On vous demande d'écrire un générateur d'entrées valides pour ce binaire, puis de le valider sur les entrées fournies par le service distant afin d'obtenir le flag.
​
Service : nc challenges2.france-cybersecurity-challenge.fr 3000

$ ./keykoolol
[+] Username: abc
[+] Serial:   0123
[!] Incorrect serial.

undefined8 FUN_00100730(void)
​
{
  char cVar1;
  size_t sVar2;
  ulong uVar3;
  ulong uVar4;
  char *__s;
  long in_FS_OFFSET;
  byte bVar5;
  char local_420 [512];
  char local_220 [512];
  long local_20;
​
  bVar5 = 0;
  local_20 = *(long *)(in_FS_OFFSET + 0x28);
  __printf_chk(1,"[+] Username: ");
  fgets(local_420,0x200,stdin);
  sVar2 = strcspn(local_420,"\n");
  local_420[sVar2] = 0;
  __printf_chk(1,"[+] Serial:   ");
  fgets(local_220,0x200,stdin);
  sVar2 = strcspn(local_220,"\n");
  local_220[sVar2] = 0;
  uVar3 = 0xffffffffffffffff;
  __s = local_220;
  do {
    if (uVar3 == 0) break;
    uVar3 = uVar3 - 1;
    cVar1 = *__s;
    __s = __s + (ulong)bVar5 * -2 + 1;
  } while (cVar1 != 0);
  uVar4 = 0xffffffffffffffff;
  __s = local_420;
  do {
    if (uVar4 == 0) break;
    uVar4 = uVar4 - 1;
    cVar1 = *__s;
    __s = __s + (ulong)bVar5 * -2 + 1;
  } while (cVar1 != 0);
  uVar3 = FUN_0010096a(&DAT_001024e0,0x400,local_420,~uVar4 - 1,local_220,~uVar3 - 1);
  __s = "[!] Incorrect serial.";
  if ((int)uVar3 != 0) {
    puts("[>] Valid serial!");
    __s = "[>] Now connect to the remote server and generate serials for the given usernames.";
  }
  puts(__s);
  if (local_20 != *(long *)(in_FS_OFFSET + 0x28)) {
                    /* WARNING: Subroutine does not return */
    __stack_chk_fail();
  }
  return 0;
}

r = FUN_0010096a(&DAT_001024e0, 0x400, username, len_username, serial, len_serial);

bVar16 = 0;
lVar10 = 0x10;
puVar13 = &DAT_00303040;
while (lVar10 != 0) {
  lVar10 = lVar10 + -1;
  *puVar13 = 0;
  puVar13 = puVar13 + 1;
}
lVar10 = 0x200;
uVar11 = (uint)data_len & 0xfffffff0;
puVar13 = &DAT_00303080;
while (lVar10 != 0) {
  lVar10 = lVar10 + -1;
  *puVar13 = 0;
  puVar13 = puVar13 + 1;
}
lVar10 = __memcpy_chk(&DAT_00303080,data,data_len,0x800);
_DAT_00303060 = uVar11 + 0x10;
_DAT_00303064 = (uint)username_len;
_DAT_00303068 = uVar11 + 0x20 + (_DAT_00303064 & 0xfffffff0);
uVar9 = (ulong)DAT_0030302c;
bVar4 = false;
puVar14 = (undefined *)((ulong)_DAT_00303060 + lVar10);
while (iVar15 = DAT_00305880, username_len != 0) {
  username_len = username_len + -1;
  *puVar14 = *username;
  username = username + (ulong)bVar16 * -2 + 1;
  puVar14 = puVar14 + (ulong)bVar16 * -2 + 1;
}
_DAT_0030306c = (uint)serial_len;
_DAT_00303070 = _DAT_00303068 + 0x10 + (_DAT_0030306c & 0xfffffff0);
bVar3 = false;
bVar2 = false;
puVar14 = (undefined *)((ulong)_DAT_00303068 + lVar10);
while (uVar11 = DAT_00303030, serial_len != 0) {
  serial_len = serial_len + -1;
  *puVar14 = *serial;
  serial = serial + (ulong)bVar16 * -2 + 1;
  puVar14 = puVar14 + (ulong)bVar16 * -2 + 1;
}

uVar1 = *(uint *)(data_ + (ulong)uVar11);
uVar5 = uVar1 >> 0x18;

if (type == 0) {
  (&DAT_00303040)[(ulong)(opcode >> 0x14)] = (&DAT_00303040)[(ulong)(opcode >> 0x10 & 0xf)];
  uVar4 = pc + 4;
}
else {
  if (type == 0x1f) {
    _DAT_00303054 = _DAT_00303054 ^ 0xf7e1560a;
    uVar4 = pc + 4;
  }
  else {
    if (type == 0x20) {
      _DAT_00303048 = _DAT_00303048 ^ 0x6ddc660c;
      uVar4 = pc + 4;
    }
    else {
      if (type == 0x21) {
        _DAT_00303074 = _DAT_00303074 ^ 0x13e40c56;
        uVar4 = pc + 4;
      }
[...]

