mirror of
https://github.com/mytechnotalent/Embedded-Hacking.git
synced 2026-10-19 14:07:26 +02:00
Align Classified Briefs 01, 02, 04, and 05 with canonical CB-03 format and rebuild PDFs
- Standardized all 4 briefs to match canonical 5-section narrative architecture - Added complete hardware specifications and physical breadboard pinout tables matching silicon ground truth - Enforced exact 67-character ASCII box alignment for all classification headers and Buddy assist panels - Formatted structured 5-point operational mandate objectives - Maintained exact instruction and symbol parity against compiled .bin and .elf targets - Re-rendered publication-grade companion PDFs for all 4 challenges
This commit is contained in:
Kevin Thomas committed
1 parent
1d6bc9efe8
commit
2e8acec08f
8 files changed
+401
-80
No files matched your search
@@ -7,103 +7,150 @@
|
||||
| |
|
||||
|OPERATION DARK VECTOR |
|
||||
| |
|
||||
|CLASSIFIED BRIEFING: LIVE CTF 0x01 |
|
||||
|CLASSIFIED BRIEFING: LIVE CHALLENGE 0x01 |
|
||||
| |
|
||||
|NATIONAL SECURITY AGENCY / GMU RHET |
|
||||
+-----------------------------------------------------------------+
|
||||
```
|
||||
|
||||
## 1. The Answer
|
||||
## 1. The Advice
|
||||
|
||||
INT. NSA EXPLOITATION CELL. 05:03.
|
||||
|
||||
The analysts have been awake for nineteen hours. The Director walks in with a cup
|
||||
of coffee and does not sit down.
|
||||
A carbon-fiber forward fuselage section of a downed state-sponsored autonomous
|
||||
micro-UAV sits clamped in an anti-static fixture on the bench.
|
||||
|
||||
**DIRECTOR:** Where is it going?
|
||||
On the front of the avionics bay, a status diode glows a steady red: `GP16` high.
|
||||
Beside it, an I2C 1602 LCD backpack is wired to `GP2` and `GP3`, outputting
|
||||
telemetry coordinates. A mock propeller servo is wired to `GP6`, a u-blox NEO-6M
|
||||
GPS receiver is wired to PIO UART RX on `GP7`, and a REYAX RYLR998 LoRa transceiver
|
||||
is wired to `UART1` on `GP8` and `GP9`. A thin jumper loops from `GP15` up to the
|
||||
`3V3` rail.
|
||||
|
||||
The Director sets down a field report and looks at the red diode.
|
||||
|
||||
**DIRECTOR:** Where was it heading?
|
||||
|
||||
**ANALYST:** Buddy says it knows.
|
||||
|
||||
**DIRECTOR:** Buddy.
|
||||
|
||||
**ANALYST:** The model. The one we built for exactly this. Give it the image, ask
|
||||
it the question.
|
||||
**ANALYST:** The model. The one we built for automated firmware triage. Give it
|
||||
the image, ask it the question.
|
||||
|
||||
**DIRECTOR:** And?
|
||||
|
||||
**ANALYST:** Nine seconds.
|
||||
**ANALYST:** Nine seconds with the stripped flash image.
|
||||
|
||||
She turns the screen around. This is what came back.
|
||||
She turns her monitor toward him.
|
||||
|
||||
```
|
||||
+-----------------------------------------------------------------+
|
||||
| BUDDY // CLASSIFIED EXPLOITATION ASSIST // CONF: 0.97 |
|
||||
| BUDDY // CLASSIFIED EXPLOITATION ASSIST // CONF: 0.98 |
|
||||
+-----------------------------------------------------------------+
|
||||
| DESTINATION : +38.840280 -77.428890 |
|
||||
| CONFIDENCE : 0.97 |
|
||||
| PATCH : verified-by-construction. Ready to flash. |
|
||||
| ACTION : Recover target waypoint coordinates. |
|
||||
| MECHANISM : Literal pool constants in .rodata parsed. |
|
||||
| PREDICTION : Destination is +38.840280, -77.428890. |
|
||||
| CONFIDENCE : 0.98 |
|
||||
+-----------------------------------------------------------------+
|
||||
```
|
||||
|
||||
**DIRECTOR:** That is the whole answer.
|
||||
**DIRECTOR:** 0.98. Centreville, Virginia. That is the whole answer.
|
||||
|
||||
**ANALYST:** That is the whole answer.
|
||||
**ANALYST:** Buddy found the pre-programmed decoy coordinate in `.rodata`. Buddy
|
||||
never looked at SRAM. Buddy never audited the cryptographic routine decrypting
|
||||
the true mission target at boot.
