> For the complete documentation index, see [llms.txt](https://0xsec.gitbook.io/0xsec/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://0xsec.gitbook.io/0xsec/ctf-writeups/2025-08-12-gameboy.md). # GameBoy (WHYCTF2025) ### Initial Analysis We initially got a .rar archive file and extracting ti gave a file named `chall.gb` which has extension of .gb which means its a GameBoy rom file So we likely have to find the flag from this rom file. For that i googled and found some GBA emulators with debugger but the one which i found useful was [mGBA](https://mgba.io/) as we can write into the memory using its debugger.I tried using `strings` but didn't found anything useful.Then i imported that rom into gba emulator to find how the game works and found out that we can only press keys `Right,Left,Up,Down,Multi(when multiple keys are pressed),A,B`.

Figure 1: mGBA

I found that we can use a plugin [GhidraBoy](https://github.com/Gekkio/GhidraBoy) by Gekkio to disassemble the rom file in ghidra so I added that to ghidra. ### Deep Dive I opened the challenge rom file in ghidra and clicked on analyze after that i got this view these initial lines of code are for initilisation of rom into gba.

Figure 2: Rom in Ghidra

When you scroll down you will find a function call `FUN_036b` which is main function of the game

Figure 3: Main Game Function

In the main game function the first thing i noticed was strings `Press START` and `NOW THE CHEAT PATTERN` and in the function `FUN_05e1` which they were used is most likely to the `printFunction` so rename it accordingly.

Figure 4: Main Game Function-1

There is another function in-between strings which is taking `0x80` as argument which is a loop for key inputs and also note the variable `uStack_f` which is storing `0xb<-->11` next things is analyze the do while loop there was a function `FUN_057e` which is `KeyInputFunction` and is stored in variable `local_5` .It then checks your input with `null` if you pressed a key or not, again there's a `FUN_0247` which converts the raw input data of gamepad from p1 register to readable button name. Then comes a nested if-statement which checks your InputKey/Button with the correct number of sequence `local_4` which was stored in `cStack_10` if its correct then it increments `local_4` by 1. It then checks if the `local_4` is equal to `0xb` if it satisfies then it calls `FUN_02c9` which is likely to be the `flagFunction` otherwise your correct\_sequence revert back to zero and this loop continues. ### Getting the flag Till now we have understood the working of the game rom and concluded if have to get the flag we have to set the `local_4` which no of correct sequence to `11 or 0xb`.Now its time to do it Open the mGBA emulator load the rom and open the debugger now we have to set the breakpoint where it increments the `local_4` which is at address `$03cc`

Figure 5: Setting Breakpoint

Now contniue the debugger and play the game untill you hit the breakpoint and do `dis` in order to confirm it.

Figure 6: Hitting Breakpoint

Do `next` and go to next instruction which loads the incremented value into `A` register and then do its comparision with the `0xb`. Now do `status` to check the current status of the registers and now we have to write `0xb` to the `HL` register to do it `w/1 hl 0x0b` which writes the `local_4` to 11 and continue. YOU GOT THE FLAG!!!!

Figure 5: Flag

Thanks For Reading --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://0xsec.gitbook.io/0xsec/ctf-writeups/2025-08-12-gameboy.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.