Welcome To HackFesta 2025

There are three types of challenges: PASTA challenges using PASTA hardware, RAMN challenges using RAMN hardware, and SERVER challenges entirely online.

PASTA challenges are worth a total of 2485 points, RAMN challenges 6190 points, and SERVER challenges 3920 points.

For all challenges, you can get generous help, so do persevere on hard challenges and ask organizers for help if you ran out of ideas or need technical guidance.

RAMN Challenges

There are five categories for RAMN challenges:

• CAN: learn how to receive and send CAN messages, until you can take control of a virtual vehicle.
• UDS: learn how to interact with ECUs using UDS commands.
• USB: Explore commands available on custom command line interfaces, and see how they interact with the CAN bus.
• HARDWARE: Get familiar with the hardware, maybe even connect a logic analyzer?
• MISC: some riddles to relax between hard technical challenges.

We recommend that you start with the first challenges of the CAN, UDS, and USB categories, then move on to your preferred type of challenges.

RAMN categories are independent and can be done simulatenously by different participants.

SERVER challenges

Server challenges are traditional CTF challenges. Try them out if you are already familiar with this type of challenges. You will need to use tools that were not covered by our workshops, such as CyberChef, Burp Suite, Postman, Wireshark, digital-forensics tools, etc.

PASTA Challenges

The challenges utilizing PASTA for Education focus on testing a variety of basic knowledge and skills related to automotive security. These challenges might not fit the conventional, cleverly crafted CTF mold you’re used to. Within these challenges, you’ll find tasks that require you to read circuit diagrams, consult manuals, and even inspect circuit boards. At first glance, these elements may seem daunting. The circuit diagrams may look like a perplexing puzzle, the manuals might feel tedious, and getting hands-on with circuit boards could feel a little intimidating. These could be areas you’ve previously shied away from or haven’t felt confident in tackling. However, once you immerse yourself in this world, you’ll realize that these tasks are filled with valuable information and can be quite enjoyable.

Rules and Remarks

• The source code of PASTA and RAMN is available on github, but we made many changes for this event. Do not assume that everything you read on github applies to your device.
• The JTAG interface of ECUs is locked - do not attempt to connect a JTAG debugger (if you brought one), as you may end up bricking ECUs.