Calle Svensson ZetaTwo

General purpose

Terminator - Terminal emulator
zsh - My shell of choice prezto - Configuration management for zsh

Editors

010 Editor - Hex editor
VSCode - Text editor

Low-level reversing

Hack-a-Sat 2021 Qualifiers - Mars or Bust: Write-up

We are provided with a website where you can download a rom file and submit a rom file to be run in a simulator. The simulator runs the provided firmware to perform a mars landing through several stages. The unmodified firmware works fine until the point where the lander has about 40 meters remaining at which point it shuts down the engine and crashes to the surface. The goal is to patch the firmware and perform a correct landing.

Looking at the firmware we see that it is MIPS 32-bit little endian code. We try to open it in Binary Ninja and disassemble the code at address 0x0. This turns out to be a jump to 0xfc00400 which suggests that 0xfc00400 so we re-open the firmware with the new base address and try to disassemble again which gives a somewhat better result. However, looking further through the code we can find the initialization routine which, among other things, copies data from 0xbfc05efc to an address which probably is RAM. This suggests

	### Keybase proof

	I hereby claim:

	* I am zetatwo on github.
	* I am zetatwo (https://keybase.io/zetatwo) on keybase.
	* I have a public key whose fingerprint is F6CB E0F3 1205 0A3D 6BCB CD6B 75D2 34C0 443D 9046

	To claim this, I am signing this object:

	apt-get install python2.7-dev python2.7
	apt-get build-dep gdb
	apt-get source gdb
	cd gdb-7.9
	sed -i -E "s\|python3\|/usr/bin/python2.7\|" debian/rules
	dpkg-buildpackage -uc -us -j8
	dpkg-install ../*.deb

	# Note: These instructions are outdated and no longer relevant

	ln -s /tmp /usr/tmp
	ln -s /lib64/ld-linux-x86-64.so.2 /lib64/ld-lsb-x86-64.so.3

	dpkg --add-architecture i386
	apt-get install libglib2.0-0:i386 gtk2-engines:i386 gtk2-engines-murrine:i386 gtk2-engines-pixbuf:i386

	#!/bin/sh

	mkdir ~/tools
	sudo apt-get install -y git zsh terminator fonts-powerline volatility nmap python-lzma audacity zbar-tools gdb wireshark tshark socat graphviz sqlmap ruby ruby-dev gimp libcapstone3 python python3 python-pip python3-pip sagemath clang
	sudo dpkg -i code_1.32.3-1552606978_amd64.deb google-chrome-stable_current_amd64.deb

	# Config
	git config --global user.email "[email protected]"
	git config --global user.name "Calle Svensson"