CRACK Solution

Spin Lock

CRACK bit-rotation + XOR cipher

In-game screenshot of Spin Lock
In-game view
FamilyCRACK Graph0.281 DifficultyEasy Ring03 IDz2_rot_xor

Prerequisites

Index XOR

Unlocks

FOLD COUNTCHECK DIGIT

Accepted input ROTATE7
Techniquebit-rotation + XOR cipher Rulenonzero SampleROTATE7

Walkthrough

Recover the accepted input below, then submit it to the CRACK verifier.

Reject Samples

  • ROTATE8
  • rotate7
  • SPINLCK
  • ROTAT7
  • ROTATE77
Verifier Listing
; z2_rot_xor: composed bit-rotation + XOR cipher, checked per position.
; Each input byte is scrambled by two steps before the compare: an 8-bit
; rotate-left by 3, then an XOR with the fixed key 0x2A. The scrambled byte is
; compared against a stored target at each of 7 positions. To crack it the
; player inverts both steps in reverse order (XOR back with 0x2A, then rotate
; right by 3) to recover the password ROTATE7. r0 = 1 on accept; rule: nonzero.
;
; This maps cleanly to the 8-bit core: the original was already byte-wise. The
; targets 0xB8 0x50 0x88 0x20 0x88 0x00 0x93 are rol8(c,3)^0x2A of "ROTATE7".

        len   r2
        cmp   r2, 7
        jnz   bad           ; fixed length 7

        mov   r7, 0         ; position index
loop:   cmp   r7, 7
        jge   ok            ; all 7 matched -> accept
        ldb   r0, [r7]      ; r0 = input[r7]
        rol   r0, 3         ; 8-bit rotate left by 3
        xor   r0, 0x2A      ; XOR with the fixed key

        ; select the target for this position
        cmp   r7, 0
        jz    t0
        cmp   r7, 1
        jz    t1
        cmp   r7, 2
        jz    t2
        cmp   r7, 3
        jz    t3
        cmp   r7, 4
        jz    t4
        cmp   r7, 5
        jz    t5
        mov   r1, 0x93      ; position 6
        jmp   chk
t0:     mov   r1, 0xB8
        jmp   chk
t1:     mov   r1, 0x50
        jmp   chk
t2:     mov   r1, 0x88
        jmp   chk
t3:     mov   r1, 0x20
        jmp   chk
t4:     mov   r1, 0x88
        jmp   chk
t5:     mov   r1, 0x00
chk:    cmp   r0, r1
        jnz   bad
        inc   r7
        jmp   loop

ok:     mov   r0, 1
        ret
bad:    mov   r0, 0
        ret