re300 - SVATTT 2015 CTF

re300-solver.c

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <stdint.h>

int dword_804B16C, dword_804B170, dword_804B174, dword_804B178, dword_804B17C, dword_804B180; 

int pos = 0;
int v11;
int v12;
int v13;
int v14;
int v141;
int v15;
int v16[30] = {};

void generateRandom(int seed)
{
	int i;
	srand(4919 * seed);
	v11 = rand();
	v12 = rand();
	v13 = rand();
	v14 = rand();
	v141 = rand();
	v15 = rand();

	for(i = 0; i < 30; i++) {
		v16[i] = rand();
	}
}

char sub_8048AFD()
{
	dword_804B16C = ((((unsigned int)((uint64_t)v11 >> 32) >> 28) + (unsigned char)v11) & 0xF)
	- ((unsigned int)((uint64_t)v11 >> 32) >> 28);

	return ((((unsigned int)((uint64_t)v11 >> 32) >> 28) + (unsigned char)v11) & 0xF)
	- ((unsigned int)((uint64_t)v11 >> 32) >> 28);
}


char sub_8048B3A()
{
	dword_804B170 = ((((unsigned int)((uint64_t)v12 >> 32) >> 28) + (unsigned char)v12) & 0xF)
	- ((unsigned int)((uint64_t)v12 >> 32) >> 28);
	return (8 * dword_804B16C % (unsigned int)dword_804B170);
}


char sub_8048B82()
{
	dword_804B174 = ((((unsigned int)((uint64_t)v13 >> 32) >> 28) + (unsigned char)v13) & 0xF)
	- ((unsigned int)((uint64_t)v13 >> 32) >> 28);

	return (((unsigned char)dword_804B170 + (unsigned char)dword_804B16C + (char)v13 % 16) & 0xF);
}

char sub_8048BCC()
{
	char v2; // bl@1

	dword_804B178 = ((((unsigned int)((uint64_t)v14 >> 32) >> 28) + (unsigned char)v14) & 0xF)
	- ((unsigned int)((uint64_t)v14 >> 32) >> 28);
	v2 = dword_804B16C - dword_804B174;
	return ((v2 + (unsigned char)v141) & 0xF);
}


char sub_8048C1D()
{
	int v2; // eax@4
	unsigned int v3; // ebx@4
	int v4; // eax@4


	dword_804B17C = ((((unsigned int)((uint64_t)v15 >> 32) >> 28) + (unsigned char)v15) & 0xF)
	- ((unsigned int)((uint64_t)v15 >> 32) >> 28);
	
	pos = dword_804B17C;

	v2 = v16[pos++];

	v3 = ((((unsigned int)((uint64_t)v2 >> 32) >> 30) + (unsigned char)v2) & 3)
	- ((unsigned int)((uint64_t)v2 >> 32) >> 30);

	v4 = v16[pos++];

	return ((((unsigned int)((uint64_t)(signed int)(v4 % 5 * v3) >> 32) >> 28)
		+ (unsigned char)(v4 % 5) * (unsigned char)v3) & 0xF)
	- ((unsigned int)((uint64_t)(signed int)(v4 % 5 * v3) >> 32) >> 28);
}


char sub_8048CB9()
{
	unsigned int v2; // ebx@4

	unsigned int v1 = v16[pos++];

	dword_804B180 = ((((unsigned int)((uint64_t)v1 >> 32) >> 28) + (unsigned char)v1) & 0xF)
	- ((unsigned int)((uint64_t)v1 >> 32) >> 28);
	
	pos += dword_804B180;

	v2 = dword_804B178 * ((dword_804B16C << dword_804B170) / (unsigned int)dword_804B174);

	return (((unsigned char)(v16[pos] % 5) * (unsigned char)v2 - dword_804B17C % 7u / (dword_804B180 & 0xFu)) & 0xF);
}


int main(int argc, char *argv[])
{
	int token = strtoul(argv[1], 0, 16);
	char a1, a2, a3, a4, a5, a6;
	
	generateRandom(token);

	a1 = sub_8048AFD();
	a2 = sub_8048B3A();
	a3 = sub_8048B82();
	a4 = sub_8048BCC();
	a5 = sub_8048C1D();
	a6 = sub_8048CB9();

	printf("%d %d %d %d %d %d\n", a1, a2, a3, a4, a5, a6);
	return 0;
}