# AVR (hardware) - 320 points, 16 solves

Writeup by poortho

## Problem Description

We found this old terminal with access to some top secret data, but it's secured by passwords. Can you break in anyway?

`avr.2020.ctfcompetition.com 1337`

Attachments:

[code.c](./code.c)
[code.hex](./code.hex)
[simavr_diff](./simavr_diff)
[simduino.elf](./simduino.elf)
[Makefile](./Makefile)

## Solution

From the files given, it looks like the challenge is running some AVR program on an arduino simulator.

Let's start with the obvious - `code.c`:

```c
#undef F_CPU
#define F_CPU 1000000UL

#include <avr/io.h>
#include <avr/sleep.h>
#include <avr/interrupt.h>
#include <util/delay.h>
#include <avr/cpufunc.h>
#include <stdio.h>
#include <string.h>

#define BAUD 125000UL
#include <util/setbaud.h>

#ifndef PASS1
#define PASS1 "PASSWORD_REDACTED_XYZ"
#endif

#ifndef PASS2
#define PASS2 "TOPSECRET_PASSWORD_ALSO_REDACTED_TOPSECRET"
#endif

#ifndef FLAG
#define FLAG "CTF{_REAL_FLAG_IS_ON_THE_SERVER_}"
#endif

const char* correctpass = PASS1;
const char* top_secret_password = PASS2;
const char* top_secret_data =
"INTELLIGENCE REPORT:\n"
"FLAG CAPTURED FROM ENEMY.\n"
"FLAG IS " FLAG ".";

char buf[512];
char secret[256] =
"Operation SIERRA TANGO ROMEO:\n"
"Radio frequency: 13.37MHz\n"
"Received message: ATTACK AT DAWN\n";
char timer_status[16] = "off";

volatile char logged_in;
int top_secret_index;

volatile char uart_ready;
ISR(USART_RX_vect) {
uart_ready = 1;
}

void uart_init(void) {
UBRR0H = UBRRH_VALUE;
UBRR0L = UBRRL_VALUE;

UCSR0C = (1<<UCSZ01) | (1<<UCSZ00);
UCSR0B = (1<<RXEN0) | (1<<TXEN0) | (1<<RXCIE0);
}

static int uart_getchar(FILE* stream) {
while (1) {
cli();
if (!uart_ready) {
sleep_enable();
sei();
sleep_cpu();
sleep_disable();
}
cli();
if (uart_ready) {
uart_ready = 0;
unsigned int c = UDR0;
sei();
return c;
}
sei();
}
}

static int uart_putchar(char c, FILE* stream) {
loop_until_bit_is_set(UCSR0A, UDRE0);
UDR0 = c;
return 0;
}
static FILE uart = FDEV_SETUP_STREAM(uart_putchar, uart_getchar, _FDEV_SETUP_RW);

void quit() {
printf("Quitting...\n");
_delay_ms(100);
cli();
sleep_enable();
sleep_cpu();
while (1);
}

volatile uint32_t overflow_count;
uint32_t get_time() {
uint32_t t;
cli();
t = (overflow_count << 16) + TCNT1;
sei();
return t;
}

void timer_on_off(char enable) {
overflow_count = 0;
strcpy(timer_status, enable ? "on" : "off");
if (enable) {
TCCR1B = (1<<CS10);
sei();
}
else {
TCCR1B = 0;
}
}

ISR(TIMER1_OVF_vect) {
if (!logged_in) {
overflow_count++;
// Allow ten seconds.
if (overflow_count >= ((10*F_CPU)>>16)) {
printf("Timed out logging in.\n");
quit();
}
}
else {
// If logged in, timer is used to securely copy top secret data.
secret[top_secret_index] = top_secret_data[top_secret_index];
timer_on_off(top_secret_data[top_secret_index]);
top_secret_index++;
}
}

void read_data(char* buf) {
scanf("%200s", buf);
}

void print_timer_status() {
printf("Timer: %s.\n", timer_status);
}

int main() {
uart_init();
stdout = &uart;
stdin = &uart;

TCCR1A = 0;
TIMSK1 = (1<

Original writeup (https://github.com/poortho/ctf-writeups/tree/master/2020/googlectf/avr).