论坛 › 卫星无线电安全::『Satellite, radio security』 › 【卫星安全系列二】HAS-BUS赛题复现

admin 发表于 2024-3-1 21:14:49

【卫星安全系列二】HAS-BUS赛题复现

<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
        <b>题目介绍：<span lang="EN-US"></span></b>
</p>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
        <span lang="EN-US">There's&nbsp;a&nbsp;very&nbsp;busy&nbsp;bus&nbsp;we've&nbsp;tapped&nbsp;a&nbsp;port&nbsp;onto,surely&nbsp;there&nbsp;is&nbsp;some&nbsp;juicy&nbsp;information&nbsp;hidden&nbsp;in&nbsp;the&nbsp;device&nbsp;memory...somewhere...</span>
</p>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
        <b>环境搭建<span lang="EN-US"></span></b>
</p>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
        先从<span lang="EN-US">GitHub</span>上拉取题目：<span lang="EN-US">https://github.com/cromulencellc/hackasat-qualifier-2020</span>题目文件夹结构大致如下<span lang="EN-US"></span>
</p>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
        <a href="https://ctfiot.oss-cn-beijing.aliyuncs.com/uploads/2023/12/1-1701421040.png"><img width="553" height="424" src="http://cobjon.com/w/php/upload/202403/01/3836fe5f.png" alt="HAS-BUS赛题复现" style="vertical-align:middle;" /></a>
</p>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
        题目采用了<span lang="EN-US">docker</span>来搭建环境，其中<span lang="EN-US">challenge</span>是题目文件夹，<span lang="EN-US">solver</span>是解题文件夹，分别都存在一个<span lang="EN-US">Dockerfile</span>来生成对应的镜像。一般来说我们复现时，直接执行如下命令对环境进行测试。由于该系列题目是<span lang="EN-US">2020</span>年的，可能搭建环境时存在某些问题，在本题当中没有遇到，后续遇到时再给出对应的方法。<span lang="EN-US"></span>
</p>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
        <span lang="EN-US">sudo&nbsp;make&nbsp;build<br />
sudo&nbsp;make&nbsp;test</span>
</p>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
        <a href="https://ctfiot.oss-cn-beijing.aliyuncs.com/uploads/2023/12/9-1701421041.png"><img width="554" height="143" src="http://cobjon.com/w/php/upload/202403/01/9cd166bc.png" alt="HAS-BUS赛题复现" style="vertical-align:middle;" /></a>
</p>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
        如上图则环境搭建成功复现时，我们只需要使用如下命令启动<span lang="EN-US">challenge</span>的服务即可<span lang="EN-US"></span>
</p>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
        <span lang="EN-US">socat&nbsp;-v&nbsp;tcp-listen:31340,reuseaddr&nbsp;exec:"docker&nbsp;run&nbsp;--rm&nbsp;-i&nbsp;-e&nbsp;SEED=1234&nbsp;-e&nbsp;FLAG=flag{skIpn1MnWtBC1DkTFhKBO8yMofVTRU8qUuMxc52jzss1XrnNva6Td2Ex84XJZCoNa6RQKoFYhKPNItMpHtocOxD}&nbsp;&nbsp;bus:challenge"</span>
</p>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
        之后使用<span lang="EN-US">nc</span>连接服务指定的<span lang="EN-US">ip</span>和端口即可<span lang="EN-US"></span>
</p>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
        <a href="https://ctfiot.oss-cn-beijing.aliyuncs.com/uploads/2023/12/3-1701421041.png"><img width="554" height="250" src="http://cobjon.com/w/php/upload/202403/01/c000e5c4.png" alt="HAS-BUS赛题复现" style="vertical-align:middle;" /></a>
</p>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
        当我们<span lang="EN-US">nc</span>连接上去以后，看见一系列的字符，书上的解释是说这是<span lang="EN-US">I²C</span>协议，学过<span lang="EN-US">I²C</span>的不知道能看出来不<span lang="EN-US"></span>
</p>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
        <b>相关背景知识<span lang="EN-US"></span></b>
</p>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
        <b><span lang="EN-US">I²C</span>协议简单了解<span lang="EN-US"></span></b>
</p>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
        <span lang="EN-US">I²C</span>仅仅使用两条线在连接到总线的设备间传输信息，一条为串行数据线<span lang="EN-US">(SDA)</span>，另一条为<span lang="EN-US">(SCL)</span>。总线上的地址由唯一地址区分。通常<span lang="EN-US">I²C</span>在硬件设备中作为传感器接口和<span lang="EN-US">EEPROM</span>存储器的接口使用。<span lang="EN-US">I²C</span>协议的基础信号有四种，分别是起始信号<span lang="EN-US">(START)</span>、停止信号<span lang="EN-US">(STOP)</span>、应答信号<span lang="EN-US">(ACK)</span>和非应答信号<span lang="EN-US">(NAK)</span>。<span lang="EN-US"></span>
</p>
<ul style="margin-top:0cm;" type="disc">
        <li style="font-family:等线;font-size:10.5pt;margin:0cm;tab-stops:list 36.0pt;text-align:justify;text-justify:inter-ideograph;">
                <span lang="EN-US">START</span>信号和<span lang="EN-US">STOP</span>信号都由主设备产生。所有信号以<span lang="EN-US">START</span>信号开始，以<span lang="EN-US">STOP</span>信号结束。<span lang="EN-US">START</span>信号和<span lang="EN-US">STOP</span>信号之间的时间认为<span lang="EN-US">I²C</span>总线处于忙碌<span lang="EN-US">(busy)</span>阶段。<span lang="EN-US"></span>
        </li>
        <li style="font-family:等线;font-size:10.5pt;margin:0cm;tab-stops:list 36.0pt;text-align:justify;text-justify:inter-ideograph;">
                <span lang="EN-US">I²C</span>有着完善的应答机制，每个字节后面必须跟一个<span lang="EN-US">ACK</span>信号或者<span lang="EN-US">NAK</span>信号。<span lang="EN-US"></span>
        </li>
</ul>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
        通信格式<span lang="EN-US"></span>
</p>
<ul style="margin-top:0cm;" type="disc">
