Fools2022 notes

WRITEUP

👉👉 https://stranck.ovh/writeups/data/fools2022/ 👈👈

For barille
https://twoblindbrothers.com/pages/braille

Map https://radixan.github.io/zzazz-world-viewer-2018/

Cavern puzzle

Random cavern up left

Sign left: finally you will become femboy

Tree down: once entered walk tweny steps total BEFORE TALKING

Rock up: go to hole in the fence five times

North responses:

Math problem

Sorry for the pasta moment
A 200km ad ovest di B
A va verso nord a 85km/h
Dopo 2h, B va verso est a 90km/h
Dopo 5 ore dalla partenza di A, quanti km distano?
Approssima il risultato


It’s 633 damn you geogebra approssimation

REWARDS

North: surf
south: cut
east: strength
west: teleport

Needed:
South: strength
West: teleport

Game corner bottom right more lucky

Pokeballs



I think there’s one ball out of these list. Not sure tho

Lost land paths

EENN
NESE
ENSS
NSEE

Are those the same from 2018? Can’t find them anymore

Pokemon survey

NNY, obtained by just trying all the possibitilies. Gave Nugget

Shifting Grove

Press one time the bottom center, two times the upper right

THree switches at south

Bottom, top, center

Cavern translaion

SOUT:
disa

TF does it means???

WEST:
trendy phrase

AFTER DARK CAVE
lettuce

Found in alternate caves:

hope
ster
less

Yeet!

LESSGOOOOO

Move the rocks (?)

SLide


MFs solving yeet challs

Wordle:

Never played wordle before, going back using the old mastermind tactics
ABCDE = -----
FGHIJ = -----
KLMON = --y–
PQRST = —yy
UVWXY = y—g
ZZZZY = ----g
MSTUY = gyyyg
MUTSY = ggyyg
MUSTY = ggggg

ABCDE = ----g
FGHIJ = -----
KLMNO = ----y
PQRST = --y-y
UVWXY = -y—
ORTVE = ygygg
TROVE = ggggg

Delirian questions

Boy that plays the flute is in the south? YES
The map of the designer has 5 signs? YES
Is the east the smaller region? NO
Crosslands has people standing? NO
Is deliria in south? NO (west iirc)
in north they ask to guess pokémons. Is any of them a grass type? YES
Alternative caves has 3 forms? YES
There are 3 “yet another map”? NO (5 iirc)
the person in boardhord asking about a star is a girl? YES
in current library are there 14 bookshelf? YES
In all north towns are there 5 houses? NO
Are there 3 people in the trendy house? YES
is there any mon in the houses of south? NO

Out of sight of our minds

TODO:

TODO: -
DONE: *

Addresses

3005e5e 203760 203764 xy coordinates
0x808af15 check collision routin. set $R4=0

CC3

ScriptContext
InitScriptContext -> 08098CB8 -> get cmd table ptr
SetupBytecodeScript -> 08098CF4 -> get script ptr

Scripts:
sScriptContext1: 03000E40 AAAAA we’re using this!
sScriptContext2: 03000EB8
Script at 0x020182c2

var = ???? //No idea del valore iniziare
for(int i = 0; i < input.length; i++){
  var += COSTANTS[i];
  var += input[i];
  var += var * MULTIPLIERS[i];
}

After a while, 8003 = 8001 (var), and var = CONST. At the end we check var2= 0xb0ef and var1 = 0xd4b9
0xea
0xdf
0xe0
0xc0
0xd1
0xb7
0xd0
0xed
0xc2
0xda

https://github.com/pret/pokeemerald/search?p=1&q=GetVarPointer
https://github.com/pret/pokeemerald/blob/eca5233abe83a074ce97f9e47b30eb0c0f430a9e/src/scrcmd.c
https://github.com/pret/pokeemerald/blob/a7e6045d71d2d21c4fa5a494d112c6b38226eaec/data/script_cmd_table.inc
https://github.com/pret/pokeemerald/blob/677b4fc394516deab5b5c86c94a2a1443cb52151/include/script.h
https://github.com/pret/pokeemerald/blob/e0fae879da1b773bf90fca145e047ccdb7613938/src/script.c

Cool passwords:

bepis + writeable chars

0xbc
0xbf
0xca
0xc3
0xe7
0xa9
0xe5
0xe3
0xce
0xee

amogus + not writeable chars

0xbb
0xe1
0xc9
0xdb
0xcf
0xcd
0xdf
0x12
0x83
0x2a

CC4

https://pastebin.com/EkzDbNGK

The encrypt/decrypt size ratio is almost 4
More or less
The response from server is 67 bytes, the request is 260
I can assume the response data really is 64 bytes and the request data 256

