Category: Blogs

  • Album Rush #2

    Welcome to Album Rush, where I go through a random album every week for my amusement.

    Illmatic Review

    Classic

    Standout

    NY State Of Mind – Bangers and Mash

    ONE TAKE. TO MAKE THIS. AT 19

    Nas’s lyrics on “NY State of Mind” are incredibly dense and complex, with intricate rhymes and wordplay that demand repeated listens to fully appreciate. He raps about everything from drug deals and shootouts to police brutality and racism, all with a sense of urgency and authenticity that is rare in hip-hop.

    On tracks like “One Love” and “Represent,” Nas paints a vivid picture of the daily grind of survival in the projects.

    One of my personal favorite tracks on the album, “Memory Lane” sees him reflecting on his childhood and coming of age in the projects.

    9/10

    Kendrick Lamar – Good Kid, M.A.A.D City

    The album art is of a photograph of 3 people with black lines covering their eyes and a baby Kendrick sitting on the lap of one of them.
    Is that Kendrick?

    “I don’t want a Sherane in my life but I’d love to have a Whitney” – Me, rn

    I love this album, listened to it a lot. It introduced me to Kendrick, who is easily my #1 artist. I wrote (and trashed) a review on each individual song about 2 years ago, but now I want to do this again.

    Good Kid, M.A.A.D City is the second studio album by American rapper Kendrick Lamar, released in 2012. The album is a concept record that tells the story of Lamar’s upbringing in Compton, California, exploring themes of family, violence, drugs, and the struggle to overcome the challenges of life in a crime-ridden environment.

    It does so by being structured like a movie or a play, with each song serving as a chapter in the larger narrative. However, these chapters are not in chronological order.

    By leaving behind the linear narrative structure and adopting the somewhat cohesive list, Kendrick is able to explore the themes of the album in a more layered way. He’s able to examine the effects of violence, drugs, and gang culture on his community from multiple perspectives, rather than simply presenting a straightforward story. This lays the groundwork for his future albums, To Pimp a Butterfly and Mr Morale & The Big Steppers, both of which examine the effects of generational trauma. The album’s non-linear structure also allows for moments of reflection, as Kendrick looks back on his past experiences and realizes the significance of the events he’s lived through.

    Part 1/3 Of the Trilogy


    Here’s a link to a playlist which will contain my fav songs from these albums. (Album Rush albums)

    If you wanna read about some of the other stuff I write about then
    here

  • Album Rush #1

    Hey there!

    Recently, I’ve been in a bit of a music rut. I’ve been listening to the same songs over and over again. Finding recommendations for good music isn’t hard, it’s forcing myself to listen to it that is. I like my comfort zone, I’m not a fan of getting out of it.

    Which is why I decided to try push myself out of it. So from this week onwards, I’ll force myself to listen to a new album (or well… an album I haven’t listened to).

    Let’s start of with the below list since it’s got some albums that I actually have listened to and love (I’m a huge Kendrick fan so… :shrug: )

    In order:

    1. Kendrick Lamar – To Pimp A Butterfly
    2. Madvillain – Madvillainy
    3. Kendrick Lamar – good kid, m.A.A.d City
    4. Nas – Illmatic
    5. Kanye West – My Beautiful Dark Twisted Fantasy
    6. Wu-Tang Clan – Enter The Wu-Tang : 36 Chambers
    7. A Tribe Called Quest – The Low End Theory
    8. Death Grips – The Money Store
    9. Danny Brown – Atrocity Exhibition
    10. Kanye West – The College Dropout

    First though…

    Illmatic – Nas

    Album art of Illmatic, featuring a young kid
    Wonder if I looked like that as a kid?

    Illmatic is widely considered one of the greatest and most influential hip-hop albums of all time. Released in 1994, it was the debut studio album of rapper Nas, who was just 20 years old at the time.

    The album features 10 tracks that paint a vivid picture of life in the Queensbridge housing projects in New York City, where Nas grew up. Through this album, Nas reflects on his experiences with poverty, violence, and crime, as well as the social and political issues affecting his community.

    Illmatic was highly acclaimed upon its release, with critics praising Nas’s lyricism, storytelling, and flow.

    The tracks on Illmatic are often cited as some of the greatest in hip-hop history, including “NY State of Mind,” “The World is Yours,” and “It Ain’t Hard to Tell.”

