├── README.md ├── skull-firmware.eep ├── skull-firmware.hex ├── skull-firmware.sh └── skull-firmware ├── FILE_ID.DIZ ├── skull-firmware.ino └── skull.nfo /README.md: -------------------------------------------------------------------------------- 1 | # The Skull CTF 2 | 3 | > A mind-bending hardware puzzle in three acts 4 | 5 | ▶ [Learn more about the project and get your own Skull](https://www.crowdsupply.com/wokwi/the-skull-ctf/) 6 | 7 | ▶ [Challenge instructions](https://skullctf.com/start) 8 | 9 | ▶ [Leaderboard](https://skullctf.com/high) 10 | 11 | You can find the complete Firmware source code in the [skull-firmware](skull-firmware/) directory. 12 | 13 | A [precompiled HEX file](skull-firmware.hex) is available too (with dummy flags, of course). 14 | For detailed instructions how to flash the firmware yourself, check out the [reprogramming guide](https://skullctf.com/reprogramming). 15 | -------------------------------------------------------------------------------- /skull-firmware.eep: -------------------------------------------------------------------------------- 1 | :100000002E4354467B666C61673120686572657D5E 2 | :00000001FF 3 | -------------------------------------------------------------------------------- /skull-firmware.hex: -------------------------------------------------------------------------------- 1 | :10000000B3C0E0C3C1C0C0C0BFC092C3BDC0BCC00C 2 | :10001000BBC0BAC0B9C0B8C0B7C0B6C0B5C0000098 3 | :10002000000037000000000038004354467B426F58 4 | :100030006E7573466C6167466F7254686542726193 5 | :1000400076657D0000D57FAAFE2B815429FC56835E 6 | :10005000D702A87D52872DF8AC79D3067BAE04D1A8 7 | :100060008550FA2FA471DB0E5A8F25F08D58F22798 8 | :1000700073A60CD9F623895C08DD77A2DF0AA07588 9 | :1000800021F45E8B9D48E23763B61CC9B461CB1E78 10 | :100090004A9F35E0CF1AB06531E44E9BE633994C68 11 | :1000A00018CD67B239EC4693C712B86D10C56FBA58 12 | :1000B000EE3B91446BBE14C19540EA3F42973DE848 13 | :1000C000BC69C316EF3A904511C46EBBC613B96C38 14 | :1000D00038ED4792BD68C21743963CE99441EB3E28 15 | :1000E0006ABF15C04B9E34E1B560CA1F62B71DC818 16 | :1000F0009C49E33619CC66B3E732984D30E54F9A08 17 | :10010000CE1BB16472A70DD88C59F3265B8E24F1F7 18 | :10011000A570DA0F20F55F8ADE0BA17409DC76A3E7 19 | :10012000F722885DD603A97C28FD5782FF2A8055D7 20 | :1001300001D47EAB8451FB2E7AAF05D0AD78D207C7 21 | :1001400053862CF90000000036000202020202026F 22 | :100150000202020201020408102020041008010219 23 | :10016000000004000000000011241FBECFE5D1E014 24 | :10017000DEBFCDBF20E0A0E6B0E001C01D92AA36F0 25 | :10018000B207E1F731D3BFC53BCF823089F018F415 26 | :10019000813051F00895833019F0843009F00895CA 27 | :1001A0008CB58F7D8CBD08958AB58F778ABD0895F3 28 | :1001B0008AB58F7DFBCFCF93DF93E0E6F1E08491AA 29 | :1001C000E6E5F1E0D491ECE4F1E0C491CC2399F0C0 30 | :1001D0008111DBDFEC2FF0E0EE0FFF1FEC5BFE4F39 31 | :1001E000A591B491EC91ED2381E090E009F480E0D9 32 | :1001F000DF91CF91089580E090E0FACF1F93CF93E5 33 | :10020000DF93282F30E0F901E25AFE4F8491F90183 34 | :10021000EC5AFE4FD491F901E65BFE4FC491CC231A 35 | :10022000A1F0162F8111B1DFEC2FF0E0EE0FFF1FD0 36 | :10023000EC5DFF4FA591B4918FB7F894EC9111113B 37 | :1002400008C0D095DE23DC938FBFDF91CF911F9143 38 | :100250000895DE2BF8CFCF93DF9390E0FC01EC5AAA 39 | :10026000FE4F2491865B9E4FFC0184918823D1F040 40 | :1002700090E0880F991FFC01E25EFF4FA591B491B9 41 | :10028000FC01EC5DFF4FC591D49161110EC09FB789 42 | :10029000F8948C91E22FE0958E238C932881E223B1 43 | :1002A000E8839FBFDF91CF9108958FB7F894EC91C9 44 | :1002B000E22BEC938FBFF6CF3FB7F89480916500A7 45 | :1002C00090916600A0916700B091680022B708B6CF 46 | :1002D00001FE05C02F3F19F00196A11DB11D3FBFC2 47 | :1002E000BA2FA92F982F8827BC01CD01620F711D4D 48 | :1002F000811D911D46E0660F771F881F991F4A9543 49 | :10030000D1F708958F929F92AF92BF92CF92DF92D2 50 | :10031000EF92FF926B017C01CFDF4B015C01C114B6 51 | :10032000D104E104F104B1F0C7DF681979098A0941 52 | :100330009B09683E73408105910588F321E0C21A4C 53 | :10034000D108E108F10888EE880E83E0981EA11C10 54 | :10035000B11CE5CFFF90EF90DF90CF90BF90AF90B2 55 | :100360009F908F900895CF92DF92EF92FF920F931C 56 | :100370001F93CF93DF93C82EEB0160E06CDF85E421 57 | :1003800090E00197F1F734E0D32E9AEF9C0D809125 58 | :1003900069008295807F892B87B9369A3699FECF7E 59 | :1003A00084B1E5B0FE2CE82E8701DA94DD2021F03F 60 | :1003B00080E8E816F10458F361E08C2D4CDF8D2DB8 61 | :1003C00090E064E770E08ED48A3191053CF0469766 62 | :1003D00096958795969587950197F1F788819981EC 63 | :1003E000E816F90608F07C01F982E882C8018E1946 64 | :1003F0009F09DF91CF911F910F91FF90EF90DF90B8 65 | :10040000CF90089596B116B885B7877E806185BF75 66 | :1004100085B7806285BFF8948BB780648BBF789472 67 | :10042000889596B908958F929F92AF92BF92CF927E 68 | :10043000DF92EF92FF92CF93DF936B01D594C79435 69 | :100440000D2C000CEE08FF08D0E0C0E0882E912CA7 70 | :10045000B12CA12CD501C4010C2E04C0B695A795D2 71 | :10046000979587950A94D2F7682F617084E0C6DE6D 72 | :1004700061E083E0C3DEC701B60144DF60E083E0F2 73 | :10048000BDDEC701B6013EDF2196C830D10511F7A8 74 | :1004900060E084E0DF91CF91FF90EF90DF90CF900C 75 | :1004A000BF90AF909F908F90A9CECF93C82F61E05F 76 | :1004B00084E0A4DE6AEF70E080E090E023DF60E09B 77 | :1004C00084E09CDE6AEF70E080E090E01BDFC150CA 78 | :1004D00071F7CF910895CF92DF92EF92FF920F9331 79 | :1004E0001F93CF93DF93CDB7DEB7A0970FB6F894E5 80 | :1004F000DEBF0FBECDBF9E012F5F3F4F690180E27F 81 | :10050000D9011D928A95E9F710E000E1802F90E073 82 | :10051000D3D38E3309F484C090F5212F30E08C3290 83 | :1005200009F474C0B0F4863209F4A0C08B3209F427 84 | :10053000C1C08132A9F4EFEFFFEFEC0FFD1FE20F16 85 | :10054000F31F2C0F3D1FD9018C91608190E0BCD32B 86 | :100550008BC0823309F4C4C038F48D3209F4B5C0BD 87 | :10056000F601E10FF11DC3C08C3309F466C08D3371 88 | :10057000B9F72C0F3D1FD9010C9101504FC087379F 89 | :1005800009F4C3C0A8F4212F30E0803409F45DC021 90 | :1005900008F4B0C08E3509F482C0823709F72150C3 91 | :1005A0003109F601E20FF31FA081B0E08C9142C047 92 | :1005B0008A3709F4BBC0A8F4883791F6812F90E000 93 | :1005C000DC011197AC0DBD1D2C91F601E80FF91F50 94 | :1005D00020830297F601E80FF91F80818C93208316 95 | :1005E0002AC08C3709F44EC08F3F09F0B9CFA096CE 96 | :1005F0000FB6F894DEBF0FBECDBFDF91CF911F9134 97 | :100600000F91FF90EF90DF90CF9008952C0F3D1F3A 98 | :10061000F901608170E090E080E074DE11500BC061 99 | :10062000212F2150330BF901EC0DFD1D808190E04D 100 | :100630009595879580830F5F69CF21503109F60129 101 | :10064000E20FF31F8081880FF5CFF9013297EC0D8F 102 | :10065000FD1D8081882341F0815080832C0F3D1F38 103 | :10066000F901008101501F5F1250E5CFF901329767 104 | :10067000EC0DFD1D2C0F3D1FD9018C91908189231C 105 | :100680008083CCCF812F90E0FC013297EC0DFD1DD3 106 | :100690008C0F9D1FDC018C919081892BF1CFF9018A 107 | :1006A0003297EC0DFD1D2C0F3D1FD9018C919081CF 108 | :1006B0008927E6CFF9013297EC0DFD1D2C0F3D1F68 109 | :1006C000D9018C919081890FDBCFF9013297EC0D24 110 | :1006D000FD1D2C0F3D1F8081D9019C91891BD0CF1E 111 | :1006E000FE01E20FF31F80812C0D3D1DF901808377 112 | :1006F0001F5FA1CF215031097601E20EF31ED70111 113 | :100700008C9190E0D9D2F70195CF812F90E0FE0136 114 | :10071000E80FF91FE081F0E02FEF3FEF2C0F3D1FB6 115 | :10072000820F931FDC018C9180839ECF6BDE83CF81 116 | :100730001F920F920FB60F9211242F933F938F9316 117 | :100740009F93AF93BF938091610090916200A091BD 118 | :100750006300B09164003091600020E3230F2D37D7 119 | :1007600058F54096A11DB11D209360008093610053 120 | :1007700090936200A0936300B09364008091650041 121 | :1007800090916600A0916700B09168000196A11D4C 122 | :10079000B11D8093650090936600A0936700B093AD 123 | :1007A0006800BF91AF919F918F913F912F910F90D2 124 | :1007B0000FBE0F901F90189523EB230F4196A11D9C 125 | :1007C000B11DD2CF1F920F920FB60F9211248F93AB 126 | :1007D0008BB78F7B8BBF85B78F7D85BF8F910F9038 127 | :1007E0000FBE0F901F901895CF93DF93CDB7DEB754 128 | :1007F00066970FB6F894DEBF0FBECDBF78948AB56A 129 | :1008000082608ABD8AB581608ABD83B7826083BFFA 130 | :1008100083B7816083BF89B7826089BF80B78260F8 131 | :1008200080BF3298319A309A379A8CB580648CBDEB 132 | :1008300010E061E0123009F460E0812F0CDD1F5FF1 133 | :100840001630B9F7B8DC892B09F08AC04FE050E0C8 134 | :1008500061E070E0CE01019620D2DE011196CE015A 135 | :100860004096F12CED91EF25F0E0EC5BFF4FF4901A 136 | :100870008A179B07B9F780E090E01ED2D82E01E0DE 137 | :100880008F1100E089E0E1E0F0E080935700E49010 138 | :1008900011E02CEFE21210E061E083E0AFDC8CEFBE 139 | :1008A000E81202C061E0DF1060E084E0A7DC68EEDF 140 | :1008B00073E080E090E026DD60E083E09FDC60E0B4 141 | :1008C00084E09CDCEE24EA94F12C6FEFC701FCD1AC 142 | :1008D00091E0E91AF1082FE0E216F104B1F7802F58 143 | :1008E0008795882787951295110F110F107C812B02 144 | :1008F00068EC70E0816097DD2AE230E08BE692E000 145 | :1009000082278FBD64EF71E080E090E0FBDC88E03F 146 | :100910008093690084B3886184BB8E010F5F1F4F91 147 | :1009200071DDF12CE12C47DC892B61F561E083E07E 148 | :1009300065DC61E084E062DC64E670E080E090E029 149 | :10094000E1DC60E083E05ADC60E084E057DC64E6F0 150 | :1009500070E080E090E0D6DC8FEFE81AF80AE3CF91 151 | :1009600061E083E04BDC61E084E048DC62E370E05E 152 | :1009700080E090E0C7DC60E083E040DC60E084E0A1 153 | :100980003DDCC5CF9BE0E916F1040CF0A4DD8FEF50 154 | :100990009FE79A8B898B9A838983E8E94E2EE8E05A 155 | :1009A0005E2EB12CA12C912C812C312C212CF12CE0 156 | :1009B000E12CD12CC12CFFDB892B09F460C0BE01D6 157 | :1009C0006F5E7F4F88E0CFDC940165E03695279518 158 | :1009D0006A95E1F7821B930B880E991E340175E02E 159 | :1009E000769467947A95E1F7C614D7040CF4630102 160 | :1009F000B80189E0B8DC950145E0369527954A9520 161 | :100A0000E1F7821B930BA80EB91EC50155E0969520 162 | :100A100087955A95E1F7E816F9060CF47C01211048 163 | :100A20000BC09601B3E035952795BA95E1F76216AC 164 | :100A300073068CF4F12CE12C9701A3E035952795F2 165 | :100A4000AA95E1F7222423948217930724F4339480 166 | :100A5000D12CC12C212C21E0421A510809F0ABCF36 167 | :100A600084E0FF24FA94381689F092E0931538F464 168 | :100A700029E08FEF830D231508F489E016DD80E06F 169 | :100A800090E0892B09F44CCFBBDA4ACF6F2D61700F 170 | :100A900083E0B4DB64E670E080E090E033DCFA945D 171 | :100AA00089EFF812F3CF8FEF9FE79C8B8B8B9A8B9C 172 | :100AB000898BD12CC12C712C612C1D8A412C512C7D 173 | :100AC000312C1E8AF4E0EF2EF12C88E893E15C01D2 174 | :100AD00021E0A21AB108892B91F26DDB892B79F202 175 | :100AE000430163E0959487946A95E1F783E0880E6B 176 | :100AF000911CBE016D5E7F4F88E035DC681679067B 177 | :100B00000CF43C0122242394881699060CF0212C25 178 | :100B1000BE016F5E7F4F89E026DC4601C816D9060C 179 | :100B20000CF44C012E89221222C023E0E216F104BB 180 | :100B300001F553E0D594C7945A95E1F723E0C20E2E 181 | :100B4000D11C21E0C816D9060CF020E0330C322A63 182 | :100B5000511016C055245394832D8F778B3409F090 183 | :100B6000512C3CEF432E44E0E42EF12C05C0F12C37 184 | :100B7000E12C9FEFE91AF90A64012E8AC501A7CF7B 185 | :100B80004394411004C0832D8F708D8B4BC0842DF6 186 | :100B9000877009F047C0842D47FE02C087E0840DAE 187 | :100BA000E82EE594E594E5940E2C000CFF0867010F 188 | :100BB00091E0C91AD108F801EC0DFD1D30822D8994 189 | :100BC000A22EB12CEA14FB0469F564EF71E080E019 190 | :100BD00090E098DB8D89823018F482E066DC21C0D9 191 | :100BE0009D89D80180E0923029F5B9808A81282F2B 192 | :100BF0002F70D22EDD0CD39490E024E0969587954B 193 | :100C00002A95E1F761E270E06DD00A967C01C12C73 194 | :100C10008B2D8C0D90E050D0B70105DCC394CD1422 195 | :100C2000B8F3512C74E0E72EF12CE8E8AE2EE3E1A6 196 | :100C3000BE2EA2CF9D01201B310B2C153D053CF48F 197 | :100C4000ED91E827F0E0EC5BFF4F8491F3CFDE01FC 198 | :100C5000AA0DBB1D9C91981711F083E0BFCFC980EE 199 | :100C60008FE0D12C92E0E91AF1088C1510F084E0A5 200 | :100C7000B5CFED2DF0E0EE15FF056CF482E090E0CD 201 | :100C80008C0F9D1FE80FF91F8C2D8D0D608190E05A 202 | :100C90001BD0D394EECF81E0A1CFDC01862FE82FCB 203 | :100CA000E199FECF1FBA05C0EEBBE09AE3950DB205 204 | :100CB0000D924150C8F70895E199FECF1FBA8EBB3F 205 | :100CC000E09A99278DB30895262FE199FECF1CBA9B 206 | :100CD0001FBA8EBB2DBB0FB6F894E29AE19A0FBEF5 207 | :100CE000019608950024552704C0080E591F880F47 208 | :100CF000991F009729F076956795B8F37105B9F7B4 209 | :0A0D0000802D952F0895F894FFCF81 210 | :00000001FF 211 | -------------------------------------------------------------------------------- /skull-firmware.sh: -------------------------------------------------------------------------------- 1 | avrdude -pattiny45 -cusbtiny -e -U eeprom:w:skull-firmware.eep:i -U flash:w:skull-firmware.hex:i -Uefuse:w:0xff:m -Uhfuse:w:0xdf:m -Ulfuse:w:0x62:m -Ulock:w:0xFC:m 2 | -------------------------------------------------------------------------------- /skull-firmware/FILE_ID.DIZ: -------------------------------------------------------------------------------- 1 | THE SKULL v1.00 - A mind-bending hardware 2 | puzzle in three acts. Naturally runs on an 3 | ATtiny45 MCU. Sleeps most of the day. Wake 4 | up by a gente touch. Eyes will glimmers, 5 | and cease shortly after. Find a way to 6 | control her mind, and reveal the hidden 7 | secret. https://skullctf.com/start 8 | -------------------------------------------------------------------------------- /skull-firmware/skull-firmware.ino: -------------------------------------------------------------------------------- 1 | /* 2 | ___________.__ ___________ .__ .__ 3 | \__ ___/| |__ ____ / _____/ | ____ __| | | | 4 | | | | | \_/ __ \ \_____ \| |/ / | \ | | | 5 | | | | Y \ ___/ / \ <| | / |_| |__ 6 | |____| |___| /\___ > /_______ /__|_ \____/|____/____/ 7 | \/ \/ \/ \/ 8 | A mind-bending hardware puzzle in three acts 9 | 10 | This firmware is released under an open-curse license. If you don't 11 | play fair, you'll be punished. 12 | 13 | https://skullctf.com/start 14 | 15 | FIRMWARE RELEASE v1.00 16 | 17 | Recommended soundtrack when reading the code: 18 | 19 | https://www.youtube.com/watch?v=Fku7hi5kI-c 20 | 21 | Copyright (C) 2020, Uri Shaked. 22 | 23 | */ 24 | 25 | #include 26 | #include 27 | #include 28 | 29 | const char flagflag[15] __attribute__((used)) EEMEM = "CTF{flag1 here}"; 30 | const uint8_t flagCheck __attribute__((used)) EEMEM = 0x2e; 31 | 32 | #define TOUCH_PIN 2 33 | #define LED1_PIN 3 34 | #define LED2_PIN 4 35 | 36 | #define CLK_PIN A2 37 | #define DIN_PIN A3 38 | 39 | const int firmwareRevision = 0x1; 40 | const int hypnosisDuration = 5000; 41 | 42 | void indicate(int8_t value) { 43 | for (; value > 0; value--) { 44 | digitalWrite(LED2_PIN, HIGH); 45 | delay(250); 46 | digitalWrite(LED2_PIN, LOW); 47 | delay(250); 48 | } 49 | } 50 | 51 | void spitByte(uint8_t value, int delayMs) { 52 | for (uint8_t b = 0; b < 8; b++) { 53 | digitalWrite(LED2_PIN, (value & bit(b)) ? HIGH : LOW); 54 | digitalWrite(LED1_PIN, HIGH); 55 | delay(delayMs / 2); 56 | digitalWrite(LED1_PIN, LOW); 57 | delay(delayMs / 2); 58 | } 59 | digitalWrite(LED2_PIN, LOW); 60 | } 61 | 62 | uint8_t crc8(uint8_t const message[], int nBytes) { 63 | static const uint8_t tbl[] PROGMEM = { 64 | 0, 213, 127, 170, 254, 43, 129, 84, 41, 252, 86, 131, 215, 2, 168, 125, 82, 135, 45, 248, 172, 121, 211, 6, 123, 174, 4, 209, 133, 80, 250, 47, 164, 113, 219, 14, 90, 143, 37, 240, 141, 88, 242, 39, 115, 166, 12, 217, 246, 35, 137, 92, 8, 221, 119, 162, 223, 10, 160, 117, 33, 244, 94, 139, 157, 72, 226, 55, 99, 182, 28, 201, 180, 97, 203, 30, 74, 159, 53, 224, 207, 26, 176, 101, 49, 228, 78, 155, 230, 51, 153, 76, 24, 205, 103, 178, 57, 236, 70, 147, 199, 18, 184, 109, 16, 197, 111, 186, 238, 59, 145, 68, 107, 190, 20, 193, 149, 64, 234, 63, 66, 151, 61, 232, 