?

SunCTF... again

Hi all! I've been lucky to be asked back to create challenges for SunCTF2026 this year. I made one web last year, obviously involved in the first one, and this is my first time creating some misc challenges. They're not very technical and kinda inspired by some challenges I've done in my life and my own interests, and if you played (the harder one) and had fun I am glad, and if you played it and hated it well sorry haha.

September (Misc)

Summary

You're given a MIDI file of the song September by Earth, Wind & Fire. It'll sound pretty normal, but if you look at it, you'll see a layer that does not deviate in pitch but is heard in either dots or dashes - it's morse!

Steps

  1. Rather straightforward. Open MIDI in a MIDI editor of your choosing.

  2. One of the layers contains the flag in morse code.

OpenMe (Misc)

Summary

You're given a .USTX file to work with. Google what can open it and you'll see that OpenUTAU is a vocal synthesizer. Open the file and you'll see the first half in the piano roll. On closer look, the voicebank (that is not included) is the gist hash. just put it in the URL and you'll find the voicebank download. Download it and open it in OpenUTAU and look at the sample waveform to find the last half of the flag hidden, or alternatively just view the .wav in Audacity and find the last half there.

Steps

  1. Open the file in a program that can open USTX files. You'll see the first half of the flag right there if you open it in the program. USTX files only come with the name of the voicebank if you don't have it, the one in this will have a garbled name. f

  2. Garbled name is actually the URL of a gist, go to gist and download the voicebank. I've also seen the URL float around if you search it on Bing.

f

f

  1. Install the voicebank, view the voicebank samples in OpenUTAU by clicking on "Tools" > "Singers". Last half is hidden inside the wavform.

ALTERNATE SOLUTION: Just analyze the .wav file in Audacity after you find the gist.

f