    In addition to its critical acclaim, Illmatic has had a significant impact on hip-hop culture. Nas’s storytelling and portrayal of life in the projects set a new standard, and the album has been praised for its social commentary and its ability to shed light on issues affecting marginalized communities.

    I’ve listened to a few songs from Illmatic before, the main one being “NY State Of Mind”.

    Oh wait! First, here’s a link to a playlist which will contain my fav songs from these albums.

    If you wanna read about some of the other stuff I write about then.
    here

  • Shay Review’s : Hogwarts Legacy

    Hogwarts Legacy Review In Progress

    Hogwarts Legacy Review:

    Currently played the game for 25 hours, story complete, review still in progress

    As a child, the idea of stepping into the world of Harry Potter was nothing short of a dream. I used to be the kind of kid who’d daydream all the time. Countless hours on my bed or just walking around, imagining all the fantasy worlds I’d been exposed to.

    A picture of Hogwarts in Autumn
    Hogwarts in Autumn

    The thought of attending Hogwarts School of Witchcraft and Wizardry, casting spells, and exploring the iconic locations from the books and films filled the mind with wonder and excitement. For many fans of the franchise, including myself, the idea of being able to experience the magic of the wizarding world was just a far-off daydream. However, with the release of the highly-anticipated action role-playing game, Hogwarts Legacy, that dream has finally become a reality.

    The game takes place in the late 1800s, decades before the events of the Harry Potter series. Players take on the role of a student at Hogwarts School of Witchcraft and Wizardry and are able to explore the vast and immersive world of the wizarding school. The game features a vast open world, which includes iconic locations from the franchise, such as Hogsmeade Village, the Forbidden Forest, and the Hogwarts Castle itself.

    Gameplay

    Hogwarts Legacy is a magical adventure that offers a vast array of mechanics that will keep you captivated for hours. The exploration aspect allows you to freely roam the halls of Hogwarts and beyond, uncovering hidden mysteries and collecting a multitude of magical artifacts. I cannot stress this enough, Hogwarts is MASSIVE. I still have not explored most of the castle. Secrets hide behind every wall and figuring out how to gain access will take a lot of time.

    The puzzles you’ll encounter are masterfully crafted, and solving them is a joy… sometimes. There are some puzzles where I definitely was lost, off on some tangent.

    A picture of Hogsmeade
    “All roads lead to Hogsmeade”

    “Does it get any more cozy than Hogsmeade?”

    Replacing Diagon Alley as the place to spend all those galleons you’ve been saving up, Hogsmeade is a small cozy town just north of Hogwarts that you go to, early in the story. Lots of chests around which are behind locks (yes, you cannot access most of these till later on in the game). A few non-playable characters truly shine, among them Sirona, the owner of the Three Broomsticks. Her background as a witch is captivating, and we’ll delve into it in greater detail later on.

    Travel between locations can be done using the convenient “Floo Powder” fast travel service, or by soaring through the skies on your broomstick or ||Spoilers||.

    Picture of Hogwarts
    Hogwarts, always so serene

    My biggest gripe is the repetitive dialogue. Hearing the same lines repeatedly becomes tiresome, and I wish the developers had devoted more time to this aspect of the game.

    Truly a vast game with a lot of side quests, I sit here with only 23% complete after finishing the main story. So expect to spend around 50-60 hours if you want to 100% the game.

    Result : 9/10

    Combat

    Unlocking the spell Avada Kedavra
    Avada Kedavra

    As a wizard or witch, your magical wand is your trusted companion. Throughout the game, you’ll use it to solve puzzles, illuminate dark areas, and scan your surroundings. However, as you progress, you’ll face increasingly powerful enemies, making it all the more important to hone your attack and defense spells.

    You’ll learn several spells from the beginning, and the key to success is combining them. Hit an opponent with three basic spells, pull it towards you, then hit it three more times before setting it on fire and pushing it back. Different spell combinations result in different effects, and experimenting with different combinations is encouraged. As you progress, you’ll learn powerful combos, but you’re also free to create your own.

    Fighting enemies is always exciting, as each opponent presents unique challenges. Some have shields that can only be broken with specific spells, while others are vulnerable to fire. To defend yourself, you can cast a shield spell or dodge out of danger. With its parry button and other mechanics, combat has a “Souls-like” feel to it. And as you progress, you can upgrade your spells for even more power and effect.

