Challenge SSTIC 2017

Relocation section '.rela.plt' at offset 0x344 contains 15 entries:
 Offset     Info    Type            Sym.Value  Sym. Name + Addend
0000596c  00000114 R_OR1K_JMP_SLOT   00002430   ioctl + 0
00005970  00000214 R_OR1K_JMP_SLOT   00002444   printf + 0
00005974  00000314 R_OR1K_JMP_SLOT   00002458   memcpy + 0
00005978  00000414 R_OR1K_JMP_SLOT   0000246c   puts + 0
0000597c  00000514 R_OR1K_JMP_SLOT   00002480   malloc + 0
00005980  00000614 R_OR1K_JMP_SLOT   00002494   mmap + 0
00005984  00000814 R_OR1K_JMP_SLOT   000024a8   write + 0
00005988  00000914 R_OR1K_JMP_SLOT   000024bc   fstat + 0
0000598c  00000a14 R_OR1K_JMP_SLOT   000024d0   read + 0
00005990  00000b14 R_OR1K_JMP_SLOT   000024e4   memset + 0
00005994  00000d14 R_OR1K_JMP_SLOT   000024f8   exit + 0
00005998  00000e14 R_OR1K_JMP_SLOT   0000250c   __libc_start_main + 0
0000599c  00000f14 R_OR1K_JMP_SLOT   00002520   strlen + 0
000059a0  00001014 R_OR1K_JMP_SLOT   00002534   open + 0
000059a4  00001114 R_OR1K_JMP_SLOT   00002548   close + 0

$ objdump -d trustzone_decrypt > objd_raw
$ cat objd_raw

trustzone_decrypt:     file format elf32-or1k


Disassembly of section .init:

000023f8 <.init>:
    23f8:   9c 21 ff fc     l.addi r1,r1,-4
    23fc:   d4 01 48 00     l.sw 0(r1),r9
    2400:   04 00 01 3e     l.jal 28f8 <_start_c+0x1f4>
    2404:   15 00 00 00     l.nop 0x0
    2408:   04 00 03 dd     l.jal 337c <decode_hex+0x9e8>
    240c:   15 00 00 00     l.nop 0x0
    2410:   85 21 00 00     l.lwz r9,0(r1)
    2414:   44 00 48 00     l.jr r9
    2418:   9c 21 00 04     l.addi r1,r1,4

Disassembly of section .plt:

0000241c <.plt>:
    241c:   19 80 00 00     l.movhi r12,0x0
    2420:   a9 8c 59 64     l.ori r12,r12,0x5964
    2424:   85 ec 00 04     l.lwz r15,4(r12)
    2428:   44 00 78 00     l.jr r15
    242c:   85 8c 00 00     l.lwz r12,0(r12)
[...]

%plt = (
 "2430" => "ioctl",
 "2444" => "printf",
 "2458" => "memcpy",
 "246c" => "puts",
 "2480" => "malloc",
 "2494" => "mmap",
 "24a8" => "write",
 "24bc" => "fstat",
 "24d0" => "read",
 "24e4" => "memset",
 "24f8" => "exit",
 "250c" => "_libc_start_main",
 "2520" => "strlen",
 "2534" => "open",
 "2548" => "close",
);

%sym = (
 "255c" => "main",
 "2994" => "decode_hex",
);

%not = ("e" => "ne", "ne" => "e", "ge" => "l", "g" => "le", "be" => "a", "b" => "ae", "a" => "be");

print "bits 32\n";
print "extern $imp\n" while ($addr, $imp) = each %plt;
print "global $s\n" while ($addr, $s) = each %sym;
print "%define _r0 0\n";
print "%define _r1 esp\n";
print "%define _r$_ [__r$_]\n" for (2..32);
print "section .text\n";
print "L_0:\n";

sub ldaddr {
    my ($r, $haddr) = @_;
    my $a = hex($haddr);
    if ($a > 0x3400 && $a < 0x3800) {
        return "lea eax, [(strings + $a - 3400h)]\nmov _$r, eax\n";
    } else {
        return "mov word _$r, 0${haddr}h\n";
    }
}

sub call {
    my $f = shift;
    return "push dword _r5\npush dword _r4\npush dword _r3\ncall $f\nadd esp, 12\n";
}

