Secret Treasures — HackTheBox

Description

Our years undercover in the art dealing world have paid off, and we have compromised the inner circle. The coordinates of the stolen treasures are contained within a mysterious device that we now have clearance to access. We managed to dump its flash memory and extract the embedded software running on it, and tap its input channel with a trigger-based capturing device in order to monitor passcode input. Its secrets must be retrieved!

Three files provided:

1. embedded_software — ARM 32-bit ELF binary (Raspberry Pi), linked with wiringPi library, not stripped
2. flash_memory_dump.bin — 16 MB W25Q128 SPI flash chip dump
3. input_channel_trace.sal — Saleae Logic 8 capture of UART input channel (internal .sal format containing digital-0.bin and meta.json)

Goal: recover the secret (flag) stored scattered across the flash memory.

Analysis

1. Binary Reconnaissance

The embedded_software file is an ARM 32-bit ELF binary for Raspberry Pi. It imports functions from libwiringPi.so (SPI and serial I/O) and libc.so.6. Source file names visible in debug info: main2.c, memory_access.c.

2. Key Functions Identified via Radare2

main — orchestrates the entire flow:

1. Initializes SPI at 2 MHz: wiringPiSPISetup(0, 0x1e8480)
2. Opens serial port: serialOpen("/dev/ttyS0", 38400) (0x9600 = 38400 decimal)
3. Reads exactly 8 characters from UART
4. Converts to unsigned long via strtoul(buffer, NULL, 10) — this is the passcode/seed
5. Stores result in global next_in_seq
6. Calls W25Q128_init(0) to configure SPI channel
7. Calls get_UniqieID() to read 8-byte unique ID from flash via SPI command 0x4B
8. Compares unique ID against hardcoded value: d2 66 b4 21 83 51 30 2c
9. If match: loops 49 times, each iteration calls random_generator() three times to construct a 24-bit flash address, reads 1 byte from flash, outputs it via putchar()
10. If no match: prints "Not Identified"

random_generator — Linear Congruential Generator (LCG):

next_in_seq = next_in_seq * 0x41c64e6d + 0x0008042a   (32-bit overflow)
return next_in_seq % 16777215                           (mod 0xFFFFFF)

get_secret — SPI flash read:

• Sends command 0x03 (Read Data) with 3-byte address
• Reads specified number of bytes from W25Q128

Address construction (per flag character):

rng1 = random_generator()
rng2 = random_generator()
rng3 = random_generator()
addr = (rng1 & 0xFF0000) | (rng2 & 0xFF00) | (rng3 & 0xFF)

3. Saleae Logic Capture (attempted but not needed)

The .sal file is a zip containing Saleae Logic 2 internal format files. Meta.json indicated: Saleae Logic 8, 50 MHz digital sample rate, 1 digital channel, 3.54 second capture. The internal binary format uses undocumented RLE-encoded transition data, making reliable UART decoding at 38400 baud difficult without the proprietary software. This led to the brute-force approach.

4. Attack Vector: Brute-Force the Seed

Key insight: the passcode is an 8-digit decimal number (00000000–99999999 = 10^8 possibilities). The LCG is fully deterministic given the seed. The flag format HTB{...} provides a known-plaintext check — we can verify the first 4 characters against the flash dump to filter candidates.

Solution

Brute-Force Strategy

1. Load the 16 MB flash dump into memory
2. For each candidate seed (0 to 99,999,999):
   • Run the LCG forward, generate addresses for the first 4 flag characters
   • Check if flash[addr] matches H, T, B, { respectively
   • On match: regenerate all 49 characters and print the flag
3. Early rejection after first mismatch makes this extremely fast

Solve Script (C)

#include <stdio.h>
#include <stdlib.h>
#include <stdint.h>
#include <string.h>

int main() {
    FILE *f = fopen("flash_memory_dump.bin", "rb");
    if (!f) { perror("open flash"); return 1; }

    unsigned char *flash = malloc(16777216);
    fread(flash, 1, 16777216, f);
    fclose(f);

    for (uint32_t seed = 0; seed < 100000000; seed++) {
        uint32_t state = seed;

        // Check first 4 chars: H, T, B, {
        char expected[] = "HTB{";
        int match = 1;
        for (int c = 0; c < 4 && match; c++) {
            state = state * 0x41c64e6d + 0x0008042a;
            uint32_t rng1 = state % 16777215;
            state = state * 0x41c64e6d + 0x0008042a;
            uint32_t rng2 = state % 16777215;
            state = state * 0x41c64e6d + 0x0008042a;
            uint32_t rng3 = state % 16777215;
            uint32_t addr = (rng1 & 0xFF0000) | (rng2 & 0xFF00) | (rng3 & 0xFF);
            if (flash[addr] != expected[c]) match = 0;
        }
        if (!match) continue;

        // Found HTB{ prefix — generate full 49-char flag
        printf("FOUND seed=%u\n", seed);
        state = seed;
        printf("Flag: ");
        for (int i = 0; i < 49; i++) {
            state = state * 0x41c64e6d + 0x0008042a;
            uint32_t rng1 = state % 16777215;
            state = state * 0x41c64e6d + 0x0008042a;
            uint32_t rng2 = state % 16777215;
            state = state * 0x41c64e6d + 0x0008042a;
            uint32_t rng3 = state % 16777215;
            uint32_t addr = (rng1 & 0xFF0000) | (rng2 & 0xFF00) | (rng3 & 0xFF);
            printf("%c", flash[addr]);
        }
        printf("\n");

        free(flash);
        return 0;
    }

    printf("Not found\n");
    free(flash);
    return 1;
}

Compiled with cc -O3 -o brute brute.c and ran in under 1 second:

FOUND seed=73261522
Flag: HTB{REDACTED}

The passcode entered via UART was 73261522.