I am having trouble figuring out this microcorruption challenge in the link below: https://microcorruption.com/debugger/Halifax
Basically, the 0x7f interrupt has been disabled so I must reenable it before inserting a payload that will call it. The program says I need to call the 0x41 interrupt with the 16byte key that is stored in secure memory, which I seemingly don't have access to.
My main issue is that when I call the 0x41 interrupt, I am not sure which argument I need to supply the pointer to the password into. The second issue is, since I'm not sure I'm supplying the password into the correct argument, I am also unsure I have found the password at all.
Things I know: The sha256_internal calls the 0x41 interrupt as well, so I have tried to emulate this with my payloads. When I insert 0x1000 as the second argument (into r14 when using sha256_internal) it gives me the encryption that the program printed out to the screen. When I change that number, the encryption changes. Each time I reset the CPU, all of these encryptions change (except for when I insert 0x0, in which case the sha256 encryption of an empty string is outputted). The max number I can put in is 0x1000, into this argument, as well as into the third argument, and if I exceed 0x1000 then the "Exceeded SRAM length" exception is thrown.
Things I have tried:
-forcing the pc to restart all the instructions from the initialization of the program, but after having overwritten the instructions for disabling the interrupt. This didn't work since apparently after the interrupt is disabled, it can only be reenabled by using the 0x41 interrupt with the password.
-I have tried to insert the parts of the internal SRAM hash they keep printing to the screen, its 32bytes and the password is only 16bytes, but unsurprisingly this hasn't worked since its just a hash of the password which doesn't seem to be very useful.
An example payload I inserted:
8000 refers to where the payload will be written to to be run later
60 refers to the length of the payload (I made a large length so I wouldn't have to set it every time)
301210473012e043301200103012000030124100 is for pushing all the arguments of the interrupt onto the stack. Here I tried putting the password address as a 5th argument instead
b0125045 is for calling the INT function to carry out the interrupt
30124445 is to push the address I want to go back to after my payload is about to finish
3041 return to the address I just pushed so the program can receive another payload
My biggest problem is that I am unsure if I am inserting the password tries into the right argument, so even if I have found the password, I am not sure it is being entered. I keep putting in a pointer to it as the third argument (into r15 in sh256_internal), but it seems wrong since this argument also has a length limit of 0x1000.
Any suggestions, hints, new things to try would be much appreciated.