Rating:

# Biooosless

Tl;dr read from floppy in 32bit protected mode with no BIOS, using PMIO. Your shellcode gets pasted into seabios.

# Intended solution

Write a floppy disk driver that does DMA. Output the flag using VGA MMIO

# My solution

1. Floppy disk

- Too stupid and lazy to learn about floppy disk, know remote hardware is always QEMU -> hack seabios to log all in/out instructions, copy paste them into shellcode.
- In/out not working -> add usleep() everywhere, shellcode magically starts working
- Final `in` instructions seems to return flag bytes -> Ignore DMA and use completely idiotic solution that works

2. Outputting the flag

- Too stupid and lazy to read docs and figure out VGA -> copy paste QEMU ACPI shutdown.
- Use as timing side channel for time-based blind boolean exfil. Binary search on flag chars
- Side channel is slow and unreliable -> babysit the brute force and guess words manually to speed it up

Original writeup (https://github.com/perfectblue/ctf-writeups/tree/master/2020/defcon-ctf-2020/biooosless).