#
5. Reykjavik
#
Challenge Overview
OVERVIEW
- Lockitall developers have implemented military-grade on-device
encryption to keep the password secure.
- This lock is not attached to any hardware security module.Running the program:
what's the password?
> password
#
Solution
Looking at the main function:
4438 <main>
4438: 3e40 2045 mov #0x4520, r14
443c: 0f4e mov r14, r15
443e: 3e40 f800 mov #0xf8, r14
4442: 3f40 0024 mov #0x2400, r15
4446: b012 8644 call #0x4486 <enc>
444a: b012 0024 call #0x2400
444e: 0f43 clr r15It looks like enc is decoding a block of memory and then calling it at 0x2400
Setting a breakpoint on the call and dumping memory:
2400: 0b12 0412 0441 2452 3150 e0ff 3b40 2045 .....A$R1P..;@ E
2410: 073c 1b53 8f11 0f12 0312 b012 6424 2152 .<.S........d$!R
2420: 6f4b 4f93 f623 3012 0a00 0312 b012 6424 oKO..#0.......d$
2430: 2152 3012 1f00 3f40 dcff 0f54 0f12 2312 !R0...?@...T..#.
2440: b012 6424 3150 0600 b490 8929 dcff 0520 ..d$1P.....)...
2450: 3012 7f00 b012 6424 2153 3150 2000 3441 0....d$!S1P .4A
2460: 3b41 3041 1e41 0200 0212 0f4e 8f10 024f ;A0A.A.....N...O
2470: 32d0 0080 b012 1000 3241 3041 d21a 189a 2.......2A0A....
2480: 22dc 45b9 4279 2d55 858e a4a2 67d7 14ae ".E.By-U....g...
2490: a119 76f6 42cb 1c04 0efa a61b 74a7 416b ..v.B.......t.Ak
24a0: d237 a253 22e4 66af c1a5 938b 8971 9b88 .7.S".f......q..
24b0: fa9b 6674 4e21 2a6b b143 9151 3dcc a6f5 ..ftN!*k.C.Q=...
24c0: daa7 db3f 8d3c 4d18 4736 dfa6 459a 2461 ...?.<M.G6..E.$a
24d0: 921d 3291 14e6 8157 b0fe 2ddd 400b 8688 ..2....W..-.@...
24e0: 6310 3ab3 612b 0bd9 483f 4e04 5870 4c38 c.:.a+..H?N.XpL8
24f0: c93c ff36 0e01 7f3e fa55 aeef 051c 242c .<.6..>.U....$,
2500: 3c56 13af e57b 8abf 3040 c537 656e 8278 <V...{..0@.7en.x
2510: 9af9 9d02 be83 b38c e181 3ad8 395a fce3 ..........:.9Z..
2520: 4f03 8ec9 9395 4a15 ce3b fd1e 7779 c9c3 O.....J..;..wy..
2530: 5ff2 3dc7 5953 8826 d0b5 d9f8 639e e970 _.=.YS.&....c..p
2540: 01cd 2119 ca6a d12c 97e2 7538 96c5 8f28 ..!..j.,..u8...(
2550: d682 1be5 ab20 7389 48aa 1fa3 472f a564 ..... s.H...G/.d
2560: de2d b710 9081 5205 8d44 cff4 bc2e 577a .-....R..D....Wz
2570: d5f4 a851 c243 277d a4ca 1e6b 0000 0000 ...Q.C'}...k....
2580: 0000 0000 0000 0000 0000 0000 0000 0000 ................assembling with the provided assembler (https://microcorruption.com/assembler) and single stepping shows a check against our input:
cmp #0x2989, -0x24(r4)
---
> r r4-24
43da 7061 7373 776f 7264 0000 0000 0000 0000 password........changing the input to be 8929 works.
Nice challenge around dynamic debugging instead of static.