs_dir = './assets/hotdogs'
output_dir = './encoded'
os.makedirs(output_dir, exist_ok=True)

köttbullar_files = [os.path.join(köttbullar_dir, f) for f in os.listdir(köttbullar_dir)]
hotdogs_files = [os.path.join(hotdogs_dir, f) for f in os.listdir(hotdogs_dir)]

with open('./secret.txt', 'r') as f:
    FLAG = f.read().strip()

bin_str = ''.join(format(ord(c), '08b') for c in FLAG)

for i, bit in enumerate(bin_str):
    src = random.choice(köttbullar_files) if bit == '0' else random.choice(hotdogs_files)
    dst = os.path.join(output_dir, f'{i:04}.jpeg')
    with Image.open(src) as img:
        img.save(dst, format='JPEG', quality=95)

print(f'Encoded {len(bin_str)} bits with CODEBULLAR encoding')

The script reads the file secret.txt, which contains the flag, and converts it to a bitstream. Then, for each bit, it saves a random image of a köttbullar or hotdog to ./encoded, depending on whether the current bit is a 1 or 0. The name of the image is the bit-index.

The handout does not contain the assets/ folder, in which the original köttbullar and hotdog images were stored, so we have to classify the images ourselves.

Analyzing the Encoded Output

Looking inside encoded.zip, we find that the many of the images are duplicates. Multiple duplicate images in the handout

To find the exact number, we can run:

find /path/to/dir -type f -exec sha256sum {} + | sort | uniq -w 64 | wc -l

and find that there are 32 unique filehashes, i.e. 32 unique images.

We can therefore easily classify the images by hand, and apply the classification to all images with the same file hash.

Decoding CÖDEBULLAR encoding

Using the following python-script, we can manually classify each image once, apply the classification to all images based on the file hash, and from that reconstruct the bitstream.

import os
import hashlib
from PIL import Image
import numpy as np

# Configuration
IMG_DIR = "./encoded"

def image_hash(path):
    with Image.open(path) as img:
        img = img.convert("L").resize((8, 8))
        arr = np.array(img).flatten()
        return hashlib.sha1(arr.tobytes()).hexdigest()

def main():
    files = sorted(f for f in os.listdir(IMG_DIR) if f.endswith(".jpeg"))
    hash_map = {}
    labels = {}

    # Build hash map for duplicates
    for f in files:
        h = image_hash(os.path.join(IMG_DIR, f))
        if h in hash_map:
            hash_map[h].append(f)
        else:
            hash_map[h] = [f]

    # Manual classification
    for h, imgs in hash_map.items():
        ref = imgs[0]
        img_path = os.path.join(IMG_DIR, ref)
        img = Image.open(img_path)
        img.show()
        cls = input(f"{ref}: kottbullar(0) or hotdog(1)? ").strip()
        while cls not in {"0", "1"}:
            cls = input("Enter 0 or 1: ").strip()
        for f in imgs:
            labels[f] = cls
        img.close()

    # Construct bitstring in file order
    bitstring = "".join(labels[f] for f in files)
    text = "".join(chr(int(bitstring[i:i+8], 2)) for i in range(0, len(bitstring), 8))
    print(text)

if __name__ == "__main__":
    main()

After running the script, we recover secret.txt, containing the flag:

Hotdogs are sausages served in soft buns, typically made from beef, pork, or chicken. They are often topped with mustard, ketchup, onions, or relish. The world record HPM (Hotdogs per Minute) is 6, achieved by Miki Sudo. The flag for this challenge is flag{w3_0bv10u5ly_n33d3d_4_f00d_ch4113n93}. Köttbullar are Swedish meatballs made from ground beef and pork, mixed with breadcrumbs, egg, and spices. They are usually served with creamy gravy, lingonberry jam, and boiled potatoes. According to the swedish government, köttbullar are based on a recipe King Karl XII brought home from the ottoman empire. However, the Swedish food historian Richard Tellström says this claim is a modern myth.

And just for your enjoyment, here are all the köttbullar and hotdog images:

Powered by Hugo with Console Theme.