while (<>) {
    s/\t/ /;
    s/ <.*>$//;
    next unless /^    (.{4}): .. .. .. .. (.*)/;
    $addr = $1;
    $insn = $2;
    print "\n;$addr $insn\n\n";
    print "L_$addr:\n";
    if (exists $sym{$addr}) { print "$sym{$addr}:\n" }
    $branch = undef;
    if ($insn =~ /l.movhi (r\d+),0x(.+)/) { print "mov word [__$1+2], 0$2h\n" }
    elsif ($insn =~ /l.ori (r\d+),\1,0x(.+)/) { print ldaddr($1, $2) }
    elsif ($insn =~ /l.ori (r\d+),(r\d+),0x0/) { print "mov eax, _$2\nmov _$1, eax\n" }
    elsif ($insn =~ /l.sw (-?\d+)\(r1\),(r\d+)/) { print "mov eax, _$2\nmov [esp+($1)], eax\n" }
    elsif ($insn =~ /l.sw (-?\d+)\((r\d+)\),(r\d+)/) { print "mov eax, _$2\nmov ecx, _$3\nmov [eax+($1)], ecx\n" }
    elsif ($insn =~ /l.sfeqi (r\d+),(.+)/) { print "mov ebx, _$1\n"; $cond = "e"; $cmp = "cmp ebx, $2" }
    elsif ($insn =~ /l.sfnei (r\d+),(.+)/) { print "mov ebx, _$1\n"; $cond = "ne"; $cmp = "cmp ebx, $2" }
    elsif ($insn =~ /l.sfgesi (r\d+),(.+)/) { print "mov ebx, _$1\n"; $cond = "ge"; $cmp = "cmp ebx, $2" }
    elsif ($insn =~ /l.sfgtsi (r\d+),(.+)/) { print "mov ebx, _$1\n"; $cond = "g"; $cmp = "cmp ebx, $2" }
    elsif ($insn =~ /l.sfleui (r\d+),(.+)/) { print "mov ebx, _$1\n"; $cond = "be"; $cmp = "cmp ebx, $2" }
    elsif ($insn =~ /l.sfgtui (r\d+),(.+)/) { print "mov ebx, _$1\n"; $cond = "a"; $cmp = "cmp ebx, $2" }
    elsif ($insn =~ /l.sfne (r\d+),(r\d+)/) { print "mov ebx, _$1\nmov edx, _$2"; $cond = "ne"; $cmp = "cmp ebx, edx" }
    elsif ($insn =~ /l.sfltu (r\d+),(r\d+)/) { print "mov ebx, _$1\nmov edx, _$2"; $cond = "b"; $cmp = "cmp ebx, edx" }
    elsif ($insn =~ /l.addi r1,r1,(-?.+)/) { print "add esp, $1\n" }
    elsif ($insn =~ /l.addi (r\d+),(r\d+),(-?.+)/) { print "mov eax, _$2\nadd eax, $3\nmov _$1, eax\n" }
    elsif ($insn =~ /l.add (r\d+),(r\d+),(r\d+)/) { print "mov eax, _$2\nadd eax, _$3\nmov _$1, eax\n" }
    elsif ($insn =~ /l.or (r\d+),(r\d+),(r\d+)/) { print "mov eax, _$2\nor eax, _$3\nmov _$1, eax\n" }
    elsif ($insn =~ /l.and (r\d+),(r\d+),(r\d+)/) { print "mov eax, _$2\nand eax, _$3\nmov _$1, eax\n" }
    elsif ($insn =~ /l.andi (r\d+),(r\d+),0x(.+)/) { print "mov eax, _$2\nand eax, 0$3h\nmov _$1, eax\n" }
    elsif ($insn =~ /l.xor (r\d+),(r\d+),(r\d+)/) { print "mov eax, _$2\nxor eax, _$3\nmov _$1, eax\n" }
    elsif ($insn =~ /l.sub (r\d+),(r\d+),(r\d+)/) { print "mov eax, _$2\nsub eax, _$3\nmov _$1, eax\n" }
    elsif ($insn =~ /l.srai (r\d+),\1,0x(.+)/) { print "sar dword _$1, 0$2h\n" }
    elsif ($insn =~ /l.srli (r\d+),(r\d+),0x(.+)/) { print "mov eax, _$2\nshr eax, 0$3h\nmov _$1, eax\n" }
    elsif ($insn =~ /l.slli (r\d+),(r\d+),0x(.+)/) { print "mov eax, _$2\nshl eax, 0$3h\nmov _$1, eax\n" }
    elsif ($insn =~ /l.bf (.*)/) { $branch = "$cmp\nj$cond L_$1\n" }
    elsif ($insn =~ /l.bnf (.*)/) { $branch = "$cmp\nj$not{$cond} L_$1\n" }
    elsif ($insn =~ /l.lwz (r\d+),(-?.+)\(r1\)/) { print "mov eax, [esp+($2)]\nmov _$1, eax\n" }
    elsif ($insn =~ /l.lwz (r\d+),(-?.+)\((r\d+)\)/) { print "mov eax, _$3\nmov eax, [eax+($2)]\nmov _$1, eax\n" }
    elsif ($insn =~ /l.lbz (r\d+),(-?.+)\((r\d+)\)/) { print "mov eax, _$3\nmovzx eax, byte [eax+($2)]\nmov _$1, eax\n" }
    elsif ($insn =~ /l.sb (-?.+)\((r\d+)\),(r\d+)/) { print "mov al, _$3\nmov ecx, _$2\nmov [ecx+($1)], al\n" }
    elsif ($insn =~ /l.sh (-?.+)\((r\d+)\),(r\d+)/) { print "mov ax, _$3\nmov ecx, _$2\nmov [ecx+($1)], ax\n" }
    elsif ($insn =~ /l.jal (.*)/) { if (exists $plt{$1}) { $f = $plt{$1} } else { $f = "L_$1" } $branch = call($f) }
    elsif ($insn =~ /l.jalr (r\d+)/) { $branch = "call dword _$1\n" }
    elsif ($insn =~ /l.jr r9/) { $branch = "mov eax, _r11\nret\n" }
    elsif ($insn =~ /l.nop 0x0/) {}
    elsif ($insn =~ /l.j (.*)/) { if (exists $plt{$1}) { $f = $plt{$1} } else { $f = "L_$1" } $branch = "jmp $f\n"; }
    else { print ";???\n" }
    print $delay if ($delay);
    $delay = $branch;
}

print "section .data\n";
print "__r$_: dd 0\n" for (2..32);
print "strings:\n";
print <<EOS;
db 44h, 00h, 48h, 00h, 9ch, 21h, 00h, 04h, 62h, 61h, 64h, 20h, 63h, 68h, 61h, 72h,
db 00h, 43h, 61h, 6eh, 27h, 74h, 20h, 6fh, 70h, 65h, 6eh, 20h, 2fh, 64h, 65h, 76h,
[...]
db 69h, 62h, 2fh, 6ch, 64h, 2dh, 6dh, 75h, 73h, 6ch, 2dh, 6fh, 72h, 31h, 6bh, 2eh,
db 73h, 6fh, 2eh, 31h, 00h, 00h, 00h, 00h, 01h, 1bh, 03h, 3bh, 00h, 00h, 00h, 48h,
EOS

;255c   l.sw -12(r1),r2

L_255c:
main:
mov eax, _r2
mov [esp+(-12)], eax

;2560   l.sw -4(r1),r9

L_2560:
mov eax, _r9
mov [esp+(-4)], eax

;2564   l.sw -16(r1),r1

L_2564:
mov eax, _r1
mov [esp+(-16)], eax

;2568   l.sw -8(r1),r14

L_2568:
mov eax, _r14
mov [esp+(-8)], eax

;256c   l.sfeqi r3,4

L_256c:
mov ebx, _r3

;2570   l.addi r1,r1,-148

L_2570:
add esp, -148

;2574   l.bnf 263c

L_2574:

;2578   l.ori r2,r4,0x0

L_2578:
mov eax, _r4
mov _r2, eax
cmp ebx, 4
jne L_263c

$ nasm -f win32 convd.asm

int __cdecl main(int argc, const char **argv, const char **envp)
{
  int v4; // [sp+4h] [bp-90h]@5
  int v5; // [sp+14h] [bp-80h]@8
  void **v6; // [sp+84h] [bp-10h]@1
  int v7; // [sp+88h] [bp-Ch]@1
  int v8; // [sp+8Ch] [bp-8h]@1
  int v9; // [sp+90h] [bp-4h]@1
  void *retaddr; // [sp+94h] [bp+0h]@1

  v7 = _r2;
  v9 = _r9;
  v6 = &retaddr;
  v8 = _r14;
  _r2 = (int)_r4;
  if ( _r3 == (_BYTE *)main + 4 )
  {
    _r14 = *((_DWORD *)_r4 + 1);
    _r3 = (char *)_r14;
    strlen((const char *)_r14);
    HIWORD(_r3) = 0;
    if ( _r11 == 32 )
    {
      _r3 = (char *)_r14;
      _r4 = &v4;
      _r5 = 16;
      decode_hex();
      HIWORD(_r3) = 0;
      if ( _r11 )
      {
        _r3 = aCanTDecodePass;
        puts(aCanTDecodePass);
        _r11 = 1;
      }
      else
      {
        load_TA();
        _r14 = _r11;
        if ( _r11 )
        {
          _r3 = aCanTLoadTa;
          puts(aCanTLoadTa);
          _r11 = 1;
        }
        else
        {
          get_version();
          _r4 = (void *)_r14;
          _r3 = *(char **)(_r2 + 8);
          open(_r3, _r14, _r5);
          _r14 = _r11;
          if ( _r11 < 0 )
          {
            _r2 = *(_DWORD *)(_r2 + 8);
            _r3 = aCanTOpenSForRe;
            printf(aCanTOpenSForRe, _r4, _r5);
            _r11 = 1;
          }
          else
          {
            _r3 = (char *)_r11;
            _r4 = &v5;
            _r5 = 112;
            read(_r11, &v5, 112);
            HIWORD(_r3) = 0;
            if ( _r11 == 112 )
            {
              _r3 = (char *)&v4;
              _r4 = &v5;
              check_pwd();
              if ( !_r11 )
              {
                _r3 = (char *)_r14;
                _r4 = *(void **)(_r2 + 12);
                decrypt_file();
                _r3 = (char *)_r14;
                close(_r14, _r4, _r5);
              }
              unload_TA();
              _r11 = 0;
            }
            else
            {
              _r2 = *(_DWORD *)(_r2 + 8);
              _r3 = aCanTReadEncryp;
              printf(aCanTReadEncryp, _r4, _r5);
              _r11 = 1;
            }
          }
        }
      }
    }
    else
    {
      _r3 = aBadPasswordLen;
      puts(aBadPasswordLen);
      _r11 = 1;
    }
  }
  else
  {
    _r2 = *(_DWORD *)_r4;
    _r3 = aUsageSPassword;
    printf(aUsageSPassword, _r4, _r5);
    _r11 = 1;
  }
  _r9 = v9;
  _r2 = v7;
  _r14 = v8;
  return _r11;
}

int decrypt_file()
{
  int v1; // [sp+4h] [bp-D8h]@2
  int v2; // [sp+8h] [bp-D4h]@6
  [ ... variables locales ]
  int v41; // [sp+D8h] [bp-4h]@1
  void *retaddr; // [sp+DCh] [bp+0h]@1