        <li style="font-family:等线;font-size:10.5pt;margin:0cm;tab-stops:list 36.0pt;text-align:justify;text-justify:inter-ideograph;">
                由于<span lang="EN-US">START</span>和<span lang="EN-US">STOP</span>是主设备发出的，所在<span lang="EN-US">START</span>后的<span lang="EN-US">7bit</span>是从设备地址，然后有<b><span lang="EN-US">1bit</span>的读<span lang="EN-US">/</span>写标志位</b>，该标志位说明了主设备要对从设备进行读<span lang="EN-US">(“1”)</span>或者写<span lang="EN-US">(“0”)</span>操作，如果对应的从设备在总线上，那该从设备将以<span lang="EN-US">ACK</span>信号应答。<span lang="EN-US"></span>
        </li>
</ul>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
        向某个设备写入数据如下图：<span lang="EN-US"></span>
</p>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
        <a href="https://ctfiot.oss-cn-beijing.aliyuncs.com/uploads/2023/12/5-1701421042.png"><img width="554" height="225" src="http://cobjon.com/w/php/upload/202403/01/e0e622f6.png" alt="HAS-BUS赛题复现" style="vertical-align:middle;" /></a>
</p>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
        从某个设备读取数据<span lang="EN-US"></span>
</p>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
        <a href="https://ctfiot.oss-cn-beijing.aliyuncs.com/uploads/2023/12/6-1701421043.png"><img width="554" height="209" src="http://cobjon.com/w/php/upload/202403/01/2f466def.png" alt="HAS-BUS赛题复现" style="vertical-align:middle;" /></a>
</p>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
        同时应为主办方在设计题目时，将<span lang="EN-US">flag</span>的长度作为一个有意义的变量参数参与了读取<span lang="EN-US">EEPROM</span>的内容计算，而<span lang="EN-US">EEPROM</span>的大小是有限的，所以可能会出现以下情况<span lang="EN-US">(</span>这里参考源码<span lang="EN-US">)</span>
</p>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
        <a href="https://ctfiot.oss-cn-beijing.aliyuncs.com/uploads/2023/12/8-1701421043.png"><img width="553" height="191" src="http://cobjon.com/w/php/upload/202403/01/9af18318.png" alt="HAS-BUS赛题复现" style="vertical-align:middle;" /></a>
</p>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
        当<span lang="EN-US">Flag</span>的内容过长时，则<span lang="EN-US">flag</span>前后的内存空间显然会变小，这时候将要<b>读取的内容的范围</b>很可能与<span lang="EN-US">flag</span>的范围重叠，因此可能会造成<span lang="EN-US">Flag</span>的泄露。<span lang="EN-US"></span>
</p>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
        <b>分析解题<span lang="EN-US"></span></b>
</p>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
        <b>解法一：<span lang="EN-US"></span></b>
</p>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
        将<span lang="EN-US">nc</span>连上去的产生的回显信息中的特殊符号<span lang="EN-US">”+^.”</span>去掉，然后将十六进制转换为<span lang="EN-US">ASCII</span>字符串。得到如下<span lang="EN-US"></span>
</p>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
        <a href="https://ctfiot.oss-cn-beijing.aliyuncs.com/uploads/2023/12/2-1701421044.png"><img width="554" height="293" src="http://cobjon.com/w/php/upload/202403/01/a6debfde.png" alt="HAS-BUS赛题复现" style="vertical-align:middle;" /></a>
</p>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
        可以看见包含<span lang="EN-US">flag</span>字符串，将这些字符串拼接去掉重复的有几率可以得到正确的<span lang="EN-US">flag</span>。<span lang="EN-US"></span>
</p>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
        <b>解法二<span lang="EN-US"></span></b>
</p>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
        对回显信息进行分析，发现都是以<span lang="EN-US">^</span>和<span lang="EN-US">.</span>来区分数据的。那么认为<span lang="EN-US">”<b>^</b>“</span>就是<span lang="EN-US">I²C</span>的<span lang="EN-US">START</span>信号，而<span lang="EN-US">”<b>.</b>“</span>就是<span lang="EN-US">I²C</span>的<span lang="EN-US">STOP</span>信号<span lang="EN-US">,</span>那么我们按照前面的分析对回显进行分析。<span lang="EN-US"></span>
</p>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
        <span lang="EN-US">^82+00+00+1f+00+00+00+12+47+40+41+c6+97+e1+3f+89+81+3f+c1+99+1d+a1+c0+20+18+a1+40+5e+42+ac+3c+.<br />
^83+00+00+3f+.<br />
^82+00+00+3f+00+00+00+20+fa+3f+41+c8+da+e2+3f+a6+64+3f+c1+ff+33+a1+c0+a4+d2+a0+40+de+50+55+40+.<br />
^b4+01+a9+94+c7+59+78+58+87+6b+d3+8e+04+be+2a+47+d4+cc+f8+6e+6c+26+67+a6+98+5e+4a+75+69+63+79+20+44+61+74+61+20+30+33+.<br />
^83+00+00+1f+.<br />
^82+00+00+1f+00+00+00+1d+ec+3f+41+d8+04+e5+3f+67+4e+40+c1+38+1b+a1+c0+e1+dd+a0+40+b9+91+91+3c+.</span>
</p>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
        我们知道<span lang="EN-US">”<b>^</b>“</span>信号是<span lang="EN-US">START</span>信号，则紧跟其后的一个字节为从设备地址以及<span lang="EN-US">1bit</span>的读写标志位，发现所有的<span lang="EN-US">”<b>^</b>“</span>之后只有<span lang="EN-US">0x82</span>、<span lang="EN-US">0x83</span>、<span lang="EN-US">0xb4 3</span>种情况，将其的读写位和地址位分开则有如下<span lang="EN-US"></span>
</p>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
        <b><span lang="EN-US">“</span></b><span lang="EN-US"></span>
</p>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
        这里一开始我本来是怀疑这个从设备地址书上是不是写错了，看了源码之后发现，在源码中它会将我们输入的第一个字节作为设备地址跟<span lang="EN-US">0xfe</span>进行<span lang="EN-US">AND</span>操作，发现它的确实地址就是<span lang="EN-US">0x82</span>、<span lang="EN-US">0x83</span>以及<span lang="EN-US">0xb4</span>
