Twilight 001 – DrUnK MoDe

Easter Eggs’s… gotta love them.

Software is constructed in a certain way: it’s a systematic combination of machine code and user interaction. When looking at a program, it’s possible to recognize parts that are intended for end users: images, text messages, metadata. The first release was a direct hit, with the following text popping up somewhere:

“Àt¾~ýWšzò¾þüWšzòÆFÿ ë&‹†úü‹–üü)†öü–øüéUÿšŠò ÀtÆFÿ ëÆFÿŠFÿÉÊ P dRuNk mode activated! ;) (Hit any key) P dRuNk mode deactivated… (Hit any key) .ZIPP This program cannot be copied! (Hit a key) P Copy to: [ ] P Copying, please wait… P File succesfully copied! (Hit a key) O Error copying file! (Hit any key) ”

dRuNk mode? After starting the Twilight Menu the dRuNk mode was nowhere to be found. It had to be some kind of key-combination. Still nothing. So it was time to do some heave lifting in machine instructions: assembly. With the right tools you do not need to be a genious to somewhat understand what’s happening in assembly.

IDA TIME

With a tool called IDA we could disassemble MENU.EXE into a series of routines. Within the tool it was also possible to search for a certain string. We found that dRuNk mode was located near other functionality that handles keyboard input. This meant we needed to look for the keyboard. It also was in the same routine that enables installing of applications… these where the hints we needed.

Disassembled code in IDA

Eureka

By pressing Control + Enter on the Release Info, dRuNk mode is activated. Normally this key combination can be used to install applications. It’s a switch.