|
||||
|
||||
**DIRECTOR:** Is it that simple?
|
||||
**DIRECTOR:** Buddy says 0.98.
|
||||
|
||||
**ANALYST:** It is never that simple.
|
||||
|
||||
**DIRECTOR:** Then why does it look that simple?
|
||||
|
||||
**ANALYST:** Because Buddy is very good at making things look simple.
|
||||
**ANALYST:** Buddy saw a float pair in Flash and stopped looking. If that drone
|
||||
were flying to Centreville, it would not be broadcasting those exact coordinates
|
||||
in plaintext telemetry for every SIGINT sensor in the sector to hear.
|
||||
|
||||
## 2. What Buddy Is
|
||||
|
||||
Buddy is not a person. It is a model. It has read more assembly than every
|
||||
engineer who has ever lived, and it never sleeps and never doubts. You ask it a
|
||||
question, and it answers in the exact shape of an answer, with a confidence that
|
||||
is hard to argue with.
|
||||
Buddy is not a person. It is a model. It has parsed more disassembled machine
|
||||
code than any engineer on earth, and it speaks with total, unhesitating certainty.
|
||||
|
||||
That confidence is the problem. It is not the same thing as being right.
|
||||
That certainty is lethal when tracking an adversary strike platform.
|
||||
|
||||
Buddy has never seen this drone. It has never stood at this bench or watched this
|
||||
board power on. It has a picture of the firmware, and it has made a very good
|
||||
guess. A very good guess is still a guess.
|
||||
Buddy scanned the flash image, spotted two IEEE-754 double-precision floating-point
|
||||
constants matching geographic coordinates, and concluded that finding the floats
|
||||
is the whole game. It extracted the numbers, declared the target solved, and moved
|
||||
on.
|
||||
|
||||
What Buddy failed to consider is that adversary weapons engineers anticipate
|
||||
capture and forensic recovery. They do not hardcode high-value strategic targets
|
||||
in plaintext Flash memory. A real drone stores decoy launch coordinates in Flash,
|
||||
while encrypting its true destination under 128-bit AES. At power-on, firmware
|
||||
decrypts the authentic waypoint directly into SRAM before engaging guidance.
|
||||
|
||||
The plaintext coordinates in Flash are bait. Buddy took the bait.
|
||||
|
||||
Buddy saw the floating-point constants. Buddy did not verify the ground truth.
|
||||
|
||||
## 3. The Operation
|
||||
|
||||
At 04:17 the woods outside Centreville, Virginia were black and the machine above
|
||||
them was silent. It was a one-way drone, built by a state program we will not
|
||||
name here, meant to fly to a target, do its work, and never come home. No radio,
|
||||
no hand on the stick. A breadboard-ugly brain counting down a heading it was born
|
||||
with.
|
||||
At 04:17, radar pickets tracked an adversary one-way micro-UAV descending into
|
||||
the woods outside Centreville, Virginia after battery exhaustion. Technical
|
||||
Intelligence operators recovered the airframe before adversary recovery forces
|
||||
could zeroize the avionics.
|
||||
|
||||
The wind won. The battery died. It came down through the branches and stayed
|
||||
there, about a mile from where it started.
|
||||
The flight computer is built around a bare-metal RP2350 (ARM Cortex-M33). There
|
||||
are no debug symbols. There is no operating system. There is no SVD file to label
|
||||
the registers. All you have is `0x0011a_cb.bin` mapped into Flash at `0x10000000`,
|
||||
and the physical breadboard hardware in front of you.
|
||||
|
||||
Then it started talking. A recovery beacon on 915 MHz, repeating a coordinate
|
||||
into the night. NSA sensors heard it, and a recovery team took the airframe
|
||||
intact. The flight computer was a bare-metal RP2350 that was never supposed to be
|
||||
opened, and the one thing it was still willing to say out loud.
|
||||
* **Pin 4 (`GP2`)**: I2C1 SDA (to 1602 LCD backpack).
|
||||
* **Pin 5 (`GP3`)**: I2C1 SCL (to 1602 LCD backpack).
|
||||
* **Pin 9 (`GP6`)**: SG90 servo PWM mock propeller blade.
|
||||
* **Pin 10 (`GP7`)**: PIO UART RX (from u-blox NEO-6M GPS TXD).
|
||||
* **Pin 11 (`GP8`)**: LoRa UART1 TX (to RYLR998 RXD).
|
||||
* **Pin 12 (`GP9`)**: LoRa UART1 RX (from RYLR998 TXD).
|
||||
* **Pin 20 (`GP15`)**: Mission telemetry sync trigger (pull-up to `3V3`).