</p>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
        <b><span lang="EN-US">”</span></b><span lang="EN-US"></span>
</p>
<table border="0" cellpadding="0" cellspacing="0" width="735" style="border-collapse:collapse;font-family:等线;font-size:10.5pt;width:551.25pt;" class="ke-zeroborder">
        <thead>
                <tr>
                        <td style="background:#DBD9D8;border:solid #CCCCCC 1.0pt;padding:6.0pt 9.0pt 6.0pt 9.0pt;">
                                <p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
                                        <b><span style="color:black;">第一个字节</span><span lang="EN-US"></span></b>
                                </p>
                        </td>
                        <td style="background:#DBD9D8;border:solid #CCCCCC 1.0pt;border-left:none;padding:6.0pt 9.0pt 6.0pt 9.0pt;">
                                <p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
                                        <b><span style="color:black;">从设备地址</span><span lang="EN-US"></span></b>
                                </p>
                        </td>
                        <td style="background:#DBD9D8;border:solid #CCCCCC 1.0pt;border-left:none;padding:6.0pt 9.0pt 6.0pt 9.0pt;">
                                <p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
                                        <b><span style="color:black;">读<span lang="EN-US">/</span>写标志位</span><span lang="EN-US"></span></b>
                                </p>
                        </td>
                        <td style="background:#DBD9D8;border:solid #CCCCCC 1.0pt;border-left:none;padding:6.0pt 9.0pt 6.0pt 9.0pt;">
                                <p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
                                        <b><span lang="EN-US" style="color:black;">I²C</span><span style="color:black;">语义</span><span lang="EN-US"></span></b>
                                </p>
                        </td>
                </tr>
        </thead>
        <tbody>
                <tr>
                        <td style="background:white;border:solid #CCCCCC 1.0pt;border-top:none;padding:6.0pt 9.0pt 6.0pt 9.0pt;">
                                <p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
                                        <span lang="EN-US" style="color:black;">0x82</span><span lang="EN-US"></span>
                                </p>
                        </td>
                        <td style="background:white;border-bottom:solid #CCCCCC 1.0pt;border-left:none;border-right:solid #CCCCCC 1.0pt;border-top:none;padding:6.0pt 9.0pt 6.0pt 9.0pt;">
                                <p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
                                        <span lang="EN-US" style="color:black;">0x82</span><span lang="EN-US"></span>
                                </p>
                        </td>
                        <td style="background:white;border-bottom:solid #CCCCCC 1.0pt;border-left:none;border-right:solid #CCCCCC 1.0pt;border-top:none;padding:6.0pt 9.0pt 6.0pt 9.0pt;">
                                <p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
                                        <span lang="EN-US" style="color:black;">0</span><span lang="EN-US"></span>
                                </p>
                        </td>
                        <td style="background:white;border-bottom:solid #CCCCCC 1.0pt;border-left:none;border-right:solid #CCCCCC 1.0pt;border-top:none;padding:6.0pt 9.0pt 6.0pt 9.0pt;">
                                <p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
                                        <span style="color:black;">写</span><span lang="EN-US"></span>
                                </p>
                        </td>
                </tr>
                <tr>
                        <td style="background:#F8F8F8;border:solid #CCCCCC 1.0pt;border-top:none;padding:6.0pt 9.0pt 6.0pt 9.0pt;">
                                <p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
                                        <span lang="EN-US" style="color:black;">0x83</span><span lang="EN-US"></span>
                                </p>
                        </td>
                        <td style="background:#F8F8F8;border-bottom:solid #CCCCCC 1.0pt;border-left:none;border-right:solid #CCCCCC 1.0pt;border-top:none;padding:6.0pt 9.0pt 6.0pt 9.0pt;">
                                <p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
                                        <span lang="EN-US" style="color:black;">0x83</span><span lang="EN-US"></span>
                                </p>
                        </td>
                        <td style="background:#F8F8F8;border-bottom:solid #CCCCCC 1.0pt;border-left:none;border-right:solid #CCCCCC 1.0pt;border-top:none;padding:6.0pt 9.0pt 6.0pt 9.0pt;">
                                <p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
