Exploiting Password Weaknesses in Physical Security

Locks are only as secure as the codes humans choose to assign to them. As a mnemonic, the security officers who set the codes often use six-letter words which are translated into codes using the mapping from a phone keypad. Using a phone keypad mapping on six-letter English dictionary words is the physical security equivalent of a website’s arbitrarily limiting passwords to eight characters.

PHDays CTF Quals 2014 Write-up: "turututu"

Reversing this program is made frustrating by the fact that it was written in OCaml, generating many instructions that maintain internal structures, check stack alignment, etc.  It becomes clear that in order to get the flag, we must pass the checks performed by each function within a list.