Corctf 2022 Whack a Frog Writeup

Posted on Aug 8, 2022



Analyzing the pcap file, we shall see that there are a lot of /anticheat?x={x_coordinate}?y={y_coordinate} requests.

Given the amount of coordinate data, it would make sense to plot these.


Required python modules:

  • parse: The opposite of format, used as a convinent replacement of regex.
  • numpy: Numerica processing
  • matplotib: Plotting

Data processing

from parse import *
with open('whacking-the-froggers.pcap', 'rb') as f:
    lines = f.readlines()

valids = []
for l in lines:
    if b'anticheat' in l:

pat = "x={:d}&y={:d}"
coords = []

for v in valids:
    res = search(pat, str(v))
    coords.append((res[0], res[1]))

The coords list should now contain a list of (x,y) coordinate pairs


Displaying the coordinate data in a heatmap with matplotlib

import matplotlib.pyplot as plt
import numpy as np
a = np.zeros((525, 70))

for l in coords:

plt.imshow(a.transpose(), cmap='hot')

The result

From the image we should be able to infer that the message says LILYXOX

Thus, the flag is corctf{LILYXOX}