reverseProhard

flag_checker

kalmarctf

Task: iCE40 HX8K FPGA bitstream that accepts a UART flag at 9600 baud and lights an LED on success. Solution: unpack the bitstream, fix the broken SB_RAM40_4K simulation model, then recover the flag with counter-guided, threaded iverilog brute force.

uart verilog bitstream ice40 fpga block_ram

bitstream_unpackingverilog_resimulationprimitive_model_fixsimulation_guided_bruteforcethreaded_worker_bruteforce

$ ls tags/ techniques/

uart verilog bitstream ice40 fpga block_ram

bitstream_unpackingverilog_resimulationprimitive_model_fixsimulation_guided_bruteforcethreaded_worker_bruteforce

Analysis

Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat.

$ python3 exploit.py --target 192.168.1.1 --port 8080
[*] Connecting to target...
[+] Shell obtained!

Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum.

Permission denied (requires tier.pro)

Sign in to access full writeups

$sign in

$ cat writeup.md…

Sign in to access full writeups

Sign in to access full writeups

Similar writeups