Skip to content

Instantly share code, notes, and snippets.

View celophi's full-sized avatar

Chris Harris celophi

  • Chico, CA
View GitHub Profile

Keybase proof

I hereby claim:

  • I am celophi on github.
  • I am celophi (https://keybase.io/celophi) on keybase.
  • I have a public key whose fingerprint is D133 4BE4 0A2F 6697 38C8 7F01 F03C E668 7615 9449

To claim this, I am signing this object:

[Colors]
AbstractTableViewBackgroundColor=#FFF8F0
AbstractTableViewHeaderTextColor=#000000
AbstractTableViewSelectionColor=#C0C0C0
AbstractTableViewSeparatorColor=#808080
AbstractTableViewTextColor=#000000
DisassemblyAddressBackgroundColor=#XXXXXX
DisassemblyAddressColor=#808080
DisassemblyAutoCommentBackgroundColor=#XXXXXX
DisassemblyAutoCommentColor=#555555
param (
[Parameter(Mandatory=$true)]
[String]
$HostList,
[Parameter(Mandatory=$true)]
[String]
$FilePath,
[Parameter(Mandatory=$false)]
function Expand-Bytes {
param (
[Parameter(
Mandatory=$true,
ValueFromPipeline=$true)]
$bytes
)
$outstream = New-Object System.IO.MemoryStream
$ms = [System.IO.MemoryStream]::New($bytes)
MSPD
RHPTIME
INT
CON
STR
DEX
MNA
Permission
Lv
MaxSta
// Melia
// Database file
//---------------------------------------------------------------------------
[
// Swordsman
//---------------------------------------------------------------------------
{ 1001 :
{
defaultSkills : [ Default, Normal_Attack, Normal_Attack_TH, Warrior_Guard, War_JustFrameAttack, War_JustFrameDagger, War_JustFramePistol, Common_shovel, Common_otlflag, Common_dumbbell, Common_vuvuzela, Common_snowspray, Common_balloonpipe, Pistol_Attack],
Flare-On 2018 challenge #6 - Magic
==================================
It's not much, but this is how I brute forced the problem.
Starting at 0x00402F0C (with .text starting at 0x00400AD0), I patched code with the following bytes.
0: c6 45 bb 00 mov BYTE PTR [rbp-0x45],0x0 // The third function has a static variable used in the CRC table that needs to be reset.
4: 48 8b 07 mov rax,QWORD PTR [rdi] // Move our key into a register so we can work with it.
7: 3c 7e cmp al,0x7e // Anything above 127 in ASCII is not going to be part of the key, so need to rollover bits.
9: 0f 85 0f 00 00 00 jne 0x1e // If not 127, just increment normally.

Keybase proof

I hereby claim:

  • I am celophi on github.
  • I am celophi (https://keybase.io/celophi) on keybase.
  • I have a public key ASC16sHPT5FH_I5Fj2iSrTDvNnNREgRj-pOw13wHrlQr_Qo

To claim this, I am signing this object: