CrewCTF 2024 Sniff One, Sniff Two Writeup

import csv
from ascii_codes import ascii
import sys
import time
import traceback

with open("../dist/i2c_keyboard.csv") as file:
    reader = csv.reader(file)
    header = next(reader)
    for row in reader:
        address = int(row[2], 16)
        data = int(row[3], 16)
        if address == 0x5F and data in ascii:
            button = ascii[data]
            #print(hex(data))
            print(*button)

def set_image(self, image):
    """Copy an image to the buffer.

    The dimensions of `image` should match the dimensions of the display being used.

    :param image: Image to copy.
    :type image: :class:`PIL.Image.Image` or :class:`numpy.ndarray` or list
    """
    if self.rotation % 180 == 0:
        self.buf = numpy.array(image, dtype=numpy.uint8).reshape((self.width, self.height))
    else:
        self.buf = numpy.array(image, dtype=numpy.uint8).reshape((self.height, self.width))

def show(self, busy_wait=True):
    """Show buffer on display.

    :param bool busy_wait: If True, wait for display update to finish before returning, default: `True`.
    """
    region = self.buf

    if self.v_flip:
        region = numpy.fliplr(region)

    if self.h_flip:
        region = numpy.flipud(region)

    if self.rotation:
        region = numpy.rot90(region, self.rotation // 90)

    buf_a = numpy.packbits(numpy.where(region == BLACK, 0, 1)).tolist()
    buf_b = numpy.packbits(numpy.where(region == RED, 1, 0)).tolist()

def _update(self, buf_a, buf_b, busy_wait=True):
    """Update display.

    :param buf_a: Black/White pixels
    :param buf_b: Yellow/Red pixels

    """
    self.setup()

    packed_height = list(struct.pack('<H', self.rows))

    if isinstance(packed_height[0], str):
        packed_height = map(ord, packed_height)

    self._send_command(0x74, 0x54)  # Set Analog Block Control
    self._send_command(0x7e, 0x3b)  # Set Digital Block Control

    self._send_command(0x01, packed_height + [0x00])  # Gate setting

    self._send_command(0x03, 0x17)  # Gate Driving Voltage
    self._send_command(0x04, [0x41, 0xAC, 0x32])  # Source Driving Voltage

    self._send_command(0x3a, 0x07)  # Dummy line period
    self._send_command(0x3b, 0x04)  # Gate line width
    self._send_command(0x11, 0x03)  # Data entry mode setting 0x03 = X/Y increment

    self._send_command(0x2c, 0x3c)  # VCOM Register, 0x3c = -1.5v?

    self._send_command(0x3c, 0b00000000)
    if self.border_colour == self.BLACK:
        self._send_command(0x3c, 0b00000000)  # GS Transition Define A + VSS + LUT0
    elif self.border_colour == self.RED and self.colour == 'red':
        self._send_command(0x3c, 0b01110011)  # Fix Level Define A + VSH2 + LUT3
    elif self.border_colour == self.YELLOW and self.colour == 'yellow':
        self._send_command(0x3c, 0b00110011)  # GS Transition Define A + VSH2 + LUT3
    elif self.border_colour == self.WHITE:
        self._send_command(0x3c, 0b00110001)  # GS Transition Define A + VSH2 + LUT1

    if self.colour == 'yellow':
        self._send_command(0x04, [0x07, 0xAC, 0x32])  # Set voltage of VSH and VSL
    if self.colour == 'red' and self.resolution == (400, 300):
        self._send_command(0x04, [0x30, 0xAC, 0x22])

    self._send_command(0x32, self._luts[self.lut])  # Set LUTs

    self._send_command(0x44, [0x00, (self.cols // 8) - 1])  # Set RAM X Start/End
    self._send_command(0x45, [0x00, 0x00] + packed_height)  # Set RAM Y Start/End

    # 0x24 == RAM B/W, 0x26 == RAM Red/Yellow/etc
    for data in ((0x24, buf_a), (0x26, buf_b)):
        cmd, buf = data
        self._send_command(0x4e, 0x00)  # Set RAM X Pointer Start
        self._send_command(0x4f, [0x00, 0x00])  # Set RAM Y Pointer Start
        self._send_command(cmd, buf)

    self._send_command(0x22, 0xC7)  # Display Update Sequence
    self._send_command(0x20)  # Trigger Display Update
    time.sleep(0.05)

    if busy_wait:
        self._busy_wait()
        self._send_command(0x10, 0x01)  # Enter Deep Sleep

# 0x24 == RAM B/W, 0x26 == RAM Red/Yellow/etc
for data in ((0x24, buf_a), (0x26, buf_b)):
    cmd, buf = data
    self._send_command(0x4e, 0x00)  # Set RAM X Pointer Start
    self._send_command(0x4f, [0x00, 0x00])  # Set RAM Y Pointer Start
    self._send_command(cmd, buf)

with open("./inky_spi.csv") as file:
    reader = csv.reader(file)
    header = next(reader)
    in_packet = False
    in_b_w = False
    in_y = False
    b_w = []
    y = []
    for row in reader:
        record = [int(row[2], 16), int(row[3], 16)]
        is_command = record[1] == 0x00
        is_data = not is_command
        if is_command:
            command = record[0]
            if command == 0x01:
                in_packet = True
            elif command == 0x20:
                in_packet = False
                display(b_w, y)
                b_w = []
                y = []
            elif command == 0x24:
                in_b_w = True
            elif command == 0x26:
                in_y = True
                in_b_w = False
        elif is_data:
            if in_packet:
                data = record[0]
                if in_b_w:
                    b_w.append(data)
                elif in_y:
                    y.append(data)

def display(buf_a, buf_b):
	BLACK = 1
	RED = 2

	color_mapping = {
		0: (255, 255, 255),
		1: (0, 0, 0),
		2: (255, 0, 0)
	}

	buf_a_unpacked = np.unpackbits(np.array(buf_a, dtype=np.uint8))
	buf_b_unpacked = np.unpackbits(np.array(buf_b, dtype=np.uint8))

	width = 136
	height = 250

	buf_a = buf_a_unpacked[:height * width].reshape((height, width))
	buf_b = buf_b_unpacked[:height * width].reshape((height, width))

	buf = np.zeros((height, width), dtype=np.uint8)

	for i in range(height):
		for j in range(width):
			if buf_a[i, j] == 0:
				buf[i, j] = BLACK
			elif buf_b[i, j] == 1:
				buf[i, j] = RED
			else:
				buf[i, j] = 0

	height, width = buf.shape
	image_array = np.zeros((height, width, 3), dtype=np.uint8)
	for y in range(height):
		for x in range(width):
			image_array[y, x] = color_mapping[buf[y,x]]
	image = Image.fromarray(image_array, 'RGB')
	image.show()