  v32 = _r2;
  v38 = _r26;
  v39 = _r28;
  v41 = _r9;
  v31 = &retaddr;
  v33 = _r14;
  v34 = _r18;
  v35 = _r20;
  v36 = _r22;
  v37 = _r24;
  v40 = _r30;
  _r26 = (int)_r3;
  _r2 = (int)_r4;
  _r3 = (char *)_r4;
  _r4 = &L_257c + 1;
  open(_r3, 65, _r5);
  _r28 = _r11;
  if ( _r11 < 0 )
  {
    _r3 = aCanTOpenSForWr;
    printf(aCanTOpenSForWr, _r4, _r5);
    _r11 = 1;
  }
  else
  {
    _r3 = (char *)_r26;
    _r4 = &v30;
    fstat(_r26, &v30, _r5);
    _r4 = &v1;
    if ( _r11 < 0 )
    {
      _r3 = aCanTStat;
      puts(aCanTStat);
      _r11 = 1;
    }
    else
    {
      _r3 = (char *)_r26;
      _r5 = 16;
      read(_r26, _r4, 16);
      _r18 = 0;
      if ( _r11 == 16 )
      {
        HIWORD(_r30) = 0x300;
        while ( 1 )
        {
          _r3 = (char *)_r26;
          _r4 = &v5;
          _r5 = 16;
          read(_r26, &v5, 16);
          _r20 = _r11;
          if ( !_r11 )
          {
            _r3 = (char *)_r28;
            close(_r28, _r4, _r5);
            goto done;
          }
          if ( _r11 != 16 )
            break;
          _r3 = (_BYTE *)(&loc_100 + 4);
          _r24 = 280;
          malloc(260u);
          _r3 = (char *)_r24;
          _r2 = _r11;
          malloc(_r24);
          _r22 = 260;
          _r14 = _r11;
          memset((void *)_r11, 0, _r24);
          _r5 = _r22;
          _r4 = 0;
          memset((void *)_r2, 0, _r22);
          _r3 = a341mi0mSendComma;
          puts(a341mi0mSendComma);
          _r4 = (void *)((unsigned int)_r18 >> 24);
          _r5 = (unsigned __int64)(unsigned int)_r18 >> 8;
          _r6 = _r18 << 24;
          _r3 = (char *)(_r18 << 8);
          *(_DWORD *)_r14 = _r30;
          _r6 |= (unsigned int)_r4;
          _r4 = (void *)(_r5 & 0xFF00);
          HIWORD(_r5) = 255;
          _r4 = (void *)((unsigned int)_r4 | _r6);
          _r3 = (char *)(_r5 & (unsigned int)_r3);
          _r5 = 3;
          _r4 = (void *)((unsigned int)_r3 | (unsigned int)_r4);
          _r3 = (char *)&v25;
          *(_DWORD *)(_r14 + 4) = _r4;
          v25 = _r5;
          *(_DWORD *)(_r14 + 8) = v5;
          v26 = _r24;
          *(_DWORD *)(_r14 + 12) = v6;
          v27 = _r14;
          *(_DWORD *)(_r14 + 16) = v7;
          _r4 = v8;
          v28 = _r22;
          *(_DWORD *)(_r14 + 20) = v8;
          v29 = _r2;
          query_dev_sstic();
          _r25 = *(_BYTE *)(_r2 + 8);
          _r23 = *(_BYTE *)(_r2 + 10);
          _r21 = *(_BYTE *)(_r2 + 12);
          _r19 = *(_BYTE *)(_r2 + 13);
          _r17 = *(_BYTE *)(_r2 + 14);
          _r15 = *(_BYTE *)(_r2 + 15);
          _r24 = *(_BYTE *)(_r2 + 9);
          _r22 = *(_BYTE *)(_r2 + 11);
          _r13 = BYTE3(v4);
          _r12 = BYTE2(v4);
          _r11 = BYTE1(v4);
          _r8 = (unsigned __int8)v4;
          _r7 = BYTE3(v3);
          _r6 = BYTE2(v3);
          _r5 = BYTE1(v3);
          _r4 = (void *)(unsigned __int8)v3;
          _r14 = *(_BYTE *)(_r2 + 16);
          _r13 = BYTE3(v4) ^ _r25;
          _r11 = BYTE1(v4) ^ _r23;
          _r7 = BYTE3(v3) ^ _r21;
          _r6 = BYTE2(v3) ^ _r19;
          _r5 = BYTE1(v3) ^ _r17;
          _r4 = (void *)((unsigned __int8)v3 ^ _r15);
          _r12 = BYTE2(v4) ^ _r24;
          _r8 = (unsigned __int8)v4 ^ _r22;
          _r3 = (char *)(BYTE3(v2) ^ _r14);
          v9 = BYTE3(v4) ^ _r25;
          v10 = BYTE2(v4) ^ _r24;
          v11 = BYTE1(v4) ^ _r23;
          v12 = (unsigned __int8)v4 ^ _r22;
          v13 = BYTE3(v3) ^ _r21;
          v14 = BYTE2(v3) ^ _r19;
          v15 = BYTE1(v3) ^ _r17;
          v16 = v3 ^ _r15;
          _r19 = *(_BYTE *)(_r2 + 17);
          _r17 = *(_BYTE *)(_r2 + 18);
          _r15 = *(_BYTE *)(_r2 + 19);
          _r8 = *(_BYTE *)(_r2 + 20);
          _r7 = *(_BYTE *)(_r2 + 21);
          _r6 = *(_BYTE *)(_r2 + 22);
          _r14 = *(_BYTE *)(_r2 + 23);
          v17 = (char)_r3;
          _r8 ^= BYTE3(v1);
          _r7 ^= BYTE2(v1);
          _r6 ^= BYTE1(v1);
          _r13 = BYTE2(v2) ^ _r19;
          _r12 = BYTE1(v2) ^ _r17;
          _r11 = (unsigned __int8)v2 ^ _r15;
          _r2 = (unsigned __int8)v1 ^ _r14;
          _r3 = (char *)_r28;
          _r4 = &v9;
          _r5 = _r20;
          v24 = v1 ^ _r14;
          v18 = BYTE2(v2) ^ _r19;
          v19 = BYTE1(v2) ^ _r17;
          v20 = v2 ^ _r15;
          v21 = _r8;
          v22 = _r7;
          v23 = _r6;
          write(_r28, &v9, _r20);
          ++_r18;
          v1 = v5;
          v2 = v6;
          v3 = v7;
          _r2 = (int)v8;
          v4 = v8;
        }
        _r3 = aBadBlockSize;
        printf(aBadBlockSize, _r4, _r5);
        _r3 = (char *)_r28;
        close(_r28, _r4, _r5);
      }
      else
      {
        _r3 = aCanTReadIv;
        puts(aCanTReadIv);
        _r11 = 1;
      }
    }
  }
done:
  _r9 = v41;
  _r2 = v32;
  _r14 = v33;
  _r18 = v34;
  _r20 = v35;
  _r22 = v36;
  _r24 = v37;
  _r26 = v38;
  _r28 = v39;
  _r30 = v40;
  return _r11;
}

struct command {
  int cmd;
  int data_in_len;
  char *data_in;
  int data_out_len;
  char *data_out;
};

struct message { // int fields are little-endian
  int cmd;
  int blockno;
  unsigned __int8 buf[16];
};

int decrypt_file(int in_hnd)
{
  unsigned __int8 previous[16]; // initialized with IV
  unsigned __int8 ciphertxt[16];
  unsigned __int8 plaintxt[16];
  struct command cmd;

