iCTF 2011 > Challenge 17 - ASM 133786
Challenge 17 - ASM 133786
Avant tout, voici l'énoncé de ce challenge 17 :
People! The new amazing l33786 processor is here! More than ten powerful opcodes! Almost eight bits to the byte! Non-Uniform Memory Access for super-high performance!
We are also super-green! To conserve power, memory in our system is split in two halfs: low and high. Memory locations are physically 7-bit long, but this is not a limit for our CPU! Just store values below 127 in the low memory and values 128 or higher in high memory. There are 4 high memory locations and 4 low ones.
Two registers are provided, rl and rh. Low memory is wired to rl, high memory is wired to rh. Registers are not limited in the values they can store.
With unprecedented generosity, UCSB is giving you access to a version of l33786 that integrates an arithmetic coprocessor! The coprocessor can increment or decrement arbitrary memory locations. DMA! Amazing.
Here is our state-of-the-art RISC instruction set:
ldh {addr} will perform:rh = high_memory[addr] ldh {addr} will perform:rl = low_memory[addr] sth {addr} will perform:high_memory[addr] = rh stl {addr} will perform:low_memory[addr] = rl incl {addr} will perform:low_memory[addr]++ decl {addr} will perform:low_memory[addr]-- inch {addr} will perform:high_memory[addr]++ dech {addr} will perform:high_memory[addr]-- xor {dest} {src} will perform:dest = dest XOR src shl rh {count} will perform:rh = rh << count shr rl {count} will perform:rl = rl >> countAddresses are integers in the range [0,3]. Example: "ldh 3".
I heard that if you load 146 in rl and 69 in rh something special may happen...
Le but était donc simple : avec un jeu d'instruction réduit, mettre 146 dans le registre rl et 69 dans le registre rh. La petite difficulté étant que rh ne peut jouer que sur une mémoire contenant des valeurs supérieures ou égales à 128 et rl sur des valeurs entre 0 et 127. De plus, seul le registre rh supporte l'opération shl et seul le registre rl supporte shr.
Il y avait donc probablement pas mal de façon de faire. Dans l'exemple suivant, j'ai pris le parti de mettre les valeurs qui vont bien dans les deux cases 0 pour que le XOR donne 146 (128 et 18). Ensuite je place dans la case 1 de la mémoire haute la valeur qui va bien pour que le xor avec 146 donne 69 (215) :
xor rh, rh sth 0 # @0h = 128 ldh 0 # rh = 128 xor rl, rl xor rl, rh # rl = 128 shr rl 3 # rl = 16 stl 0 # @0l = 16 incl 0 incl 0 # @0l = 18 ldl 0 # rl = 18 stl 1 # @1l = 18 incl 1 incl 1 incl 1 incl 1 # @1l = 22 ldl 1 # rl = 22 xor rh, rh xor rh, rl # rh = 22 shl rh 2 # rh = 88 sth 1 # @1h = 216 dech 1 # @1h = 215 ldh 0 # rh = 128 ldl 0 # rl = 18 xor rl, rh # rl = 146 ldh 1 # rh = 215 xor rh, rl # rh = 69
Rien de bien plus compliqué donc, une fois qu'on a bien compris l'énoncé.