188, 105, 195, 22, 239, 58, 144, 69, 17, 196, 110, 187, 198, 19, 185, 108, 56, 237, 71, 146, 189, 104, 194, 23, 67, 150, 60, 233, 148, 65, 235, 62, 106, 191, 21, 192, 75, 158, 52, 225, 181, 96, 202, 31, 98, 183, 29, 200, 156, 73, 227, 54, 25, 204, 102, 179, 231, 50, 152, 77, 48, 229, 79, 154, 206, 27, 177, 100, 114, 167, 13, 216, 140, 89, 243, 38, 91, 142, 36, 241, 165, 112, 218, 15, 32, 245, 95, 138, 222, 11, 161, 116, 9, 220, 118, 163, 247, 34, 136, 93, 214, 3, 169, 124, 40, 253, 87, 130, 255, 42, 128, 85, 1, 212, 126, 171, 132, 81, 251, 46, 122, 175, 5, 208, 173, 120, 210, 7, 83, 134, 44, 249 65 | }; 66 | uint8_t r = 0; 67 | for (int i = 0; i < nBytes; ++i) { 68 | r = pgm_read_byte(tbl + (message[i] ^ r)); 69 | } 70 | return (r); 71 | } 72 | 73 | ISR(INT0_vect) { 74 | bitClear(GIMSK, INT0); // Disable INT0 interrupt 75 | sleep_disable(); 76 | } 77 | 78 | void sleep() { 79 | uint8_t oldAdc = ADCSRA; 80 | 81 | // Disable ADC - saves about 324.5uA in sleep mode! 82 | ADCSRA = 0; 83 | 84 | set_sleep_mode(SLEEP_MODE_PWR_DOWN); 85 | sleep_enable(); 86 | noInterrupts(); 87 | bitSet(GIMSK, INT0); // Enable INT0 interrupt 88 | interrupts(); 89 | sleep_cpu(); 90 | 91 | // Restore ADC 92 | ADCSRA = oldAdc; 93 | } 94 | 95 | void spell() { 96 | 97 | uint8_t*a,pc=16,sp=0, 98 | s[32]={0},op;while(!0){op= 99 | EEPROM.read(pc);switch(+op){case 100 | ',':delay(s[sp-1]);sp--;break;case'>': 101 | s[sp-1]>>=1|1;break;case'<':s[sp-1]<<=1; 102 | break;case'=':pc=s[sp-1]-1;sp--;break;case 103 | '@':if(s[sp-2]){s[sp-2]--;pc=s[sp-1]-1;sp+= 104 | 1;}sp-=2;break;case'&':s[sp-2]&=s[sp-1];sp-=1; 105 | break;case'|':s[sp-2]|=s[sp-1];sp-=1;break;case 106 | '^':s[sp-2]^=s[sp-1];sp--;break;case'+':s[sp-2]+= 107 | s[sp-1];sp=sp-1;break;case'-':s[sp-2]-=s[sp-1];sp--; 108 | break;case'2':s[sp]=s[sp-1];sp=sp+1;break;case'?':s[ 109 | sp-1]=EEPROM. read(s[sp-1]|0 );break;case 110 | "!!!"[0]: 666,EEPROM .write(s 111 | [sp-1] ,s[sp-2] );sp=+ 112 | sp-02; ;break; 1;case 113 | "Arr"[ 1]: s[+ sp-1]= 114 | *(char*) (s[+ sp-1 ]);break 115 | ;case'w':* (char*)( s[+sp-1]) =s[sp-+2]; 116 | sp-=2;break;case+ 'x':s[sp] =s[sp-1 117 | ];s[sp-1]=s[sp + -2];s[sp-2]=s[ 118 | 0|sp];break; ;; case"zzz"[0 119 | ]:sleep();" Arrr ";break;case 120 | 255 :return;; default:s [sp] 121 | =+ op;sp+= 1,1 ;}pc= 122 | + pc + 1; %> 123 | 124 | } 125 | 126 | void factoryTest() { 127 | uint8_t buf[sizeof(flagflag)]; 128 | eeprom_read_block(buf, &flagflag, sizeof(buf)); 129 | bool okay = crc8(buf, sizeof(buf)) == EEPROM[&flagCheck]; 130 | bool locked = boot_lock_fuse_bits_get(GET_LOCK_BITS) == 0xfc; 131 | digitalWrite(LED1_PIN, HIGH); 132 | digitalWrite(LED2_PIN, locked && okay ? HIGH : LOW); 133 | delay(1000); 134 | digitalWrite(LED1_PIN, LOW); 135 | digitalWrite(LED2_PIN, LOW); 136 | for (uint8_t i = 255; i >= 16; i--) { 137 | EEPROM.write(i, 0xff); 138 | } 139 | spitByte((firmwareRevision & 0x3f) | (okay << 7) | (locked << 6), 200); 140 | TCNT1 = (int)spell ^ (int)F("CTF{BonusFlagForTheBrave}"); 141 | delay(500); 