H8/300H simulator running code that contains a debug monitor, which in turn speaks the GDB wire protocol.


*EDIT:* Apparently, you could just control the PC register. Whoops. Made my life a bit more complicated, I guess.

The stub doesn't let you control the PC register nor write to memory, so instead we exploit a bug in the command receiver to smash the registers to our liking. We thus redirect the CPU into an open() and a read() to get the flag contents into memory, then we dump it out using the memory read command.

Original writeup (https://github.com/q3k/ctf/tree/master/SECCON2016Quals/microcomputer).