Response: authority=CrackerFour/serial=7499209/holder=Aelita/type=silverÿ

Request looks like a base64 data that translates to raw, followed by other raw data. The first base64 block is, after decoding, 64 bytes long, as well as our request. The second block is long 168 bytes

0x020186D0

Map script at 0x0203e332
Talk script at 0x020182b5

Two certs decrypted Aelita/Celita:

21 32 27 a7 e8 5c 4b 07 cf d8 2e 6b bd 30 32 ca 03 1e 25 1c 94 37 1d 43 cd bf eb a1 fe 18 63 bf f5 4e eb 03 ab b9 34 8a d0 de 62 fe fa e3 bf 56 4f 38 0d 59 7e d2 29 22 67 43 6c 85 43 d0 b0 39
21 32 27 a7 e8 5c 4b 07 cf d8 2e 6b bd 30 32 ca 03 f2 a2 55 81 a5 19 13 01 3c be dc dc 9c 0f c9 dc 5c aa c8 75 fe 70 27 90 d7 62 01 a8 dd f8 bd 1e 7d 6f e3 e6 16 e9 3a 4d a7 4a e2 cc ef a9 26

First 34 16 bytes are the same

Other certs: (Generated by: holder=typeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeE/type=silver & co)

hold_last_e: 213227a7e85c4b07cfd82e6bbd3032ca 5142447d658212463844e71456befc6de092bd730cbb729b3abe973e9a0acc99fe643ff5a7c668395c5fadccf702d9ebe1c56d9a553d5f30830bb47c901bf21c7859d2c511588ba363ea102ccb93da1eff4abb25e581d760f620f3f37ed0e7ae3f1de8b64108bd6e6509cbd02e72f0455680e2f050d58af2232c01696ea8b2cb0c8eb746a08f836c04edec905d94ccf0903a0100fd4173c6442354cbe499f6fa
hold_last_E: 213227a7e85c4b07cfd82e6bbd3032ca 25ddbdf7376c6a71c7bf85cc64aaa08b4941a4462a9b9351653d9ff168ec1d156f662b7f2d3762a98425c4778d2cf891e0708db1040248d83d225a7083f60d1c4206b75375f26aaf245007ac5d2845ea319c2a6c786e64329ad803eb6a08c921003c161840d15592417c9140d1858bba2d2c724aff7e9bb86cecb552d40e5e72effe23a6f70bfc7ca14e1e96d5f57d7a0bd2eb5fbab2b5f1f843b2194eb07533
hold_firs_e: 213227a7e85c4b07cfd82e6bbd3032ca 4f6c000cd8adf7af818fbc293fc8e4c97776eb39e08b6aa70fd98fa50bd4bc5202397afcba9edb50bbf8fea884ab70007a1c47b09d58df415cabc18994890fc503077ebc5d4a53a57b8fae40e72cc7b5c91c883a49177b2bb4ed55d7ff672e8c42fa77f2f20110cf5a8135b205db612c74dbd607495e2bffdb63002541f67977b55ff368080b8f7ba8154d641ac0101b81a6233b441cae8c275ab760469951b9
hold_firs_E: 213227a7e85c4b07cfd82e6bbd3032ca 9121ccb22dd39110e37f1ae0cc2ebc771560fbef2732c28023dbfbb038f03046a907fc9f505beb07bd29f84774faf1e91634f7da9ed3821c07a7fa22db355f87c3d144950ed0ba99176f1e27e97c63fe9ada159a654b8ab84553d03c3bf093b4e31daf0d3d73aebe2fda83bc18f667bfe5b236a27de36c12cf9e453363d0d182dfc10d5103f15ff6caee530a7808e6c55b789cb528620e91c0cd6275d7ad2380

Editing the first common bytes of the certificate breaks stuff.
Code:

sub_index = 13
certificate = certificate[:sub_index - 1] + b"\x00" + certificate[sub_index:]

Response:

RESP b64:     TgAAAGVycm9yPTEvZGVzYz1EaXJlY3RpdmUgd2l0aCBtb3JlIHRoYW4gMSB2YWx1ZS9hdXRob3JpdHk9Q3JhY2tlckZvdXI=
RESP DECODED: b'N\x00\x00\x00error=1/desc=Directive with more than 1 value/authority=CrackerFour'

Note that the error code is INSIDE the classic response packet that should be passed to the gameboy
With sub_index = 6 it gives me: b'N\x00\x00\x00error=1/desc=Invalid key i@%\x92b{\xc7\xab,\x83\xdf\x8f6\xae\x1e\xc5rFoursserial/authority=CrackerFour' (TgAAAGVycm9yPTEvZGVzYz1JbnZhbGlkIGtleSBpQCWSYnvHqyyD3482rh7FckZvdXJzc2VyaWFsL2F1dGhvcml0eT1DcmFja2VyRm91cg==)

