Debugging Interface

.sal File

file debugging_interface_signal.sal 
debugging_interface_signal.sal: Zip archive data, made by v4.5 UNIX, extract using at least v2.0, last modified Mar 23 2021 12:02:50, uncompressed size 22090, method=deflate

This is a Saleae Logic 1.x capture file.

• Saleae’s software uses it for saved logic-analyzer captures.

Internally it is simply a ZIP archive (v4.5, deflate-compressed) that contains: – meta.json (sample rate, channel names, etc.) – digital.bin (the actual raw logic samples)

Let’s extract it:

Extracting the ZIP

┌──(kali㉿vm-kali)-[~/…/challenges/hardware/debugging_interface/dir]
└─$ unzip debugging_interface_signal.sal -d extracted_sal

Archive:  debugging_interface_signal.sal
  inflating: extracted_sal/digital-0.bin  
  inflating: extracted_sal/meta.json  
                                                                                                                                                                                                             
┌──(kali㉿vm-kali)-[~/…/challenges/hardware/debugging_interface/dir]
└─$ cd extracted_sal 
                                                                                                                                                                                                             
┌──(kali㉿vm-kali)-[~/…/hardware/debugging_interface/dir/extracted_sal]
└─$ ls -la
total 60
drwxrwxr-x 2 kali kali  4096 Aug  3 17:07 .
drwxrwxr-x 3 kali kali  4096 Aug  3 17:07 ..
-rw-r--r-- 1 kali kali 22090 Mar 23  2021 digital-0.bin
-rw-r--r-- 1 kali kali 27810 Mar 23  2021 meta.json

Looking inside the .bin file with strings or cat yields no result.

xxd digital-0.bin| head
00000000: 3c53 414c 4541 453e 0100 0000 6400 0000  <SALEAE>....d...
00000010: 0100 0000 0084 d787 414b 80f6 5e78 0100  ........AK..^x..
00000020: 0066 6666 6666 66e6 3f00 003a 0000 0000  .ffffff.?..:....
00000030: 0000 0000 0000 0000 0000 0000 8019 0000  ................
00000040: 0000 0000 8019 0000 0000 0080 f0fa 0200  ................
00000050: 0000 0001 0000 0000 0000 0004 0000 0000  ................
00000060: 0000 0040 e5ff 7f01 0000 0000 0000 0000  ...@............
00000070: 0000 0000 0000 0000 0000 0000 0000 0001  ................
00000080: 0000 0000 8019 0000 0000 0000 0033 0000  .............3..
00000090: 0000 0000 8019 0000 0000 0080 f0fa 0200  ................

3c 53 41 4c 45 41 45 3e → "<SALEAE>"

We will analyze the .sal file using Logic 2 (SALEAE’s software). Open the .sal file.

Go to the analyzer tab and set the Async Serial values:

All we see is framing or errors:

To fix this error all we do is go to the first wave:

We will measure the time from one falling edge to the next (start bit to start bit). (32.02 microseconds)

Convert it into seconds and apply the formula:

1 / 32.02x10^(-6)

Insert the result in bit rate field (from analyzer async serial menu).

View in terminal form:

[MSG] Activity from: 003b9434a45f0eecd2d35bcc78129aa3edc363f802ae5abdd161c4f421ca49a7
[MSG] Activity from: 65ec312325f43f40107dfcba651cab2d1afb6df54578065f1d8bba89801d3ef2
[MSG] Activity from: 223e634cea203ba2c7d4e7931a2dafdf0d452309c1a1eb1a28fc2fae057df400
[MSG] Activity from: 431d591c6eed3b6e793b316d7bf6ce2e3be51aa707680b6f14511fbc9dae9e32
[MSG] Activity from: 65ec312325f43f40107dfcba651cab2d1afb6df54578065f1d8bba89801d3ef2
[MSG] Activity from: 65ec312325f43f40107dfcba651cab2d1afb6df54578065f1d8bba89801d3ef2
[MSG] Activity from: ebb2b5d1dfbbb8174f5fb1fd15230540aea77772d3a65482def3d978f6caf152
[MSG] Activity from: f7fab4b591754a190be32cb607f257f436fa3f325d71edf41b6179c5330cd75a
[MSG] Activity from: 476bdcaf166385371f49c54ba74d275cfdfa5c70c255ea45363e3795cbc11ae5
[MSG] Activity from: 63681fa3c03451c49f9fc2ab9be43bea7f069069c1c472f6a41e3ef3a761de50
[MSG] Activity from: 36257a19934b71cea753da3df9be8ae8ca49ee843b72b1c5468f8f5dab8a7ad0
[MSG] Activity from: 36257a19934b71cea753da3df9be8ae8ca49ee843b72b1c5468f8f5dab8a7ad0
[MSG] Activity from: HTB{d38u991n9_xxxx_d3v1c3!!52}

---