Fix lint

Author: b1r1b1r1

assets/scss/post.scss

@@ -85,6 +85,7 @@
   pre {
     overflow-x: auto;
     background-color: #272822;
+    padding: 5px;
   }
 
   ol {

content/blog/googlectf2024-auxin2/index.md

@@ -11,19 +11,21 @@ tldr: "codegolf uxntal assembly challenge"
 date: "2024-06-25T18:22:53+03:00"
 tags: [misc]
 summary: |
-  We were given a ROM for the Varvara system running on Uxntal assembly. The ROM loads the provided shellcode into memory, checks if the lower 4 bits of each byte are not in [0, 2, 3, 6, 7, 0xe], and if true, executes it. The goal is to read the flag located at "flag".
+  We were given a ROM for the Varvara system running on Uxntal assembly. The ROM loads the provided shellcode into memory, checks if the lower 4 bits of each byte are not in [0, 2, 3, 6, 7, 0xe], and if true, executes it. The goal is to read the flag located at `"flag"`.
 ---
 
 ## Basics
 
-We were given a ROM for the Varvara system running on Uxntal assembly. The ROM loads the provided shellcode into memory, checks if the lower 4 bits of each byte are not in [0, 2, 3, 6, 7, 0xe], and if true, executes it. The goal is to read the flag located at `flag`.
+We were given a ROM for the Varvara system running on Uxntal assembly. The ROM loads the provided shellcode into memory, checks if the lower 4 bits of each byte are not in [0, 2, 3, 6, 7, 0xe], and if true, executes it. The goal is to read the flag located at `"flag"`.
 
 ## The ROM
 
 The provided script simply runs:
+
 ```python
 subprocess.run(['./uxncli', 'auxin2.rom', s], timeout=0.5, capture_output=True)
 ```
+
 and gives us the output. The [ROM](auxin2.rom) loads the provided hex-encoded code to address 0x1d0, checks the lower 4 bits of each byte, and executes it if they are not forbidden. Our output has to be <= 112 bytes.
 
 ## Shellcode Without Constraints
@@ -45,7 +47,9 @@ We communicate with the I/O through `DEO` and `DEI` to load the flag at a specif
 
 ## Initial Plan
 
-After deliberation, we decided to write a self-modifying shellcode, where the last n bytes are the shellcode itself without forbidden bytes, and the prior bytes modify the shellcode to contain forbidden bytes. Here is the instruction table (forbidden instructions are marked in red): ![Opcode Table](opcode_table.webp)
+After deliberation, we decided to write a self-modifying shellcode, where the last n bytes are the shellcode itself without forbidden bytes, and the prior bytes modify the shellcode to contain forbidden bytes. Here is the instruction table (forbidden instructions are marked in red):
+
+![Opcode Table](opcode_table.webp)
 
 No `PUSH`, `POP`, `DEO`, `DEI`, or `DUP` are allowed. Luckily, most instructions in this assembly come with a `k` variant, meaning the instruction will execute but not pop values from the stack. Since the `INC` instruction is allowed, we come up with the following plan:
 
@@ -75,7 +79,9 @@ LDA2k INC2 SWP2 STA2k
 The final step is to obtain the address 0x223 (where our shellcode to be changed starts). Luckily, one of our teammates comes up with a way to do so using the initial state of the stack ([02, 04]). All we have to do then is implement the [program](decoder.tal) and write a short [script](pepe.py) which substitutes the address we read from to (0x151 + offset) and uses one of the tricks on it if necessary. The Uxn binaries needed to run the script can be downloaded from [here](https://git.sr.ht/~rabbits/uxn).
 
 ## Flag
-CTF{Sorry__n0_Music_thi5_t1m3}
+
+CTF{Sorry\_\_n0_Music_thi5_t1m3}
 
 ## Conclusion
+
 A pretty interesting but relatively simple code golf challenge. Interestingly, the final program has only 3 or so bytes to spare, so we are quite close to the limit.