    Personally, I found combat very fun, as long as you can stomach all the spell book switching that you’d need to do to be efficient. It can take a bit to get used to. It took me time to get used to dodging and the shield charm. To figure out when an opponent attacked based on their animation was quite difficult I must say.

    I do wish there were more spells that you could use, hopefully we can see some later.

    For those who prefer a more subtle approach, you can also sneak past enemies or stun them silently. The choice is yours! (My character played as a wizard who wouldn’t shy away from combat. I’d brazenly walk up to the front gate of a castle and fight everyone, no matter the numbers.)

    Also unlocking and using the 3 unforgivable spells are always fun.

    [On further review, I’d actually consider the combat as so much better than I thought it was. Sure, the enemies don’t all shoot spells at once, but I’d rather have it be fun to play with than realistic. I don’t want to be spending half the fight dodging everyone’s spells]

    Score: 8/10 8.5/10

    Graphics and Performance

    Played on both a PC (1440p, medium) as well as on my Steam Deck

    A picture of the library at Hogwarts
    The Librarian

    There is no photo mode.

    Every aspect of the castle and its surroundings has been meticulously designed and crafted, making it feel like you’ve truly been transported into the world of magic. The stunning landscapes and intricate details of Hogwarts are truly a sight to behold. The grand halls are awe-inspiring, with their high ceilings and intricate details. And outside the castle, the sprawling grounds are just as captivating, offering endless opportunities for exploration and discovery. The attention to detail is phenomenal, from the cobblestone paths to the swaying trees. You’ll feel like you’re actually walking the grounds of Hogwarts, rather than just playing a game.

    Some lighting issues whenever you move from one room to another. It’s like the lights take a while to render and it ends up looking really bad.

    On a Steam Deck it runs around 20-30 fps and some drops down to the 10s. But all in all, I’d say it’s reasonable.

    Score: 6.5/10 (I have heard reports of many other users having issues with the game)

    Story and Characters

    Main character with red eyes

    Warning: This section probably contains spoilers

    Hogwarts Legacy is set in the late 1800s and follows a student starting at Hogwarts in the fifth year. Why they are only starting that late is never really explained.

    We start the game off with the introduction of Professor Fig, who acts as a mentor to the character, escorting the protagonist to Hogwarts via a flying coach. During the ride, they end up using a port key which teleports them to the bank of Gringotts, Diagon Alley. From this point, the protagonist learns they can see ancient magic, and are confronted by Ranrok the main antagonist, a goblin fueled by something resembling the ancient power wielded by the protagonist. Fig and the protagonist escape the goblin, and the protagonist begins their term at Hogwarts.

    The rest of the story deals with them trying to deal with the Ranrok as well as learning the history of their ancient power.

    I’d say the story felt predictable but is paced great, with time in between to attend classes and to learn new spells. However the actual story feels kinda dull. I had a hard time getting myself to go through some of the boring missions. Lots of puzzles to go through if that interests you though.

    The protagonist never really feels like he cares about the people around him for some reason. He shows no emotions sometimes and just finishes his work (kinda relatable ngl).

    There are also three main sidequests in the game, each following a character from Gryffindor, Hufflepuff and Slytherin (What happened to Ravenclaw??).

    Now… the only quest I found interesting were the ones following Sebastian, the companion from Slytherin. With rewards like the 3 Unforgivables, a great story featuring Omnis Gaunt (Voldy’s grand uncle?) and some unpleasant choices, it’s the sidequest that actually feels like a story being played.

    The other side quests are kinda fun, but I say this as someone who is fine with most Ubisoft-esque quests so your views may differ.

    Score: 7/10

    Verdict

    If you’re a fan of the Harry Potter franchise, then you’ll be delighted if you end up buying Hogwarts Legacy. Hogwarts Legacy is the ultimate Harry Potter RPG experience that I have been longing for. The Open World format, demanding and intricate combat and the stunning depiction of Hogwarts and it’s surroundings will keep you yearning for more.

    While there are some technical issues and an average main story, the rest of the game is quite remarkable. Which is why I’d give it 2 different scores.

    Score(as a HP fan): 8.5/10

    Score (as an RPG game) : 7.5/10

    JK Rowling Issue

    Please be aware that J.K. Rowling, the creator of the Harry Potter franchise, has made controversial comments about transgender people in recent years. These comments have caused a lot of criticism and sparked a debate about whether or not to support her works, including Hogwarts Legacy.

