↓ Skip to main content
bubka hacks stuff

HTB-Hubbub

Reverse Engineering Linux ELF Ghidra Avr
Table of Contents

Description
In the cacophony of noise lies the potential for a clear message. (The flag format is HTB{SOME TEXT HERE}.)

Difficulty: Easy
OS: Linux
Date: 2026-01-21

Initial Analysis
#

I identified the binary type to understand what I was dealing with

1$ file Hubbub 
2Hubbub: ELF 32-bit LSB executable, Atmel AVR 8-bit, version 1 (SYSV), statically linked, with debug_info, not stripped

Its’ an Atmel AVR 8-bit executable, commonly used in Arduino microcontrollers

Running strings on the binary revealed references to Arduino library functions like tone() and delay(). This immediately suggested the program generates audio output, possibly encoding a hidden message.

Reverse
#

I’m opened it in Ghidra and found a main logic in function (FUN_code_0002f4) i understood that … and than …

alt text
Inside main, I observed a repetitive pattern of function calls. By correlating the assembly instructions with the strings found earlier, I identified two key functions:

The Pattern Emerges
#

tone (FUN_code_0001b5): generates sound at specific frequencies

delay (FUN_code_000098): creates pauses in execution

Looking closely at the arguments passed to delay(), I noticed two distinct constants being loaded into registers: - 0x012c (300 ms)
- 0x0158 (600 ms)

Given the audio context, i hypothesized this was Morse Code.

- The shorter duration 0x2c represents a Dot (.)
- The longer duration 0x58 (exactly double the short duration) represents a Dash (-)

Decoding
#

I extracted the decompiled C code from Ghidra into a text file named dec.txt and wrote a Python script to parse it

 1with open("dec.txt", 'r', encoding='utf-8') as f:
 2    lines = f.readlines()
 3
 4morse_code = ""
 5
 6for l in lines:
 7    if "0x2c" in l:
 8        morse_code += "."
 9    elif "0x58" in l:
10        morse_code += "-"
11    
12    if "0xe8" in l:
13        morse_code += " "
14    elif "0xd0" in l:
15        morse_code += " / " 
16
17print(morse_code)
18
19MORSE_dict = {
20    '..-.': 'F', '-..-': 'X', '.--.': 'P', '-': 'T', '..---': '2',
21    '....-': '4', '-----': '0', '--...': '7', '...-': 'V', '-.-.': 'C',
22    '.': 'E', '.---': 'J', '---': 'O', '-.-': 'K', '----.': '9',
23    '..': 'I', '.-..': 'L', '.....': '5', '...--': '3', '-.--': 'Y',
24    '-....': '6', '.--': 'W', '....': 'H', '-.': 'N', '.-.': 'R',
25    '-...': 'B', '---..': '8', '--..': 'Z', '-..': 'D', '--.-': 'Q',
26    '--.': 'G', '--': 'M', '..-': 'U', '.-': 'A', '...': 'S', '.----': '1'
27}
28
29def morse_to_text(stri):
30    res = ""
31    stri = stri.split(" ")
32
33    for s in stri:
34        if s == "/":
35            res += " "   
36        else: 
37            res += MORSE_dict[s]
38    return res
39
40print(morse_to_text(morse_code))

Running the script:

1$ python3 dec.py
2.... - -... / .- / -. --- .. ... -.-- / -... ..- --.. --.. . .-. / -.-. --- -- -- .- -. -.. ... / .- - - . -. - .. --- -.
3HTB A NOISY BUZZER COMMANDS ATTENTION

the flag:

1HTB{A NOISY BUZZER COMMANDS ATTENTION}