API tools faq
paste
View difference between Paste ID: 6bWHKiEF and LPvENm3e
SHOW: | | - or go back to the newest paste.
1
<?php
2
// Dr Gareth Owen, School of Engineering, University of Greenwich
3
// GCHQ CanYouCrackIt Stage 2 solution
4-
// http://gchqchallnege.blogspot.com
4+
// http://gchqchallenge.blogspot.com
5
// To run: php vm.php
6
// Enable $disasm flag to enable disassembly mode
7
8
$ip = 0;

9
define( 'CS', 4);

10
define( 'DS', 5);

11
$gregs = array(0,0,0,0,0,0x10); // r0,1,2,3, cs, ds

12
// flag reg

13
$fl = 0;

14
15
//data

16
$mem = array(0x31, 0x04, 0x33, 0xaa, 0x40, 0x02, 0x80, 0x03, 0x52, 0x00, 0x72, 0x01, 0x73, 0x01, 0xb2, 0x50,0x30, 0x14, 0xc0, 0x01, 0x80, 0x00, 0x10, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,0x98, 0xab, 0xd9, 0xa1, 0x9f, 0xa7, 0x83, 0x83, 0xf2, 0xb1, 0x34, 0xb6, 0xe4, 0xb7, 0xca, 0xb8,0xc9, 0xb8, 0x0e, 0xbd, 0x7d, 0x0f, 0xc0, 0xf1, 0xd9, 0x03, 0xc5, 0x3a, 0xc6, 0xc7, 0xc8, 0xc9,0xca, 0xcb, 0xcc, 0xcd, 0xce, 0xcf, 0xd0, 0xd1, 0xd2, 0xd3, 0xd4, 0xd5, 0xd6, 0xd7, 0xd8, 0xd9,0xda, 0xdb, 0xa9, 0xcd, 0xdf, 0xdf, 0xe0, 0xe1, 0xe2, 0xe3, 0xe4, 0xe5, 0xe6, 0xe7, 0xe8, 0xe9,0x26, 0xeb, 0xec, 0xed, 0xee, 0xef, 0xf0, 0xf1, 0xf2, 0xf3, 0xf4, 0xf5, 0xf6, 0xf7, 0xf8, 0xf9,0x7d, 0x1f, 0x15, 0x60, 0x4d, 0x4d, 0x52, 0x7d, 0x0e, 0x27, 0x6d, 0x10, 0x6d, 0x5a, 0x06, 0x56,0x47, 0x14, 0x42, 0x0e, 0xb6, 0xb2, 0xb2, 0xe6, 0xeb, 0xb4, 0x83, 0x8e, 0xd7, 0xe5, 0xd4, 0xd9,0xc3, 0xf0, 0x80, 0x95, 0xf1, 0x82, 0x82, 0x9a, 0xbd, 0x95, 0xa4, 0x8d, 0x9a, 0x2b, 0x30, 0x69,0x4a, 0x69, 0x65, 0x55, 0x1c, 0x7b, 0x69, 0x1c, 0x6e, 0x04, 0x74, 0x35, 0x21, 0x26, 0x2f, 0x60,0x03, 0x4e, 0x37, 0x1e, 0x33, 0x54, 0x39, 0xe6, 0xba, 0xb4, 0xa2, 0xad, 0xa4, 0xc5, 0x95, 0xc8,0xc1, 0xe4, 0x8a, 0xec, 0xe7, 0x92, 0x8b, 0xe8, 0x81, 0xf0, 0xad, 0x98, 0xa4, 0xd0, 0xc0, 0x8d,0xac, 0x22, 0x52, 0x65, 0x7e, 0x27, 0x2b, 0x5a, 0x12, 0x61, 0x0a, 0x01, 0x7a, 0x6b, 0x1d, 0x67,0x75, 0x70, 0x6c, 0x1b, 0x11, 0x25, 0x25, 0x70, 0x7f, 0x7e, 0x67, 0x63, 0x30, 0x3c, 0x6d, 0x6a,0x01, 0x51, 0x59, 0x5f, 0x56, 0x13, 0x10, 0x43, 0x19, 0x18, 0xe5, 0xe0, 0xbe, 0xbf, 0xbd, 0xe9,0xf0, 0xf1, 0xf9, 0xfa, 0xab, 0x8f, 0xc1, 0xdf, 0xcf, 0x8d, 0xf8, 0xe7, 0xe2, 0xe9, 0x93, 0x8e,0xec, 0xf5, 0xc8, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,0x37, 0x7a, 0x07, 0x11, 0x1f, 0x1d, 0x68, 0x25, 0x32, 0x77, 0x1e, 0x62, 0x23, 0x5b, 0x47, 0x55,0x53, 0x30, 0x11, 0x42, 0xf6, 0xf1, 0xb1, 0xe6, 0xc3, 0xcc, 0xf8, 0xc5, 0xe4, 0xcc, 0xc0, 0xd3,0x85, 0xfd, 0x9a, 0xe3, 0xe6, 0x81, 0xb5, 0xbb, 0xd7, 0xcd, 0x87, 0xa3, 0xd3, 0x6b, 0x36, 0x6f,0x6f, 0x66, 0x55, 0x30, 0x16, 0x45, 0x5e, 0x09, 0x74, 0x5c, 0x3f, 0x29, 0x2b, 0x66, 0x3d, 0x0d,0x02, 0x30, 0x28, 0x35, 0x15, 0x09, 0x15, 0xdd, 0xec, 0xb8, 0xe2, 0xfb, 0xd8, 0xcb, 0xd8, 0xd1,0x8b, 0xd5, 0x82, 0xd9, 0x9a, 0xf1, 0x92, 0xab, 0xe8, 0xa6, 0xd6, 0xd0, 0x8c, 0xaa, 0xd2, 0x94,0xcf, 0x45, 0x46, 0x67, 0x20, 0x7d, 0x44, 0x14, 0x6b, 0x45, 0x6d, 0x54, 0x03, 0x17, 0x60, 0x62,0x55, 0x5a, 0x4a, 0x66, 0x61, 0x11, 0x57, 0x68, 0x75, 0x05, 0x62, 0x36, 0x7d, 0x02, 0x10, 0x4b,0x08, 0x22, 0x42, 0x32, 0xba, 0xe2, 0xb9, 0xe2, 0xd6, 0xb9, 0xff, 0xc3, 0xe9, 0x8a, 0x8f, 0xc1,0x8f, 0xe1, 0xb8, 0xa4, 0x96, 0xf1, 0x8f, 0x81, 0xb1, 0x8d, 0x89, 0xcc, 0xd4, 0x78, 0x76, 0x61,0x72, 0x3e, 0x37, 0x23, 0x56, 0x73, 0x71, 0x79, 0x63, 0x7c, 0x08, 0x11, 0x20, 0x69, 0x7a, 0x14,0x68, 0x05, 0x21, 0x1e, 0x32, 0x27, 0x59, 0xb7, 0xcf, 0xab, 0xdd, 0xd5, 0xcc, 0x97, 0x93, 0xf2,0xe7, 0xc0, 0xeb, 0xff, 0xe9, 0xa3, 0xbf, 0xa1, 0xab, 0x8b, 0xbb, 0x9e, 0x9e, 0x8c, 0xa0, 0xc1,0x9b, 0x5a, 0x2f, 0x2f, 0x4e, 0x4e, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00);