  • A foray into Virtual Reality

    A foray into Virtual Reality

    My foray into Virtual Reality (in India)

    Let’s talk about my foray into Virtual Reality. Ready to escape the mundane and enter a realm of endless possibilities?

    Growing up, I used to be quite a big reader of fiction.Time Riders, Goosebumps, 39 Clues (these were really expensive for 13 year old me), and the Hunger Games were some of the books you could see sprawled around my house. And a LOT of zombie books (World War Z the movie ruined World War Z the book).

    One of the books that I read back in the day was Ready Player One. The idea that you could put a headset on and enter another world enthralled me. It was always a thought at the back of my mind whenever I tried playing a video game. But as all things go, I slowly started to forget about my memories reading the book.

    And then in March 2018, they released the movie based off the book. Watching this spurned my old interest in VR once again. And now, I really wanted to try VR out. But headsets were still expensive, especially for 17 year old me (not to forget the premium you have to pay to ship tech into the country). Discouraged as I was, I wasn’t going to give up on this Quest of mine.

    What is Virtual Reality?

    So Virtual Reality is the term used to describe a three-dimensional, computer generated environment which can be explored and interacted with by a person. And well.. you can interact with objects in this generated environment.

    So let’s take a look at how the landscape of VR headsets looked around this time.

    VR Headsets (2010 – 2018)

    So way back in 2010(I feel so weird saying this),Oculus, a VR startup, started a crowdfunding campaign for their plans to develop a VR headset. This culminated in the release of the Oculus Rift DK1, launched in 2013. And then in the year 2014, Facebook (now Meta) acquired the company for a small sum of $2 billion. This one buyout changed the landscape for all headsets back then and even now.

    Since then, we’ve had both consumer grade as well as enterprise grade headsets make their way into the market, such as HTC’s Vive, Steam’s Index, and both the Varjo and Pico line of headsets.

    A Varjo XR-3 costing $6500

    Some of the main issues preventing wide scale adoption of these headsets were the cost of buying both the headset and a device capable of outputting to the display and the lack of mobility while using these devices (you needed to connect a wire to the headset, and sometimes you ended up all tangled up).

    Of course, we had some budget headsets pop up, such as Google Cardboard or the Galaxy GearVR which had you use your mobile as the display… and this isn’t really the greatest experience.

    Fun fact, the Gear sold so many headsets that at one point it was the highest selling VR device.

    Back to the story

    So it was around this time that I was strolling around in a mall when I noticed a stall where they would let you use a VR headset for a certain amount of time.

    This was something I just had to try. So I remember spending the cash, and ended up playing this trashy zombie shooter game 🙁
    Not the experience I dreamt about now was it?

    And I think this was around the time when my interest in VR dipped to the lowest point it had been. And thus, I gave up on my hopes (for now at least).

    But the Quest isn’t over yet!

    May 21, 2019. The day they released the Quest. A standalone VR device which supported 6 Degrees of freedom (you can move in any direction), internal sensors + an array of cameras, all running on a Snapdragon 835 (for all my non-techy readers, pretty fast but ).

    What made it so much better than the rest of the headsets? Well, it solved the issues preventing most people from trying VR. At $299, it was one of the cheapest headsets available on the market. And since it was standalone, you didn’t need to connect any wires to play.

    It brought a lot of attention to Meta’s VR division. And they followed this by releasing the Quest 2, an improvement of the Quest but now lighter, with higher display resolution and refresh rate AND you could connect it to your PC wirelessly (added later).

    The price? Once again, $299

    Back to the story

    So a few weeks back, I noticed that the Quest 2 was available on Amazon, at not that much of a premium. I’d heard good reviews about it, but never really researched too much. So I took a leap of faith and purchased it, wanting to be a guinea pig.

    And honestly, it did not disappoint.

    A room with 3 square blocks of different colours, two paper planes, and a ping pong ball and bat. All on top of a table.
    A tutorial which shows you some of the cool things you could do in VR (First Steps)
    A cyberpunk aesthetic looking room in VR
    A lonely cyberpunk themed house

    My cool cyberpunk home. Complete with a nice view of the city.

    A windmill and a scenic view of a lake behind it
    Atop a windmill (The Climb 2)

    Ended up climbing a huge mountain which took around 20 minutes and my shoulders ached for days after 🙂

    Darth Vader (man in black costume) pointing at you
    The time I realised Darth Vader was actually HUGE (Vader Immortal Ep 1)

    Turns out Darth Vader is 6’6? He looks GIGANTIC. (also, why isn’t he Dark Vader?)

