CTF/0ctf/EzLogic

EzLogic

Problem

Our task is to reverse engineer a flag checker implemented on an FPGA.The hardware system is constructed from a netlist synthesized by Xilinx Vivado, where the netlist serves a role similar to assembly language in the software domain, representing a lower-level, more hardware-specific description. The netlist is described using Verilog, enabling convenient simulation of the system.

Knowledge

If you find yourself new to Verilog or digital integrated circuit design, that's completely fine. We're here to help with a recommended Verilog syntax tutorial and an official manual covering all the foundational components used in the netlist.

• Verilog Syntax: https://www.chipverify.com/tutorials/verilog
• FPGA Design Elements: https://docs.amd.com/r/en-US/ug953-vivado-7series-libraries/Design-Elements

Simulation

For system simulation, you can choose one of the following tools:

• Xilinx Vivado (free version is enough)
• Icarus Verilog and gtkwave (open-source software)

Using Vivado

1. Install Vivado HL WebPACK version (must select Zynq 7000 series boards support)
2. Create a project (just click "next" to the end, nothing is needed to configure)
3. In "sources" window, add the Verilog files (*.v) to simulation sources
4. Run simulation (run until stops)
5. Watch the value of signal success or check the output message in "Tcl Console"

Using Icarus Verilog

1. Installing iverilog and gtkwave

sudo apt-get install iverilog gtkwave

2. Compilation Note: Zynq 7000 FPGA primitives (FDCE, LUT, ...) are not supported by iverilog, so behavioral models for these components are provided for simulation purposes.

iverilog -s EzLogic_tb -o EzLogic.vvp ./problem/EzLogic_top_synth.v ./problem/EzLogic_tb.v  ./behavioral\ models/*.v

If successful, you can see EzLogic.vvp file in the folder.

3. Running the Simulation

vvp EzLogic.vvp

The results of the check are printed on the terminal.

4. Viewing in Graph Form If you want to check internal signals, just use gtkwave.

gtkwave EzLogic.vcd

Hints

• A schematic printout is included in schematic folder, which can greatly assist you in understanding the data pathways and program logic. (Only for EzLogic)
• Variable names are auto-generated by Vivado Synthesizer and don't necessarily mean anything; don't be confused by the names.