Nostalgia — HackTheBox

Description

It's late at night and your room's a mess, you stumble upon an dusty old looking box and you decide to go through it, you start unveiling hidden childhood memories and you find a mesmerising gamebody advanced flash card labeled 'Nostalgia', you pop the card in and a logo welcomes you, this strange game expects you to input a cheatcode. Can you figure it out?

Instructions: Open the rom in a GBA emulator of your choice. Select is to clear the input on the screen and start is to submit it, if the cheatcode is wrong, nothing will happen.

English summary: A Game Boy Advance ROM (Nostalgia.gba, 72812 bytes) presents a cheat code input screen. The player must enter the correct button sequence and press Start to submit. If correct, the flag is displayed on screen as a bitmap image. The goal is to reverse engineer the validation logic and extract the flag.

Analysis

Initial Reconnaissance

• file Nostalgia.gba → Game Boy Advance ROM image
• No plaintext flag strings found via strings — no "HTB", "flag", "correct", or "wrong" strings
• GBA ROM uses ARM7TDMI processor (ARM + Thumb mode), ROM base address 0x08000000
• The game expects a button sequence (cheat code) as input; Select clears, Start submits

Button Input Handling

Disassembled with radare2 (r2 -a arm -b 16 -m 0x08000000). The button input loop at 0x080015F4:

1. Reads GBA key register at 0x04000130
2. Iterates through 10 button masks from a lookup table at 0x0200B03C
3. Detects newly pressed buttons via tst r0, r2 (current & ~previous)

Standard GBA button masks: A=0x01, B=0x02, Select=0x04, Start=0x08, Right=0x10, Left=0x20, Up=0x40, Down=0x80, L=0x200, R=0x100.

Accumulator Validation Logic

...