    A movie theatre with a girl dancing
    Watched a movie with on Netflix Party
    A movie theatre with many girls dancing
    Convinced to watch SOTY

    And well… it was euphoric. The first few minutes actually had me gobsmacked. I even got my dad to try it on, and for the first time ever, I saw him actually enjoy a game I liked.

    Movies feel insane, you feel like you’re sitting in a theatre (the above picture can also be accessed without VR).

    And I think that’s where Meta is trying to make their audience. Bringing in people who just like to hop on for a few hours a week. And they’ve hit the price exactly.

    However, there are some things I’d like to point out about the headset (and some specifically affecting India)

    The Cons

    Firstly, the headset isn’t supported in India. So if something goes wrong, you don’t have a way to get anything replace (there are certain websites online which sell parts, but good luck figuring out how to fix things on your own)

    Another issue with the point above is in regards to the Oculus Store (where you buy apps). Sadly, due to the new RBI law, Indian Credit/Debit cards no longer work with the store (however, I have heard a rumour that forex cards and Amazon ICICI credit cards work) . So you’re stuck with PC VR games… (unless you plan to side load games)

    I’m really lucky to be very resistant to VR motion sickness. However, not everyone is the same. Some people end up not being able to play due to how much it effects them. Something which you’ll have to keep in mind if you plan on getting one.

    Also, software isn’t really that well developed. There’s not really much to do. A ton of research probably needs to be done, and probably a lot more investment. Meta has showed that with a cheap product that it is possible to grab market share but there needs to be software to capitalize on it.

    And my final issue… and this really affected me a ton.

    VR Disassociation

    Have you ever felt like you were floating outside of your body while in a virtual reality experience? This phenomenon is known as Virtual Reality Disassociation (VRD).

    VRD occurs when an individual experiences a disconnection between their physical body and their virtual reality environment. It can lead to feelings of disorientation, dizziness, headaches, and even anxiety or panic. The intensity of the virtual reality experience, the individual’s susceptibility to motion sickness, and the quality of the virtual reality equipment being used are some of the factors that can contribute to VRD.

    The day after I bought the headset, around 8 PM, I started to feel really weird when sitting. Like I couldn’t ‘feel’ my hands. It felt… fake? And then I started seeing the Guardian lines (they show up in the headset when you get too close to a wall). My mind felt really weird? I felt like I was wearing the headset all the time.

    Honestly, this freaked me out so much when it started happened. Spent quite a bit of time researching about why it was happening before I found the actual term. And it took another week before I finally got over it and actually felt normal.

    VRD is considered a normal and temporary side effect of virtual reality immersion and it is not a mental disorder. But in some rare cases, it may indicate an underlying condition such as vestibular disorder, or it can be a symptom of other conditions such as migraines. To prevent VRD, it is important to take breaks, to be in a comfortable environment and to have comfortable VR equipment, and to provide a natural and realistic VR experience.

    If you experience VRD and it persists or makes you feel uncomfortable it is recommended to consult a doctor or a healthcare professional to rule out any underlying conditions.

    Winding up

    I’m not sure how I can bring this to a close. There’s just so much that I can’t put it into words. And it’s something I hope everyone could try for a bit.

    And I think the best way for me to wind this up is for me to show some footage.

    Hand tracking
    I wish I lived somewhere like this

    Also it’s been quite a while since I’ve last written here, mostly due to a lack of motivation. Not any longer though.

  • What is OPSEC?

    Operational security (OPSEC) is a security and risk management process that prevents sensitive information from getting into the wrong hands.

    “If you have nothing to hide, you have nothing to fear.” This argument is commonly used in privacy discussions. Why does it matter? “The government is protecting us,” you say.

    Well, governments change. Governments can shift from one policy to another. And why is this a problem? Well maybe the current government doesn’t pose a threat. Nor the next one. But once they document information on you, every government after has access to it.What happens if they decide to make a change and crack down on us? What happens if a select few decide to abuse their power?


