You’re taking a stroll in the lab, when Dr. Klostermann is calling your name: "Agent, we’ve discovered the origin of the device. This time you won’t be able to reach your destination by air, but by the new Trans-Sibiriean Railway, as opposed to the old one, which runs along side it at the same time, it is a bit odd. And it goes to Shenzhen. I am sorry agent, but the further you go into this task, the more precautions you will have to take, and remember, the enemy can be anyone. It could be a conductor, the engineer, it could even be our own people that will meet you at the spot you need to be at. Be selective with who you trust. I think you got the point, go now, I got much to do. Agent, much depends on you!."
When opening the attachment, we can find two files: `chal.c` and `pico.uf2`.
Before this challenge I had never heard of a `uf2` file, but from googling "pico.uf2", I found that it is probably a firmware file for the Paspberry Pi Pico.
While I would have loved to play around with that, I didn't have one at hand. So we'll have to do with the `chal.c` file (which is probably the file running in the firmware).
In this code, we see a lot of calls to the functions `gpio_set_mask()` and `gpio_clr_mask()`. When looking up what these to, we find [this documentation](https://raspberrypi.github.io/pico-sdk-doxygen/group__hardware__gpio.html):
All this script does, is read the `chal.c` file line by line. If the line contains either the `gpio_set_mask()` or the `gpio_clr_mask()` function, it gets the location of the parameter and appends it to a list.
In the end we get two lists: `set_masks` and `clr_masks`.
### Applying the masks
Now comes the more difficult part, we have to apply these masks.
For setting the masks, we can use the bitwise OR operation (`|`). It works like this:
| State | Value |
| ------------- | --------------- |
| Initial value | `1001 0101` |
| Bitmask | **`1111 0000`** |
| Result | `1111 0101` |
As we can see in this table, it now set the bytes passed to `gpio_set_mask()` to true.
Clearing the masks is a little harder. For this we'll need to first invert the bitmask (`~`), and than use the bistwise AND operation (`&`) with the current value. It would work like this:
| State | Value |
| -------------- | --------------- |
| Initial value | `1111 0101` |
| Bitmask | **`1100 0010`** |
| Invert bismask | **`0011 1101`** |
| Result | `0011 0101` |
If we turn this into a python script, it would look like this:
```py
current_output = 0
flag = ""
for set_mask, clr_mask in zip(set_masks, clr_masks):
