$ cyanpencil's blog - posts - about - contact

Pokemini reversing

Last weekend, we organizers ranked 7th in the Plaid CTF. This is my writeup for the pokemini challenge.

We didn’t actually get the flag here, but we got very damn close and learnt so much that I still wanted to share our experience.

The chall

The challenge was a ROM image for a forgotten gameboy clone called the Pokemini. Have a look at it:

Good stuff
The pokemini in all it's glory

The cartridge was basically just a flag checker with some interesting music:

Good stuff
This gives me some oldschool keygen nostalgia. 10/10

Let’s get to business.

A warning

Before I go and explain the solution, I should before explain that in the case it may look like a huge time was poured into this challenge, there’s a good reason for it.

I spent over 24 full hours (not counting sleep or eating) on this challenge, and I received huge amount of help by my teammates here:

But we still did not solve it. So make of the follwing as you wish:

Part 1: Lifting heavy weights

We were aware this was not gonna be easy. The architecture it was based on was rather esoteric, since, according to wikipedia, has the following features:

So we had to look for the manual and constantly consult it during the whole weekend to look up instructions, register, and everything else.

When I joined the discord channel created for the challenge, people already made some substantial progress on the challenge. In particular, this guy SlidyBat had written a lifter for Binary Ninja making it able to recognize control flow in the binary letting us draw the CFG. This proved to be absolutely vital later on and without it we would have abandoned after a couple hours I think.

Here’s a screen of it in action:

This is where I jump in thinking that it would be cool to spend a few hours learning about an absolutely irrelevant forgotten architecture. Let’s jump in the reversing part.

Another important part was about

Part 2: Head-bashing

We quickly found the function that dealt with flag checking through memory watches on where the flag was written.

Function 0x2c95:

This horrible mess was an absolute pain to understand.

It will continue in another blog post, as it definitely needs part 2 of its own.