17
18
dump('initial');

19
20
// instructions

21
$instr = array('jmp', 'movr', 'movm', 'add', 'xor', 'cmp', 'jmpe', 'hlt');

22
23
// dump array on single line

24
function da($nm, $arr) {

25
  echo "$nm=(";

26
  foreach($arr as $a)

27
    echo "$a,";

28
  echo ") ";

29
}

30
31
$disasm = 0;

32
$first = 0;

33
// main loop

34
while(1) {

35
  if($disasm && $ip > 15) { $gregs[CS]++; $ip %= 16; }

36
  $i = $gregs[CS] * 16 + $ip;

37
38
/*if($i == 0x10e && $first == 0) {

39
  $ip += 4;//0x112;

40
  $first = 1;

41
}*//*if($i > 0x100) $disasm = 1;*/

42
43
// ofset print

44
  printf("0x%x [%x:%x]", $i, $gregs[CS], $ip);

45
  echo "{$gregs[CS]}:$ip "; // mem location

46
47
48
  $tmpreg = $gregs;

49
50
  // out of memory

51
  if($i>count($mem)) { echo "oob $i\n";  exit(0); }

52
  

53
  $b = $mem[$i];

54
  $opcode = ($b & 0xE0) >> 5;

55
  $mod = ($b & 0x10) >> 4;

56
  $op1 = ($b & 0x0F);

57
  $op2 = $mem[$i+1];

58
  $bytes = 1;

59
60
// instruction stat

61
  if(!$disasm) {

62
    echo "{$instr[$opcode]} (m=$mod, op1=$op1, op2=$op2) ";

63
    da('r*', $gregs);

64
    echo " fl=$fl ";

65
  }

66
67
  $noadv = 0; // dont advance IP (for jumps)