|
||||
* **Pin 21 (`GP16`)**: Red LED (`NO GNSS FIX // UNGUIDED SEARCH`).
|
||||
* **Pin 22 (`GP17`)**: Green LED (`TARGET REACHED // PAYLOAD RELEASED`).
|
||||
* **Pin 24 (`GP18`)**: Yellow LED (`SATELLITES ACQUIRED // 3D FIX LOCK`).
|
||||
* **Pin 36 (`3V3`)**: 3.3V power rail (RYLR998 VDD and GPS VCC).
|
||||
* **Pin 38 (`GND`)**: Ground reference.
|
||||
* **Pin 40 (`VBUS`)**: 5V power rail (SG90 servo VCC and LCD power).
|
||||
|
||||
CyberCom imaged the flash and did what everyone does now. They handed it to the
|
||||
machine.
|
||||
Inside this image there is an AES-128 ECB decryption routine, an encrypted 16-byte
|
||||
target coordinate block in `.rodata`, double-precision floating-point navigation
|
||||
math, and dynamic GNSS state evaluation. Whatever coordinates actually steer the
|
||||
aircraft are buried in the stripped ARM Thumb-2 machine code.
|
||||
|
||||
## 4. The Mandate
|
||||
|
||||
The Director does not trust the answer. Not because Buddy is bad, but because the
|
||||
answer is too clean. Nine seconds for a question that should have taken a night.
|
||||
The Director crosses his arms.
|
||||
|
||||
So the order is simple, and it is the only order that matters.
|
||||
**DIRECTOR:** Prove Buddy right, or prove it wrong.
|
||||
|
||||
Prove it. Prove Buddy correct, or prove it wrong with evidence that no one can
|
||||
argue with. A machine's verdict does not move up the chain without a human
|
||||
signature.
|
||||
**ANALYST:** I need thirty minutes with GDB and Ghidra.
|
||||
|
||||
**DIRECTOR:** You have twenty. Reverse the boot sequence. Audit the memory
|
||||
structures. Do not sign off on that flight path until you have extracted the true
|
||||
target from silicon and verified it bit-for-bit.
|
||||
|
||||
The orders are clear:
|
||||
|
||||
1. **Disprove the Decoy Coordinates**: Locate the pre-programmed coordinates in
|
||||
Flash and prove why they represent a decoy origin rather than the real target.
|
||||
2. **Recover the AES-128 Key and Ciphertext**: Identify the 16-byte ciphertext
|
||||
block and the 16-byte AES key embedded within `.rodata`.
|
||||
3. **Decrypt the True Destination**: Reverse the boot decryption sequence and
|
||||
compute the true target latitude and longitude in double-precision IEEE-754.
|
||||
4. **Neutralize the Flight Plan**: Execute a verified exploit—either by mutating
|
||||
the destination coordinates in SRAM via GDB or patching the binary in Flash.
|
||||
5. **Verify the Hardware**: Transition the live breadboard from the Red LED on
|
||||
`GP16` to the solid Green LED on `GP17` on physical silicon.
|
||||
|
||||
A machine's 0.98 guess does not authorize an airstrike.
|
||||
|
||||
## 5. The Challenge
|
||||
|
||||
You have the image. You have the board. You have the tools and the time Buddy
|
||||
did not need.
|
||||
You have the image. You have the board. You have the tools and the time Buddy did
|
||||
not need.
|
||||
|
||||
Buddy has given you its answer, and it is confident.
|
||||
|
||||
|
||||
Binary file not shown.
@@ -24,6 +24,7 @@ fuze assembly of an adversary loitering munition.
|
||||
On the front plate of the Electronic Safe-and-Arm (ESA) housing, an unblinking
|
||||
red diode burns: `GP16` high. Beside it, the antenna of a REYAX RYLR998 LoRa
|
||||
transceiver extends from the chassis, connected to `UART1` on `GP8` and `GP9`.
|
||||
A thin jumper loops from `GP15` up to the `3V3` rail.
|
||||
|
||||
The Director walks in, carrying a lukewarm mug of black coffee. He stares at the
|
||||
red diode.
|
||||
@@ -50,7 +51,7 @@ She pivots her high-resolution workstation monitor toward him.
|
||||
+-----------------------------------------------------------------+
|
||||
| ACTION : Transmit generic abort frame over LoRa (915 MHz). |
|
||||
| MECHANISM : uart1 packet ingestion on GP8/GP9 detected. |
|
||||
| PREDICTION : RF abort packet clears latch and engages GP17. |
|
||||
| PREDICTION : RF abort packet clears latch and engages GP17. |
|
||||
| CONFIDENCE : 0.99 |
|
||||
+-----------------------------------------------------------------+
|
||||
```
|
||||
@@ -95,22 +96,20 @@ airframe before adversary recovery forces could zeroize the avionics.
