kevinthomas's dc540-0x0000a

Author:
kevinthomas

Language:
Assembler

Upload:
2026-10-31 15:48

Download

Platform:
Unspecified/other

Difficulty:
5.5

Quality:
3.0

Arch:
ARM

Downloads:
79

Size:
32.65 KB

Writeups:
0

Comments:
10

Description

Bare-metal ARM Cortex-M33 (RP2350) firmware, no OS, XIP from flash at 0x10000000, Thumb-2. The image drives a WS2812 LED ring and runs a fake Linux shell over UART0 at 115200 8N1 (or emulate it). Every string and response is ChaCha20-Poly1305 sealed; the game is a 100-record encrypted command table behind a memory-hard scrypt-lite KDF. Find the three missing fragments, assemble the key, and scorch the serpent. The machine prints nothing that gives itself away. The flag sits inside curly braces: it begins with {th3_s3rp3nt_sl33ps_n0_m0r3 but does not end there. The machine will confirm the whole when the serpent sleeps no more. SOLVES: 0

Labels ?

String / data encryption XOR AES (encryption) Substitution / table Self-modifying / runtime decrypt Crypto / hash algorithm Other / custom hash Code virtualization / VM Control-flow obfuscation State machine / dispatcher Anti-disassembly Junk / garbage bytes Anti-tamper / integrity Custom / generic obfuscation

Comments (10)
Writeups (0)

You must be logged in to post a comment

arshi on 2026-10-31 18:41: [Click to reveal]

kevinthomas on 2026-10-31 18:47: Hi @arshi great start! What you posted is the prefix the node tells everyone. The real FLAG line is much more than that.

arshi on 2026-11-01 12:57: @kevinthomas The binary only gives the flag prefix, the full flag requires three 71 byte fragments and the first seems to require external Stage One/badge data. Can you confirm if another artifact or the physical badge is needed? I'm asking for the point to start, not the answer.

kevinthomas on 2026-11-01 13:38: @arshi the bin yields only the prefix as the three 71-char fragments are not in the binary however no physical badge or other artifact is needed as the bin and the lore solves it statically. The first word is tied to the first badge's story not its files. Research dc540-0x0000a as additional clues will be posted over time. Look at social media, etc...

arshi on 2026-11-01 14:58: @kevinthomas I’ve decrypted the accessible records, reproduced the KDF/ChaCha path, and confirmed the three 71-byte fragment gates and 215-byte final-key layout. I’ve also located the first badge’s published story, but no candidate has authenticated yet. By ‘first word,’ do you mean Fragment 1’s opening word, directly present in that story?

kevinthomas on 2026-11-01 15:47: @arshi The first word is not present in the first badge's published story, which is exactly why none of your candidates authenticate. The connection is thematic: the machine says 'the faithful already know the first word,' but the actual 71-character fragment lives in the challenge's own lore channel, not in Stage One's files. Your reconstruction is confirmed correct: the 3x71 fragment gates, the 215-byte final key, the KDF/ChaCha path, all of it. You're at the exact wall the challenge intends, because the words have not been released yet. Watch dc540-0x0000a and the social channels. The clues drop over time, and the first word will reach the faithful before the others.

arshi on 2026-11-01 16:15: @kevinthomas Could you please post an update here when the words start dropping? I’ll keep the verified pipeline ready and resume as soon as you post.

kevinthomas on 2026-11-01 16:20: @arshi absolutely! This challenge is designed to be different than the normal REA solve in 10 seconds. I designed this to bring back the real challenge of solving a very complex binary that has pieces fused with encryption that forces you to have solutions off the badge. This sort of technique will likely be used going forward in industry to stop the GPT's from trivially reversing literally everything so a product can have a chance at real security. Who knows, maybe I am wrong but that is what this challenge is. I appreciate someone like you @arshi who is working hard to get at the real challenge and ask legit questions based on real barriers. As I am ready to slowly drop clues I will post a hint here but it will be some other social media outlet to really build out the challenge.

TrynaToBe6for6Def on 2026-11-01 18:03: A lot of bugs but i found this : CMO{th3_s3rp3nt_sl33ps_n0_m0r3}

kevinthomas on 2026-11-01 18:55: @TrynaToBe6for6Def Thanks for giving it a shot! Just to clarify, what may appear as bugs in the binary is actually the intentional obfuscation and anti-analysis design working exactly as intended to make this a brutal wall. Also, the string you posted is just the prefix I openly shared in the challenge description above. The true flag requires decrypting the rest using the three missing fragments. Keep an eye out for the upcoming lore drops if you want to tackle the actual puzzle!

Show all spoilers

You must be logged in to submit a writeup

crackmes.one

crackmes.one

kevinthomas's dc540-0x0000a