Successfully debuted at BSides San Diego 2026, ORI’s Lunar Descent CTF has been updated with additional documentation and example solutions
One of the many activities that we do at ORI is to participate in and host contests and puzzles. Capture the Flag competitions (CTFs) are a particular type of competition commonly encountered in the cybersecurity and hacking communities. CTFs pose a set of challenges for participants to solve, often drawn from a particular theme or subject. CTFs can be tackled by individuals, but the interdisciplinary and complex nature of many CTFs require a team working together in order to score enough points to be at the top of the leader board.
The Lunar Descent CTF debuted at BSides San Diego, held at San Diego State Univsity on 4 April 2026. This is an ORI original, and all documents can be found on GitHub at https://github.com/OpenResearchInstitute/lunar-descent-ctf. The CTF is based on a real signal processing problem in a radar altimeter.
ISRO’s KaRA radar altimeter guided Chandrayaan-3 to a soft lunar landing on 23 August 2023. The Radar Altimeter Processor (RAP) computes altitude and velocity from FMCW chirp signals, running on a single Xilinx Virtex-5 FPGA. This CTF uses a Python model of that system, faithful to the published paper, where the altimeter feeds a landing autopilot. The altimeter works perfectly. However, once the system was operational, the autopilot keeps crashing in last-minute testing. Why? The answer is the solution to the CTF.
The Lunar Descent CTF is self-scoring and self-paced, which reduced the workload of the booth volunteers. A copy of the IEEE Aerospace and Electronics System Society Magazine article that inspired the CTF was available for people to read. ORI-themed USB drives with a copy of the CTF repository contents were given away to anyone that wanted one to take home with them. The CTF attracted a lof of attention at the ORI-supported RF Village at BSides San Diego, and reviews from participants were very good. While it was anticipated that some participants would be able to solve the CTF in two hours or so, it took the first place winner most of the day, as they wanted to see all the other villages at BSides, and also attend talks. The self-paced “take home” format greatly reduced the pressure on the participants to commit to a contest over seeing the rest of the show. We received positive feedback about this decision, and will use the self-scoring and self-paged methodology in future CTFs. This approach was inspired by the self-scoring BLE CTF, which can be found at https://github.com/hackgnar/ble_ctf
If you would l like to try the CTF, then clone the lunar-descent-ctf repository, start with the top-level README.md, and avoid looking in the spoilers/ directory. The spoilers/ directory has a README file for staff running the event, detailed directions on how to score challenge #1, and also has two example solutions for challenge #2 and challenge #3. Since the solutions are tucked away into a separate directory, one can clone the repository and attempt the CTF without accidentally seeing any of the solutions or hints. However, if you get stuck, or want to compare your solution to the example solutions, all you need to do is drop down into the spoilers/ directory and read through the documentation and solutions.
If you want to use this CTF at your own event, please feel free to clone it and adapt it for your setting and audience.