Skip to content

Commit c8e82b6

Browse files
yasarjamesyasarjames
committed
add wp for rev-chase
1 parent fce9073 commit c8e82b6

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

45 files changed

+4880
-0
lines changed

‎rev-chase/README.md

+52
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
# chase (47 solves)
2+
3+
The players receive a nes rom file. This game is modified from the original game "chase" made by [Shiru](https://shiru.untergrund.net/software.shtml#nes).
4+
5+
You can download the source code and the original version, which is very helpful for solving this challenge.
6+
7+
## Modifications
8+
9+
- Hide the flag pt.1 in the winning screen.
10+
- Extend the game to hidden level 6, which contains the flag pt.2.
11+
- Adding some new tiles in CHR-ROM, which represent the flag pt.3.
12+
13+
Additionally, I add some constraints to make it more challenging.
14+
15+
But in general, this challenge is very easy.
16+
17+
## A Easy Way to Solve
18+
19+
Using the emulator like [FCEUX](https://fceux.com/web/home.html) is very easy to run the game rom.
20+
21+
## Flag pt.1
22+
23+
The game is not difficult, and you can easily play to win. ~~But as a CTFer, you must use another way to solve it.~~
24+
25+
FCEUX provides debugger, memory viewer, cheats and other useful tools. You can just modify the score to easily win the game.
26+
27+
## Flag pt.3
28+
29+
The flag pt.3 is hidden in the CHR-ROM. You can use the PPU viewer in FCEUX to view the CHR-ROM.
30+
31+
## Flag pt.2
32+
33+
### Intended
34+
35+
To get into the hidden level 6, you need to modify the game's code to bypass the check. There are many ways to do this.
36+
37+
1. Use the debugger to step through the program.
38+
2. Use the IDA Pro to disassemble the code. (The IDA Pro can't load the nes rom directly, you need to use the loader from [https://github.com/Jinmo/nesldr-py](https://github.com/Jinmo/nesldr-py).)
39+
40+
Change the jump condition and you can easily enter the hidden level 6.
41+
42+
~~It is my fault not to add any hint for hidden level.~~
43+
44+
### Unintended
45+
46+
Some players use the hex editor to find the corresponding code of flag pt.1 in the winning screen, and find the flag pt.2 in the game rom.
47+
48+
Just replace the flag pt.1 with the pt.2 and win the game again to get the flag pt.2.
49+
50+
This is not the intended way, but it is also a valid way to solve this challenge.
51+
52+
~~I will obfuscate the flag next time.~~

‎rev-chase/src/compile.bat

+17
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
@echo off
2+
3+
set name="chase.nes"
4+
5+
set path=%path%;D:\CTF\Tools\famicom\cc65-snapshot-win64\bin
6+
7+
cc65 -Oi game.c --add-source
8+
ca65 crt0.s
9+
ca65 game.s
10+
11+
ld65 -C nrom_128_horz.cfg -o %name% crt0.o game.o nes.lib
12+
13+
pause
14+
15+
del *.o
16+
@REM del game.s
17+