type_op  k    m    p    q
00000000 0000 0000 0000 000000000000
-----------------s ssss
​
s = pour les opérations de shift (5 bits)
. = concaténation de bits

00 -> reg[k] = reg[m]
01 -> reg[k] = text[reg[m]]
02 -> reg[k] = m.p (8 bits)
03 -> text[reg[k]] = reg[m]
04 -> text[reg[k]] = text[reg[m]]
05 -> text[reg[k]] = m . p (8 bits)
06 -> sauvegarde PC+4; pc = k.m.p.q; (CALL)
07 -> jump_flag = reg[k] - reg[m] (CMP between two registers)
08 -> jump_flag = reg[k] - m.p (CMP with immediate)
09 -> jump to k.m.p.q if jump_flag = 0 (JE)
0a -> jump to k.m.p.q if jump_flag != 0 (JNE)
0b -> reg[k] = reg[k] + reg[m]
0c -> reg[k] = reg[k] + m.p
0d -> reg[k] = reg[k] * reg[m]
0e -> reg[k] = reg[k] * m.p
0f -> reg[k] += 1
10 -> reg[k] = reg[k] % reg[m]
11 -> reg[k] = reg[k] % m.p
12 -> reg[k] = reg[k] ^ reg[m]
13 -> reg[k] = reg[k] ^ m.p
14 -> jump to k.m.p.q if jump_flag < 0 (JL)
15 -> jump to k.m.p.q if jump_flag > 0 (JG)
16 -> reg[k] = reg[k] - reg[m]
17 -> reg[k] = reg[k] - m.p
18 -> jump to k.m.p.q
19 -> reg[k] = reg[k] >> s
1a -> reg[k] = PC + 4
1b -> reg[k] = swap_endianness(text[reg[m]])
1c -> text[reg[k]] = swap_endianness(reg[m])
1d -> reg[k] = reg[k] << s
1e -> text[reg[k]] = AES(text[reg[m]], text[reg[p]])
1f -> fd : reg[something] ^= some hardcoded value
fe -> récupère l'adresse de retour et jump (RET)
ff -> fin du prog et retourne reg[0]

from binascii import hexlify as tohex, unhexlify as unhex
import re, struct, sys
import aes as crypto # Tiré de https://github.com/p4-team/crypto-commons/blob/master/crypto_commons/symmetrical/aes.py
​
disassembly_mode = False
debug_mode = False
​
if len(sys.argv) > 1 and sys.argv[1] == '--disassembly':
  disassembly_mode = True
if len(sys.argv) > 1 and sys.argv[1] == '--debug':
  debug_mode = True
  disassembly_mode = True
​
decode = lambda u: (u[3] << 24) | (u[2] << 16) | (u[1] << 8) | u[0]
​
# Contient un dump du C généré par Ghidra pour la fonction principale
code = open('code.txt', 'r').read()
​
code = code.replace(' ', '').replace('\t', '').replace('\n', '')
s = re.findall(r'if\(type\_op\=\=((?:0x)?[0-9a-f]{1,3})\)\{(?:\_)?DAT\_003030[0-9a-f]{2}\=(?:\_)?DAT\_003030([0-9a-f]{2})\^0x([0-9a-f]{1,8})\;', code)
​
xor_opcodes = {}
for opcode, reg_i, magic in s:
  xor_opcodes[eval(opcode)] = ((int(reg_i, 16) - 0x40) // 4, int(magic, 16))
​
def dis(pc, ins):
  print('{:04x}'.format(pc) + ' ' + ins)
​
def read(text, offset):
  return decode(text[offset:offset + 4])
​
def read128(text, offset):
  return b''.join(bytes([text[offset + i]]) for i in range(16))
​
def write(text, offset, value):
  text[offset] = value & 0xff
  text[offset + 1] = (value >> 8) & 0xff
  text[offset + 2] = (value >> 16) & 0xff
  text[offset + 3] = (value >> 24) & 0xff
​
def write_bytes(text, offset, value):
  for i in range(len(value)):
    text[offset + i] = value[i]
​
def swap(x):
  return ((x & 0xff) << 24) | (((x >> 8) & 0xff) << 16) | (((x >> 16) & 0xff) << 8) | ((x >> 24) & 0xff)
​