  out_hnd = open(out_fname, 'A');
  if ( out_hnd < 0 )
  {
    printf("Can't open %s for writing", out_fname);
    retcode = 1;
  }
  else
  {
    status = fstat(in_hnd, &stat_buf);
    if ( status < 0 )
    {
      puts("Can't stat");
      retcode = 1;
    }
    else
    {
      n = read(in_hnd, previous, 16);
      blockno = 0;
      if ( n != 16 )
      {
        puts("Can't read IV");
        retcode = 1;
      }
      else
      {
        while ( 1 )
        {
          n = read(in_hnd, &ciphertxt, 16);
          if ( 0 == n )
          {
            close(out_hnd);
            goto done;
          }
          if ( n != 16 )
          {
            printf("Bad block size");
            close(out_hnd);
            goto done;
          }
          msg_out = (struct message*) malloc(260);
          msg_in = (struct message*) malloc(280);
          memset(msg_in, 0, 280);
          memset(msg_out, 0, 260);
          puts("Send command to Trusted App CMD_DECRYPT_BLOCK");
          msg_in.cmd = little_endian(CMD_DECRYPT_BLOCK);
          msg_in.blockno = bswap(blockno);
          cmd.cmd = CMD_TA_MESSAGE;
          memcpy(msg_in.buf, ciphertxt, 16);
          cmd.data_in_len = 280;
          cmd.data_in = msg_in;
          cmd.data_out_len = 260;
          cmd.data_out = msg_out;
          query_dev_sstic(&cmd);
          plaintxt[0] = previous[15] ^ msg_out.buf[0];
          plaintxt[1] = previous[14] ^ msg_out.buf[1];
          plaintxt[2] = previous[13] ^ msg_out.buf[2];
          plaintxt[3] = previous[12] ^ msg_out.buf[3];
          plaintxt[4] = previous[11] ^ msg_out.buf[4];
          plaintxt[5] = previous[10] ^ msg_out.buf[5];
          plaintxt[6] = previous[9] ^ msg_out.buf[6];
          plaintxt[7] = previous[8] ^ msg_out.buf[7];
          plaintxt[8] = previous[7] ^ msg_out.buf[8];
          plaintxt[9] = previous[6] ^ msg_out.buf[9];
          plaintxt[10] = previous[5] ^ msg_out.buf[10];
          plaintxt[11] = previous[4] ^ msg_out.buf[11];
          plaintxt[12] = previous[3] ^ msg_out.buf[12];
          plaintxt[13] = previous[2] ^ msg_out.buf[13];
          plaintxt[14] = previous[1] ^ msg_out.buf[14];
          plaintxt[15] = previous[0] ^ msg_out.buf[15];
          write(out_hnd, plaintxt, n);
          ++blockno;
          memcpy(previous, ciphertxt);
        }
      }
    }
  }
done:
  return retcode;
}

struct command {
  int cmd;
  int data_in_len;
  char *data_in;
  int data_out_len;
  char *data_out;
};

struct message { // int fields are little-endian
  int status;
};

signed int query_dev_sstic(struct command *cmd)
{
  int hnd;
  struct message *msg_out;

  hnd = open("/dev/sstic", 0);
  if ( hnd < 0 ) {
    puts("Can't open /dev/sstic");
    return 1;
  }
  else
  {
    status = ioctl(hnd, 0xC0145300, cmd);
    msg_out = (struct message*) cmd.data_out;
    if ( status )
    {
      [ ... error handling ]
    }
    printf("OS return code = 0x%08x, TA return code = 0x%08x", _r4, _r5);
close_hnd:
    close(hnd);
    _r3 = bswap(msg_out.status);
    _r11 = (int)&_r3[_r2];
    return _r11;
  }
}

~/sstic2017/challenges/riscy_zones falkn$ strings -t x vmlinux.bin | grep sstic
335a0c sstic
335a1b 6sstic: ioctl() error copy message struct
335a47 6sstic: ioctl() error bad data_in_len
335a6f 6sstic: can't allocate input_buffer
335a95 6sstic: ioctl() error bad data_out_len
335abe 6sstic: can't allocate output_buffer
335ae5 6sstic: ioctl() error copy_from_user (input_buffer)
335b1b 6sstic: ioctl() error copy_to_user (output_buffer)
3a6159 sstic-vm

~/sstic2017/challenges/riscy_zones falkn$ grep "l.ori .*0x5300" vmlinux.disas
  20b2e0:   a8 42 53 00     l.ori r2,r2,0x5300

~/sstic2017/challenges/riscy_zones falkn$ grep "l.ori .*0x5a.." vmlinux.disas
     dac:   ab de 5a ec     l.ori r30,r30,0x5aec
[...]
  20b34c:   a8 63 5a 1a     l.ori r3,r3,0x5a1a
  20b394:   a8 63 5a 46     l.ori r3,r3,0x5a46
  20b3b4:   a8 63 5a 6e     l.ori r3,r3,0x5a6e
  20b3d4:   a8 63 5a 94     l.ori r3,r3,0x5a94
  20b3f4:   a8 63 5a bd     l.ori r3,r3,0x5abd
  20b464:   a8 63 5a e4     l.ori r3,r3,0x5ae4
[...]

check_ioctl:

  20b2d8:   18 40 c0 14     l.movhi r2,0xc014
  20b2dc:   d7 e1 4f fc     l.sw -4(r1),r9       ; save link register r9
  20b2e0:   a8 42 53 00     l.ori r2,r2,0x5300   ; c0145300 = ioctl #
  20b2e4:   d7 e1 0f e8     l.sw -24(r1),r1      ; store single word (source is rhs)
  20b2e8:   d7 e1 77 f0     l.sw -16(r1),r14
  20b2ec:   d7 e1 97 f4     l.sw -12(r1),r18
  20b2f0:   d7 e1 a7 f8     l.sw -8(r1),r20
  20b2f4:   e4 24 10 00     l.sfne r4,r2         ; set flag if not equal
  20b2f8:   9c 21 ff d4     l.addi r1,r1,-44     ; reserve 44 bytes of stack
                                             ; first 20 bytes = copy of message header
                                             ; next come 6 32-bit words for saved regs r1, r2, r14, r18, r20, r9

  20b2fc:   10 00 00 9e     l.bf 20b574 <_binary_vmlinux_bin_start+0x20b574> ; branch if flag

  20b300:   9d 60 fd fd     l.addi r11,r0,-515   ; r11 = -515
  20b304:   84 6a 00 10     l.lwz r3,16(r10)     ; r3 = [r10 + 16]
  20b308:   bc a3 00 13     l.sfleui r3,19       ; set flag if less or equal to unsigned imm
                                             ; [r10 + 16] <=? 19