Craft packets:

Generate: 
07000000
XXXXXXXXXXXXXXXXXXXX
ffc04600000000

Validate:
08000000
XXXXXXXXXXXXXXXXXXXXXXXXXX
0000000217018037121200c71d020213006587010217018000001200da75030213008c8701021200db75030213008d8701021601800000160280a3001701800000180280010021028000000605898701021701805f121200c81d02021300b287010217018000001200da7503021300d98701021200db7503021300da870102160180000016028067001701800000180280010021028000000605d68701021701807b101200c91d

This packet: type=silver/holder=silver\xffgol= returns FoolsDescriptiveProcessingError('directive without value or with multiple values')

Rn i’m crying and trying editing the cert generated by this payload holder=typeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeE/type=silver/test=aaaaaaaaaaaaaaaaaa. I have no idea why this is working. Really.

It somehow worked. No no no no no fucking clue

Protocol

GENERATE:
1) –> Client asks (25 bytes) the server to generate a cert for given name and type (Apprantly, can’t change directly to gold). Request buffer is at 0x20186d0
2) <– Server responds with a b64-encoded crypted certificate (89 encoded 64 decoded bytes long) (NOTE that there are two layers of b64 encoding, since all packets are already base64 encoded). Receiving buffer is at 0x20186f4

VALIDATE:
3) –> Client sends the b64-enc certificate received previously followed by 167 bytes of junk data after the end of receiving buffer (Total packet length: 0x104)
4) <– Server respondes with the original (1) string prepended with cert authority and cert serial

EXAMPLE PACKETS:

Name: Celita

  1. –> BwAAAGhvbGRlcj1DZWxpdGEvdHlwZT1zaWx2ZXL/wEYIAAAA
  2. <– SVRJbnAraGNTd2ZQMkM1cnZUQXl5Z1B5b2xXQnBSa1RBVHkrM055Y0Q4bmNYS3JJZGY1d0o1RFhZZ0dvM2ZpOUhuMXY0K1lXNlRwTnAwcml6TytwSmc9Pf8=
  3. –> CAAAAElUSW5wK2hjU3dmUDJDNXJ2VEF5eWdQeW9sV0JwUmtUQVR5KzNOeWNEOG5jWEtySWRmNXdKNURYWWdHbzNmaTlIbjF2NCtZVzZUcE5wMHJpek8rcEpnPT3/AAAAAhcBgDcSEgDHHQICEwBlhwECFwGAAAASANp1AwITAIyHAQISANt1AwITAI2HAQIWAYAAABYCgKMAFwGAAAAYAoABACECgAAABgWJhwECFwGAXxISAMgdAgITALKHAQIXAYAAABIA2nUDAhMA2YcBAhIA23UDAhMA2ocBAhYBgAAAFgKAZwAXAYAAABgCgAEAIQKAAAAGBdaHAQIXAYB7EBIAyR0=
  4. <– UwAAAGF1dGhvcml0eT1DcmFja2VyRm91ci9zZXJpYWw9NTA3NjAwOS9ob2xkZXI9Q2VsaXRhL3R5cGU9c2lsdmVy/w==

Name: Aelita

  1. –> BwAAAGhvbGRlcj1BZWxpdGEvdHlwZT1zaWx2ZXL/wEYAAAAA
  2. <– SVRJbnAraGNTd2ZQMkM1cnZUQXl5Z01lSlJ5VU54MUR6Yi9yb2Y0WVk3LzFUdXNEcTdrMGl0RGVZdjc2NDc5V1R6Z05XWDdTS1NKblEyeUZROUN3T1E9Pf8=
  3. –> CAAAAElUSW5wK2hjU3dmUDJDNXJ2VEF5eWdNZUpSeVVOeDFEemIvcm9mNFlZNy8xVHVzRHE3azBpdERlWXY3NjQ3OVdUemdOV1g3U0tTSm5RMnlGUTlDd09RPT3/AAAAAhcBgDcSEgDHHQICEwBlhwECFwGAAAASANp1AwITAIyHAQISANt1AwITAI2HAQIWAYAAABYCgKMAFwGAAAAYAoABACECgAAABgWJhwECFwGAXxISAMgdAgITALKHAQIXAYAAABIA2nUDAhMA2YcBAhIA23UDAhMA2ocBAhYBgAAAFgKAZwAXAYAAABgCgAEAIQKAAAAGBdaHAQIXAYB7EBIAyR0=
  4. <– UwAAAGF1dGhvcml0eT1DcmFja2VyRm91ci9zZXJpYWw9MjQyOTkzMy9ob2xkZXI9QWVsaXRhL3R5cGU9c2lsdmVy/w==

Odd stuff

Tested so far:

Stuff

Profile after the last achievment! :D