text = "6e 18 b0 17 c9 f5 bf 08 74 00 00 0a 37 52 0a 00 98 95 1c 00 74 03 00 06 88 1c 00 08 74 00 00 0a 3f 9e 08 00 56 94 1c 00 ad 06 18 0c c6 0f 20 02 88 02 00 06 89 97 0c 00 7c 02 08 0c c9 73 1c 00 5b 00 19 0c 7c 00 00 06 fa 1b 0c 00 f7 01 10 00 a7 f3 1f 0c 4b 19 10 0c fc 00 00 06 5a 41 0c 00 09 95 1c 00 8e 08 18 0c 28 0b 26 02 e8 02 00 06 64 34 7b ff 05 0c 00 02 af b4 68 ff de 24 f2 1a 05 88 f4 0c fd 5c dd 12 c0 49 df 13 b9 82 d0 1d 5a 3a de 13 ea 8f d0 1d c1 2f dd 13 37 86 d0 1d c0 1f dc 13 02 c4 ef 1b 64 91 ed 12 0a 33 fe 1c db 8a e1 1d 40 81 e1 19 28 fe e7 08 c8 00 00 15 1a 46 f0 0c a4 00 00 18 be e2 e2 c3 b8 2b f2 c1 04 a2 f0 c0 29 de f2 cf c7 18 fd d2 c1 5b c0 c2 f5 30 e5 ce 4c ec e7 c9 0c e3 d2 c8 fc d7 d9 ce 08 b2 cf ce 38 e3 d2 d9 5e 3d 4c 3f 4e 65 ff 1a c0 85 f4 0c eb 87 dd 12 bf 15 da 13 f2 82 d0 1d c3 2c db 13 be 80 d0 1d f0 32 dc 13 1c 8d d0 1d 88 49 dd 13 6f 26 ef 1b 54 13 ed 12 1f ad fe 1c cc 8d e1 1d d8 80 e1 19 23 f2 e7 08 48 01 00 15 44 44 f0 0c 24 01 00 18 11 07 a3 d4 ab bd a5 d8 54 f2 b3 d4 54 bb 33 d6 44 b0 93 d6 66 8d 83 d4 7a 9c 86 df a5 59 f7 d5 03 a0 82 d4 0d b4 86 df d6 f6 80 d7 21 2b 96 db 27 b5 92 dc 25 b3 c3 dd fd b3 c3 cc 75 78 f3 d4 97 b8 f6 d8 3a f3 83 d4 c0 13 94 d4 9b f2 90 ca d2 81 f3 d4 35 bf f7 d8 39 99 85 d4 37 b8 82 d8 b9 e4 94 d4 51 ba 96 d8 50 f4 90 ca 9e 13 f3 d4 19 bd f0 d8 51 33 85 d4 aa be 82 d8 dd 87 94 d4 27 be 97 d8 53 fc 90 ca 7b e7 f3 d4 15 b4 f1 d8 b5 e9 83 d4 63 b1 80 d8 35 d9 94 d4 a6 bc 90 d8 20 fc 90 ca f1 b8 f3 d4 c0 bd f2 d8 41 b3 85 d4 cb 4c 94 d4 d9 b6 91 d8 d1 f0 90 ca 83 17 f2 d4 b7 87 85 d4 e6 65 94 d4 36 b3 92 d8 ff f9 90 ca 31 7c 34 db 6d b3 31 dc 89 b0 c3 dd f9 b3 c3 cc 83 ee 5a 2a 34 f0 0f 0f 85 eb 02 0f 7f 82 0a 0f 44 7d 00 0f 9a 88 03 0f 1a ba 0f 0f 8b 89 0f 0f f4 2d 09 0f 97 0a 08 0f 66 55 0f 0f b3 23 0c 0f fb d6 0b 0f 33 83 09 0f 3f 94 0a 0f e3 c1 00 0f 5f c8 00 0f 88 d4 07 0f 23 5c 06 0f 43 de 0e 0f 25 fa af 62 7c 94 2c cf 8d a5 9c bc 67 70 de f4 c6 7e 70 01 e2 0c 70 08 98 02 00 0a e4 02 00 18 c5 0c 60 02 9b 85 37 00 54 65 36 0b 58 d6 30 0e e7 50 32 13 4b f6 3f 11 9c 4d 46 00 a3 a9 42 0b a6 06 41 11 7e 8a 41 0b f5 ff 54 01 0e 42 53 12 65 92 45 03 57 e2 69 0f ac 0e 61 08 9c 02 00 0a 7c ca 07 0f 99 f1 25 0f 88 02 00 06 fe 32 5b fe e8 59 fd 1a 2f 83 f4 0c 27 b8 dd 12 b0 a8 da 13 36 82 d0 1d 6b bc db 13 b5 84 d0 1d 28 cb dc 13 de 88 d0 1d 39 d2 dd 13 37 3d ef 1b e5 59 ed 12 0c 7d fe 1c 5e 89 e1 1d 74 8f e1 19 c9 f6 e7 08 34 03 00 15 16 4a f0 0c 10 03 00 18 9f bb fc df 30 78 8c dd 32 dc 9d dd b8 dd 8f d6 ad 2c 9f d6 da 35 88 dc 59 b0 99 dc 14 fe 89 da c6 b8 cc d7 81 24 fa d2 f9 6a fe da 92 b8 cc d7 56 ae cc df da b8 cc c5 dd b1 cc df e5 79 c6 23 36 01 30 02 01 c9 20 00 0a 27 23 0b 5f 56 22 01 1c 09 20 08 f0 03 00 09 af 99 23 08 a4 03 00 15 89 09 23 08 f8 03 00 14 7c 08 23 17 b8 03 00 18 68 67 26 08 f8 03 00 15 3e 17 26 08 f8 03 00 14 f9 73 25 17 3a 47 43 00 25 22 40 11 a4 1c 40 08 d4 03 00 09 b5 0c 21 0e 86 93 52 00 e8 03 00 18 29 d6 25 12 59 80 43 00 55 19 40 19 b6 02 41 0b c3 39 42 03 d7 54 35 0f 78 03 00 18 1b 13 00 02 fc 03 00 18 dc 00 00 02 a0 a1 31 fe"
