finished bomb lab 1-6

1 files changed, 102 insertions, 51 deletions

diff --git a/Content/posts/2023-10-04-bomb-lab.md b/Content/posts/2023-10-04-bomb-lab.md
index d72322f..c805279 100644
--- a/Content/posts/2023-10-04-bomb-lab.md
+++ b/Content/posts/2023-10-04-bomb-lab.md
@@ -1,23 +1,29 @@
 ---
 date: 2023-10-04 13:12
-description: Introduction, Phases 1-5 of Bomb Lab for CSCI 2400 Lab - 2
+description: Walkthrough of Phases 1-6 of Bomb Lab for CSCI 2400 Computer Systems Lab 2
 tags: gdb, reverse-engineering, c++, csci2400, assembly
 ---
 
-# Bomb Lab Phases 1-5
+# Bomb Lab
 
 ## Introduction
 
-Lab 2 for CSCI 2400 - Computer Systems. 
+Lab 2 for CSCI 2400 @ CU Boulder - Computer Systems
 
-I like using objdump to disassemble the code and see a broad overview of what is happening. 
+> The nefarious Dr. Evil has planted a slew of “binary bombs” on our class machines. A binary bomb is a program that consists of a sequence of phases. Each phase expects you to type a particular string on stdin. If you type the correct string, then the phase is defused and the bomb proceeds to the next phase. Otherwise, the bomb explodes by printing "BOOM!!!" and then terminating. The bomb is defused when every phase has been defused.
+
+> There are too many bombs for us to deal with, so we are giving each student a bomb to defuse. Your mission, which you have no choice but to accept, is to defuse your bomb before the due date. Good luck, and welcome to the bomb squad!
+
+I like using objdump to disassemble the code and get a broad overview of what is happening before I start. 
 
 `objdump -d bomb > dis.txt`
 
+*Note: I am not sure about the history of the bomb lab. I think it started at CMU.*
+
 ## Phase 1
 
-```
-jovyan@jupyter-nach6988:~/lab2-bomblab-navanchauhan/bombbomb$ gdb -ex 'break phase_1' -ex 'break explode_bomb' -ex 'run' ./bomb 
+```shell
+joxxxn@jupyter-nxxh6xx8:~/lab2-bomblab-navanchauhan/bombbomb$ gdb -ex 'break phase_1' -ex 'break explode_bomb' -ex 'run' ./bomb 
 GNU gdb (Ubuntu 12.1-0ubuntu1~22.04) 12.1
 Copyright (C) 2022 Free Software Foundation, Inc.
 License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
@@ -36,7 +42,7 @@ Type "apropos word" to search for commands related to "word"...
 Reading symbols from ./bomb...
 Breakpoint 1 at 0x15c7
 Breakpoint 2 at 0x1d4a
-Starting program: /home/jovyan/lab2-bomblab-navanchauhan/bombbomb/bomb 
+Starting program: /home/joxxxn/lab2-bomblab-navanchauhan/bombbomb/bomb 
 [Thread debugging using libthread_db enabled]
 Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
 Welcome to my fiendish little bomb. You have 6 phases with
@@ -68,7 +74,7 @@ $1 = 93824992244048
 
 ## Phase 2
 
-```
+```shell
 Phase 1 defused. How about the next one?
 1 2 3 4 5 6
 
@@ -106,7 +112,7 @@ End of assembler dump.
 (gdb) 
 ```
 
-```
+```shell
    0x00005555555555fd <+18>:    cmpl   $0x0,(%rsp)
    0x0000555555555601 <+22>:    js     0x55555555560d <phase_2+34>
 ...
@@ -116,7 +122,7 @@ End of assembler dump.
 The program first compares if the first number is not 0. If the number is not 0, then the `cmpl` instruction returns a negative value. The `js` instruction stands for jump if sign -> causing a jump to the specified address if the sign bit is set. This would result in the explode_bomb function being called.
 
 
-```
+```shell
    0x0000555555555603 <+24>:    mov    %rsp,%rbp
    0x0000555555555606 <+27>:    mov    $0x1,%ebx
 ```
@@ -129,13 +135,13 @@ By executing `mov %rsp,%rbp` we are setting the base pointer (`%rbp`) to point t
 Now, for the second instruction `mov $0x1,%ebx`, we are initalising the `%ebx` register with the value 1. Based on the assembly code, you can see that this is being used as a counter/index for the loop.
 
