README

Max Mirkin

Cybersecurity director in Toronto. I run security programs and still build the tools they depend on.

My resume is locked behind this crackme. check_key is a small ARM routine running on an emulated Cortex-M0 right in your browser. Reverse it, find the key, and the resume unlocks.

Not here to debug? Skip straight to the resume.

How to play

  1. Type any guess as the key and press Enter. It will be denied.
  2. Press s to step through the code and watch the registers change.
  3. Work out what check_key wants, then run that key.
Hints

Level 1 of 3: Warm-up

check_key() looks at your key one byte at a time. Find out what each byte must be.

No hints used yet. Each one gives a little more away.

CPU Cortex-M0

Code level1.elf · .text 0x08000000–0x0800005c

  1. 08000000; void _start(void)
  2. 08000000_start:
  3. 080000004801ldrr0, ; [pc, #4] @ 0x08000008
  4. 08000002f000 f80bbl
  5. 08000006df00svc#0; exit(r0)
  6. 0800000820000000.word; 0x20000000
  7.  
  8. 0800000c; size_t strlen(const char *s)
  9. 0800000cstrlen:  ; XREF: check_key+0x4↓
  10. 0800000c0001movsr1, r0
  11. 0800000eloc_0800000e:  ; XREF: strlen+0x8↓
  12. 0800000e780aldrbr2, [r1]
  13. 080000103101addsr1, #1
  14. 080000122a00cmpr2, #0
  15. 08000014d1fbbne
  16. 080000161a08subsr0, r1, r0
  17. 080000183801subsr0, #1
  18. 0800001a4770bxlr; return
  19.  
  20. 0800001c; int check_key(const char *key)
  21. 0800001ccheck_key:  ; XREF: _start+0x2↑
  22. 0800001cb510push{r4, lr}
  23. 0800001e0004movsr4, r0
  24. 08000020f7ff fff4bl
  25. 080000242807cmpr0, #7
  26. 08000026d117bne
  27. 0800002878e0ldrbr0, [r4, #3]
  28. 0800002a2874cmpr0, #0x74
  29. 0800002cd114bne
  30. 0800002e7820ldrbr0, [r4]
  31. 080000302868cmpr0, #0x68
  32. 08000032d111bne
  33. 0800003479a0ldrbr0, [r4, #6]
  34. 080000363830subsr0, #0x30
  35. 080000382802cmpr0, #2
  36. 0800003ad10dbne
  37. 0800003c7860ldrbr0, [r4, #1]
  38. 0800003e2875cmpr0, #0x75
  39. 08000040d10abne
  40. 080000427960ldrbr0, [r4, #5]
  41. 080000442872cmpr0, #0x72
  42. 08000046d107bne
  43. 0800004878a0ldrbr0, [r4, #2]
  44. 0800004a286ecmpr0, #0x6e
  45. 0800004cd104bne
  46. 0800004e7920ldrbr0, [r4, #4]
  47. 080000502865cmpr0, #0x65
  48. 08000052d101bne
  49. 080000542001movsr0, #1
  50. 08000056bd10pop{r4, pc}; return
  51. 08000058loc_08000058:  ; XREF: check_key+0xa↑, check_key+0x10↑, …
  52. 080000582000movsr0, #0
  53. 0800005abd10pop{r4, pc}; return

Registers

r0
r1
r2
r3
r4
r5
r6
r7
r8
r9
r10
r11
r12
sp
lr
pc

Flags:N=0Z=0C=0V=0

Stack sp = 0x20001000

  1. empty

Dump

2000000000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00................
2000001000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00................
2000002000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00................
2000003000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00................
2000004000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00................
2000005000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00................
2000006000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00................
2000007000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00................

Console type help

Paused at _start: ldr r0, =input