  20b30c:   10 00 00 0b     l.bf 20b338 <_binary_vmlinux_bin_start+0x20b338>

  20b310:   a8 45 00 00     l.ori r2,r5,0x0      ; r2 = r5
  20b314:   9c 63 ff ec     l.addi r3,r3,-20     ; r3 -= 20                      ; [buf+16] - 20 (message payload sz?)
  20b318:   e4 45 18 00     l.sfgtu r5,r3        ; r5 > [buf+16] - 20
  20b31c:   10 00 00 07     l.bf 20b338 <_binary_vmlinux_bin_start+0x20b338>

  20b320:   a8 85 00 00     l.ori r4,r5,0x0      ; r4 = r5
  20b324:   a8 61 00 00     l.ori r3,r1,0x0      ; r3 = r1
  20b328:   07 f7 de a1     l.jal 2dac <_binary_vmlinux_bin_start+0x2dac> ; memcpy(stack msg, ioctl 3rd parm, 20)
  20b32c:   9c a0 00 14     l.addi r5,r0,20      ; r5 = 20 (delay slot)

  20b330:   00 00 00 11     l.j 20b374 <_binary_vmlinux_bin_start+0x20b374> ; continue_afer_memcpy below
  20b334:   bc 2b 00 00     l.sfnei r11,0        ; r11 = return value != 0 ?

xxx_less_or_eq_19: ; message too short -> error

  20b338:   bd 62 00 00     l.sfgesi r2,0        ; r2 >= 0 ? (errors on)
  20b33c:   10 00 00 05     l.bf 20b350 <_binary_vmlinux_bin_start+0x20b350>
  20b340:   18 a0 80 00     l.movhi r5,0x8000

memcpy_failed:
  20b344:   18 60 c0 33     l.movhi r3,0xc033
  20b348:   00 00 00 6b     l.j 20b4f4 <_binary_vmlinux_bin_start+0x20b4f4>

  20b34c:   a8 63 5a 1a     l.ori r3,r3,0x5a1a ; "sstic: ioctl() error copy message struct"

no_err_message:
  20b350:   a8 61 00 00     l.ori r3,r1,0x0
  20b354:   a8 82 00 00     l.ori r4,r2,0x0
  20b358:   07 f7 de 95     l.jal 2dac <_binary_vmlinux_bin_start+0x2dac> ; jump and link
  20b35c:   e0 a5 10 02     l.sub r5,r5,r2

  20b360:   18 80 80 00     l.movhi r4,0x8000
  20b364:   a8 84 00 14     l.ori r4,r4,0x14
  20b368:   e0 62 20 00     l.add r3,r2,r4
  20b36c:   e1 63 58 00     l.add r11,r3,r11
  20b370:   bc 2b 00 00     l.sfnei r11,0


continue_after_memcpy:

  20b374:   13 ff ff f4     l.bf 20b344 <_binary_vmlinux_bin_start+0x20b344> ; handle memcpy() error code

  20b378:   18 c0 00 01     l.movhi r6,0x1   ; r6 = 0x10000
  20b37c:   84 61 00 04     l.lwz r3,4(r1)   ; r3 = data_in_len from tee message
  20b380:   e4 a3 30 00     l.sfleu r3,r6    ; data_in_len < 64k ?
  20b384:   10 00 00 05     l.bf 20b398 <_binary_vmlinux_bin_start+0x20b398>
  20b388:   1a 40 02 40     l.movhi r18,0x240 ; r18 = 0x2400000

  20b38c:   18 60 c0 33     l.movhi r3,0xc033
  20b390:   00 00 00 59     l.j 20b4f4 <_binary_vmlinux_bin_start+0x20b4f4>

  20b394:   a8 63 5a 46     l.ori r3,r3,0x5a46 ; "sstic: ioctl() error bad data_in_len"

data_in_len_small_enough:
  20b398:   07 fa a5 16     l.jal b47f0 <_binary_vmlinux_bin_start+0xb47f0> ; kmalloc(data_in_len, 0x24000c0)
  20b39c:   a8 92 00 c0     l.ori r4,r18,0xc0 ; r4 = 0x24000c0 kmalloc flags

  20b3a0:   bc 2b 00 00     l.sfnei r11,0
  20b3a4:   10 00 00 05     l.bf 20b3b8 <_binary_vmlinux_bin_start+0x20b3b8> ; jmp if not NULL

  20b3a8:   a9 cb 00 00     l.ori r14,r11,0x0 ; r14 = alloc'd block for input data
  20b3ac:   18 60 c0 33     l.movhi r3,0xc033
  20b3b0:   00 00 00 51     l.j 20b4f4 <_binary_vmlinux_bin_start+0x20b4f4>

  20b3b4:   a8 63 5a 6e     l.ori r3,r3,0x5a6e ; "sstic: can't allocate input_buffer"

alloc_ok:
  20b3b8:   84 61 00 0c     l.lwz r3,12(r1)  ; r3 = data_out_len
  20b3bc:   18 80 00 01     l.movhi r4,0x1
  20b3c0:   e4 a3 20 00     l.sfleu r3,r4    ; data_out_len < 64k?
  20b3c4:   10 00 00 05     l.bf 20b3d8 <_binary_vmlinux_bin_start+0x20b3d8>

  20b3c8:   15 00 00 00     l.nop 0x0
  20b3cc:   18 60 c0 33     l.movhi r3,0xc033
  20b3d0:   00 00 00 49     l.j 20b4f4 <_binary_vmlinux_bin_start+0x20b4f4>

  20b3d4:   a8 63 5a 94     l.ori r3,r3,0x5a94 ; sstic: ioctl() error bad data_out_len

data_out_len_ok:
  20b3d8:   07 fa a5 06     l.jal b47f0 <_binary_vmlinux_bin_start+0xb47f0> ; kmalloc(data_out_len, 0x24000c0)
  20b3dc:   a8 92 00 c0     l.ori r4,r18,0xc0  ; (delay slot)