    “Arguing that you don’t care about the right to privacy because you have nothing to hide is no different than saying you don’t care about free speech because you have nothing to say.” – Edward Snowden

    Attackers probe for potential weaknesses in OPSEC. If found they can then use Open Source Intelligence (OSINT) techniques. These are to find information about their target such as

    • Full Name
    • Location
    • Aadhar Card Number
    • Date of Birth
    • Email Accounts and Passwords
    • Online Digital Footprint
    • Employment Information
    • Financial Information
    • Mobile/Work Telephone Numbers
    • Social Media Information/Posts
    • Family/Friends/Colleagues

    A motivated attacker could use the above to do damage against you.

    Maltego. A tool used in OSINT.
    A tool used to help link accounts (Maltego)

    For example let’s take a look at one of the most infamous cybercriminals of this generation, ‘Dread Pirate Roberts’.

    Who is Dread Pirate Roberts?

    Ross William Ulbricht better known by his alias ‘Dread Pirate Roberts’ was the owner of Silk Road, an underground market selling many illegal products and services. To access the Silk Road, one needed to install the Tor Client and visit the site.

    Ross William Ulbricht before his OPSEC was compromised
    Looks like a nice man right? He allegedly ordered two assassinations before being arrested.

    Tor

    Now I guess most of you are thinking, what is Tor?

    Tor short for The Onion Router is an open-source software used to enable anonymous communication. It directs traffic through many relays, which conceals a user’s location and usage and prevents network traffic analysis.

    Tor is NOT meant to solve the issue of anonymity. It is to reduce the likelihood of being tracked.

    The transactions over Silk road are made using escrow accounts, buyer feedback and also using cryptocurrency. The product ships through mail from the seller to the buyer, and keeping the Dread Pirate Roberts’ hands clean and maintain OPSEC. The only trace was money, and a process called tumbling used to make the cryptocurrency harder to trace. Tumbling is a service that mixes cryptocurrency funds with others, so as to obscure the trail back to the fund’s original source. The FBI trace the money and the servers were all cloaked and could be migrated in minutes. So how could they catch this criminal?

    Well, they did that by ‘looking into the past’. The FBI conducted searches into the earliest mentions of the name ‘Silk Road’. They ended up finding a single post by a user named ‘altoid’ which redirected to a wordpress page and upon subpoenaing them they received other crucial finds such as a post by altoid which gave away his email, the FBI found the name of the man they were chasing.

    By using his email, they saw a picture on his google+ account at the Mises Institute.”

    What can we learn from this?

    And then it was just a matter of weeks before he was caught and arrested. He is now serving a double life sentence plus forty years without the possibility of parole.

    This one mistake started the fall of one of the most wanted men on the dark net.

    Being aware of the information you spread online will drastically reduce the risk of your OPSEC being broken. Because it’s not one “breadcrumb” of information that causes the damage; it’s the accumulated data over time.

    Part of a series on OPSEC, with the next part describing how to maintain OPSEC

    For more blogs, click this

  • Microcorruption: Sydney & New Orleans writeups

    Another Microcorruption CTF level!

    Sydney & New Orleans Writeups

    New Orleans Writeup

    Image showing the New Orleans' level details. (Part of the Sydney & New Orleans Writeups)
    4438 <main>
    4438:  3150 9cff      add	#0xff9c, sp
    443c:  b012 7e44      call	#0x447e <create_password>
    4440:  3f40 e444      mov	#0x44e4 "Enter the password to continue", r15
    4444:  b012 9445      call	#0x4594 <puts>
    4448:  0f41           mov	sp, r15
    444a:  b012 b244      call	#0x44b2 <get_password>
    444e:  0f41           mov	sp, r15
    4450:  b012 bc44      call	#0x44bc <check_password>
    4454:  0f93           tst	r15
    4456:  0520           jnz	#0x4462 <main+0x2a>
    4458:  3f40 0345      mov	#0x4503 "Invalid password; try again.", r15
    445c:  b012 9445      call	#0x4594 <puts>
    4460:  063c           jmp	#0x446e <main+0x36>
    4462:  3f40 2045      mov	#0x4520 "Access Granted!", r15
    4466:  b012 9445      call	#0x4594 <puts>
    446a:  b012 d644      call	#0x44d6 <unlock_door>
    446e:  0f43           clr	r15
    4470:  3150 6400      add	#0x64, sp

    So let’s take a look at the main function given here.
    A few interesting routines stand out, namely the create_password and check_password. Let’s take a look at both of them and analyze them.

    ```
    447e <create_password>
    447e:  3f40 0024      mov	#0x2400, r15
    4482:  ff40 3400 0000 mov.b	#0x34, 0x0(r15)
    4488:  ff40 4c00 0100 mov.b	#0x4c, 0x1(r15)
    448e:  ff40 6200 0200 mov.b	#0x62, 0x2(r15)
    4494:  ff40 6300 0300 mov.b	#0x63, 0x3(r15)
    449a:  ff40 5b00 0400 mov.b	#0x5b, 0x4(r15)
    44a0:  ff40 6800 0500 mov.b	#0x68, 0x5(r15)
    44a6:  ff40 7100 0600 mov.b	#0x71, 0x6(r15)
    44ac:  cf43 0700      mov.b	#0x0, 0x7(r15)
    44b0:  3041           ret
    ```

    We can see from the above code that certain bytes are being moved in an incremental manner into bytes from the offset 0x2400.
    The last byte stored is the null byte as shown in 44ac.

    Now let us take a look at the check_password function

    44bc <check_password>
    44bc:  0e43           clr 	r14
    44be:  0d4f           mov	 r15, r13
    44c0:  0d5e           add	 r14, r13
    44c2:  ee9d 0024      cmp.b	@r13, 0x2400(r14)
    44c6:  0520           jne	#0x44d2 <check_password+0x16>
    44c8:  1e53           inc	r14
    44ca:  3e92           cmp	#0x8, r14
    44cc:  f823           jne	#0x44be <check_password+0x2>
    44ce:  1f43           mov	#0x1, r15
    44d0:  3041           ret
    44d2:  0f43           clr	r15
    44d4:  3041           ret

    Hmm, so the value stored in r13 is compared.
    Let us take a closer look at 44c2

    44c2:  ee9d 0024      cmp.b	@r13, 0x2400(r14)
    44c6:  0520           jne	#0x44d2 <check_password+0x16>

    So the password is compared relative to the memory location.

    Let’s put a breakpoint on 44c2 and then enter some random input.

    Once we hit our breakpoint, we can read the value stored, shown below

    > r 2400 8
       2400:   344c 6263 5b68 7100  4Lbc[hq.
       2408:   0000 0000 0000 0000  ........
       2410:   0000 0000 0000 0000  ........
       2418:   0000 0000 0000 0000  ........
    

    So the password is stored in the hex bytes 344c 6263 5b68 7100
    We can solve the lock by submitting the password after enabling the hex input option

    Another method:

    We can create a breakpoint at 4400 we can read the memory address at 2400.

    In the raw memory dump:

    0150:   0000 0000 0000 0000 0000 0000 085a 0000   .............Z..
    0160:   *
    2400:   344c 6263 5b68 7100 0000 0000 0000 0000   4Lbc[hq.........
    2410:   *
    4390:   0000 0000 0000 0000 0000 4044 0000 0000   ..........@D....
    43a0:   *
    4400:   3140 0044 1542 5c01 75f3 35d0 085a 3f40   1@.D.B\.u.5..Z?@

    Which once again gives us 344c 6263 5b68 7100.
    or 4Lbc[hq

    Sydney

    Image showing the Sydeny's level details. (Part of the Sydney & New Orleans Writeups)
    4438 <main>
    4438:  3150 9cff      add	#0xff9c, sp
    443c:  3f40 b444      mov	#0x44b4 "Enter the password to continue.", r15
    4440:  b012 6645      call	#0x4566 <puts>
    4444:  0f41           mov	sp, r15
    4446:  b012 8044      call	#0x4480 <get_password>
    444a:  0f41           mov	sp, r15
    444c:  b012 8a44      call	#0x448a <check_password>
    4450:  0f93           tst	r15
    4452:  0520           jnz	#0x445e <main+0x26>
    4454:  3f40 d444      mov	#0x44d4 "Invalid password; try again.", r15
    4458:  b012 6645      call	#0x4566 <puts>
    445c:  093c           jmp	#0x4470 <main+0x38>
    445e:  3f40 f144      mov	#0x44f1 "Access Granted!", r15
    4462:  b012 6645      call	#0x4566 <puts>
    4466:  3012 7f00      push	#0x7f
    446a:  b012 0245      call	#0x4502 <INT>
    446e:  2153           incd	sp
    4470:  0f43           clr	r15
    4472:  3150 6400      add	#0x64, sp
    

