PATCH Solution

LOCKRING VM

PATCH ARC bytecode VM repair

FamilyPATCH Graph0.890 DifficultyHard Ring05 IDzp26_lockring_vm

Prerequisites

CHECKSUM

Unlocks

Fletcher Gate Tiny Machine

Patch choices bc1op=2 bc1arg=0x11 bc2arg=3 bc3op=4 guardfix=jnz | bc1op=2 bc1arg=0x11 bc2arg=3 bc3op=4 guardfix=jg

Accepted keysLOCKRING Editable slots5 Rulenonzero

Walkthrough

The dispatch loop is intact, but the embedded bytecode image is not. Patch the opcode and operand bytes that define the VM transform, then fix the compare guard.

Do not patch the dispatcher until the program bytes make sense. Decode each opcode pair, rebuild the intended transform, and only then judge the final branch.

Valid Patch Combos

bc1op=2 bc1arg=0x11 bc2arg=3 bc3op=4 guardfix=jnz
bc1op=2 bc1arg=0x11 bc2arg=3 bc3op=4 guardfix=jg

Reject Battery

LOCKRIN
LOCKRINGX
AOCKRING
LOCKRINX
lockring
GNIRKCOL

Editable Slot Options

bc1op: 4, 2, 1, 3
bc1arg: 0x2A, 0x11, 0x2D, 0x28
bc2arg: 5, 3, 0x3F, 0x1A
bc3op: 1, 4, 2, 3
guardfix: jz, jnz, jg, jl

Broken Listing

; LOCKRING VM: PATCH job. A tiny bytecode program transforms each input
; byte before the compare. The editable slots are in the bytecode image
; and in the final guard, not in the verdict block.

        len   r2
        cmp   r2, 8
        jnz   bad

        mov   r1, 0
bc0op: mov   r0, 1
        stb   [r1], r0
        inc   r1
bc0arg: mov   r0, 0x5A
        stb   [r1], r0
        inc   r1
bc1op: mov   r0, 4
        stb   [r1], r0
        inc   r1
bc1arg: mov   r0, 0x2A
        stb   [r1], r0
        inc   r1
bc2op: mov   r0, 3
        stb   [r1], r0
        inc   r1
bc2arg: mov   r0, 0x05
        stb   [r1], r0
        inc   r1
bc3op: mov   r0, 1
        stb   [r1], r0
        inc   r1
bc3arg: mov   r0, 0x27
        stb   [r1], r0
        inc   r1
bcstop: mov   r0, 0
        stb   [r1], r0

        mov   r7, 0
outer:  cmp   r7, 8
        jge   ok
        ldb   r3, [r7]
        mov   r6, 0
vmloop: lds   r4, [r6]
        cmp   r4, 0
        jz    vmdone
        mov   r5, r6
        inc   r5
        lds   r5, [r5]
        cmp   r4, 1
        jz    op_xor
        cmp   r4, 2
        jz    op_add
        cmp   r4, 3
        jz    op_rol
        cmp   r4, 4
        jz    op_sub
        cmp   r4, 5
        jz    op_ror
        jmp   vmadv
op_xor: xor   r3, r5
        jmp   vmadv
op_add: add   r3, r5
        jmp   vmadv
op_rol: rol   r3, r5
        jmp   vmadv
op_sub: sub   r3, r5
        jmp   vmadv
op_ror: ror   r3, r5
vmadv:  add   r6, 2
        jmp   vmloop

vmdone:
        cmp   r7, 0
        jz    t0
        cmp   r7, 1
        jz    t1
        cmp   r7, 2
        jz    t2
        cmp   r7, 3
        jz    t3
        cmp   r7, 4
        jz    t4
        cmp   r7, 5
        jz    t5
        cmp   r7, 6
        jz    t6
        mov   r1, 0x4A      ; position 7
        jmp   chk
t0:     mov   r1, 0x12
        jmp   chk
t1:     mov   r1, 0x0A
        jmp   chk
t2:     mov   r1, 0x2A
        jmp   chk
t3:     mov   r1, 0xEA
        jmp   chk
t4:     mov   r1, 0xA1
        jmp   chk
t5:     mov   r1, 0xFA
        jmp   chk
t6:     mov   r1, 0x02
        jmp   chk
chk:    cmp   r3, r1
guardfix: jz    bad
        inc   r7
        jmp   outer

ok:     mov   r0, 1
        ret
bad:    mov   r0, 0
        ret