PATCH Solution
SPIN COUNT
PATCH wrong rotate amount
Prerequisites
Unlocks
spin=3
Accepted keysSPIN
Editable slots1
Rulenonzero
Walkthrough
The decode rotates each byte the wrong number of bit positions, so every byte lands a few bits off the stored targets. Only the marked rotate count can move. Find the single distance that lines every byte up with its target, then TEST.
The same rotate distance applies to every byte, so test the targets as a set, not one at a time. The right distance is the one that maps all four key bytes onto all four targets together.
Valid Patch Combos
- spin=3
Reject Battery
- SPIM
- SPIT
- XPIN
- SPI
- SPINN
Editable Slot Options
- spin: 1, 3, 5, 7
Broken Listing
; SPIN COUNT: a PATCH job. Each byte is decoded by ROTATING it right a fixed
; number of bit positions, then compared to a stored target. The rotate direction
; and the targets are right; the DISTANCE is wrong, so every byte lands a few bits
; off and nothing matches. Only the marked rotate count (label "spin") is yours to
; edit; the target table and the verdict are frozen.
;
; The real key is SPIN. The same distance applies to every byte, so the correct
; distance is the one that lines all four bytes up with their targets at once.
;
; r0 = 1 on accept; rule: nonzero. SHIPPED count is 5, which spins the bits to the
; wrong place and bounces the real key.
len r2
cmp r2, 4
jnz bad
mov r7, 0
loop: cmp r7, 4
jge ok
ldb r0, [r7]
spin: ror r0, 5 ; SHIPPED BROKEN: wrong distance -> find the count that lines up
cmp r7, 0
jz t0
cmp r7, 1
jz t1
cmp r7, 2
jz t2
mov r1, 0xC9 ; target for position 3
jmp chk
t0: mov r1, 0x6A
jmp chk
t1: mov r1, 0x0A
jmp chk
t2: mov r1, 0x29
jmp chk
chk: cmp r0, r1
jnz bad
inc r7
jmp loop
ok: mov r0, 1
ret
bad: mov r0, 0
ret