{"id":1443,"date":"2026-09-06T16:44:48","date_gmt":"2026-09-06T16:44:48","guid":{"rendered":"https:\/\/www.securesteps.tn\/?p=1443"},"modified":"2026-09-06T16:44:48","modified_gmt":"2026-09-06T16:44:48","slug":"harald-blatann-nns-ctf-walkthrough","status":"publish","type":"post","link":"https:\/\/www.securesteps.tn\/ar\/harald-blatann-nns-ctf-walkthrough\/","title":{"rendered":"Harald Bl\u00e5tann \u2014 BLE Device Information Service | NNS CTF"},"content":{"rendered":"

Harald Bl\u00e5tann \u2014 BLE Device Information Service<\/h1>\n

Platform:<\/strong> NNS CTF 2026
Category:<\/strong> Reverse Engineering \/ Bluetooth<\/p>\n

1. Artifact and first hypothesis<\/h2>\n

The challenge provides an Intel HEX image for ARM Thumb firmware running on an nRF\/Zephyr Bluetooth device advertised as NNS flag checker<\/code>. The image contains a long custom characteristic value that looks attractive, but it is an explicit decoy: NNS{th15_is_n0t_th3_fl4g}<\/code>.<\/p>\n

The correct approach is to reconstruct the GATT data instead of trusting the most visible string. Zephyr stores attribute records, UUID references, callbacks, permissions, and user-data pointers in the firmware image. Standard Bluetooth services are also more likely to have meaningful labels than arbitrary vendor characteristics.<\/p>\n

2. Parsing the Intel HEX image<\/h2>\n

extract_dis_flag.py<\/code> reads every HEX record, validates its checksum, handles extended segment and linear addresses, and reconstructs a contiguous image beginning at 0x01000000<\/code>. This validation matters: one ignored address record or bad checksum could make every later pointer incorrect.<\/p>\n

Each reconstructed attribute is interpreted as six little-endian words\/halfwords. UUID references are read from the image, and NUL-terminated strings are resolved through the attribute’s user-data pointer.<\/p>\n

3. Locating the useful service<\/h2>\n

The service declaration at 0x01026F78<\/code> points to UUID 0x180A<\/code>, the standard Device Information Service. Its value attributes have the expected UUIDs:<\/p>\n

    \n
  • 0x01026FA0<\/code> \u2192 0x2A24<\/code>, Model Number;<\/li>\n
  • 0x01026FC8<\/code> \u2192 0x2A29<\/code>, Manufacturer Name;<\/li>\n
  • 0x01027018<\/code> \u2192 0x2A25<\/code>, Serial Number.<\/li>\n<\/ul>\n

    The script checks each UUID before reading its pointer. This prevents accidentally interpreting an adjacent attribute or a decoy string as the answer.<\/p>\n

    4. Extracting and assembling the values<\/h2>\n

    The exact NUL-terminated values are:<\/p>\n

    Model Number (UUID 0x2A24): Flag checker\nManufacturer Name (UUID 0x2A29): NNS\nSerial Number (UUID 0x2A25): 1337<\/code><\/pre>\n
    The model confirms that this is the intended checker. The manufacturer supplies the flag namespace and the serial number supplies the body. Combining them according to the challenge convention gives Manufacturer{Serial Number}<\/code>.<\/p>\n
    5. Reproduction<\/h2>\n
    cd \/home\/z13db\/CTF\/reverse\/harald-blatann\npython3 extract_dis_flag.py<\/code><\/pre>\n
    The script asserts the HEX checksums, minimum flash address, service UUID, all three characteristic UUIDs, and all expected string values. It then prints the assembled result.<\/p>\n
    6. Verified flag<\/h2>\n
    NNS{1337}<\/code><\/pre>\n
    7. Lessons<\/h2>\n
      \n
    • Do not assume a custom characteristic is the intended data source.<\/li>\n
    • Standard GATT services have stable UUID semantics and are excellent anchors during firmware analysis.<\/li>\n
    • Validate binary checksums and pointers before trusting extracted strings.<\/li>\n
    • When a challenge includes a decoy, prove the final value through several independent structure checks.<\/li>\n<\/ul>","protected":false},"excerpt":{"rendered":"
      Detailed NNS CTF reverse-engineering walkthrough covering Intel HEX validation, Zephyr GATT attribute reconstruction, UUID checks, and flag assembly.<\/p>","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_joinchat":[],"footnotes":""},"categories":[1],"tags":[],"class_list":["post-1443","post","type-post","status-publish","format-standard","hentry","category-webapplicationsecurity"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t