 
-```
+```shell
    0x000055555555560b <+32>:    jmp    0x555555555620 <phase_2+53>
 ```
 
 The program now jumps to <phase_2+53>
 
-```
+```shell
    0x0000555555555620 <+53>:    mov    %ebx,%eax
    0x0000555555555622 <+55>:    add    0x0(%rbp),%eax
    0x0000555555555625 <+58>:    cmp    %eax,0x4(%rbp)
@@ -150,7 +156,7 @@ Then, the value at the memory location pointed by `%rbp` is added to the value i
 
 `je 0x555555555614 <phase_2+41>` - The program will jump to `phase_2+41` if the previous `cmp` instruction determined the values as equal. 
 
-```
+```shell
    0x0000555555555614 <+41>:    add    $0x1,%ebx
    0x0000555555555617 <+44>:    add    $0x4,%rbp
    0x000055555555561b <+48>:    cmp    $0x6,%ebx
@@ -173,7 +179,7 @@ Thus,
 * 6th number = 10 (prev value) + 5 = 15
 
 
-```
+```shell
 ...
 Phase 1 defused. How about the next one?
 0 1 3 6 10 15
@@ -188,7 +194,7 @@ That's number 2.  Keep going!
 
 Let us look at the disassembled code first
 
-```
+```shell
 0000000000001638 <phase_3>:
     1638:	f3 0f 1e fa          	endbr64 
     163c:	48 83 ec 18          	sub    $0x18,%rsp
@@ -275,7 +281,7 @@ Let us look at the disassembled code first
     1797:	eb f4                	jmp    178d <phase_3+0x155>
 ```
 
-```
+```shell
 ...
     165b:	e8 80 fc ff ff       	call   12e0 <__isoc99_sscanf@plt>
 ...
@@ -285,8 +291,8 @@ We can see that `scanf` is being called which means we need to figure out what d
 
 Because I do not want to enter the solutions to phases 1 and 2 again and again, I am goig to pass a file which has these solutions.
 
-```
-jovyan@jupyter-nach6988:~/lab2-bomblab-navanchauhan/bombbomb$ gdb -ex 'break phase_3' -ex 'break explode_bomb' -ex 'run' -args ./bomb sol.txt 
+```shell
+joxxxn@jupyter-nxxh6xx8:~/lab2-bomblab-navanchauhan/bombbomb$ gdb -ex 'break phase_3' -ex 'break explode_bomb' -ex 'run' -args ./bomb sol.txt 
 GNU gdb (Ubuntu 12.1-0ubuntu1~22.04) 12.1
 Copyright (C) 2022 Free Software Foundation, Inc.
 License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
@@ -305,7 +311,7 @@ Type "apropos word" to search for commands related to "word"...
 Reading symbols from ./bomb...
 Breakpoint 1 at 0x1638
 Breakpoint 2 at 0x1d4a
-Starting program: /home/jovyan/lab2-bomblab-navanchauhan/bombbomb/bomb sol.txt
+Starting program: /home/joxxxn/lab2-bomblab-navanchauhan/bombbomb/bomb sol.txt
 [Thread debugging using libthread_db enabled]
 Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
 Welcome to my fiendish little bomb. You have 6 phases with
@@ -348,7 +354,7 @@ Dump of assembler code for function phase_3:
 
 `gdb` has thankfully marked the address which is being passed to `scanf`. We can access the value:
 
-```
+```shell
 (gdb) x/1s 0x5555555571b6
 0x5555555571b6: "%d %c %d"
 (gdb) 
@@ -356,7 +362,7 @@ Dump of assembler code for function phase_3:
 
 BINGO! The program expects an integer, character, and another integer. Onwards.
 
