Rating:

Solution with 1-stage ROP, performing 32768 Pin verifications, to exploit a timing attack on PIN verification.

Original writeup (https://learnhackpwn.com/2020/11/20/donjon-ctf-picohsm-series-write-up-2-3/).