  20b3e0:   bc 2b 00 00     l.sfnei r11,0
  20b3e4:   10 00 00 05     l.bf 20b3f8 <_binary_vmlinux_bin_start+0x20b3f8> ; jmp if not NULL

  20b3e8:   aa 8b 00 00     l.ori r20,r11,0x0  ; r20 = kblk_out for output data
  20b3ec:   18 60 c0 33     l.movhi r3,0xc033
  20b3f0:   00 00 00 41     l.j 20b4f4 <_binary_vmlinux_bin_start+0x20b4f4>

  20b3f4:   a8 63 5a bd     l.ori r3,r3,0x5abd ; "sstic: can't allocate output_buffer"
  20b3f8:   84 a1 00 04     l.lwz r5,4(r1)     ; r5 = data_in_len (again but from kernel copy of message on stack)
  20b3fc:   84 6a 00 10     l.lwz r3,16(r10)   ; r3 = address limit?
  20b400:   e4 45 18 00     l.sfgtu r5,r3      ; data_in_len > address limit?
  20b404:   10 00 00 0a     l.bf 20b42c <_binary_vmlinux_bin_start+0x20b42c> ; jmp if data_in_len too big
  20b408:   84 81 00 08     l.lwz r4,8(r1)     ; (delay) r4 = data_in

  20b40c:   e0 63 28 02     l.sub r3,r3,r5     ; r3 = limit - data_in_len = max data_in ptr
  20b410:   e4 44 18 00     l.sfgtu r4,r3      ; data_in_ptr > max ?
  20b414:   10 00 00 07     l.bf 20b430 <_binary_vmlinux_bin_start+0x20b430>
  20b418:   bd 84 00 00     l.sfltsi r4,0      ; data_in < 0 signed ? (delay)

  20b41c:   07 f7 de 64     l.jal 2dac <_binary_vmlinux_bin_start+0x2dac> ; memcpy(kblk_in, data_in, data_in_len)
  20b420:   a8 6e 00 00     l.ori r3,r14,0x0   ; dst = r14 = alloc'd block for input data

  20b424:   00 00 00 0b     l.j 20b450 <_binary_vmlinux_bin_start+0x20b450>

  20b428:   a8 ab 00 00     l.ori r5,r11,0x0   ; r5 = memcpy() result

; it looks like something special and weird happens when data_in is negative as a signed number...

data_in_gt_address_limit:
  20b42c:   bd 84 00 00     l.sfltsi r4,0      ; data_in < 0 (signed)

data_in_ptr_too_big:
  20b430:   10 00 00 08     l.bf 20b450 <_binary_vmlinux_bin_start+0x20b450> ; jmp if data_in < 0 signed

  20b434:   18 c0 80 00     l.movhi r6,0x8000  ; r6 = 0x80000000 (could this be assuming the wrong kernel limit?)
  20b438:   a8 6e 00 00     l.ori r3,r14,0x0   ; r3 = dst = kernel block for input data
  20b43c:   e2 45 30 00     l.add r18,r5,r6    ; r18 = 0x80000000 + data_in_len
  20b440:   e2 44 90 00     l.add r18,r4,r18   ; r18 = 0x80000000 + data_in + data_in_len
  20b444:   07 f7 de 5a     l.jal 2dac <_binary_vmlinux_bin_start+0x2dac> ; memcpy(kblk_in, data_in, <see below>)
  20b448:   e0 a5 90 02     l.sub r5,r5,r18    ; (delay) r5 = 0x80000000 - data_in
  20b44c:   e0 ab 90 00     l.add r5,r11,r18   ; r5 = memcpy() result + data_in_len

data_in_negative_or_memcpy_input_data_done:
  20b450:   bc 05 00 00     l.sfeqi r5,0       ; r5 == 0 ?
  20b454:   10 00 00 05     l.bf 20b468 <_binary_vmlinux_bin_start+0x20b468> ; r5 = 0 means success

  20b458:   18 c0 40 00     l.movhi r6,0x4000

  20b45c:   18 60 c0 33     l.movhi r3,0xc033
  20b460:   00 00 00 25     l.j 20b4f4 <_binary_vmlinux_bin_start+0x20b4f4> ; error handling
  20b464:   a8 63 5a e4     l.ori r3,r3,0x5ae4 ; (delay) "sstic: ioctl() error copy_from_user (input_buffer)"

memcpy_input_data_successful:
  20b468:   18 80 40 00     l.movhi r4,0x4000  ; r4 = 0x40000000

  20b46c:   e0 6e 20 00     l.add r3,r14,r4    ; r3 = kblk_in + 0x40000000
  20b470:   e0 b4 30 00     l.add r5,r20,r6    ; r5 = kblk_out + 0x40000000
  20b474:   85 61 00 00     l.lwz r11,0(r1)    ; r11 = message.cmd
  20b478:   84 81 00 04     l.lwz r4,4(r1)     ; r4 = message.data_in_len
  20b47c:   84 c1 00 0c     l.lwz r6,12(r1)    ; r6 = message.data_out_len
  20b480:   20 00 00 00     l.sys 0x0          ; trustzone call


  ***************** IT HAPPENS HERE


  20b484:   84 8a 00 10     l.lwz r4,16(r10)   ; r4 = address limit?
  20b488:   d4 01 30 0c     l.sw 12(r1),r6     ; msg.data_out_len = r6 (update message)
  20b48c:   e4 46 20 00     l.sfgtu r6,r4      ; new data_out_len > address limit?
  20b490:   a8 a6 00 00     l.ori r5,r6,0x0    ; r5 = r6 = new data_out_len
  20b494:   a9 cb 00 00     l.ori r14,r11,0x0  ; r14 = r11 = trustzone call result?
  20b498:   10 00 00 0a     l.bf 20b4c0 <_binary_vmlinux_bin_start+0x20b4c0> ; jmp if new data_out_len big
  20b49c:   84 61 00 10     l.lwz r3,16(r1)    ; (delay) r3 = data_out