text = [int(x, 16) for x in text.split(' ')]
​
reg = [0] * 16
​
if debug_mode or not disassembly_mode:
  username = input('Username: ').encode()
  serial = input('Serial: ').encode()
​
  text += [0] * 0x400 # Heap
​
  write_bytes(text, 0x400 + 0x20 + 0x10, serial)
​
  reg[8] = 0x400 + 0x10 # Adresse username
  reg[9] = len(username)
  write_bytes(text, reg[8], username)
​
  reg[10] = 0x400 + 0x20 + (reg[9] & 0xfffffff0) # Adresse serial
  reg[11] = len(serial)
  write_bytes(text, reg[10], serial)
​
  reg[12] = reg[10] + 0x10 + (reg[11] & 0xfffffff0) # Adresse something
​
pc = 0
save_pc = []
jump_flag = 0
​
breakpoints = []
no_stop = False
​
while (debug_mode or not disassembly_mode) or (pc < len(text)):
  type_op = decode(text[pc:pc + 4])
  opcode = type_op >> 24
  k = (type_op >> 20) & 0xf
  m = (type_op >> 16) & 0xf
  p = (type_op >> 12) & 0xf
  q = type_op & 0xfff
  kmpq = type_op & 0xffffff
  imm = (m << 4) | p
  s = (type_op >> 0xc) & 0x1f
​
  if no_stop and pc in breakpoints:
    no_stop = False
​
  if debug_mode and not no_stop:
    print("Regs: %s" % (','.join('{:08x}'.format(_) for _ in reg)))
    print("Heap: %s" % tohex(bytes(text[0x400:0x400+0x300])))
​
  if opcode == 0x00:
    if disassembly_mode and not no_stop:
      dis(pc, 'mov r%s, r%s' % (k, m))
    if debug_mode or not disassembly_mode:
      reg[k] = reg[m]
    pc += 4
​
  elif opcode == 0x01:
    if disassembly_mode and not no_stop:
      dis(pc, 'mov r%s, (char) [r%s]' % (k, m))
    if debug_mode or not disassembly_mode:
      reg[k] = read(text, reg[m]) & 0xff
    pc += 4
​
  elif opcode == 0x02:
    if disassembly_mode and not no_stop:
      dis(pc, 'mov r%s, %s' % (k, imm))
    if debug_mode or not disassembly_mode:
      reg[k] = imm
    pc += 4
​
  elif opcode == 0x03:
    if disassembly_mode and not no_stop:
      dis(pc, 'mov [r%s], (char) r%s' % (k, m))
    if debug_mode or not disassembly_mode:
      write_bytes(text, reg[k], bytes([reg[m] & 0xff]))
    pc += 4
​
  elif opcode == 0x04:
    if disassembly_mode and not no_stop:
      dis(pc, 'mov [r%s], [r%s]' % (k, m))
    if debug_mode or not disassembly_mode:
      write(text, reg[k], read(text, reg[m]))
    pc += 4
​
  elif opcode == 0x05:
    if disassembly_mode and not no_stop:
      dis(pc, 'mov [r%s], (char) %s' % (k, imm))
    if debug_mode or not disassembly_mode:
      write_bytes(text, reg[k], bytes([reg[m] & 0xff]))
    pc += 4
​
  elif opcode == 0x06:
    if disassembly_mode and not no_stop:
      dis(pc, 'call %s' % ('{:04x}'.format(kmpq)))
      pc += 4
    if debug_mode or not disassembly_mode:
      save_pc.append(pc + 4)
      pc = kmpq
​
  elif opcode == 0x07:
    if disassembly_mode and not no_stop:
      dis(pc, 'cmp r%s, r%s' % (k, m))
    if debug_mode or not disassembly_mode:
      jump_flag = reg[k] - reg[m]
    pc += 4
​
  elif opcode == 0x08:
