{"id":1442,"date":"2026-09-06T16:47:52","date_gmt":"2026-09-06T16:47:52","guid":{"rendered":"https:\/\/www.securesteps.tn\/?p=1442"},"modified":"2026-09-06T16:47:52","modified_gmt":"2026-09-06T16:47:52","slug":"sleepy-cpu-nns-ctf-walkthrough","status":"publish","type":"post","link":"https:\/\/www.securesteps.tn\/ar\/sleepy-cpu-nns-ctf-walkthrough\/","title":{"rendered":"Sleepy CPU \u2014 Power-Trace Flag Recovery | NNS CTF"},"content":{"rendered":"

Sleepy CPU \u2014 Power-Trace Flag Recovery<\/h1>\n

Platform:<\/strong> NNS CTF 2026
Category:<\/strong> Miscellaneous \/ Hardware Forensics<\/p>\n

1. The misleading source flag<\/h2>\n

The challenge includes a Zephyr application and a flag.h<\/code> file. The header contains a decoy value, so reading the source string is not a valid solution. The real behavior is visible in the supplied Joulescope recording, sleepy_cpu.jls<\/code>.<\/p>\n

2. What the firmware leaks<\/h2>\n

The application loops through the flag one character at a time:<\/p>\n

for (char* c = flag; *c; c++) {\n    for (int i = 0; i < 100000; i++) {\n        __asm volatile (\"nop\");\n    }\n    k_sleep(K_MSEC(*c));\n}<\/code><\/pre>\n
Each character creates two observable phases. First, the processor performs 100,000 nop<\/code> instructions, producing a repeatable high-current region. It then sleeps for a number of milliseconds equal to the ASCII value of the current character. The low-current gap is therefore a direct timing encoding of the byte.<\/p>\n
3. Reading the trace<\/h2>\n
The trace contains a 50 kHz signal, so there are 50 samples per millisecond. A current threshold of 0.0016 A<\/code> separates the high-current instruction loops from the quiet sleep intervals. The decoder marks transitions into and out of high-current regions and keeps runs longer than 250 samples to reject noise.<\/p>\n
If end_previous<\/code> is the end of one high-current run and start_current<\/code> is the beginning of the next, then:<\/p>\n
gap_samples = start_current - end_previous\ncharacter = round(gap_samples \/ 50)<\/code><\/pre>\n
The first high-current run has no preceding character gap. Every following run contributes one decoded character. A final high-current run after the last sleep acts as a terminator and makes the last character measurable.<\/p>\n
4. Reproduction<\/h2>\n
import pyjls, numpy as np\nr = pyjls.Reader('misc_sleepy-cpu\/sleepy_cpu.jls')\nx = r.fsr(2, 0, r.signals[2].length)\nhigh = x > 0.0016\nedges = np.diff(np.r_[False, high, False].astype(np.int8))\nstarts = np.flatnonzero(edges == 1)\nends = np.flatnonzero(edges == -1)\nruns = [(a, z) for a, z in zip(starts, ends) if z-a > 250]\nvals = [round((runs[i][0] - runs[i-1][1]) \/ 50)\n        for i in range(1, len(runs))]\nprint(''.join(chr(v) for v in vals))<\/code><\/pre>\n
The preserved decode.py<\/code> prints the number of detected runs, each gap, each candidate character, and the final decoded string. It identifies 58 regions and 57 inter-region gaps.<\/p>\n
5. Verified result<\/h2>\n
NNS{pow3r_4n4lys15_c4n_rev3al_what_th3_cpu_i5_w0rk1ng_on}<\/code><\/pre>\n
6. Why this works<\/h2>\n
The program does not need to intentionally transmit the flag. The current draw of the CPU is correlated with its instruction and sleep state, and the sleep duration is controlled directly by the secret byte. This is a timing and power side channel: the measurement device becomes the output channel.<\/p>\n
7. Defensive lessons<\/h2>\n
    \n
  • Do not perform secret-dependent sleeps on observable hardware.<\/li>\n
  • Use constant-time and constant-power techniques where practical.<\/li>\n
  • Keep sensitive operations away from externally measurable power rails.<\/li>\n
  • Do not assume that removing serial output removes information leakage.<\/li>\n
  • Validate suspicious \u201cdecoy\u201d source values against runtime measurements.<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"
    Detailed NNS CTF hardware-forensics walkthrough explaining the Zephyr loop, power-trace segmentation, sampling conversion, decoder, and side-channel lessons.<\/p>","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_joinchat":[],"footnotes":""},"categories":[30],"tags":[],"class_list":["post-1442","post","type-post","status-publish","format-standard","hentry","category-infrastructuresecurity"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t