HellGates, custom CPU gate-level challenge
5 hours ago
- Custom 32-bit CPU with encrypted, bit-addressable memory designed in VHDL and synthesized to a heavily obfuscated gate-level netlist.
- CPU features 16 general-purpose registers plus special registers for overflow, condition flags, program counter, key modifiers, and a TEA pseudo-random state.
- Memory encryption uses two-layer TEA: dynamically generated word keys from CPU state, plus key encryption keys (KEK) based on nonce and word index to prevent side-channel attacks.
- Word indexes are permuted to scatter the program across a 1GB data.bin, mixed with entropy data.
- Weakness in state encryption (simple XOR and addition with fake_values) allowed a side-channel/differential analysis attack.
- GPT-6 solved the challenge in under 30 minutes by exploiting the side-channel, calling the netlist with proper CPU state to decrypt memory.
- The program (written in custom assembly hgasm) includes LCD display, password checking, anti-debug, anti-tamper, timing checks, and animated skull.
- Host-side obfuscation includes recursively encrypted nested shellcodes (CXE), runtime decryption via exception handlers, and control-flow obfuscation using nanomites (int3, SIGSEGV).
- Toolchains used: yosys, GHDL, blif2cpp, LLVM, ELFIO, and a custom linker script for shellcode generation.
- Author acknowledges the solution was partial (side-channel only) and plans a next-generation challenge with no practical side-channels.