                                        <span lang="EN-US" style="color:black;">1</span><span lang="EN-US"></span>
                                </p>
                        </td>
                        <td style="background:#F8F8F8;border-bottom:solid #CCCCCC 1.0pt;border-left:none;border-right:solid #CCCCCC 1.0pt;border-top:none;padding:6.0pt 9.0pt 6.0pt 9.0pt;">
                                <p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
                                        <span style="color:black;">读</span><span lang="EN-US"></span>
                                </p>
                        </td>
                </tr>
                <tr>
                        <td style="background:white;border:solid #CCCCCC 1.0pt;border-top:none;padding:6.0pt 9.0pt 6.0pt 9.0pt;">
                                <p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
                                        <span lang="EN-US" style="color:black;">0xb4</span><span lang="EN-US"></span>
                                </p>
                        </td>
                        <td style="background:white;border-bottom:solid #CCCCCC 1.0pt;border-left:none;border-right:solid #CCCCCC 1.0pt;border-top:none;padding:6.0pt 9.0pt 6.0pt 9.0pt;">
                                <p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
                                        <span lang="EN-US" style="color:black;">0xb4</span><span lang="EN-US"></span>
                                </p>
                        </td>
                        <td style="background:white;border-bottom:solid #CCCCCC 1.0pt;border-left:none;border-right:solid #CCCCCC 1.0pt;border-top:none;padding:6.0pt 9.0pt 6.0pt 9.0pt;">
                                <p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
                                        <span lang="EN-US" style="color:black;">0</span><span lang="EN-US"></span>
                                </p>
                        </td>
                        <td style="background:white;border-bottom:solid #CCCCCC 1.0pt;border-left:none;border-right:solid #CCCCCC 1.0pt;border-top:none;padding:6.0pt 9.0pt 6.0pt 9.0pt;">
                                <p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
                                        <span style="color:black;">写</span><span lang="EN-US"></span>
                                </p>
                        </td>
                </tr>
        </tbody>
</table>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
        按照表中的信息来看，我们的设备只有两台，地址分别是<span lang="EN-US">0x82</span>和<span lang="EN-US">0xb4</span>。如果按照表中的信息解析的话，则<span lang="EN-US">^83</span>的操作是读操作，但是在回显信息当中以<span lang="EN-US">^83</span>开头的只有两种情况如下<span lang="EN-US"></span>
</p>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
        <span lang="EN-US">^83+00+00+3f+.<br />
^83+00+00+1f+.</span>
</p>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
        且有效内容长度仅仅为<span lang="EN-US">3</span>个字节，同时<span lang="EN-US">1f</span>为非打印字符，对于读取<span lang="EN-US">flag</span>来讲，这不太现实。所以本题将实际的<span lang="EN-US">I²C</span>语义进行了反转，结果如下<span lang="EN-US"></span>
</p>
<table border="0" cellpadding="0" cellspacing="0" width="735" style="border-collapse:collapse;font-family:等线;font-size:10.5pt;width:551.25pt;" class="ke-zeroborder">
        <thead>
                <tr>
                        <td style="background:#DBD9D8;border:solid #CCCCCC 1.0pt;padding:6.0pt 9.0pt 6.0pt 9.0pt;">
                                <p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
                                        <b><span style="color:black;">第一个字节</span><span lang="EN-US"></span></b>
                                </p>
                        </td>
                        <td style="background:#DBD9D8;border:solid #CCCCCC 1.0pt;border-left:none;padding:6.0pt 9.0pt 6.0pt 9.0pt;">
                                <p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
                                        <b><span style="color:black;">从设备地址</span><span lang="EN-US"></span></b>
                                </p>
                        </td>
                        <td style="background:#DBD9D8;border:solid #CCCCCC 1.0pt;border-left:none;padding:6.0pt 9.0pt 6.0pt 9.0pt;">
                                <p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
                                        <b><span style="color:black;">读<span lang="EN-US">/</span>写标志位</span><span lang="EN-US"></span></b>
                                </p>
                        </td>
                        <td style="background:#DBD9D8;border:solid #CCCCCC 1.0pt;border-left:none;padding:6.0pt 9.0pt 6.0pt 9.0pt;">
                                <p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
                                        <b><span style="color:black;">本题实际语义</span><span lang="EN-US"></span></b>
                                </p>
                        </td>
                </tr>
        </thead>
        <tbody>
                <tr>
                        <td style="background:white;border:solid #CCCCCC 1.0pt;border-top:none;padding:6.0pt 9.0pt 6.0pt 9.0pt;">
                                <p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
                                        <span lang="EN-US" style="color:black;">0x82</span><span lang="EN-US"></span>
                                </p>
                        </td>
                        <td style="background:white;border-bottom:solid #CCCCCC 1.0pt;border-left:none;border-right:solid #CCCCCC 1.0pt;border-top:none;padding:6.0pt 9.0pt 6.0pt 9.0pt;">
                                <p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
                                        <span lang="EN-US" style="color:black;">0x82</span><span lang="EN-US"></span>
                                </p>
                        </td>
                        <td style="background:white;border-bottom:solid #CCCCCC 1.0pt;border-left:none;border-right:solid #CCCCCC 1.0pt;border-top:none;padding:6.0pt 9.0pt 6.0pt 9.0pt;">
                                <p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
                                        <span lang="EN-US" style="color:black;">0</span><span lang="EN-US"></span>
                                </p>
                        </td>
                        <td style="background:white;border-bottom:solid #CCCCCC 1.0pt;border-left:none;border-right:solid #CCCCCC 1.0pt;border-top:none;padding:6.0pt 9.0pt 6.0pt 9.0pt;">
                                <p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
                                        <span style="color:black;">读</span><span lang="EN-US"></span>
                                </p>
                        </td>
                </tr>
                <tr>
                        <td style="background:#F8F8F8;border:solid #CCCCCC 1.0pt;border-top:none;padding:6.0pt 9.0pt 6.0pt 9.0pt;">
                                <p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
                                        <span lang="EN-US" style="color:black;">0x83</span><span lang="EN-US"></span>
                                </p>
                        </td>
                        <td style="background:#F8F8F8;border-bottom:solid #CCCCCC 1.0pt;border-left:none;border-right:solid #CCCCCC 1.0pt;border-top:none;padding:6.0pt 9.0pt 6.0pt 9.0pt;">
                                <p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
                                        <span lang="EN-US" style="color:black;">0x83</span><span lang="EN-US"></span>
                                </p>
                        </td>
                        <td style="background:#F8F8F8;border-bottom:solid #CCCCCC 1.0pt;border-left:none;border-right:solid #CCCCCC 1.0pt;border-top:none;padding:6.0pt 9.0pt 6.0pt 9.0pt;">
                                <p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
                                        <span lang="EN-US" style="color:black;">1</span><span lang="EN-US"></span>
                                </p>
                        </td>
                        <td style="background:#F8F8F8;border-bottom:solid #CCCCCC 1.0pt;border-left:none;border-right:solid #CCCCCC 1.0pt;border-top:none;padding:6.0pt 9.0pt 6.0pt 9.0pt;">
                                <p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
                                        <span style="color:black;">写</span><span lang="EN-US"></span>
                                </p>
                        </td>
                </tr>
                <tr>
                        <td style="background:white;border:solid #CCCCCC 1.0pt;border-top:none;padding:6.0pt 9.0pt 6.0pt 9.0pt;">
                                <p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
                                        <span lang="EN-US" style="color:black;">0xb4</span><span lang="EN-US"></span>
                                </p>
                        </td>
                        <td style="background:white;border-bottom:solid #CCCCCC 1.0pt;border-left:none;border-right:solid #CCCCCC 1.0pt;border-top:none;padding:6.0pt 9.0pt 6.0pt 9.0pt;">
                                <p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
                                        <span lang="EN-US" style="color:black;">0xb4</span><span lang="EN-US"></span>
                                </p>
                        </td>
                        <td style="background:white;border-bottom:solid #CCCCCC 1.0pt;border-left:none;border-right:solid #CCCCCC 1.0pt;border-top:none;padding:6.0pt 9.0pt 6.0pt 9.0pt;">
                                <p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
                                        <span lang="EN-US" style="color:black;">0</span><span lang="EN-US"></span>
