CRACK Solution
Crossword
CRACK two-dimensional row + column parity
Prerequisites
Unlocks
MATRIXKEY
Techniquetwo-dimensional row + column parity
Rulenonzero
SampleMATRIXKEY
Walkthrough
Nine characters drop into a 3x3 grid, and the gate checks parity both across and down. Every square answers to one row and one column at once, so the answer has to satisfy the crossing constraints together.
Lay the nine bytes row by row. Each row parity is the XOR of its three bytes and each column parity is the XOR of its column; all six must match. Solve the across and down XOR targets simultaneously.
Hints
- HINT 1: Length is fixed at 9, read as three rows of three. Bytes 0,1,2 are the top row; 0,3,6 are the left column.
- HINT 2: A row check is byte XOR byte XOR byte across; a column check is byte XOR byte XOR byte down. Both directions are enforced.
- HINT 3: The grid that satisfies all six XOR targets spells MATRIXKEY row by row.
Reject Samples
- MATRIXKEX
- matrixkey
- MATRIXKE
- MATRIXKEYY
- MATRIXYEK
- PASSWORD9
Verifier Listing
; z7_grid_parity: "Crossword". The input is nine characters laid into a 3x3 grid
; in reading order (row 0 is bytes 0,1,2; row 1 is 3,4,5; row 2 is 6,7,8). The
; check folds the grid two ways: each ROW parity is the XOR of its three bytes, and
; each COLUMN parity is the XOR of its three bytes. All three row parities AND all
; three column parities must match stored targets. Because every byte sits in one
; row and one column, changing a single character breaks exactly one row check and
; one column check at once, which is the classic two-dimensional parity property.
; To crack it, fit characters into the grid so both the across and the down XORs
; line up. Technique: two-dimensional row + column parity. r0 = 1 on accept; rule:
; nonzero.
;
; grid "MATRIXKEY":
; row parities: 0x58 0x43 0x57 (M^A^T, R^I^X, K^E^Y)
; col parities: 0x54 0x4D 0x55 (M^R^K, A^I^E, T^X^Y)
len r2
cmp r2, 9
jnz bad ; a full 3x3 grid is nine characters
; --- row 0 parity = byte0 ^ byte1 ^ byte2 ---------------------
mov r1, 0
ldb r3, [r1]
mov r1, 1
ldb r0, [r1]
xor r3, r0
mov r1, 2
ldb r0, [r1]
xor r3, r0
cmp r3, 0x58
jnz bad
; --- row 1 parity = byte3 ^ byte4 ^ byte5 ---------------------
mov r1, 3
ldb r3, [r1]
mov r1, 4
ldb r0, [r1]
xor r3, r0
mov r1, 5
ldb r0, [r1]
xor r3, r0
cmp r3, 0x43
jnz bad
; --- row 2 parity = byte6 ^ byte7 ^ byte8 ---------------------
mov r1, 6
ldb r3, [r1]
mov r1, 7
ldb r0, [r1]
xor r3, r0
mov r1, 8
ldb r0, [r1]
xor r3, r0
cmp r3, 0x57
jnz bad
; --- col 0 parity = byte0 ^ byte3 ^ byte6 ---------------------
mov r1, 0
ldb r3, [r1]
mov r1, 3
ldb r0, [r1]
xor r3, r0
mov r1, 6
ldb r0, [r1]
xor r3, r0
cmp r3, 0x54
jnz bad
; --- col 1 parity = byte1 ^ byte4 ^ byte7 ---------------------
mov r1, 1
ldb r3, [r1]
mov r1, 4
ldb r0, [r1]
xor r3, r0
mov r1, 7
ldb r0, [r1]
xor r3, r0
cmp r3, 0x4D
jnz bad
; --- col 2 parity = byte2 ^ byte5 ^ byte8 ---------------------
mov r1, 2
ldb r3, [r1]
mov r1, 5
ldb r0, [r1]
xor r3, r0
mov r1, 8
ldb r0, [r1]
xor r3, r0
cmp r3, 0x55
jnz bad
mov r0, 1
ret
bad: mov r0, 0
ret