defcon badge bruteforce

defcon18ninjacrack.c

#include <stdio.h>
#include <mach/std_types.h>
#include <stdlib.h>

#define TUMBLERS_PER_IMAGE		15

typedef enum {
  DEFCON,
  EIGHTEEN, // * 0xE38 + 16¢
  BADGE,
  BY,
  JOEGRAND,
  AKA,
  KINGPIN,
  USB,
  NINJA
} badge_state_type;

typedef enum {
  TOP = 0,
  MIDDLE = 1,
  BOTTOM = 2
} tumbler_state_type;

int dc18_ninja_validate(uint32_t val) {
  uint16_t a, b;
  a = (uint16_t)(val & 0xfff);
  b = (uint16_t)(val >> 12);
  if((a ^ b) == 0x916) {   
    return 1;
  }   
  return 0;
}

tumbler_state_type  gTumblers[TUMBLERS_PER_IMAGE];  // setting of each tumbler

void incr_tumblers1(tumbler_state_type *tumblers, uint16_t count) {
  if(count == 0) {
    /* we're at the top now, nothing left to increment. */
    printf("Can't increment anymore\n");
    exit(1);
  } else if(tumblers[count-1] == TOP || tumblers[count-1] == MIDDLE) {
    tumblers[count-1] += 1;
  } else if(tumblers[count-1] == BOTTOM) {
    tumblers[count-1] = TOP;
    incr_tumblers1(tumblers, count-1);
  }
}

void incr_tumblers(tumbler_state_type *tumblers) {
  incr_tumblers1(tumblers, TUMBLERS_PER_IMAGE);
}

void print_tumbler_state(tumbler_state_type *tumblers) {
  int i=0;
  for(i=0;i<TUMBLERS_PER_IMAGE;i++) {
    switch(tumblers[i]) {
    case TOP:
      printf("top ");
      break;
    case MIDDLE:
      printf("middle ");
      break;
    case BOTTOM:
      printf("bottom ");
      break;
    default:
      printf("bad ");
      break;
    }
  }
  printf("\n");
}

int valid_tumblers(tumbler_state_type *tumblers) {
  int i=0;
  for(i=0;i<TUMBLERS_PER_IMAGE;i++) {
    switch(tumblers[i]) {
    case TOP:
    case MIDDLE:
    case BOTTOM:
      break;
    default:
      return 0;
      break;
    }
  }
  return 1;
}

// encode tumbler states into 24-bit value
uint32_t dc18_encode_tumblers(tumbler_state_type *tumblers) {
    uint32_t x = 0, j = 1;
    uint16_t i;

    for(i = 0; i < TUMBLERS_PER_IMAGE; i++) {
        x += tumblers[i] * j;
        j *= 3;
    }

    return x;
}

int main() {
  tumbler_state_type tumblers[TUMBLERS_PER_IMAGE] = { TOP, TOP, TOP,
                                                      TOP, TOP, TOP,
                                                      TOP, TOP, TOP,
                                                      TOP, TOP, TOP,
                                                      TOP, TOP, TOP };

  while(1) {
    uint32_t encoded = dc18_encode_tumblers(tumblers);

    if(dc18_ninja_validate(encoded)) {
      printf("got (%u) ", encoded);
      print_tumbler_state(tumblers);
    }
    
    incr_tumblers(tumblers);
  }
}