                                </p>
                        </td>
                        <td style="background:white;border-bottom:solid #CCCCCC 1.0pt;border-left:none;border-right:solid #CCCCCC 1.0pt;border-top:none;padding:6.0pt 9.0pt 6.0pt 9.0pt;">
                                <p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
                                        <span style="color:black;">读</span><span lang="EN-US"></span>
                                </p>
                        </td>
                </tr>
        </tbody>
</table>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
        结合上表再进行分析<span lang="EN-US"></span>
</p>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
        <span lang="EN-US">#</span>从<span lang="EN-US">ID:0x82</span>的设备读取内容<span lang="EN-US"><br />
^82+00+00+1f+00+00+00+12+47+40+41+c6+97+e1+3f+89+81+3f+c1+99+1d+a1+c0+20+18+a1+40+5e+42+ac+3c+.<br />
#</span>向<span lang="EN-US">ID:0x82</span>的设备写入内容<span lang="EN-US"><br />
^83+00+00+3f+.<br />
#</span>从<span lang="EN-US">ID:0x82</span>的设备读取内容<span lang="EN-US"><br />
^82+00+00+3f+00+00+00+20+fa+3f+41+c8+da+e2+3f+a6+64+3f+c1+ff+33+a1+c0+a4+d2+a0+40+de+50+55+40+.<br />
#</span>从<span lang="EN-US">ID:0xb4</span>的设备读取内容<span lang="EN-US"><br />
^b4+01+a9+94+c7+59+78+58+87+6b+d3+8e+04+be+2a+47+d4+cc+f8+6e+6c+26+67+a6+98+5e+4a+75+69+63+79+20+44+61+74+61+20+30+33+.<br />
#</span>向<span lang="EN-US">ID:0x82</span>的设备写入内容<span lang="EN-US"><br />
^83+00+00+1f+.<br />
#</span>从<span lang="EN-US">ID:0x82</span>的设备读取内容<span lang="EN-US"><br />
^82+00+00+1f+00+00+00+1d+ec+3f+41+d8+04+e5+3f+67+4e+40+c1+38+1b+a1+c0+e1+dd+a0+40+b9+91+91+3c+.</span>
</p>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
        顺便画个图<span lang="EN-US"></span>
</p>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
        <a href="https://ctfiot.oss-cn-beijing.aliyuncs.com/uploads/2023/12/5-1701421045.png"><img width="522" height="714" src="http://cobjon.com/w/php/upload/202403/01/c02f5564.png" alt="HAS-BUS赛题复现" style="vertical-align:middle;" /></a>
</p>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
        根据对回显信息的分析，猜测读<span lang="EN-US">b4</span>的条件就是<span lang="EN-US">82</span>的某个参数是否为特定值，大致流程就是，先读<span lang="EN-US">82</span>确认某个参数，发现参数没有被设置，则对<span lang="EN-US">82</span>进行写操作改变该参数，之后再次对<span lang="EN-US">82</span>进行读操作确认参数已经被设置，确认完毕则对<span lang="EN-US">b4</span>进行读操作。并且<span lang="EN-US">b4</span>的数据一直都是比较长的，所以猜测<span lang="EN-US">flag</span>应该在<span lang="EN-US">b4</span>这个设备当中。同时回去注意到<span lang="EN-US">README</span>当中<span lang="EN-US"></span>
</p>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
        <span lang="EN-US">*&nbsp;OBC&nbsp;(Onboard&nbsp;computer&nbsp;-&nbsp;bus&nbsp;master)<br />
*&nbsp;EEP&nbsp;(Some&nbsp;kind&nbsp;of&nbsp;device&nbsp;which&nbsp;contains&nbsp;"juicy&nbsp;data"&nbsp;+&nbsp;the&nbsp;flag)<br />
*&nbsp;EPS&nbsp;(Electrical&nbsp;power&nbsp;system&nbsp;controller)</span>
</p>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
        表明了<span lang="EN-US">flag</span>存在于<span lang="EN-US">EEP</span>当中，则我们这里<span lang="EN-US">b4</span>就是<span lang="EN-US">EEP</span>设备。我们知道，写的操作只有如下两种<span lang="EN-US"></span>
</p>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
        <span lang="EN-US">^83+00+00+3f+.<br />
^83+00+00+1f+.</span>
</p>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
        通过之前的分析可以知道，在读<span lang="EN-US">EEP</span>的内容时，<span lang="EN-US">82</span>的内容为<span lang="EN-US">^83+00+00+3f</span>，当我们对<span lang="EN-US">b4</span>读完之后，会先对<span lang="EN-US">82</span>在进行一次写操作，其操作为<span lang="EN-US">^83+00+00+1f</span>。对此总结可知读<span lang="EN-US">EEP</span>的整个流程操作大致如下<span lang="EN-US"></span>
</p>
<ol style="margin-top:0cm;" start="1" type="1">
        <li style="font-family:等线;font-size:10.5pt;margin:0cm;tab-stops:list 36.0pt;text-align:justify;text-justify:inter-ideograph;">
                先对<span lang="EN-US">82</span>进行读操作，确认其某个参数是否被设置；<span lang="EN-US">82</span>初始状态为：<span lang="EN-US">^83+00+00+1f</span>
        </li>
        <li style="font-family:等线;font-size:10.5pt;margin:0cm;tab-stops:list 36.0pt;text-align:justify;text-justify:inter-ideograph;">
                发现<span lang="EN-US">82</span>某个参数没有被设置，对<span lang="EN-US">82</span>进行写操作，将其对应的参数设置<span lang="EN-US"></span>
        </li>
        <li style="font-family:等线;font-size:10.5pt;margin:0cm;tab-stops:list 36.0pt;text-align:justify;text-justify:inter-ideograph;">
                再次对<span lang="EN-US">82</span>进行读操作，确认该参数被设置<span lang="EN-US"></span>
        </li>
        <li style="font-family:等线;font-size:10.5pt;margin:0cm;tab-stops:list 36.0pt;text-align:justify;text-justify:inter-ideograph;">
                对<span lang="EN-US">EEP(b4)</span>进行读操作<span lang="EN-US"></span>
        </li>
        <li style="font-family:等线;font-size:10.5pt;margin:0cm;tab-stops:list 36.0pt;text-align:justify;text-justify:inter-ideograph;">