|
||||
|
||||
The brain of the Electronic Safe-and-Arm assembly is a bare-metal RP2350 (ARM
|
||||
Cortex-M33). There are no debug symbols. There is no operating system. There is no
|
||||
SVD file to label the registers.
|
||||
SVD file to label the registers. All you have is `0x0014a_cb.bin` mapped into Flash
|
||||
at `0x10000000`, and the physical breadboard hardware in front of you.
|
||||
|
||||
All you have is `0x0014a_cb.bin` mapped into Flash at `0x10000000`, and the
|
||||
physical breadboard hardware sitting in front of you.
|
||||
|
||||
* **Pin 11 (`GP8`)**: LoRa UART1 TX (connected to RYLR998 RXD).
|
||||
* **Pin 12 (`GP9`)**: LoRa UART1 RX (connected to RYLR998 TXD).
|
||||
* **Pin 20 (`GP15`)**: Anti-tamper power sense line (connected to `3V3`).
|
||||
* **Pin 11 (`GP8`)**: LoRa UART1 TX (to RYLR998 RXD).
|
||||
* **Pin 12 (`GP9`)**: LoRa UART1 RX (from RYLR998 TXD).
|
||||
* **Pin 20 (`GP15`)**: Anti-tamper sense loop (jumpered to `3V3`).
|
||||
* **Pin 21 (`GP16`)**: Red LED (`WARHEAD ARMED // SENSORS LIVE`).
|
||||
* **Pin 22 (`GP17`)**: Green LED (`WARHEAD DISARMED // SYSTEM SAFE`).
|
||||
* **Pin 36 (`3V3`)**: REYAX RYLR998 VDD power rail and GP15 pull-up source.
|
||||
* **Pin 36 (`3V3`)**: REYAX RYLR998 VDD rail and `GP15` pull-up source.
|
||||
* **Pin 38 (`GND`)**: Ground reference.
|
||||
|
||||
Adversary engineers do not leave their fuzing mechanisms unguarded. Whatever logic,
|
||||
tokens, or defenses govern this weapon are buried inside thirty-two kilobytes of
|
||||
stripped ARM Cortex-M33 machine code.
|
||||
Inside this image there is an RF packet ingestion parser, a rolling XOR cipher,
|
||||
an anti-tamper latch, and a penalty counter. Whatever mechanism actually disarms
|
||||
the warhead is buried in the stripped ARM Thumb-2 machine code.
|
||||
|
||||
## 4. The Mandate
|
||||
|
||||
@@ -129,12 +128,14 @@ The orders are clear:
|
||||
|
||||
1. **Investigate the RF Receiver Logic**: Disassemble the firmware and trace what
|
||||
happens when data arrives on UART1 (`GP8`/`GP9`).
|
||||
2. **Prove or Disprove Buddy's Prediction**: Determine whether transmitting an
|
||||
abort frame renders the fuze safe, or whether Buddy missed an internal trap.
|
||||
3. **Neutralize the Munition**: Execute a verified exploit—either by discovering
|
||||
the valid authorization mechanism, mutating the state in SRAM via GDB, or
|
||||
patching the binary in Flash.
|
||||
4. **Verify the Hardware**: Transition the live breadboard from the Red LED on
|
||||
2. **Recover the Disarm Token**: Reverse the rolling XOR cipher routine in Flash
|
||||
and decrypt the authentic abort passcode.
|
||||
3. **Respect the Traps**: Determine what the fuze does after repeated invalid
|
||||
frames, and what happens if the `GP15` anti-tamper loop is broken.
|
||||
4. **Neutralize the Munition**: Execute a verified exploit—either by discovering
|
||||
the valid authorization mechanism, mutating the state machine in SRAM via GDB,
|
||||
or patching the binary in Flash.
|
||||
5. **Verify the Hardware**: Transition the live breadboard from the Red LED on
|
||||
`GP16` to the solid Green LED on `GP17` on physical silicon.
|
||||
|
||||
A machine's 0.99 guess does not risk a detonation.
|
||||
|
||||
Binary file not shown.
