DCPU DRM cracking: challenge accepted

; written by Eidako
; Cracked by Soron (with implicit permission)

; This was decrypted from a challenge that was posted to Reddit
; Orginal Reddit thread: http://www.reddit.com/r/dcpu16/comments/tivjz/drm_decompiler_resistant_code_good_luck/
; Challenge in machine code form: http://pastebin.com/GKbeL9sq
; First disassembled pass: http://pastebin.com/q9GfMVDb

; I've left the original decryption code in place, so you can see how it works ;).


; two no-ops to get words to line up properly
; original was "SET PC, start_decrypting"
SET A, A
SET A, A

;;;;;;;;;;;;;;;;;;;;;;;;;;;
; START DECRYPTED BLOCK 2 ;
;;;;;;;;;;;;;;;;;;;;;;;;;;;

; this decrypted block writes the string to the screen, then overwrites memory
; note: the string was also decrypted in this block


; dude, you have no HWI. You're also not checking which port the monitor is attached to.
; ergo, this will break on any emulator that doesn't start with the screen memory
; mapped to 0x8000
:start_writing
  SET I, 0x80a0
  SET J, the_string

:write_loop
  BOR [J], 0xf000
  STI [I], [J]
  IFN [J], 0
    SET PC, write_loop
  SET PC, garble_decrypted_memory

DAT 0x0001 ; I have no idea why, but word count got thrown off by 1 somewhere. Meh. Fixing that with a no op.

:the_string ; started at memory position 13 (or 0xD)
  DAT 0x0054, 0x0068, 0x0061, 0x0074, 0x0027, 0x0073, 0x0020, 0x0073, 0x0074, 0x0072, 0x0061, 0x006e, 0x0067, 0x0065, 0x002c, 0x0020, 0x0074, 0x0068, 0x0069, 0x0073, 0x0020, 0x0073, 0x0074, 0x0072, 0x0069, 0x006e, 0x0067, 0x0020, 0x0020, 0x0020, 0x0020, 0x0020, 0x0020, 0x0064, 0x0069, 0x0064, 0x006e, 0x0027, 0x0074, 0x0020, 0x0073, 0x0068, 0x006f, 0x0077, 0x0020, 0x0075, 0x0070, 0x0020, 0x0069, 0x006e, 0x0020, 0x0074, 0x0068, 0x0065, 0x0020, 0x0073, 0x006f, 0x0075, 0x0072, 0x0063, 0x0065, 0x002e, 0x002e, 0x002e, 0x0000, 0x0054, 0x0068, 0x0065, 0x0020, 0x0070, 0x0061, 0x0073, 0x0073, 0x0077, 0x006f, 0x0072, 0x0064, 0x0020, 0x0069, 0x0073, 0x0020, 0x0027, 0x0065, 0x006c, 0x0061, 0x006b, 0x0061, 0x006a, 0x006f, 0x006f, 0x0027, 0x002e, 0x0000

:garble_decrypted_memory
  SET J, 0x0075
  SET A, 0x8781
  XOR B, B
  XOR C, C
  XOR X, X
  XOR Y, Y
  XOR Z, Z
  XOR I, I
  XOR SP, SP
  XOR EX, EX

:garble_loop
  ; so, you do know that you're leaking some decrypted memory, by not wiping both decrypted blocks, right?
  ; might be better to set I to a suitable value, use "SET [I], A" as well,
  ; and set A to the machine code for "SUB PC, 1"
  STD [J], A
  MOD J, 0x8000
  SET PC, garble_loop

  ; I have no friggin' idea what the next block is all about. Red herring?

  DAT 0xf575, 0x4db7, 0x90c4, 0x286b, 0xde68, 0xf0ec, 0x004b, 0xeef5, 0xfb76, 0x1029, 0xc30a, 0x22c0, 0xfc71, 0x3328, 0x9bbf, 0x7952, 0x34c5, 0x121d, 0x7bc7, 0xb14d, 0xe665, 0xaa1f, 0xf017, 0xfb87, 0xa81a, 0xeb82, 0xd684, 0x8ad5, 0x3eb6, 0x092c, 0x0fff, 0x98a5, 0xe1ad, 0xf63e, 0xc40e, 0xc371, 0x699e, 0xfd76, 0xa48d, 0xdeb7, 0x3e78, 0x4c6c

;;;;;;;;;;;;;;;;;;;;;;;;;
; END DECRYPTED BLOCK 2 ;
;;;;;;;;;;;;;;;;;;;;;;;;;



:start_decrypting
  JSR first_decrypt_pass
  STI X, Y
  SET PC, I ; equivalent to "SET PC, second_decrypt_pass"


;;;;;;;;;;;;;;;;;;;;;;;;;;;
; START DECRYPTED BLOCK 1 ;
;;;;;;;;;;;;;;;;;;;;;;;;;;;

; this decrypted block decrypts block 2


  DAT 0x8f93 ; I think this is just a garbage value intended to throw people off

:second_decrypt_pass
  SET A, [0x007d]
  ADD A, [0x0083]
  SET A, [A]
  SET B, [0x008e]
  SUB B, [0x0085]
  SET B, [B]
  SET C, [0x0091]
  ADD C, [0x00a0]
  SET C, [C]
  SET I, 2

:second_decrypt_loop ; this label could possibly be moved up one instruction, not sure if it was in the original or not
  SET J, 0x00a5
  SET PUSH, [I]
  ADD [I], B
  XOR [I], A
  SHL [I], C
  BOR [I], EX
  ADD A, POP
  ADD C, A
  MOD C, 0x0010
  SHL B, C
  BOR B, EX
  ADD I, 1
  IFL I, J
    SET PC, second_decrypt_loop
  SET PC, start_writing

  ;this DAT looks like more garbage intended to throw people off, to me
  DAT 0x2d91, 0xe6b6, 0x5d0b, 0x4b57, 0x1ffa, 0x4721

;;;;;;;;;;;;;;;;;;;;;;;;;
; END DECRYPTED BLOCK 1 ;
;;;;;;;;;;;;;;;;;;;;;;;;;

:first_decrypt_pass
  XOR I, I
  SUB I, 0xff36
  SET X, I
  SUB X, 0x0021
  SET J, [0x0097]
  ADD J, [0x009b]

:first_decrypt_loop
  XOR [I], J
  STD A, A
  IFG I, X
    SET PC, first_decrypt_loop
  DAT 0x6381, 0xbf26, 0x7f4c, 0x6099, 0x823f, 0x4e35, 0xfb87, 0x7f81, 0x0000