noise-pattern-detector

# Noise Pattern Detector

## Purpose
A specialized analyzer used to identify and filter out "noise" or garbage data added to ciphertexts to obfuscate the flag, a common CTF technique.

## Protocol
1. **Analyze Entropy**: 
   - Low-entropy regions (e.g., repeating bytes like `0x00`, `0x41`) indicate simple padding or noise.
   - High-entropy regions indicate the ciphertext or compressed data.
2. **Detect Repeating Key Offsets**:
   - If the key is XORed with a constant character (e.g., `_`), identify the repeating byte and strip it.
3. **Identify Markers**: 
   - Search for common flag starts (e.g., `flag{`, `CTF{`, `TCHVNTE{`) in the decrypted output.
   - Everything *outside* the valid flag structure is treated as noise.
4. **Clean and Format**:
   - Strip trailing null bytes, newlines, and non-printable ASCII characters.
   - Join fragmented pieces of the flag if scattered across the noise.

## Usage Guidelines
- Apply after a decryption attempt (e.g., `xor-analyzer`) that results in a partially clear but noisy output.
- Effective for challenges where the flag is embedded in a large block of junk data.