PATCH Solution

BACKDOOR KILL

PATCH backdoor removal

In-game screenshot of BACKDOOR KILL
In-game view
FamilyPATCH Graph0.334 DifficultyMedium Ring02 IDzp5_backdoor

Prerequisites

Even/Odd KeysFRAMER

Unlocks

PEAK SELECT

Patch choices master=nop
Accepted keysUSER Editable slots1 Rulenonzero

Walkthrough

The normal key is valid, but an old maintenance key still reaches the verdict. Only the marked opcode can move. Remove the backdoor without breaking the real key.

The master-key branch is not the real check. Let that path fall through into the normal validator, then confirm the real key still reaches the verdict.

Valid Patch Combos

  • master=nop

Reject Battery

  • ROOT
  • ROOS
  • ROOU
  • USES
  • USERX
  • AAAA

Editable Slot Options

  • master: jz, nop, jmp, jg
Broken Listing 
; BACKDOOR KILL: PATCH job. A master key path jumps to the verdict before the
; normal key can prove itself. Only the marked opcode is editable.
;
; The real key is USER. ROOT is an old maintenance key and must be rejected.

        len   r2
        cmp   r2, 4
        jnz   bad

        mov   r7, 0
        ldb   r0, [r7]
        cmp   r0, 0x52
        jnz   legit
        mov   r7, 1
        ldb   r0, [r7]
        cmp   r0, 0x4F
        jnz   legit
        mov   r7, 2
        ldb   r0, [r7]
        cmp   r0, 0x4F
        jnz   legit
        mov   r7, 3
        ldb   r0, [r7]
        cmp   r0, 0x54
master: jz    good

legit:  mov   r7, 0
        ldb   r0, [r7]
        cmp   r0, 0x55
        jnz   bad
        mov   r7, 1
        ldb   r0, [r7]
        cmp   r0, 0x53
        jnz   bad
        mov   r7, 2
        ldb   r0, [r7]
        cmp   r0, 0x45
        jnz   bad
        mov   r7, 3
        ldb   r0, [r7]
        cmp   r0, 0x52
        jnz   bad

good:   mov   r0, 1
        ret
bad:    mov   r0, 0
        ret