                对<span lang="EN-US">82</span>进行写操作使其恢复为初始状态，操作为：<span lang="EN-US">^83+00+00+1f</span>
        </li>
        <li style="font-family:等线;font-size:10.5pt;margin:0cm;tab-stops:list 36.0pt;text-align:justify;text-justify:inter-ideograph;">
                对<span lang="EN-US">82</span>进行读操作确认是否恢复初始状态<span lang="EN-US"></span>
        </li>
</ol>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
        很明显可以知道，<span lang="EN-US">82</span>控制着<span lang="EN-US">EEP</span>的开和关，同样从<span lang="EN-US">README</span>当中可知其名为<span lang="EN-US">EPS</span>，<span lang="EN-US">EPS</span>和<span lang="EN-US">EEP</span>的关系如下<span lang="EN-US"></span>
</p>
<table border="0" cellpadding="0" cellspacing="0" width="735" style="border-collapse:collapse;font-family:等线;font-size:10.5pt;width:551.25pt;" class="ke-zeroborder">
        <thead>
                <tr>
                        <td style="background:#DBD9D8;border:solid #CCCCCC 1.0pt;padding:6.0pt 9.0pt 6.0pt 9.0pt;">
                                <p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
                                        <b><span lang="EN-US" style="color:black;">EEP</span><span style="color:black;">电源开<span lang="EN-US">/</span>关<span lang="EN-US">(82)</span></span><span lang="EN-US"></span></b>
                                </p>
                        </td>
                        <td style="background:#DBD9D8;border:solid #CCCCCC 1.0pt;border-left:none;padding:6.0pt 9.0pt 6.0pt 9.0pt;">
                                <p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
                                        <b><span lang="EN-US" style="color:black;">EPS</span><span style="color:black;">状态<span lang="EN-US">(</span>十六进制<span lang="EN-US">)</span></span><span lang="EN-US"></span></b>
                                </p>
                        </td>
                        <td style="background:#DBD9D8;border:solid #CCCCCC 1.0pt;border-left:none;padding:6.0pt 9.0pt 6.0pt 9.0pt;">
                                <p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
                                        <b><span lang="EN-US" style="color:black;">EPS</span><span style="color:black;">状态<span lang="EN-US">(</span>二进制<span lang="EN-US">)</span></span><span lang="EN-US"></span></b>
                                </p>
                        </td>
                </tr>
        </thead>
        <tbody>
                <tr>
                        <td style="background:white;border:solid #CCCCCC 1.0pt;border-top:none;padding:6.0pt 9.0pt 6.0pt 9.0pt;">
                                <p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
                                        <span style="color:black;">关</span><span lang="EN-US"></span>
                                </p>
                        </td>
                        <td style="background:white;border-bottom:solid #CCCCCC 1.0pt;border-left:none;border-right:solid #CCCCCC 1.0pt;border-top:none;padding:6.0pt 9.0pt 6.0pt 9.0pt;">
                                <p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
                                        <span lang="EN-US" style="color:black;">1f</span><span lang="EN-US"></span>
                                </p>
                        </td>
                        <td style="background:white;border-bottom:solid #CCCCCC 1.0pt;border-left:none;border-right:solid #CCCCCC 1.0pt;border-top:none;padding:6.0pt 9.0pt 6.0pt 9.0pt;">
                                <p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
                                        <span lang="EN-US" style="color:black;">0001   1111</span><span lang="EN-US"></span>
                                </p>
                        </td>
                </tr>
                <tr>
                        <td style="background:#F8F8F8;border:solid #CCCCCC 1.0pt;border-top:none;padding:6.0pt 9.0pt 6.0pt 9.0pt;">
                                <p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
                                        <span style="color:black;">开</span><span lang="EN-US"></span>
                                </p>
                        </td>
                        <td style="background:#F8F8F8;border-bottom:solid #CCCCCC 1.0pt;border-left:none;border-right:solid #CCCCCC 1.0pt;border-top:none;padding:6.0pt 9.0pt 6.0pt 9.0pt;">
                                <p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
                                        <span lang="EN-US" style="color:black;">3f</span><span lang="EN-US"></span>
                                </p>
                        </td>
                        <td style="background:#F8F8F8;border-bottom:solid #CCCCCC 1.0pt;border-left:none;border-right:solid #CCCCCC 1.0pt;border-top:none;padding:6.0pt 9.0pt 6.0pt 9.0pt;">
                                <p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
                                        <span lang="EN-US" style="color:black;">0011   1111</span><span lang="EN-US"></span>