-```
+```shell
    0x0000555555555660 <+40>:    cmp    $0x2,%eax
    0x0000555555555663 <+43>:    jle    0x555555555685 <phase_3+77>
 ...
@@ -367,7 +373,7 @@ The program checks whether `scanf` returns a value <= 2, if it does then it call
 
 *Note: `scanf` returns the number of fields that were succesfully converted and assigned*
 
-```
+```shell
    0x0000555555555665 <+45>:    cmpl   $0x7,0xc(%rsp)
    0x000055555555566a <+50>:    ja     0x55555555577d <phase_3+325>
 ...
@@ -377,7 +383,7 @@ The program checks whether `scanf` returns a value <= 2, if it does then it call
 Similarly, the program checks and ensures the returned value is not > 7. 
 
 
-```
+```shell
    0x0000555555555670 <+56>:    mov    0xc(%rsp),%eax
    0x0000555555555674 <+60>:    lea    0x1b55(%rip),%rdx        # 0x5555555571d0
    0x000055555555567b <+67>:    movslq (%rdx,%rax,4),%rax
@@ -413,7 +419,7 @@ $1 = 3
 
 We can see that this makes us jump to `<phase_3+186>` (Continue to step through the code by using `ni`)
 
-```
+```shell
    0x00005555555556f2 <+186>:   mov    $0x64,%eax
    0x00005555555556f7 <+191>:   cmpl   $0x280,0x8(%rsp)
    0x00005555555556ff <+199>:   je     0x555555555787 <phase_3+335>
@@ -422,7 +428,7 @@ We can see that this makes us jump to `<phase_3+186>` (Continue to step through
 
 We see that `0x64` (Decimal 100) is being stored in `%eax`. Then, the program compares `0x280` (Decimal 640) with memory address `0x8` bytes above the stack pointer (`%rsp`). If the values are equal, then it jumps to `<phase_3+335>`, otherwise `explode_bomb` is called.
 
-```
+```shell
    0x0000555555555787 <+335>:   cmp    %al,0x7(%rsp)
    0x000055555555578b <+339>:   jne    0x555555555792 <phase_3+346>
    0x000055555555578d <+341>:   add    $0x18,%rsp
@@ -434,7 +440,7 @@ Here, the program is comparing the value of our given character to the value sto
 
 Knowing that the character is stored at an offset of 7 bytes to `%rsp`, we can print and check the value by running:
 
-```
+```shell
 (gdb) x/1cw $rsp+7
 c
 (gdb) print $al
@@ -443,7 +449,7 @@ $1 = 100
 
 We can simply lookup the [ASCII table](https://www.cs.cmu.edu/~pattis/15-1XX/common/handouts/ascii.html), and see that 100 in decimal stands for the character `d`. Let us try this answer:
 
-```
+```shell
 ...
 That's number 2.  Keep going!
 3 d 640
@@ -456,8 +462,8 @@ Halfway there!
 
 ## Phase 4
 
-```
-jovyan@jupyter-nach6988:~/lab2-bomblab-navanchauhan/bombbomb$ gdb -ex 'break phase_4' -ex 'break explode_bomb' -ex 'run' -args ./bomb sol.txt 
+```shell
+joxxxn@jupyter-nxxh6xx8:~/lab2-bomblab-navanchauhan/bombbomb$ gdb -ex 'break phase_4' -ex 'break explode_bomb' -ex 'run' -args ./bomb sol.txt 
 GNU gdb (Ubuntu 12.1-0ubuntu1~22.04) 12.1
 Copyright (C) 2022 Free Software Foundation, Inc.
 License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
@@ -476,7 +482,7 @@ Type "apropos word" to search for commands related to "word"...
 Reading symbols from ./bomb...
 Breakpoint 1 at 0x17d3
 Breakpoint 2 at 0x1d4a
-Starting program: /home/jovyan/lab2-bomblab-navanchauhan/bombbomb/bomb sol.txt
+Starting program: /home/joxxxn/lab2-bomblab-navanchauhan/bombbomb/bomb sol.txt
 [Thread debugging using libthread_db enabled]
 Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
 Welcome to my fiendish little bomb. You have 6 phases with
@@ -518,28 +524,28 @@ End of assembler dump.
 
