You’re the sheriff of a small town, investigating news about a gangster squad passing by. Rumor has it they’re easy to outsmart, so you have just followed one to their encampment by the river. You know you can easily take them out one by one, if you would just know their secret handshake..
$file gunpoint_2daf5fe3fb236b398ff9e5705a058a7f.dat gunpoint_2daf5fe3fb236b398ff9e5705a058a7f.dat: Gameboy ROM: "FLUX", [ROM ONLY], ROM: 256Kbit
Nice, a gameboy ROM. Searching for
gameboy emulator gets us Visual Boy Advance as the first result. We need to change the extension to
gbc to be able to open the file in the emulator. After running the game for some time or doing
options->emulator->speed up toggle, we get:
So probably we need to guess the secret key combination. Fortunately emulator has also dissasembler and IDA is also able to dissaseble the code. Here is some thorough description of Gameboy hardware. The most interesting part is here:
If we go to
Tools->Dissasemble then we have a fairly good chance we land up in the code that is almost the same. (If not press
Next few times) We can see that the result of the key presses are stored in addresses
C0A2. Counter at address
C0A0 is increased each time we press the correct key. Using
Tools->Memory viewer we can see when we press the correct key. The sequence is
up, left, down, right, up, left, down, right, B, B A, A.
Flag is tkCXDJheQDNRN
###Other write-ups and resources