‎rev-chase/src/crt0.s

+266
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,266 @@
1+
; startup code for cc65 and neslib
2+
; based on code by Groepaz/Hitmen <[email protected]>, Ullrich von Bassewitz <[email protected]>
3+
4+
;v050517
5+
6+
7+
8+
FT_DPCM_OFF = __DMC_START__ ;set in the linker CFG file via MEMORY/DMC section
9+
;'start' there should be $c000..$ffc0, in 64-byte steps
10+
FT_SFX_STREAMS = 4 ;number of sound effects played at once, 1..4
11+
12+
.define FT_DPCM_ENABLE 0 ;undefine to exclude all DMC code
13+
.define FT_SFX_ENABLE 1 ;undefine to exclude all sound effects code
14+
15+
16+
17+
.export _exit,__STARTUP__:absolute=1
18+
.import initlib,push0,popa,popax,_main,zerobss,copydata
19+
20+
; Linker generated symbols
21+
.import __RAM_START__ ,__RAM_SIZE__
22+
.import __ROM0_START__ ,__ROM0_SIZE__
23+
.import __STARTUP_LOAD__,__STARTUP_RUN__,__STARTUP_SIZE__
24+
.import __CODE_LOAD__ ,__CODE_RUN__ ,__CODE_SIZE__
25+
.import __RODATA_LOAD__ ,__RODATA_RUN__ ,__RODATA_SIZE__
26+
.import __DMC_START__
27+
.import NES_MAPPER,NES_PRG_BANKS,NES_CHR_BANKS,NES_MIRRORING
28+
.include "zeropage.inc"
29+
30+
31+
32+
FT_BASE_ADR =$0100 ;page in RAM, should be $xx00
33+
34+
.define FT_THREAD 1 ;undefine if you call sound effects in the same thread as sound update
35+
.define FT_PAL_SUPPORT 1 ;undefine to exclude PAL support
36+
.define FT_NTSC_SUPPORT 1 ;undefine to exclude NTSC support
37+
38+
39+
PPU_CTRL =$2000
40+
PPU_MASK =$2001
41+
PPU_STATUS =$2002
42+
PPU_OAM_ADDR =$2003
43+
PPU_OAM_DATA =$2004
44+
PPU_SCROLL =$2005
45+
PPU_ADDR =$2006
46+
PPU_DATA =$2007
47+
PPU_OAM_DMA =$4014
48+
DMC_FREQ =$4010
49+
CTRL_PORT1 =$4016
50+
CTRL_PORT2 =$4017
51+
52+
OAM_BUF =$0200
53+
PAL_BUF =$01c0
54+
55+
56+
57+
.segment "ZEROPAGE"
58+
59+
NTSC_MODE: .res 1
60+
FRAME_CNT1: .res 1
61+
FRAME_CNT2: .res 1
62+
VRAM_UPDATE: .res 1
63+
NAME_UPD_ADR: .res 2
64+
NAME_UPD_ENABLE: .res 1
65+
PAL_UPDATE: .res 1
66+
PAL_BG_PTR: .res 2
67+
PAL_SPR_PTR: .res 2
68+
SCROLL_X: .res 1
69+
SCROLL_Y: .res 1
70+
SCROLL_X1: .res 1
71+
SCROLL_Y1: .res 1
72+
PAD_STATE: .res 2 ;one byte per controller
73+
PAD_STATEP: .res 2
74+
PAD_STATET: .res 2
75+
PPU_CTRL_VAR: .res 1
76+
PPU_CTRL_VAR1: .res 1
77+
PPU_MASK_VAR: .res 1
78+
RAND_SEED: .res 2
79+
FT_TEMP: .res 3
80+
81+
TEMP: .res 11
82+
83+
PAD_BUF =TEMP+1
84+
85+
PTR =TEMP ;word
86+
LEN =TEMP+2 ;word
87+
NEXTSPR =TEMP+4
88+
SCRX =TEMP+5
89+
SCRY =TEMP+6
90+
SRC =TEMP+7 ;word
91+
DST =TEMP+9 ;word
92+
93+
RLE_LOW =TEMP
94+
RLE_HIGH =TEMP+1
95+
RLE_TAG =TEMP+2
96+
RLE_BYTE =TEMP+3
97+
98+
99+
100+
.segment "HEADER"
101+
102+
.byte $4e,$45,$53,$1a
103+
.byte <NES_PRG_BANKS
104+
.byte <NES_CHR_BANKS
105+
.byte <NES_MIRRORING|(<NES_MAPPER<<4)
106+
.byte <NES_MAPPER&$f0
107+
.res 8,0
108+
109+
110+
111+
.segment "STARTUP"
112+
113+
start:
114+
_exit:
115+
116+
sei
117+
ldx #$ff
118+
txs
119+
inx
120+
stx PPU_MASK
121+
stx DMC_FREQ
122+
stx PPU_CTRL ;no NMI
123+
124+
initPPU:
125+
126+
bit PPU_STATUS
127+
@1:
128+
bit PPU_STATUS
129+
bpl @1
130+
@2:
131+
bit PPU_STATUS
132+
bpl @2
133+
134+
clearPalette:
135+
136+
lda #$3f
137+
sta PPU_ADDR
138+
stx PPU_ADDR
139+
lda #$0f
140+
ldx #$20
141+
@1:
142+
sta PPU_DATA
143+
dex
144+
bne @1
145+
146+
clearVRAM:
147+
148+
txa
149+
ldy #$20
150+
sty PPU_ADDR
151+
sta PPU_ADDR
152+
ldy #$10
153+
@1:
154+
sta PPU_DATA
155+
inx
156+
bne @1
157+
dey
158+
bne @1
159+
160+
clearRAM:
161+
162+
txa
163+
@1:
164+
sta $000,x
165+
sta $100,x
166+
sta $200,x
167+
sta $300,x
168+
sta $400,x
169+
sta $500,x
170+
sta $600,x
171+
sta $700,x
172+
inx
173+
bne @1
174+
175+
lda #4
176+
jsr _pal_bright
177+
jsr _pal_clear
178+
jsr _oam_clear
179+
180+
jsr zerobss
181+
jsr copydata
182+
183+
lda #<(__RAM_START__+__RAM_SIZE__)
184+
sta sp
185+
lda #>(__RAM_START__+__RAM_SIZE__)
186+
sta sp+1 ; Set argument stack ptr
187+
188+
jsr initlib
189+
190+
lda #%10000000
191+
sta <PPU_CTRL_VAR
192+
sta PPU_CTRL ;enable NMI
193+
lda #%00000110
194+
sta <PPU_MASK_VAR
195+
196+
waitSync3:
197+
lda <FRAME_CNT1
198+
@1:
199+
cmp <FRAME_CNT1
200+
beq @1
201+
202+
detectNTSC:
203+
ldx #52 ;blargg's code
204+
ldy #24
205+
@1:
206+
dex
207+
bne @1
208+
dey
209+
bne @1
210+
211+
lda PPU_STATUS
212+
and #$80
213+
sta <NTSC_MODE
214+
215+
jsr _ppu_off
216+
217+
ldx #<music_data
218+
ldy #>music_data
219+
lda <NTSC_MODE
220+
jsr FamiToneInit
221+
222+
.if(FT_SFX_ENABLE)
223+
ldx #<sounds_data
224+
ldy #>sounds_data
225+
jsr FamiToneSfxInit
226+
.endif
227+
228+
lda #$fd
229+
sta <RAND_SEED
230+
sta <RAND_SEED+1
231+
232+
lda #0
233+
sta PPU_SCROLL
234+
sta PPU_SCROLL
235+
sta PPU_OAM_ADDR
236+
237+
jmp _main ;no parameters
238+
239+
.include "neslib.s"
240+
241+
.segment "RODATA"
242+
243+
music_data:
244+
.include "music.s"
245+
246+
.if(FT_SFX_ENABLE)
247+
sounds_data:
248+
.include "sounds.s"
249+
.endif
250+
251+
.segment "SAMPLES"
252+
253+
.if(FT_DPCM_ENABLE)
254+
.incbin "music.dmc"
255+
.endif
256+
257+
.segment "VECTORS"
258+
259+
.word nmi ;$fffa vblank nmi
260+
.word start ;$fffc reset
261+
.word irq ;$fffe irq / brk
262+
263+
264+
.segment "CHARS"
265+
266+
.incbin "tileset.chr"

0 commit comments

Comments
 (0)