 Again, `gdb` has marked the string being passed to `scanf`
 
-```
+```shell
 (gdb) x/1s 0x5555555573a6
 0x5555555573a6: "%d %d"
 ```
 
 Okay, so this time we are supposed to enter 2 numbers.
 
-```
+```shell
    0x00005555555557f6 <+35>:    cmp    $0x2,%eax
    0x00005555555557f9 <+38>:    jne    0x555555555802 <phase_4+47>
 ```
 
 Checks if there were 2 values read from calling `scanf`, if not -> jump to `<phase_4+47>` which calls `<explode_bomb>`.
 
-```
+```shell
    0x00005555555557fb <+40>:    cmpl   $0xe,0xc(%rsp)
    0x0000555555555800 <+45>:    jbe    0x555555555807 <phase_4+52>
 ```
 
 Compare `0xe` (14 in Decimal) and value stored at `$rsp` + `0xc` bytes (Decimal 12). If this condition is met (<= 14), jump to `<phase_4+52>`. If not, then explode bomb.
 
-```
+```shell
 ...
    0x0000555555555807 <+52>:    mov    $0xe,%edx
    0x000055555555580c <+57>:    mov    $0x0,%esi
@@ -557,7 +563,7 @@ Compare `0xe` (14 in Decimal) and value stored at `$rsp` + `0xc` bytes (Decimal
 
 Let us look into `func4`
 
-```
+```shell
 (gdb) disas func4
 Dump of assembler code for function func4:
    0x0000555555555799 <+0>:     endbr64 
@@ -586,7 +592,7 @@ This looks like a recursive function :(  (I hate recursive functions)
 
 Let's annotate the instructions.
 
-```
+```shell
 endbr64
 sub $0x8,%rsp  // subtract 8 bytes from the stack pointer
 mov %edx,%ecx  // Move the value in register %edx to %ecx
@@ -633,14 +639,14 @@ Okay, so we know that the number needed to be passed to `func4` is 5. But, what
 
 If we go back to the code for `<phase_4>`, we can see that:
 
-```
+```shell
    0x000055555555581f <+76>:    cmpl   $0x2,0x8(%rsp)
    0x0000555555555824 <+81>:    je     0x55555555582b <phase_4+88>
 ```
 
 The value at `$rsp+8` should be equal to 2. So, let us try passing `5 2` as our input.
 
-```
+```shell
 ...
 Phase 1 defused. How about the next one?
 That's number 2.  Keep going!
@@ -655,7 +661,7 @@ So you got that one.  Try this one.
 
 ## Phase 5
 
-```
+```shell
 So you got that one.  Try this one.
 test string
 
@@ -695,7 +701,7 @@ End of assembler dump.
 (gdb) 
 ```
 
-```
+```shell
 ...
    0x000055555555583c <+12>:    call   0x555555555b10 <string_length>
    0x0000555555555841 <+17>:    cmp    $0x6,%eax
@@ -723,7 +729,7 @@ We can also see a similar pattern compared to Phase 2, where we had a loop:
 
 We can check the reference string we need, which `gdb` has marked as `# 0x5555555571bf`, and the lookup table marked as `# 0x5555555571f0 <array.0>`
 
-```
+```shell
 (gdb) x/s 0x5555555571bf
 0x5555555571bf: "bruins"
 (gdb) x/s 0x5555555571f0
@@ -761,7 +767,7 @@ s -> g
 
 Let us try out this answer:
 
-```
+```shell
 ...
 That's number 2.  Keep going!
 Halfway there!
@@ -778,7 +784,7 @@ Awesome!
 
 ## Phase 6
 
-```
+```shell
 Good work!  On to the next...
 test string
 
@@ -887,7 +893,7 @@ Again, we see the familiar `read_six_digits` function.
 
 Let us analyse this function in chunks:
 
-```
+```shell
    0x00005555555558bb <+34>:    call   0x555555555d97 <read_six_numbers>
    0x00005555555558c0 <+39>:    mov    %r14,%r12
    0x00005555555558c3 <+42>:    mov    $0x1,%r15d
@@ -902,7 +908,7 @@ Let us analyse this function in chunks:
    2.3. `mov %r14,%r13`: The value is also copied to `%r13`
 3. Jump to start of loop:
 
-```
+```shell
    0x0000555555555997 <+254>:   mov    %r14,%rbp
    0x000055555555599a <+257>:   mov    (%r14),%eax
    0x000055555555599d <+260>:   sub    $0x1,%eax
@@ -920,21 +926,21 @@ Let us analyse this function in chunks:
 
 => All numbers should be between 1 and 6.
 
-```
+```shell
    0x00005555555559a9 <+272>:   cmp    $0x5,%r15d
    0x00005555555559ad <+276>:   jg     0x5555555558f9 <phase_6+96>
 ```
 