    Once again, let us take a look at check_password

    448a:  bf90 7a3f 0000 cmp	#0x3f7a, 0x0(r15)
    4490:  0d20           jnz	$+0x1c
    4492:  bf90 642c 0200 cmp	#0x2c64, 0x2(r15)
    4498:  0920           jnz	$+0x14
    449a:  bf90 3773 0400 cmp	#0x7337, 0x4(r15)
    44a0:  0520           jne	#0x44ac <check_password+0x22>
    44a2:  1e43           mov	#0x1, r14
    44a4:  bf90 456e 0600 cmp	#0x6e45, 0x6(r15)
    44aa:  0124           jeq	#0x44ae <check_password+0x24>
    44ac:  0e43           clr	r14
    44ae:  0f4e           mov	r14, r15

    We can see that we are comparing bytes to the bytes relative to r15
    We can decipher the password from this so we get: 3f7a 2c64 7337 6e45
    However, since these are in Little Endian, we must convert them.
    Therefore password is 7a3f 642c 3773 456e which is to be input in hex

    Previous in this series: Level 0

    Sydney & New Orleans Writeups

  • Microcorruption CTF Level 0 – Tutorial

    What is Microcorruption?

    Microcorruption CTF is a beginner level embedded device CTF challenge. You are given a debugger and a lock (with several iterations based on the level that you are on). Your task is to unlock the lock.

    The debugger lets you reverse engineer parts of the code with a disassembler.It also lets you utilise certain functions such as break points and a live memory dump. Using these tools, we must figure out a way to break the program using exploits and unlock the lock.

    Pre-requisites

    Some of the prerequisites are:

    • you are familiar with debuggers (or can at least learn while debugging)
    • some knowledge of assembly (a lock manual is given but you will need to look up certain lines of code to understand more)
    • knowledge of some memory exploits such as buffer overflow
    • Previous experience w

    The lock (LockIT Pro) given is based off the MSP430 microcontroller as written in the manual.

    Microcorruption CTF home page
    A look at the Microcorruption CTF website as well as the level system

    Level 0 : Tutorial

    So the tutorial goes through the basics of the debugger. Let’s go through the solution of this challenge.

    4438 <main>
    4438:  3150 9cff      add	#0xff9c, sp
    443c:  3f40 a844      mov	#0x44a8 "Enter the password to continue", r15
    4440:  b012 5845      call	#0x4558 <puts>
    4444:  0f41           mov	sp, r15
    4446:  b012 7a44      call	#0x447a <get_password>
    444a:  0f41           mov	sp, r15
    444c:  b012 8444      call	#0x4484 <check_password>
    4450:  0f93           tst	r15
    4452:  0520           jnz	#0x445e <main+0x26>
    4454:  3f40 c744      mov	#0x44c7 "Invalid password; try again.", r15
    4458:  b012 5845      call	#0x4558 <puts>
    445c:  063c           jmp	#0x446a <main+0x32>
    445e:  3f40 e444      mov	#0x44e4 "Access Granted!", r15
    4462:  b012 5845      call	#0x4558 <puts>
    4466:  b012 9c44      call	#0x449c <unlock_door>
    446a:  0f43           clr	r15
    446c:  3150 6400      add	#0x64, sp

    Hmm… that check_password function looks interesting. Let’s take a look at it

    4484 <check_password>
    4484:  6e4f           mov.b	@r15, r14
    4486:  1f53           inc	r15
    4488:  1c53           inc	r12
    448a:  0e93           tst	r14
    448c:  fb23           jnz	#0x4484 <check_password+0x0>
    448e:  3c90 0900      cmp	#0x9, r12
    4492:  0224           jeq	#0x4498 <check_password+0x14>
    4494:  0f43           clr	r15
    4496:  3041           ret
    4498:  1f43           mov	#0x1, r15
    449a:  3041           ret

    The first character of the password entered is loaded into r14 from the memory location pointed to in r15
    Both r15 and r12 are incremented till we get a null byte \0
    Once reached, it bypasses the jump (0x448c) and reaches the cmp statement. Here, it tests to see if there are 8 characters in the password statement (8 characters + the null byte = 9 ).

    If there are, it unlocks the door.

    Password: Any 8 character password

    Next: Level 1 & 2 (New Orleans and Sydney)

    This is the first of many in the CTF Writeup series which I will be posting about. We will finish parts of the microcorruption CTF and then look at other challenges.