CRACK Solution

Set Bits

CRACK population count

In-game screenshot of Set Bits
In-game view
FamilyCRACK Graph0.598 DifficultyMedium Ring04 IDz3_popcount

Prerequisites

PEAK FILTER

Unlocks

VECTOR CLOCK

Accepted input POPCNT88
Techniquepopulation count Rulenonzero SamplePOPCNT88

Walkthrough

Recover the accepted input below, then submit it to the CRACK verifier.

Reject Samples

  • POPCNT89
  • QOPCNT88
  • AAAAAAAA
  • POPCNT8
  • POPCNT888
Verifier Listing
; z3_popcount: "Set Bits". The check ignores the VALUES of your bytes and
; looks only at how many bits each one has set. An inner shift-and-add-low-bit
; loop counts ones per byte (population count); the required counts per position
; are {2,5,2,3,4,3,3,3}. Two positions are pinned to exact characters so the
; intended answer resolves to one word. Technique: population count / Hamming
; weight. Fits the 8-bit core cleanly. r0 = 1 on accept. Accept rule: nonzero.
;
; sample "POPCNT88": 'P' pinned, popcounts 5 2 3 4 3 3, '8' pinned.
;
; The eight required counts are staged into scratch[0..7] up front, then a single
; popcount loop walks the input and compares each byte's set-bit count to its slot.

        len   r2
        cmp   r2, 8
        jnz   bad           ; exactly 8 bytes

        ; --- stage the per-position target counts into scratch -------------
        mov   r0, 2
        mov   r1, 0
        stb   [r1], r0      ; scratch[0] = 2  (overridden by the 'P' pin below)
        mov   r0, 5
        mov   r1, 1
        stb   [r1], r0      ; scratch[1] = 5
        mov   r0, 2
        mov   r1, 2
        stb   [r1], r0      ; scratch[2] = 2
        mov   r0, 3
        mov   r1, 3
        stb   [r1], r0      ; scratch[3] = 3
        mov   r0, 4
        mov   r1, 4
        stb   [r1], r0      ; scratch[4] = 4
        mov   r0, 3
        mov   r1, 5
        stb   [r1], r0      ; scratch[5] = 3
        mov   r0, 3
        mov   r1, 6
        stb   [r1], r0      ; scratch[6] = 3
        mov   r0, 3
        mov   r1, 7
        stb   [r1], r0      ; scratch[7] = 3  (overridden by the '8' pin below)

        ; --- pin position 0 to 'P' (0x50) and position 7 to '8' (0x38) ------
        mov   r7, 0
        ldb   r0, [r7]
        cmp   r0, 0x50
        jnz   bad
        mov   r7, 7
        ldb   r0, [r7]
        cmp   r0, 0x38
        jnz   bad

        ; --- popcount each byte and compare to its target count ------------
        mov   r7, 1         ; positions 1..6 are gated by popcount (0 and 7 pinned)
ploop:  cmp   r7, 7
        jge   ok
        ldb   r6, [r7]      ; r6 = input[r7]
        mov   r3, 0         ; r3 = set-bit count
        mov   r4, 8         ; 8 bits to inspect
bits:   cmp   r4, 0
        jz    cmpc
        mov   r5, r6
        and   r5, 1         ; low bit
        add   r3, r5        ; count += low bit
        shr   r6, 1
        dec   r4
        jmp   bits
cmpc:   lds   r1, [r7]      ; r1 = required count for this position
        cmp   r3, r1
        jnz   bad
        inc   r7
        jmp   ploop

ok:     mov   r0, 1
        ret
bad:    mov   r0, 0
        ret