    if disassembly_mode and not no_stop:
      dis(pc, 'cmp r%s, %s' % (k, imm))
    if debug_mode or not disassembly_mode:
      jump_flag = reg[k] - imm
    pc += 4
​
  elif opcode == 0x09:
    if disassembly_mode and not no_stop:
      dis(pc, 'je %s' % ('{:04x}'.format(kmpq)))
      if not debug_mode:
        pc += 4
    if debug_mode or not disassembly_mode:
      if jump_flag == 0:
        pc = kmpq
      else:
        pc += 4
​
  elif opcode == 0x0a:
    if disassembly_mode and not no_stop:
      dis(pc, 'jne %s' % ('{:04x}'.format(kmpq)))
      if not debug_mode:
        pc += 4
    if debug_mode or not disassembly_mode:
      if jump_flag != 0:
        pc = kmpq
      else:
        pc += 4
​
  elif opcode == 0x0b:
    if disassembly_mode and not no_stop:
      dis(pc, 'add r%s, r%s' % (k, m))
    if debug_mode or not disassembly_mode:
      reg[k] = (reg[k] + reg[m]) & 0xffffffff
    pc += 4
​
  elif opcode == 0x0c:
    if disassembly_mode and not no_stop:
      dis(pc, 'add r%s, %s' % (k, imm))
    if debug_mode or not disassembly_mode:
      reg[k] = (reg[k] + imm) & 0xffffffff
    pc += 4
​
  elif opcode == 0x0d:
    if disassembly_mode and not no_stop:
      dis(pc, 'mul r%s, r%s' % (k, m))
    if debug_mode or not disassembly_mode:
      reg[k] = (reg[k] * reg[m]) & 0xffffffff
    pc += 4
​
  elif opcode == 0x0e:
    if disassembly_mode and not no_stop:
      dis(pc, 'mul r%s, %s' % (k, imm))
    if debug_mode or not disassembly_mode:
      reg[k] = (reg[k] * imm) & 0xffffffff
    pc += 4
​
  elif opcode == 0x0f:
    if disassembly_mode and not no_stop:
      dis(pc, 'inc r%s' % k)
    if debug_mode or not disassembly_mode:
      reg[k] = (reg[k] + 1) & 0xffffffff
    pc += 4
​
  elif opcode == 0x10:
    if disassembly_mode and not no_stop:
      dis(pc, 'mod r%s, r%s' % (k, m))
    if debug_mode or not disassembly_mode:
      reg[k] %= reg[m]
    pc += 4
​
  elif opcode == 0x11:
    if disassembly_mode and not no_stop:
      dis(pc, 'mod r%s, %s' % (k, imm))
    if debug_mode or not disassembly_mode:
      reg[k] %= imm
    pc += 4
​
  elif opcode == 0x12:
    if disassembly_mode and not no_stop:
      dis(pc, 'xor r%s, r%s' % (k, m))
    if debug_mode or not disassembly_mode:
      reg[k] ^= reg[m]
    pc += 4
​
  elif opcode == 0x13:
    if disassembly_mode and not no_stop:
      dis(pc, 'xor r%s, %s' % (k, imm))
    if debug_mode or not disassembly_mode:
      reg[k] ^= imm
    pc += 4
​
  elif opcode == 0x14:
    if disassembly_mode and not no_stop:
      dis(pc, 'jl %s' % ('{:04x}'.format(kmpq)))
      if not debug_mode:
        pc += 4
    if debug_mode or not disassembly_mode:
      if jump_flag < 0:
        pc = kmpq
      else:
        pc += 4
​
  elif opcode == 0x15:
    if disassembly_mode and not no_stop:
      dis(pc, 'jg %s' % ('{:04x}'.format(kmpq)))
      if not debug_mode:
        pc += 4
    if debug_mode or not disassembly_mode:
      if jump_flag > 0:
        pc = kmpq
