r2pipe solution to the r2frida crackme

r2solve.py

# Example run: https://asciinema.org/a/g6yChI5WgSWNRYfLaPfmUbnIt

import json
import r2pipe
from contextlib import redirect_stdout
import io

app = "r2con.2020.CrackMe"

print(f"Launching the app: {app}")
r2f = r2pipe.open(f"frida://spawn/usb//{app}")

print("Loading bypass1.js")
r2f.cmd("\\. bypass1.js; \\dc")

r2f.cmd("e anal.nopskip = false")
r2f.cmd(".\\init")
r2f.cmd(".\\ii*")
r2f.cmd(".\\is*")

# 0x102e685fc s -[FirstViewController getPassphrase]
offset_output = r2f.cmd("\\is~getPass")
getpass_offset = offset_output.split(" ")[0]

print("Creating passcode string on the heap")
# Stick the string passcode on the heap
string_ptr = r2f.cmd("\\dmas passcode")

print("Replacing the returned string of getPassphrase")
# Replace the return value of the getPassphrase function with our string
r2f.cmd(f"\\dis {getpass_offset} {string_ptr}")

print("Bypassing challenge 2")
r2f.cmd("s `\dm~CrackMe~r-x:0[0]`")
r2f.cmd(".\\e/")
opcodes = r2f.cmd("pa svc 0x80")
svc_hits = r2f.cmd(f"\\/x {opcodes}")

for s in svc_hits.split("\n"):
    s_hit = s.split(" ")[0]
    if "0x" in s_hit:
        print(f"nop and trace syscall @ {s_hit}")
        r2f.cmd(f"wao nop @ {s_hit}")
        r2f.cmd(f"\dtr $$ x0 @ {s_hit}")

input("Press any key to exit...")