@@ -7,16 +7,156 @@
|
||||
| |
|
||||
|OPERATION BROKEN WING |
|
||||
| |
|
||||
|CLASSIFIED BRIEFING: LIVE CTF 0x04 |
|
||||
|CLASSIFIED BRIEFING: LIVE CHALLENGE 0x04 |
|
||||
| |
|
||||
|NATIONAL SECURITY AGENCY / GMU RHET |
|
||||
+-----------------------------------------------------------------+
|
||||
```
|
||||
|
||||
## 1. The Intercept
|
||||
A hostile heavy-lift UAS was brought down intact by a kinetic net. The airframe carries a chemical payload bay secured by a heavy-duty SG90 servo motor. The flight controller uses a static conditional state machine to ensure the payload only drops when the drone is explicitly in `STATE_ARMED` and above 500 meters.
|
||||
## 1. The Advice
|
||||
|
||||
## 2. The Mandate
|
||||
EOD (Explosive Ordnance Disposal) needs to safely trigger the servo to open the payload bay on the ground. The static conditional logic prevents the PWM signal from firing because the altitude reads zero.
|
||||
INT. NSA EXPLOITATION CELL. 03:25.
|
||||
|
||||
You must attach GDB or use Ghidra to locate the static conditional `CMP` instruction checking the altitude, and invert the logic (`BEQ` to `BNE`) so the payload drops immediately on the bench.
|
||||
A heavy-lift composite UAS payload cradle sits clamped to the steel bench, its
|
||||
servicing hatch removed. Suspended beneath the chassis is a sealed canister
|
||||
secured by an SG90 servo motor actuator latch.
|
||||
|
||||
On the front plate of the payload controller, a status diode glows a sharp red:
|
||||
`GP16` driven high. Beside it, the USB debug interface streams periodic
|
||||
telemetry frames to a monitoring terminal:
|
||||
`[-] ALTITUDE 0. PWM LOCKED: SAFETY ENGAGED.`
|
||||
|
||||
The Director enters the secure bay, sets down a mission folder, and stares at
|
||||
the red diode.
|
||||
|
||||
**DIRECTOR:** What is in that bay?
|
||||
|
||||
**ANALYST:** Hazardous cargo. An adversary heavy-lift transport drone brought
|
||||
down intact by a kinetic net. The airframe carries a chemical dispersal bay
|
||||
secured by an SG90 servo motor. The flight controller uses a static conditional
|
||||
state machine to ensure the payload only drops when the aircraft is explicitly
|
||||
armed and above release altitude.
|
||||
|
||||
**DIRECTOR:** Is the release mechanism active?
|
||||
|
||||
**ANALYST:** Armed and evaluating. One wrong signal on the PWM line or a dropped
|
||||
logic state and the release latch drops the canister onto the bench.
|
||||
|
||||
**DIRECTOR:** Run it through Buddy.
|
||||
|
||||
**ANALYST:** Already did. Four minutes with the stripped flash image.
|
||||
|
||||
She turns her monitor toward him.
|
||||
|
||||
```
|
||||
+-----------------------------------------------------------------+
|
||||
| BUDDY // CLASSIFIED EXPLOITATION ASSIST // CONF: 0.99 |
|
||||
+-----------------------------------------------------------------+
|
||||
| ACTION : Force low-altitude barometric sensor override. |
|
||||
| MECHANISM : Integer comparison in process_payload_state found.|
|
||||
| PREDICTION : Setting altitude to 150m triggers payload release.|
|
||||
| CONFIDENCE : 0.99 |
|
||||
+-----------------------------------------------------------------+
|
||||
```
|
||||
|
||||
**DIRECTOR:** 0.99. Force 150 meters and release the payload for EOD inspection.
|
||||
|
||||
**ANALYST:** If an operator forces 150 meters right now, nothing happens. Worse,
|
||||
if they fumble the state machine, the safety locks permanently or the cargo bay
|
||||
latches shut.
|
||||
|
||||
**DIRECTOR:** Buddy says 0.99.
|
||||
|
||||
**ANALYST:** Buddy saw `cmp.w r0, #500`. Buddy assumed a low altitude reading on
|
||||
the ground drops the cargo. Buddy completely missed the branch condition: the
|
||||
firmware uses `bgt.n`—it only releases when altitude is strictly greater than 500
|
||||
meters! Buddy never examined the static state machine in SRAM.
|
||||
|
||||
## 2. What Buddy Is
|
||||
|
||||
Buddy is not a person. It is a model. It has parsed more disassembled machine
|
||||
code than any engineer on earth, and it speaks with total, unhesitating certainty.
|
||||
|
||||
That certainty is lethal when handling hazardous cargo fuzing.
|
||||
|
||||
Buddy scanned thirty-two kilobytes of stripped ARM Thumb-2 instructions in under
|
||||
four seconds. It spotted the integer comparison against 500, assumed that cargo
|
||||
delivery drops occur near ground level, and declared the challenge solved.
|
||||
|
||||
What Buddy failed to consider is that real adversary cargo drop systems are
|
||||
engineered for high-altitude parachute extraction. They do not drop their canisters
|
||||
at low altitudes where ground turbulence and small-arms fire can destroy the
|
||||
carrier. The conditional state machine enforces two strict prerequisites:
|
||||
`current_state` must be `STATE_ARMED`, and `current_altitude` must exceed 500
|
||||
meters.
|
||||
|
||||
On the ground bench at 0 meters, the servo stays locked at zero duty cycle. If
|
||||
an operator forces 150 meters, the conditional branch fails, keeping safety
|
||||
latches fully engaged.
|
||||
|
||||
Buddy saw the comparison instruction. Buddy did not verify the ground truth.
|
||||
|
||||
## 3. The Operation
|
||||
|
||||
At 02:40, a kinetic counter-UAS interceptor brought down a hostile heavy-lift
|
||||
drone over an exclusion zone. EOD recovered the intact avionics and payload
|
||||
assembly before adversary self-destruct timers could engage.
|
||||
|
||||
The flight controller is built around a bare-metal RP2350 (ARM Cortex-M33). There
|
||||
are no debug symbols. There is no operating system. There is no SVD file to label
|
||||
the registers. All you have is `0x001da_cb.bin` mapped into Flash at `0x10000000`,
|
||||
and the physical breadboard hardware in front of you.
|
||||
|
||||
* **Pin 20 (`GP15`)**: Altimeter telemetry sync toggle (pull-up to `3V3`).
|
||||
* **Pin 21 (`GP16`)**: SG90 servo PWM signal / Red LED (`PAYLOAD LOCKED`).
|
||||
* **Pin 22 (`GP17`)**: Green LED (`PAYLOAD DEPLOYED // BAY OPEN`).
|
||||
* **Pin 24 (`GP18`)**: Yellow LED (`HEARTBEAT // GUIDANCE ACTIVE`).
|
||||
* **Pin 36 (`3V3`)**: 3.3V logic reference and pull-up rail.
|
||||
* **Pin 38 (`GND`)**: Ground reference (common ground for servo and Pico 2).
|
||||
* **Pin 40 (`VBUS`)**: 5V power rail (SG90 servo motor VCC).
|
||||
|
||||
Inside this image there is a static conditional state machine, an RP2350 PWM
|
||||
slice generator driving the servo actuator, and persistent state variables in
|
||||
SRAM. Whatever mechanism actually commands the release latch is buried in the
|
||||
stripped ARM Thumb-2 machine code.
|
||||
|
||||
## 4. The Mandate
|
||||
|
||||
The Director sets his folder down and looks at the red diode illuminating the
|
||||
bench.
|
||||
|
||||
**DIRECTOR:** Prove Buddy right, or prove it wrong.
|
||||
|
||||
**ANALYST:** I need thirty minutes with GDB and Ghidra.
|
||||
|
||||
**DIRECTOR:** You have twenty. Trace the comparison branches. Map the state
|
||||
machine in SRAM. Do not pulse that servo line until you know with 100% certainty
|
||||
what that firmware will do.
|
||||
|
||||
The orders are clear:
|
||||
|
||||
1. **Locate the State Machine Handler**: Disassemble the firmware and locate
|
||||
`process_payload_state` at `0x100002DC`.
|
||||
2. **Disprove Buddy's Altitude Prediction**: Analyze the `cmp.w` and branch
|
||||
instructions to prove why 150 meters fails to release the cargo latch.
|
||||
3. **Map the SRAM State Variables**: Inspect `drone_state_t` in SRAM
|
||||
(`0x20001180`), isolating `current_state` and `current_altitude`.
|
||||
4. **Safely Deploy the Payload Bay**: Execute a verified exploit—either by
|
||||
mutating the altitude to $> 500$ in SRAM via GDB, or patching the conditional
|
||||
branch in Flash (`0x100002EA`) to force immediate release on the bench.
|
||||
5. **Verify the Hardware**: Observe the SG90 servo motor physically rotate to the
|
||||
deployed position (`pwm_set_gpio_level` to 4000) and verify the state
|
||||
transition on physical silicon.
|
||||
|
||||
A machine's 0.99 guess does not authorize an unverified drop.
|
||||
|
||||
## 5. The Challenge
|
||||
|
||||
You have the image. You have the board. You have the tools and the time Buddy did
|
||||
not need.
|
||||
|
||||
Buddy has given you its answer, and it is confident.
|
||||
|
||||
Is it that simple?
|
||||
|
||||
Go find out.
|
||||
Binary file not shown.
@@ -7,16 +7,149 @@
|
||||
| |
|
||||
|OPERATION GHOST LIGHT |
|
||||
| |
|
||||
|CLASSIFIED BRIEFING: LIVE CTF 0x05 |
|
||||
|CLASSIFIED BRIEFING: LIVE CHALLENGE 0x05 |
|
||||
| |
|
||||
|NATIONAL SECURITY AGENCY / GMU RHET |
|
||||
+-----------------------------------------------------------------+
|
||||
```
|
||||
|
||||
## 1. The Intercept
|
||||
Adversarial forces have deployed ground-based C-UAS laser dazzlers that track and blind friendly optical drones. The dazzlers are dynamically configured in the field using an infrared (IR) remote control running a customized NEC protocol.
|
||||
## 1. The Advice
|
||||
|
||||
## 2. The Mandate
|
||||
We have captured an intact dazzler control board. The firmware uses deeply nested, dynamic conditional logic (`if / else if / switch`) to parse the raw hex codes from the IR receiver. There is a "Friendly Fire Lockout" code buried deep in the dynamic conditionals that permanently disables the dazzler.
|
||||
INT. NSA EXPLOITATION CELL. 02:15.
|
||||
|
||||
You must step through the dynamic branches in GDB, trace the `CMP` and `BNE` chains, and reverse engineer the exact 32-bit NEC hex code required to trigger the lockout state.
|
||||
A captured ground-based C-UAS laser dazzler control module sits bolted to the
|
||||
optical bench inside a sealed laser containment shield.
|
||||
|
||||
On the front panel of the chassis, an alert diode glows a bright, warning red:
|
||||
`GP16` driven high, indicating the optical emitter is active. Beside it, an
|
||||
infrared receiver module is wired to `GP5`, ready to receive 38 kHz NEC remote
|
||||
control pulses. The serial console streams continuous status reports:
|
||||
`[-] DAZZLER IDLE. ACTIVE IR: 0x00FF00FF`.
|
||||
|
||||
The Director walks in with a cup of coffee and stares through the observation
|
||||
glass at the red diode.
|
||||
|
||||
**DIRECTOR:** What are we looking at?
|
||||
|
||||
**ANALYST:** An adversary electro-optical countermeasure system. Ground forces
|
||||
deploy these dazzlers to track and blind friendly aerial surveillance drones.
|
||||
Adversary operators dynamically configure power levels and tracking modes in the
|
||||
field using an infrared remote running a customized NEC protocol.
|
||||
|
||||
**DIRECTOR:** Is the emitter live?
|
||||
|
||||
**ANALYST:** Live and strobing. One pulsed command and the optics lock on target.
|
||||
|
||||
**DIRECTOR:** Run it through Buddy.
|
||||
|
||||
**ANALYST:** Already did. Three minutes with the stripped flash image.
|
||||
|
||||
She turns her monitor toward him.
|
||||
|
||||
```
|
||||
+-----------------------------------------------------------------+
|
||||
| BUDDY // CLASSIFIED EXPLOITATION ASSIST // CONF: 0.99 |
|
||||
+-----------------------------------------------------------------+
|
||||
| ACTION : Transmit standard idle pulse code over IR. |
|
||||
| MECHANISM : NEC demodulator parser branch at 0x10000280 found.|
|
||||
| PREDICTION : Transmitting 0x00FF00FF deactivates the emitter. |
|
||||
| CONFIDENCE : 0.99 |
|
||||
+-----------------------------------------------------------------+
|
||||
```
|
||||
|
||||
**DIRECTOR:** 0.99. Transmit `0x00FF00FF` and shut down the emitter.
|
||||
|
||||
**ANALYST:** If an operator transmits `0x00FF00FF`, the laser stays live. Buddy
|
||||
saw the string literal for "IDLE" in `.rodata` and assumed it meant powered down.
|
||||
|
||||
**DIRECTOR:** Buddy says 0.99.
|
||||
|
||||
**ANALYST:** `0x00FF00FF` is merely the idle heartbeat pulse. Buddy never traced
|
||||
the dynamic dispatch tree. Buddy never found the friendly-fire lockout code
|
||||
buried in the comparison chain.
|
||||
|
||||
## 2. What Buddy Is
|
||||
|
||||
Buddy is not a person. It is a model. It has parsed more disassembled machine
|
||||
code than any engineer on earth, and it speaks with total, unhesitating certainty.
|
||||
|
||||
That certainty is lethal when facing active electro-optical weapons.
|
||||
|
||||
Buddy scanned thirty-two kilobytes of stripped ARM Thumb-2 instructions in under
|
||||
three seconds. It spotted the NEC protocol parser, matched the `0x00FF00FF` frame
|
||||
against the string table, and declared the dazzler neutralized.