                                </p>
                        </td>
                </tr>
        </tbody>
</table>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
        很明显可以看见，只需修改第六位就可以控制<span lang="EN-US">EEP</span>的开与关而在题目描述中<span lang="EN-US"></span>
</p>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
        <span lang="EN-US">There's&nbsp;a&nbsp;very&nbsp;busy&nbsp;bus&nbsp;we've&nbsp;tapped&nbsp;a&nbsp;port&nbsp;onto,&nbsp;surely&nbsp;there&nbsp;<b>is</b>&nbsp;some&nbsp;juicy<br />
information&nbsp;hidden&nbsp;<b>in</b>&nbsp;the&nbsp;device&nbsp;memory...&nbsp;somewhere...<br />
<br />
The&nbsp;OBC&nbsp;<b>is</b>&nbsp;tying&nbsp;up&nbsp;the&nbsp;bus&nbsp;most&nbsp;of&nbsp;the&nbsp;time.</span>
</p>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
        说明了<span lang="EN-US">bus</span>非常的忙，理论上我们这里需要将除了<span lang="EN-US">EEP</span>设备其他都关闭，但同时题目也说到，做轮询操作，期间间隔短<span lang="EN-US"></span>
</p>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
        <span lang="EN-US">By&nbsp;looking&nbsp;at&nbsp;the&nbsp;traffic,&nbsp;we&nbsp;see&nbsp;the&nbsp;OBC&nbsp;enabling&nbsp;power&nbsp;to&nbsp;the&nbsp;device,<br />
reading&nbsp;<b>from</b>&nbsp;it&nbsp;(<b>in</b>&nbsp;random&nbsp;areas&nbsp;that&nbsp;don't&nbsp;contain&nbsp;the&nbsp;flag),&nbsp;and<br />
turning&nbsp;it&nbsp;off&nbsp;afterwards.&nbsp;After&nbsp;that,&nbsp;there's&nbsp;a&nbsp;short&nbsp;pause<br />
(a&nbsp;few&nbsp;seconds)&nbsp;before&nbsp;the&nbsp;polling&nbsp;starts&nbsp;again.</span>
</p>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
        在我们肉眼可见的情况下表现出来的形式就是，会短暂的停一下，所以我们需要在这个时间段发送<span lang="EN-US">I²C</span>信号来获得<span lang="EN-US">flag</span>。我们知道<span lang="EN-US">EEP</span>开启只需要第六位为<span lang="EN-US">1</span>即可，则我们应该对<span lang="EN-US">82</span>做如下操作：<span lang="EN-US">^83+00+00+20.</span>
</p>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
        <b><span lang="EN-US">“</span></b><span lang="EN-US"></span>
</p>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
        复现过程中发现<span lang="EN-US">20</span>并不唯一，存在多个参数可解；<span lang="EN-US"></span>
</p>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
        <b><span lang="EN-US">”</span></b><span lang="EN-US"></span>
</p>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
        <a href="https://ctfiot.oss-cn-beijing.aliyuncs.com/uploads/2023/12/3-1701421046.png"><img width="554" height="37" src="http://cobjon.com/w/php/upload/202403/01/06e4b91e.png" alt="HAS-BUS赛题复现" style="vertical-align:middle;" /></a>
</p>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
        输入后成功的关闭了除了<span lang="EN-US">EEP</span>的其他设备，接下来只需要将<span lang="EN-US">EEP</span>的内容读出来即可，操作如下<span lang="EN-US"></span>
</p>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
        <b><span lang="EN-US">“</span></b><span lang="EN-US"></span>
</p>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
        这里在关闭了除了<span lang="EN-US">EEP</span>的其他设备后，<span lang="EN-US">b4</span>后面的参数已经不重要了，对<span lang="EN-US">b4</span>的读操作会将<span lang="EN-US">EEP</span>中的所有内容都读出来。复现过程中尝试搞明白为什么在<span lang="EN-US">^83+00+00+20.</span>操作过后就能够关闭其他设备，从而直接泄露<span lang="EN-US">EEP</span>的全部内容，但是有些操作好像在源码中不能直接看出来，直接略过。有明白的师傅可以交流一下！！！<span lang="EN-US"></span>
</p>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
        <b><span lang="EN-US">”</span></b><span lang="EN-US"></span>
</p>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
        <span lang="EN-US">^b4111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111</span>
</p>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
        结果如下，只要将<span lang="EN-US"> ^ + </span>符号去掉，再将十六进制转为字符串即可<span lang="EN-US"></span>
</p>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
        <a href="https://ctfiot.oss-cn-beijing.aliyuncs.com/uploads/2023/12/0-1701421046.png"><img width="554" height="45" src="http://cobjon.com/w/php/upload/202403/01/9fd73dc1.png" alt="HAS-BUS赛题复现" style="vertical-align:middle;" /></a>
</p>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
        <span lang="EN-US"><a href="https://ctfiot.oss-cn-beijing.aliyuncs.com/uploads/2023/12/9-1701421047.png"><img width="553" height="178" src="http://cobjon.com/w/php/upload/202403/01/45f52a4f.png" alt="HAS-BUS赛题复现" style="vertical-align:middle;" /></a><br />
<br />
</span>
</p>
<div align="center" style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:center;text-justify:inter-ideograph;">
        <span lang="EN-US">
        <hr size="0" width="100%" align="center" />
        </span>
</div>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
        参考文章：<span lang="EN-US"></span>
</p>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
        <span lang="EN-US">https://cloud.tencent.com/developer/article/2332362</span>
</p>
<p style="font-family:等线;font-size:10.5pt;margin:0cm;text-align:justify;text-justify:inter-ideograph;">
        <span lang="EN-US">&nbsp;</span>
</p>

查看完整版本: 【卫星安全系列二】HAS-BUS赛题复现