68
  switch($opcode) {

69
    case 0: // jmp

70
      if(!$disasm)

71
        $ip = $gregs[$op1]; 

72
73
      if($mod == 1) {

74
        if(!$disasm)

75
          $gregs[CS] = $op2;

76
        echo "jmp $op2:r$op1\n";

77
        $bytes ++;

78
      } else echo "jmp r$op1\n";

79
      $noadv = 1;

80
      break;

81
    case 1: // movr

82
      $bytes++;

83
      if($mod == 0)  {

84
        $gregs[$op1] = $gregs[$op2];

85
        echo "movr r$op1, r$op2\n";

86
      }

87
      else {

88
        echo "movr r$op1, $op2\n";

89
        $gregs[$op1] = $op2;

90
      }

91
      break;

92
    case 2: // movm

93
      $bytes++;

94
      if($mod == 0) {

95
        $gregs[$op1] = $mem[$gregs[DS]*16 + $gregs[$op2]];

96
        echo "movm r$op1, [ds:r$op2]\n";

97
        if(!$disasm) echo "{$gregs[$op1]} <= [{$gregs[DS]}:{$gregs[$op2]}] {$mem[$gregs[DS]*16 + $gregs[$op2]]}";

98
      }

99
      else {

100
        $mem[$gregs[DS]*16 + $gregs[$op1]] = $gregs[$op2];

101
        echo "movm [ds:r$op1], r$op2\n";

102
        if(!$disasm) echo "[{$gregs[DS]}:{$gregs[$op1]}] {$mem[$gregs[DS]*16 + $gregs[$op1]]} <= {$gregs[$op2]}";

103
      }

104
      

105
      break;

106
    case 3: // add

107
      $bytes++;

108
      if($mod == 0) {

109
        $gregs[$op1] = ($gregs[$op1] + $gregs[$op2]) & 0xFF;

110
        echo "add r$op1, r$op2\n";

111
      }

112
      else {

113
        $gregs[$op1] = ($gregs[$op1] + $op2) & 0xFF;

114
        echo "add r$op1, $op2\n";

115
      }

116
      break;

117
    case 4: // xor

118
      $bytes++;

119
      if($mod == 0) {

120
        $gregs[$op1] ^= $gregs[$op2];

121
        echo "xor r$op1, r$op2\n";

122
      }

123
      else{

124
        $gregs[$op1] ^= $op2;

125
        echo "xor r$op1, $op2\n";

126
      }

127
      break;

128
    case 5: // cmp

129
      $bytes++;

130
      if($mod == 0)

131
      {

132
        if($gregs[$op1] == $gregs[$op2]) $fl = 0;

133
        else if($gregs[$op1] < $gregs[$op2]) $fl = 0xff;

134
        else $fl = 1;

135
        echo "cmp r$op1, r$op2\n";

136
      }

137
      else

138
      {

139
        if($gregs[$op1] == $op2) $fl = 0;

140
        else if($gregs[$op1] < $op2) $fl = 0xff;

141
        else $fl = 1;

142
        echo "cmp r$op1, $op2\n";

143
      }

144
      break;

145
    case 6: // jmpe

146
      if($fl == 0 || $disasm) {

147
        if(!$disasm)

148
          $ip = $gregs[$op1];

149
        $noadv = 1;

150
        if($mod != 0) {

151
          $bytes++;

152
          if(!$disasm)

153
            $gregs[CS] = $op2;

154
          echo "jmpe $op2:r$op1\n";

155
        } else echo "jmpe r$op1\n"; 

156
      } 

157
      break;

158
    case 7: // hlt

159
      echo "hlt\n";

160
      if(!$disasm) {

161
        dump();

162
        exit(0);

163
      }

164
      break;

165
    default:

166
      echo "invalid\n";

167
  }

168
  

169
  if($disasm)

170
    $gregs=$tmpreg;

171
  

172
  if(!$noadv || $disasm)

173
    $ip+=$bytes;

174
  if(!$disasm)

175
    echo "\n";

176
}

177
178
function dump($f = "dump.bin") {

179
  global $mem;

180
  $o = fopen($f, "wb");

181
  foreach($mem as $m)

182
    fputs($o, chr($m));

183
  fclose($o);

184
  echo "dumped\n";

185-
}
185+
186
187
        

    


            


                                


        

            



                
    

        Public Pastes
    

    
            

    

                    

        

    





    


    
    
    
    
    
    
    
    




    


    



                

            We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.             OK, I Understand
        

    
                

            

                
                    
                
            

            

                Not a member of Pastebin yet?

                Sign Up, it unlocks many cool features!