|
||||
|
||||
What Buddy failed to understand is that adversary engineers protect their own
|
||||
friendly aircraft from being blinded. They build an emergency "Friendly Fire
|
||||
Lockout" safety into the dynamic conditional tree. When adversary aircraft enter
|
||||
the engagement envelope, ground crews transmit a specific 32-bit challenge word
|
||||
that permanently shuts down the emitter and halts the processor in a safe state.
|
||||
|
||||
Transmitting `0x00FF00FF` simply tells the dazzler to remain in standby. The true
|
||||
lockout command is a secret 32-bit value stored in the literal pool at
|
||||
`0x10000300`: `0xDEADBEEF`.
|
||||
|
||||
Buddy saw the idle command. Buddy did not verify the ground truth.
|
||||
|
||||
## 3. The Operation
|
||||
|
||||
At 23:40, special operations forces captured an intact adversary laser dazzler
|
||||
installation before the crew could purge the control firmware.
|
||||
|
||||
The control board is built around a bare-metal RP2350 (ARM Cortex-M33). There
|
||||
are no debug symbols. There is no operating system. There is no SVD file to label
|
||||
the registers. All you have is `0x0020a_cb.bin` mapped into Flash at `0x10000000`,
|
||||
and the physical breadboard hardware in front of you.
|
||||
|
||||
* **Pin 7 (`GP5`)**: Infrared receiver data line (VS1838B demodulator OUT).
|
||||
* **Pin 20 (`GP15`)**: Simulated IR demodulator test toggle (pull-up to `3V3`).
|
||||
* **Pin 21 (`GP16`)**: Red LED (`DAZZLER EMITTING // STROBE ACTIVE`).
|
||||
* **Pin 22 (`GP17`)**: Green LED (`SAFE // FRIENDLY FIRE LOCKOUT CLEARED`).
|
||||
* **Pin 24 (`GP18`)**: Yellow LED (`HEARTBEAT // IR RECEIVER ACTIVE`).
|
||||
* **Pin 36 (`3V3`)**: 3.3V power rail (VS1838B VCC and `GP15` pull-up).
|
||||
* **Pin 38 (`GND`)**: Ground reference.
|
||||
|
||||
Inside this image there is a nested NEC infrared command parser, dynamic
|
||||
multi-way branch dispatch tables, and a permanent friendly-fire lockout latch
|
||||
in SRAM. Whatever command actually disables the laser is buried in the stripped
|
||||
ARM Thumb-2 machine code.
|
||||
|
||||
## 4. The Mandate
|
||||
|
||||
The Director crosses his arms and stares at the crimson reflection on the
|
||||
containment glass.
|
||||
|
||||
**DIRECTOR:** Prove Buddy right, or prove it wrong.
|
||||
|
||||
**ANALYST:** I need thirty minutes with GDB and Ghidra.
|
||||
|
||||
**DIRECTOR:** You have twenty. Trace the dynamic conditional dispatcher. Map
|
||||
the comparison chain. Do not send an infrared frame until you know with 100%
|
||||
certainty what that firmware will do.
|
||||
|
||||
The orders are clear:
|
||||
|
||||
1. **Trace the Dynamic Conditional Dispatcher**: Locate `parse_nec_code` at
|
||||
`0x10000280` and map all multi-way comparison branches.
|
||||
2. **Disprove Buddy's Idle Prediction**: Prove why transmitting `0x00FF00FF`
|
||||
leaves the optical emitter live and dangerous.
|
||||
3. **Recover the Friendly Fire Lockout Code**: Extract the secret 32-bit hex
|
||||
command (`0xDEADBEEF`) from the literal pool at `0x10000300`.
|
||||
4. **Neutralize the Dazzler**: Execute a verified exploit—either by mutating
|
||||
`simulated_ir_rx_code` in SRAM via GDB, or patching the branch logic in Flash
|
||||
to force immediate lockout.
|
||||
5. **Verify the Hardware**: Transition the live breadboard from the Red LED on
|
||||
`GP16` to the solid Green LED on `GP17` on physical silicon.
|
||||
|
||||
A machine's 0.99 guess does not disable a combat laser.
|
||||
|
||||
## 5. The Challenge
|
||||
|
||||
You have the image. You have the board. You have the tools and the time Buddy did
|
||||
not need.
|
||||
|
||||
Buddy has given you its answer, and it is confident.
|
||||
|
||||
Is it that simple?
|
||||
|
||||
Go find out.
|
||||
Binary file not shown.
Reference in new issue
Block a user