MicroCorruption/21-Cold Lake/initial-notes.md

load_address:

8000: BE
 vv
0080: LE

program_text:

text:

35400880 0045 0545 0545 0545 0545 0545 0545 0f43 3041

disassembly:

asm (msp430) : 8000
3540 0880      mov	#0x8008, r5
0045           br	r5          ; uncond branch to #8008
0545           nop
0545           nop
0545           nop
0545           nop
0545           nop
0545           nop
0f43           clr	r15
3041           ret

Signature:

8605e027f42368ea6bba9de66409f6a8ddedcd49614a4648281c47a7b4ad252f5639069b17ba8ff104d371e2d8a625b038f0750667364087e7987e40ea81510f

public key?

b6458aae646e18722450b46348f3a09b4be01a9e69edc9516a0752cc17d27d6f: Nope

b645 8aae 646e 1872 2450 b463 48f3 a09b 4be0 1a9e 69ed c951 6a07 52cc 17d2 7d6f ?

45b6 ae8a 6e64 7218 5024 63b4 48f3 9ba0 e04b 9e1a ed69 51c9 076a cc52 d217 6fd7 ?

45b6ae8a6e647218502463b448f39ba0e04b9e1aed6951c9076acc52d2176fd7: Nope

Solution:

if ((int)loadaddr & 0x8000 && (int)loadaddr < 0xf001) {
   // Here, it copies the payload
   memcpy ((void *)loadaddr, &payload, 0x100);
   // Then, it verifies the signature
   if (verify_ed25519 ((char *)0x2400, loadaddr, 0x100, signature) == 1) {
      puts ("Signature valid, executing payload");

Cycle	Loadaddr	Payload	Signature
1	0880	30400245	00
2	0090	35400880 0045 0545 0545 0545 0545 0545 0545 0f43 3041	8605 e027 f423 68ea 6bba 9de6 6409 f6a8 dded cd49 614a 4648 281c 47a7 b4ad 252f 5639 069b 17ba 8ff1 04d3 71e2 d8a6 25b0 38f0 7506 6736 4087 e798 7e40 ea81 510f

0880
30400245
00

0090
3540088000450545054505450545054505450f433041
8605e027f42368ea6bba9de66409f6a8ddedcd49614a4648281c47a7b4ad252f5639069b17ba8ff104d371e2d8a625b038f0750667364087e7987e40ea81510f