      else:
        pc += 4
​
  elif opcode == 0x16:
    if disassembly_mode and not no_stop:
      dis(pc, 'sub r%s, r%s' % (k, m))
    if debug_mode or not disassembly_mode:
      reg[k] = (reg[k] - reg[m]) % 2**32
    pc += 4
​
  elif opcode == 0x17:
    if disassembly_mode and not no_stop:
      dis(pc, 'sub r%s, %s' % (k, imm))
    if debug_mode or not disassembly_mode:
      reg[k] = (reg[k] - imm) % 2**32
    pc += 4
​
  elif opcode == 0x18:
    if disassembly_mode and not no_stop:
      dis(pc, 'jmp %s' % ('{:04x}'.format(kmpq)))
      pc += 4
    if debug_mode or not disassembly_mode:
      pc = kmpq
​
  elif opcode == 0x19:
    if disassembly_mode and not no_stop:
      dis(pc, 'shr r%s, %s' % (k, s))
    if debug_mode or not disassembly_mode:
      reg[k] >>= s
    pc += 4
​
  elif opcode == 0x1a:
    if disassembly_mode and not no_stop:
      dis(pc, 'loadpc r%s' % k)
    if debug_mode or not disassembly_mode:
      reg[k] = pc + 4
    pc += 4
​
  elif opcode == 0x1b:
    if disassembly_mode and not no_stop:
      dis(pc, 'mov r%s, swap([r%s])' % (k, m))
    if debug_mode or not disassembly_mode:
      reg[k] = swap(read(text, reg[m]))
    pc += 4
​
  elif opcode == 0x1c:
    if disassembly_mode and not no_stop:
      dis(pc, 'mov [r%s], swap(r%s)' % (k, m))
    if debug_mode or not disassembly_mode:
      write(text, reg[k], swap(reg[m]))
    pc += 4
​
  elif opcode == 0x1d:
    if disassembly_mode and not no_stop:
      dis(pc, 'shl r%s, %s' % (k, s))
    if debug_mode or not disassembly_mode:
      reg[k] = (reg[k] << s) & 0xffffffff
    pc += 4
​
  elif opcode == 0x1e:
    if disassembly_mode and not no_stop:
      dis(pc, 'mov [r%s], aes([r%s], [r%s])' % (k, m, p))
    if debug_mode or not disassembly_mode:
      cipher = crypto.AES()
      write_bytes(text, reg[k], cipher.AESENC(read128(text, reg[m]), read128(text, reg[p])))
    pc += 4
​
  elif opcode in xor_opcodes.keys():
    reg_i, value = xor_opcodes[opcode]
    if disassembly_mode and not no_stop:
      dis(pc, 'xor r%s, %s' % (reg_i, hex(value)))
    if debug_mode or not disassembly_mode:
      reg[reg_i] ^= value
    pc += 4
​
  elif opcode == 0xfe:
    if disassembly_mode and not no_stop:
      dis(pc, 'ret\n')
      pc += 4
    if debug_mode or not disassembly_mode:
      pc = save_pc.pop()
​
  elif opcode == 0xff:
    if disassembly_mode and not no_stop:
      dis(pc, 'end\n')
      pc += 4
    if debug_mode or not disassembly_mode:
      break
​
  else:
    print("[-] %s: opcode %s not supported" % (pc, hex(opcode)))
    break
​
  if debug_mode and not no_stop:
    while True:
      command = input('> ')
      if command == '' or command == 'n':
        break
      elif command == 'c':
        no_stop = True
        break
      elif command[:2] == 'b ':
        breakpoints.append(int(command[2:], 16))
      else:
        print('Unknown command')
​
if not disassembly_mode or debug_mode:
  print('[+] Program ended with %s' % reg[0])