  20b4a0:   e0 84 30 02     l.sub r4,r4,r6     ; r4 -= new data_out_len
  20b4a4:   e4 43 20 00     l.sfgtu r3,r4
  20b4a8:   10 00 00 07     l.bf 20b4c4 <_binary_vmlinux_bin_start+0x20b4c4>

  20b4ac:   bd 83 00 00     l.sfltsi r3,0      ; test data_out negative
  20b4b0:   07 f7 de 3f     l.jal 2dac <_binary_vmlinux_bin_start+0x2dac> ; memcpy(data_out, kblk_out, new data_out_len)
  20b4b4:   a8 94 00 00     l.ori r4,r20,0x0   ; src = r20 = kblk_out
  20b4b8:   00 00 00 0b     l.j 20b4e4 <_binary_vmlinux_bin_start+0x20b4e4>
  20b4bc:   a8 ab 00 00     l.ori r5,r11,0x0   ; (delay)

handle_big_data_out_len:
  20b4c0:   bd 83 00 00     l.sfltsi r3,0

handle_another_weird_case:
  20b4c4:   10 00 00 08     l.bf 20b4e4 <_binary_vmlinux_bin_start+0x20b4e4>

  ; memcpy() with diffent parms to handle corner cases

  20b4c8:   18 80 80 00     l.movhi r4,0x8000
  20b4cc:   e2 45 20 00     l.add r18,r5,r4
  20b4d0:   a8 94 00 00     l.ori r4,r20,0x0
  20b4d4:   e2 43 90 00     l.add r18,r3,r18
  20b4d8:   07 f7 de 35     l.jal 2dac <_binary_vmlinux_bin_start+0x2dac> memcpy(...)
  20b4dc:   e0 a5 90 02     l.sub r5,r5,r18
  20b4e0:   e0 ab 90 00     l.add r5,r11,r18

after_regular_copy_to_user:
  20b4e4:   bc 05 00 00     l.sfeqi r5,0
  20b4e8:   10 00 00 07     l.bf 20b504 <_binary_vmlinux_bin_start+0x20b504> ; r5 == 0 => copy_to_user_succeeded

  20b4ec:   18 60 c0 33     l.movhi r3,0xc033
  20b4f0:   a8 63 5b 1a     l.ori r3,r3,0x5b1a ; "sstic: ioctl() error copy_to_user (output_buffer)"

log_error_message?:

  20b4f4:   07 f9 88 cf     l.jal 6d830 <_binary_vmlinux_bin_start+0x6d830>

  20b4f8:   15 00 00 00     l.nop 0x0
  20b4fc:   00 00 00 1e     l.j 20b574 <_binary_vmlinux_bin_start+0x20b574>

  20b500:   9d 60 ff f2     l.addi r11,r0,-14

copy_to_user_suceeded:
  20b504:   84 6a 00 10     l.lwz r3,16(r10)   ; again, wtf is this?
  20b508:   bc a3 00 13     l.sfleui r3,19
  20b50c:   10 00 00 0c     l.bf 20b53c <_binary_vmlinux_bin_start+0x20b53c>

  20b510:   bd 82 00 00     l.sfltsi r2,0
  20b514:   9c 63 ff ec     l.addi r3,r3,-20   ; r3 -= 20
  20b518:   e4 42 18 00     l.sfgtu r2,r3
  20b51c:   10 00 00 07     l.bf 20b538 <_binary_vmlinux_bin_start+0x20b538>

  20b520:   a8 62 00 00     l.ori r3,r2,0x0    ; r3 = frame pointer?
  20b524:   a8 81 00 00     l.ori r4,r1,0x0
  20b528:   07 f7 de 21     l.jal 2dac <_binary_vmlinux_bin_start+0x2dac> ; memcpy(, stack copy of message, 20)
  20b52c:   9c a0 00 14     l.addi r5,r0,20    ; (delay) sz = 20

  20b530:   00 00 00 0e     l.j 20b568 <_binary_vmlinux_bin_start+0x20b568>
  20b534:   bc 2b 00 00     l.sfnei r11,0

  20b538:   bd 82 00 00     l.sfltsi r2,0
  20b53c:   13 ff ff 82     l.bf 20b344 <_binary_vmlinux_bin_start+0x20b344> ; indirect branch to 4f4 error handling

  20b540:   18 a0 80 00     l.movhi r5,0x8000
  20b544:   a8 62 00 00     l.ori r3,r2,0x0  ; dst = r2
  20b548:   e0 a5 10 02     l.sub r5,r5,r2   ; sz = 0x80000000 - r2
  20b54c:   07 f7 de 18     l.jal 2dac <_binary_vmlinux_bin_start+0x2dac> memcpy(r2, stack msg, adjusted sz)
  20b550:   a8 81 00 00     l.ori r4,r1,0x0  ; (delay) src = r1

  20b554:   18 c0 80 00     l.movhi r6,0x8000
  20b558:   a8 c6 00 14     l.ori r6,r6,0x14
  20b55c:   e0 42 30 00     l.add r2,r2,r6
  20b560:   e1 62 58 00     l.add r11,r2,r11
  20b564:   bc 2b 00 00     l.sfnei r11,0

handle_error_or_epilogue:
  20b568:   13 ff ff 78     l.bf 20b348 <_binary_vmlinux_bin_start+0x20b348> ; indirect branch to 4f4 error handling

  20b56c:   18 60 c0 33     l.movhi r3,0xc033
  20b570:   a9 6e 00 00     l.ori r11,r14,0x0

epilogue:

  20b574:   9c 21 00 2c     l.addi r1,r1,44
  20b578:   85 21 ff fc     l.lwz r9,-4(r1)
  20b57c:   84 21 ff e8     l.lwz r1,-24(r1)
  20b580:   84 41 ff ec     l.lwz r2,-20(r1)
  20b584:   85 c1 ff f0     l.lwz r14,-16(r1)
  20b588:   86 41 ff f4     l.lwz r18,-12(r1)
  20b58c:   44 00 48 00     l.jr r9
  20b590:   86 81 ff f8     l.lwz r20,-8(r1)   ; delay slot