 This checks if the value stored in `%r15` is > 5, if it is then it jumps somewhere else. This validates our assumption that `%r15` is acting as a counter.
 
-```
+```shell
    0x00005555555559b3 <+282>:   mov    %r15,%rbx
    0x00005555555559b6 <+285>:   jmp    0x5555555558e8 <phase_6+79>
 ```
 
 Let us jump to +79
 
-```
+```shell
    0x00005555555558e8 <+79>:    mov    0x0(%r13,%rbx,4),%eax
    0x00005555555558ed <+84>:    cmp    %eax,0x0(%rbp)
    0x00005555555558f0 <+87>:    jne    0x5555555558db <phase_6+66>
@@ -944,7 +950,7 @@ Let us jump to +79
 
 This section deals with checking if all the numbers in the sequence are unique or not. Thus, we need to ensure out 6 digits are unique
 
-```
+```shell
    0x00005555555558db <+66>:    add    $0x1,%rbx // Increments by 1
    0x00005555555558df <+70>:    cmp    $0x5,%ebx 
    0x00005555555558e2 <+73>:    jg     0x55555555598f <phase_6+246> // Jump if > 5 (Loop iterations are complete)
@@ -961,7 +967,7 @@ After stepping through the instructions, we can also see that the numbers are be
 
 Let us try to figure out what `   0x0000555555555928 <+143>:   lea    0x3d01(%rip),%rdx        # 0x555555559630 <node1>` is:
 
-```
+```shell
 (gdb) x/30wx 0x555555559630
 0x555555559630 <node1>: 0x000000d9      0x00000001      0x55559640      0x00005555
 0x555555559640 <node2>: 0x000003ab      0x00000002      0x55559650      0x00005555
@@ -993,4 +999,49 @@ struct node {
 };
 ```
 
-Let us convert the values into decimal
+Let us convert the values into decimal:
+
+```
+0x000000d9 -> 217
+0x000003ab -> 939
+0x0000014f -> 335
+0x000000a1 -> 161
+0x000001b3 -> 435
+0x000002da -> 730
+```
+
+**Missing Notes**
+
+To re-arrange this linked list in descending order, we would arrange it as follows:
+
+```
+Node 2 -> Node 6 -> Node 5 -> Node 3 -> Node 1 -> Node 4
+```
+
+Since we also need to apply the transformation: `7 - x`:
+
+```
+(7-2) -> (7-6) -> ... -> (7-4) 
+```
+
+Final answer: `5 1 2 4 6 3`
+
+Let us try the answer:
+
+```
+...
+That's number 2.  Keep going!
+Halfway there!
+So you got that one.  Try this one.
+Good work!  On to the next...
+5 1 2 4 6 3
+
+Breakpoint 1, 0x0000555555555899 in phase_6 ()
+(gdb) continue
+Continuing.
+Congratulations! You've defused the bomb!
+Your instructor has been notified and will verify your solution.
+[Inferior 1 (process 1754) exited normally]
+```
+
+But, what about the secret phase?
\ No newline at end of file