142 | } 143 | 144 | void setup() { 145 | // Set most pins as output, saving power during sleep 146 | for (uint8_t i = 0; i <= 5; i++) { 147 | pinMode(i, i == TOUCH_PIN ? INPUT : OUTPUT); 148 | } 149 | 150 | if (!digitalRead(TOUCH_PIN)) { 151 | factoryTest(); 152 | } else { 153 | digitalWrite(LED1_PIN, HIGH); 154 | digitalWrite(LED2_PIN, HIGH); 155 | delay(50); 156 | digitalWrite(LED1_PIN, LOW); 157 | digitalWrite(LED2_PIN, LOW); 158 | } 159 | 160 | analogReference(INTERNAL1V1); 161 | DIDR0 |= (1 << ADC2D) | (1 << ADC3D); 162 | } 163 | 164 | int sample(uint8_t pin, int &minVal) { 165 | pinMode(pin, INPUT); 166 | delayMicroseconds(300); 167 | uint16_t result = 0; 168 | uint8_t samplesLeft = 4; 169 | for (; samplesLeft && result < 128; samplesLeft--) { 170 | result = analogRead(pin); 171 | } 172 | pinMode(pin, OUTPUT); 173 | delayMicroseconds(samplesLeft * 116); 174 | minVal = min(result, minVal); 175 | result -= minVal; 176 | return result; 177 | } 178 | 179 | int trackMax(int &maxVal, int value) { 180 | maxVal = max(value, maxVal); 181 | return value; 182 | } 183 | 184 | int lowPass(uint16_t &filter, int value) { 185 | filter -= filter >> 5; 186 | filter += value; 187 | return filter >> 5; 188 | } 189 | 190 | bool isAhoy() { 191 | uint8_t counter = 0; 192 | int lMin = INT16_MAX, lPeak = 0; 193 | int rMin = INT16_MAX, rPeak = 0; 194 | uint16_t lFilter = 0, rFilter = 0; 195 | bool rNext = false; 196 | 197 | for (int i = 0; i < 2200; i++) { 198 | if (!digitalRead(TOUCH_PIN)) { 199 | return false; 200 | } 201 | auto l = trackMax(lPeak, lowPass(lFilter, sample(CLK_PIN, lMin))); 202 | auto r = trackMax(rPeak, lowPass(rFilter, sample(DIN_PIN, rMin))); 203 | if (!rNext && l < lPeak / 8) { 204 | rNext = true; 205 | rPeak = 0; 206 | } 207 | if (rNext && r < rPeak / 8) { 208 | counter++; 209 | rNext = false; 210 | lPeak = 0; 211 | } 212 | } 213 | 214 | if (counter == 4) { 215 | return true; 216 | } 217 | 218 | if (counter > 2) { 219 | indicate(min(counter - 1, 9)); 220 | } 221 | 222 | return false; 223 | } 224 | 225 | void doIt(uint8_t cmd[16], uint8_t cmdLen) { 226 | if (cmdLen < 2) { 227 | indicate(2); 228 | return; 229 | } 230 | 231 | // Read 232 | if (cmdLen == 2) { 233 | uint8_t addr = cmd[0]; 234 | uint8_t speed = cmd[1] >> 4; 235 | uint8_t count = 1 + 2 * (cmd[1] & 0xf); 236 | for (uint8_t i = 0; i < count; i++) { 237 | spitByte(EEPROM.read((addr + i) & 0xff), 10 + speed * 33); 238 | } 239 | return; 240 | } 241 | 242 | // Write 243 | int crcValue = crc8(cmd, cmdLen - 1); 244 | if (crcValue != cmd[cmdLen - 1]) { 245 | indicate(3); 246 | return; 247 | } 248 | 249 | uint8_t addr = cmd[0]; 250 | if (addr < sizeof(flagflag) + 1){ 251 | indicate(4); 252 | return; 253 | } 254 | 255 | for (uint8_t i = 0; i < cmdLen - 2; i++) { 256 | EEPROM.write((addr + i) & 0xff, cmd[i + 1]); 257 | } 258 | indicate(1); 259 | } 260 | 261 | void mindBender() { 262 | for (uint8_t i = 0; i < 6; i++) { 263 | digitalWrite(LED1_PIN, i % 2 ? LOW : HIGH); 264 | delay(100); 265 | } 