# Corctf 2022 Whack a Frog Writeup

Posted on Aug 8, 2022

## Problem ## Analysis

Analyzing the pcap file, we shall see that there are a lot of `/anticheat?x={x_coordinate}?y={y_coordinate}` requests.

Given the amount of coordinate data, it would make sense to plot these.

## Solution

Required python modules:

• `parse`: The opposite of format, used as a convinent replacement of regex.
• `numpy`: Numerica processing
• `matplotib`: Plotting

### Data processing

``````from parse import *
with open('whacking-the-froggers.pcap', 'rb') as f:

valids = []
for l in lines:
if b'anticheat' in l:
valids.append(l)

pat = "x={:d}&y={:d}"
coords = []

for v in valids:
res = search(pat, str(v))
coords.append((res, res))
``````

The `coords` list should now contain a list of (x,y) coordinate pairs

### Visualization

Displaying the coordinate data in a heatmap with matplotlib

``````import matplotlib.pyplot as plt
import numpy as np
a = np.zeros((525, 70))

for l in coords:
a[l]+=1

plt.imshow(a.transpose(), cmap='hot')
plt.show()
``````

## The result From the image we should be able to infer that the message says `LILYXOX`

Thus, the flag is `corctf{LILYXOX}`