> For the complete documentation index, see [llms.txt](https://0xsec.gitbook.io/0xsec/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://0xsec.gitbook.io/0xsec/ctf-writeups/2025-08-12-gameboy.md). # GameBoy (WHYCTF2025) ### Initial Analysis We initially got a .rar archive file and extracting ti gave a file named `chall.gb` which has extension of .gb which means its a GameBoy rom file So we likely have to find the flag from this rom file. For that i googled and found some GBA emulators with debugger but the one which i found useful was [mGBA](https://mgba.io/) as we can write into the memory using its debugger.I tried using `strings` but didn't found anything useful.Then i imported that rom into gba emulator to find how the game works and found out that we can only press keys `Right,Left,Up,Down,Multi(when multiple keys are pressed),A,B`.

Figure 1: mGBA

I found that we can use a plugin [GhidraBoy](https://github.com/Gekkio/GhidraBoy) by Gekkio to disassemble the rom file in ghidra so I added that to ghidra. ### Deep Dive I opened the challenge rom file in ghidra and clicked on analyze after that i got this view these initial lines of code are for initilisation of rom into gba.

Figure 2: Rom in Ghidra

When you scroll down you will find a function call `FUN_036b` which is main function of the game

Figure 3: Main Game Function

In the main game function the first thing i noticed was strings `Press START` and `NOW THE CHEAT PATTERN` and in the function `FUN_05e1` which they were used is most likely to the `printFunction` so rename it accordingly.

Figure 4: Main Game Function-1

There is another function in-between strings which is taking `0x80` as argument which is a loop for key inputs and also note the variable `uStack_f` which is storing `0xb<-->11` next things is analyze the do while loop there was a function `FUN_057e` which is `KeyInputFunction` and is stored in variable `local_5` .It then checks your input with `null` if you pressed a key or not, again there's a `FUN_0247` which converts the raw input data of gamepad from p1 register to readable button name. Then comes a nested if-statement which checks your InputKey/Button with the correct number of sequence `local_4` which was stored in `cStack_10` if its correct then it increments `local_4` by 1. It then checks if the `local_4` is equal to `0xb` if it satisfies then it calls `FUN_02c9` which is likely to be the `flagFunction` otherwise your correct\_sequence revert back to zero and this loop continues. ### Getting the flag Till now we have understood the working of the game rom and concluded if have to get the flag we have to set the `local_4` which no of correct sequence to `11 or 0xb`.Now its time to do it Open the mGBA emulator load the rom and open the debugger now we have to set the breakpoint where it increments the `local_4` which is at address `$03cc`

Figure 5: Setting Breakpoint

Now contniue the debugger and play the game untill you hit the breakpoint and do `dis` in order to confirm it.

Figure 6: Hitting Breakpoint

Do `next` and go to next instruction which loads the incremented value into `A` register and then do its comparision with the `0xb`. Now do `status` to check the current status of the registers and now we have to write `0xb` to the `HL` register to do it `w/1 hl 0x0b` which writes the `local_4` to 11 and continue. YOU GOT THE FLAG!!!!

Figure 5: Flag

Thanks For Reading