266 | 267 | int timeLeft = hypnosisDuration; 268 | int changeTime = 4; 269 | int lMin = INT16_MAX, lPeak = 0; 270 | int vMin = INT16_MAX, vPeak = 0; 271 | bool lastL = false; 272 | uint8_t sequence = 0; 273 | bool sequenceMatch = false; 274 | uint8_t buf[16]; 275 | int8_t bufIdx = 0; 276 | uint8_t cmdLen = 0; 277 | while (timeLeft-- && digitalRead(TOUCH_PIN)) { 278 | bool l = trackMax(lPeak, sample(CLK_PIN, lMin)) >= 4 + lPeak / 8; 279 | bool v = trackMax(vPeak, sample(DIN_PIN, vMin)) >= 4 + vPeak / 8; 280 | if (l != lastL) { 281 | changeTime = 0; 282 | lastL = l; 283 | } 284 | if (changeTime++ == 3) { 285 | sequence = (sequence << 1) | v; 286 | bufIdx++; 287 | if (!sequenceMatch) { 288 | sequenceMatch = (sequence & 0x7f) == 0b1001011; 289 | bufIdx = -4; 290 | } else { 291 | timeLeft = hypnosisDuration; 292 | if (bufIdx == 0) { 293 | cmdLen = sequence & 0xf; 294 | } else if (bufIdx % 8 == 0) { 295 | buf[bufIdx / 8 - 1] = sequence; 296 | if (bufIdx / 8 == cmdLen) { 297 | delay(500); 298 | doIt(buf, cmdLen); 299 | sequenceMatch = false; 300 | } 301 | } 302 | } 303 | } 304 | } 305 | } 306 | 307 | void loop() { 308 | sleep(); 309 | 310 | // Someone touched - Briefly wake up! 311 | int cnt = 0; 312 | while (!digitalRead(TOUCH_PIN)) { 313 | digitalWrite(LED1_PIN, HIGH); 314 | digitalWrite(LED2_PIN, HIGH); 315 | delay(100); 316 | digitalWrite(LED1_PIN, LOW); 317 | digitalWrite(LED2_PIN, LOW); 318 | delay(100); 319 | cnt++; 320 | } 321 | 322 | if (cnt > 10) { 323 | spell(); 324 | } 325 | 326 | if (isAhoy()) { 327 | mindBender(); 328 | } 329 | } 330 | -------------------------------------------------------------------------------- /skull-firmware/skull.nfo: -------------------------------------------------------------------------------- 1 | 2 | ▄▄▄█████▓ ██░ ██ ▓█████ ██████ ██ ▄█▀ █ ██ ██▓ ██▓ 3 | ▓ ██▒ ▓▒▓██░ ██▒▓█ ▀ ▒██ ▒ ██▄█▒ ██ ▓██▒▓██▒ ▓██▒ 4 | ▒ ▓██░ ▒░▒██▀▀██░▒███ ░ ▓██▄ ▓███▄░ ▓██ ▒██░▒██░ ▒██░ 5 | ░ ▓██▓ ░ ░▓█ ░██ ▒▓█ ▄ ▒ ██▒▓██ █▄ ▓▓█ ░██░▒██░ ▒██░ 6 | ▒██▒ ░ ░▓█▒░██▓░▒████▒ ▒██████▒▒▒██▒ █▄▒▒█████▓ ░██████▒░██████▒ 7 | ▒ ░░ ▒ ░░▒░▒░░ ▒░ ░ ▒ ▒▓▒ ▒ ░▒ ▒▒ ▓▒░▒▓▒ ▒ ▒ ░ ▒░▓ ░░ ▒░▓ ░ 8 | ░ ▒ ░▒░ ░ ░ ░ ░ ░ ░▒ ░ ░░ ░▒ ▒░░░▒░ ░ ░ ░ ░ ▒ ░░ ░ ▒ ░ 9 | ░ ░ ░░ ░ ░ ░ ░ ░ ░ ░░ ░ ░░░ ░ ░ ░ ░ ░ ░ 10 | ░ ░ ░ ░ ░ ░ ░ ░ ░ ░ ░ ░ ░ 11 | 12 | 13 | ∙-/\/-∙ WOKWI PROUDLY PRESENTS ∙-\/\-∙ 14 | 15 | ______________________________________ 16 | / \ \. 17 | | | |. 18 | \_ | T H E S K U L L |. 19 | | |. 20 | | |. 21 | | PLATFORM : ATtiny45 |. 22 | | VERSiON : 1.0 |. 23 | | PROTECTiON : Ancient Spell |. 24 | | PACKAGED BY : urish |. 25 | | SUPPLiED BY : CrowdSupply |. 26 | | DATE : 12-31-2020 |. 27 | | DiSK(S) : 1 (12kb) |. 28 | | |. 29 | | https://skullctf.com/start |. 30 | | |. 31 | | _____ |. 32 | | / \ |. 33 | | | () () | |. 34 | | \ ^ / |. 35 | | ||||| |. 36 | | ||||| |. 37 | | |. 38 | | _________________________________|___ 39 | | / /. 40 | \_/dc__________________________________/. 41 | 42 | --------------------------------------------------------------------------------