CRACK Solution

Two Keys

CRACK repeating four-byte XOR cipher

In-game screenshot of Two Keys
In-game view
FamilyCRACK Graph0.589 DifficultyMedium Ring04 IDz2_two_key

Prerequisites

THRESHOLD CLIP

Unlocks

COMMAND CHANNEL

Accepted input TWINKEY7
Techniquerepeating four-byte XOR cipher Rulenonzero SampleTWINKEY7

Walkthrough

Recover the accepted input below, then submit it to the CRACK verifier.

Reject Samples

  • TWINKEY8
  • twinkey7
  • TWINKEY
  • TWINKEY77
  • DUALKEYS
Verifier Listing
; z2_two_key: repeating four-byte XOR key (the additive layer the original
; folded into its compare targets is folded here too, so what remains is a clean
; cycling XOR). Length must be 8. Each position XORs the input byte with one of
; four key bytes that repeat every four positions: 0x13 0x37 0xC0 0xDE. The
; result is compared to a stored target. XOR is self-inverse, so the player
; recovers c = target XOR key[i mod 4]. Inverting the eight targets yields
; TWINKEY7. r0 = 1 on accept; rule: nonzero.
;
; Maps cleanly to the 8-bit core (byte-wise XOR). The key is held in SCRATCH[0..3]
; so the program indexes it with (i AND 3); targets sit in SCRATCH[4..11].
; Targets 0x47 0x60 0x89 0x90 0x58 0x72 0x99 0xE9 = key-XOR of "TWINKEY7".

        len   r2
        cmp   r2, 8
        jnz   bad

        ; lay the 4-byte key into scratch[0..3]
        mov   r0, 0x13
        mov   r1, 0
        stb   [r1], r0
        mov   r0, 0x37
        mov   r1, 1
        stb   [r1], r0
        mov   r0, 0xC0
        mov   r1, 2
        stb   [r1], r0
        mov   r0, 0xDE
        mov   r1, 3
        stb   [r1], r0

        ; lay the 8 targets into scratch[4..11]
        mov   r1, 4
        mov   r0, 0x47
        stb   [r1], r0
        inc   r1
        mov   r0, 0x60
        stb   [r1], r0
        inc   r1
        mov   r0, 0x89
        stb   [r1], r0
        inc   r1
        mov   r0, 0x90
        stb   [r1], r0
        inc   r1
        mov   r0, 0x58
        stb   [r1], r0
        inc   r1
        mov   r0, 0x72
        stb   [r1], r0
        inc   r1
        mov   r0, 0x99
        stb   [r1], r0
        inc   r1
        mov   r0, 0xE9
        stb   [r1], r0

        mov   r7, 0         ; position index 0..7
loop:   cmp   r7, 8
        jge   ok
        ldb   r0, [r7]      ; input byte

        ; key index = r7 AND 3
        mov   r3, r7
        and   r3, 3
        lds   r4, [r3]      ; key[i mod 4]
        xor   r0, r4

        ; target index = r7 + 4
        mov   r5, r7
        add   r5, 4
        lds   r6, [r5]      ; target[i]
        cmp   r0, r6
        jnz   bad
        inc   r7
        jmp   loop

ok:     mov   r0, 1
        ret
bad:    mov   r0, 0
        ret