UIUC eCTF 2026

This repository contains the implementation of UIUC's hardware security module (HSM) system for the MITRE eCTF 2026 competition.

Design

Setup

Building the design requires a global.secrets file in the root directory of the repository. A sample file is available in sample.global.secrets, and needs to be copied and edited if necessary.

Contributing Code

To maintain a consistent code style and prevent some code patterns that might cause unintended problems we use clippy and rustfmt in our GitHub Actions CI. Before pushing your code, please make sure to run these two tools locally and fix any warnings and errors they report, the CI will otherwise fail.

For clippy, run the following command:

cargo clippy --bins --no-default-features -- -D warnings

For rustfmt, run the following command:

cargo fmt --all --check

Debugging

You can use the probe-rs debugger on the mspm0 board for features like break point and single stepping.

To configure for VS Code, first install the probe-rs extension. Then copy launch.probers.json to launch.json and tasks.probers.json to tasks.json, or integrate the contents in these two files into your existing launch.json and tasks.json.

Notice that you'll need to modify the "programBinary" field in launch.json to the path of the binary you want to debug.

For more information, please refer to the debugger section of the official documentation.

Design Documentation

To build the Design Documentation, you can run the following command:

nix build .#doc --extra-experimental-features nix-command --extra-experimental-features fl
akes

You can also download the automatically-built pdf document from GitHub Actions.

To do so, first click "Actions":

Then find the newest build:

And download the docs-pdf artifact:

MITRE Bootloaders

Downloading + Patching

Bootloaders can be downloaded + patched (to be installed with probe-rs) as follows:

• Insecure (LITO boards): nix build .#insecure-bl

• Launchpad: nix build .#launchpad-bl

If not using Nix, first download the bootloader. Then, run

arm-none-eabi-objcopy \
    --remove-section=.BCRConfig \
    --remove-section=.BSLConfig \
    2026.0.2.insecure.out \
    result

Flashing

probe-rs download \
    result \
    --protocol=swd \
    --chip=MSPM0L2228

Usage

Verify the bootloader is successfully loaded:

uvx ectf hw PORT status

Tip

If this fails with "Could not get status! Reboot board and try again", and reboots don't work, try flashing the > design normally (cargo run --release) and then re-flash the bootloader.

Rebuild the design with required features (Note: for production builds, use the command in build.sh):

HSM_PIN='xxxxxx' PERMISSIONS='x=RWC:x=RWC' cargo build --release --no-default-features

Convert the design to a binary:

arm-none-eabi-objcopy -O binary target/thumbv6m-none-eabi/release/hsm target/thumbv6m-none-eabi/release/hsm.bin

Then, flash the binary to the board:

uvx ectf hw PORT reflash -n 'hsm' target/thumbv6m-none-eabi/release