106 lines
2.8 KiB
JavaScript
106 lines
2.8 KiB
JavaScript
// NOTE: most of the code here used to reference into constants,
|
|
// but I have rewritten it to use literals directly.
|
|
|
|
const constants = [
|
|
'copy_char',
|
|
'value',
|
|
'207aLjBod',
|
|
'1301420SaUSqf',
|
|
'233ZRpipt',
|
|
'2224QffgXU',
|
|
'check_flag',
|
|
'408533hsoVYx',
|
|
'instance',
|
|
'278338GVFUrH',
|
|
'Correct!',
|
|
'549933ZVjkwI',
|
|
'innerHTML',
|
|
'charCodeAt',
|
|
'./check_flag.wasm',
|
|
'result',
|
|
'977AzKzwq',
|
|
'Incorrect!',
|
|
'exports',
|
|
'length',
|
|
'getElementById',
|
|
'1jIrMBu',
|
|
'input',
|
|
'615361geljRK',
|
|
];
|
|
|
|
const get_const = function(addr, _seemingly_unused) {
|
|
addr = addr - 0xc3;
|
|
let result = constants[addr];
|
|
return result;
|
|
};
|
|
|
|
// Stack aligner of some sort?
|
|
(function() {
|
|
while (!![]) {
|
|
try {
|
|
const result =
|
|
-parseInt(get_const(0xc8)) * -parseInt(get_const(0xc9))
|
|
+ -parseInt(get_const(0xcd))
|
|
+ parseInt(get_const(0xcf))
|
|
+ parseInt(get_const(0xc3))
|
|
+ -parseInt(get_const(0xc6)) * parseInt(get_const(0xd4))
|
|
+ parseInt(get_const(0xcb))
|
|
+ -parseInt(get_const(0xd9)) * parseInt(get_const(0xc7));
|
|
|
|
if (result === 0x4bb06) break;
|
|
else constants['push'](constants['shift']());
|
|
} catch (_0x4f8a) {
|
|
constants['push'](constants['shift']());
|
|
}
|
|
}
|
|
}());
|
|
|
|
let exports;
|
|
|
|
// Load the WebAssembly module and get its exports
|
|
(async () => {
|
|
let checkFlagWasm = await fetch('./check_flag.wasm'),
|
|
arrayBufferResult = await WebAssembly['instantiate'](await checkFlagWasm['arrayBuffer']()),
|
|
arrayBufferResultInstance = arrayBufferResult['instance'];
|
|
exports = arrayBufferResultInstance['exports'];
|
|
})();
|
|
|
|
function onButtonPress() {
|
|
let value = document['getElementById']('input')['value'];
|
|
const copy_char = exports['copy_char'];
|
|
|
|
for (let i = 0x0; i < value['length']; i++) {
|
|
const char_code = value['charCodeAt'](i);
|
|
copy_char(char_code, i);
|
|
}
|
|
|
|
exports['copy_char'](0x0, value['length']), exports['check_flag']() == 0x1
|
|
? document['getElementById']('result')['innerHTML'] = 'Correct!'
|
|
: document['getElementById']('result')['innerHTML'] = 'Incorrect!';
|
|
}
|
|
|
|
// Reverse engineered from check_flag.wat
|
|
// func3, i.e. copy_char
|
|
|
|
// function func3(var0, var1) {
|
|
// global0 = 0x10500;
|
|
// var2 = global0;
|
|
// var3 = 0x10;
|
|
// var4 = (var2 - var3);
|
|
// store(var4 + 12, var0);
|
|
// store(var4 + 8, var1);
|
|
// var5 = load(var4 + 12);
|
|
// if (var5 != 0) {
|
|
// var6 = load(var4 + 12);
|
|
// var7 = 0x8;
|
|
// var8 = (var6 ^ var7);
|
|
// store(var4 + 12, var8);
|
|
// }
|
|
// var9 = load(var4 + 12);
|
|
// var10 = load(var4 + 8);
|
|
// store(0x430, (var10 & 0xFF));
|
|
// return;
|
|
// }
|
|
|
|
// It seems like copy_char xors all characters with 0x8 before transferring them?
|