diff options
| author | Navan Chauhan <navanchauhan@gmail.com> | 2023-10-16 16:04:29 -0600 |
|---|---|---|
| committer | Navan Chauhan <navanchauhan@gmail.com> | 2023-10-16 16:04:29 -0600 |
| commit | 48d3baf9803f673a101f6360a3d40b8211ec3e10 (patch) | |
| tree | d38655908277c204704d1ac9deac408b95deb78b /docs/posts/2023-10-04-bomb-lab.html | |
| parent | 13d2fc49885c271b4b3d0235e286588b93c63a86 (diff) | |
update dependencies
Diffstat (limited to 'docs/posts/2023-10-04-bomb-lab.html')
| -rw-r--r-- | docs/posts/2023-10-04-bomb-lab.html | 1356 |
1 files changed, 687 insertions, 669 deletions
diff --git a/docs/posts/2023-10-04-bomb-lab.html b/docs/posts/2023-10-04-bomb-lab.html index 226487f..2c9518c 100644 --- a/docs/posts/2023-10-04-bomb-lab.html +++ b/docs/posts/2023-10-04-bomb-lab.html @@ -77,130 +77,133 @@ <h2>Phase 1</h2> <div class="codehilite"> -<pre><span></span><code>joxxxn@jupyter-nxxh6xx8:~/lab2-bomblab-navanchauhan/bombbomb$ gdb -ex <span class="s1">'break phase_1'</span> -ex <span class="s1">'break explode_bomb'</span> -ex <span class="s1">'run'</span> ./bomb -GNU gdb <span class="o">(</span>Ubuntu <span class="m">12</span>.1-0ubuntu1~22.04<span class="o">)</span> <span class="m">12</span>.1 -Copyright <span class="o">(</span>C<span class="o">)</span> <span class="m">2022</span> Free Software Foundation, Inc. -License GPLv3+: GNU GPL version <span class="m">3</span> or later <http://gnu.org/licenses/gpl.html> -This is free software: you are free to change and redistribute it. -There is NO WARRANTY, to the extent permitted by law. -Type <span class="s2">"show copying"</span> and <span class="s2">"show warranty"</span> <span class="k">for</span> details. -This GDB was configured as <span class="s2">"x86_64-linux-gnu"</span>. -Type <span class="s2">"show configuration"</span> <span class="k">for</span> configuration details. -For bug reporting instructions, please see: +<pre><span></span><code>joxxxn@jupyter-nxxh6xx8:~/lab2-bomblab-navanchauhan/bombbomb$<span class="w"> </span>gdb<span class="w"> </span>-ex<span class="w"> </span><span class="s1">'break phase_1'</span><span class="w"> </span>-ex<span class="w"> </span><span class="s1">'break explode_bomb'</span><span class="w"> </span>-ex<span class="w"> </span><span class="s1">'run'</span><span class="w"> </span>./bomb<span class="w"> </span> +GNU<span class="w"> </span>gdb<span class="w"> </span><span class="o">(</span>Ubuntu<span class="w"> </span><span class="m">12</span>.1-0ubuntu1~22.04<span class="o">)</span><span class="w"> </span><span class="m">12</span>.1 +Copyright<span class="w"> </span><span class="o">(</span>C<span class="o">)</span><span class="w"> </span><span class="m">2022</span><span class="w"> </span>Free<span class="w"> </span>Software<span class="w"> </span>Foundation,<span class="w"> </span>Inc. +License<span class="w"> </span>GPLv3+:<span class="w"> </span>GNU<span class="w"> </span>GPL<span class="w"> </span>version<span class="w"> </span><span class="m">3</span><span class="w"> </span>or<span class="w"> </span>later<span class="w"> </span><http://gnu.org/licenses/gpl.html> +This<span class="w"> </span>is<span class="w"> </span>free<span class="w"> </span>software:<span class="w"> </span>you<span class="w"> </span>are<span class="w"> </span>free<span class="w"> </span>to<span class="w"> </span>change<span class="w"> </span>and<span class="w"> </span>redistribute<span class="w"> </span>it. +There<span class="w"> </span>is<span class="w"> </span>NO<span class="w"> </span>WARRANTY,<span class="w"> </span>to<span class="w"> </span>the<span class="w"> </span>extent<span class="w"> </span>permitted<span class="w"> </span>by<span class="w"> </span>law. +Type<span class="w"> </span><span class="s2">"show copying"</span><span class="w"> </span>and<span class="w"> </span><span class="s2">"show warranty"</span><span class="w"> </span><span class="k">for</span><span class="w"> </span>details. +This<span class="w"> </span>GDB<span class="w"> </span>was<span class="w"> </span>configured<span class="w"> </span>as<span class="w"> </span><span class="s2">"x86_64-linux-gnu"</span>. +Type<span class="w"> </span><span class="s2">"show configuration"</span><span class="w"> </span><span class="k">for</span><span class="w"> </span>configuration<span class="w"> </span>details. +For<span class="w"> </span>bug<span class="w"> </span>reporting<span class="w"> </span>instructions,<span class="w"> </span>please<span class="w"> </span>see: <https://www.gnu.org/software/gdb/bugs/>. -Find the GDB manual and other documentation resources online at: - <http://www.gnu.org/software/gdb/documentation/>. - -For help, <span class="nb">type</span> <span class="s2">"help"</span>. -Type <span class="s2">"apropos word"</span> to search <span class="k">for</span> commands related to <span class="s2">"word"</span>... -Reading symbols from ./bomb... -Breakpoint <span class="m">1</span> at 0x15c7 -Breakpoint <span class="m">2</span> at 0x1d4a -Starting program: /home/joxxxn/lab2-bomblab-navanchauhan/bombbomb/bomb -<span class="o">[</span>Thread debugging using libthread_db enabled<span class="o">]</span> -Using host libthread_db library <span class="s2">"/lib/x86_64-linux-gnu/libthread_db.so.1"</span>. -Welcome to my fiendish little bomb. You have <span class="m">6</span> phases with -which to blow yourself up. Have a nice day! -<span class="nb">test</span> string - -Breakpoint <span class="m">1</span>, 0x00005555555555c7 <span class="k">in</span> phase_1 <span class="o">()</span> -<span class="o">(</span>gdb<span class="o">)</span> dias phase_1 -Undefined command: <span class="s2">"dias"</span>. Try <span class="s2">"help"</span>. -<span class="o">(</span>gdb<span class="o">)</span> disas phase_1 -Dump of assembler code <span class="k">for</span> <span class="k">function</span> phase_1: -<span class="o">=</span>> 0x00005555555555c7 <+0>: endbr64 - 0x00005555555555cb <+4>: sub <span class="nv">$0</span>x8,%rsp - 0x00005555555555cf <+8>: lea 0x1b7a<span class="o">(</span>%rip<span class="o">)</span>,%rsi <span class="c1"># 0x555555557150</span> - 0x00005555555555d6 <+15>: call 0x555555555b31 <strings_not_equal> - 0x00005555555555db <+20>: <span class="nb">test</span> %eax,%eax - 0x00005555555555dd <+22>: jne 0x5555555555e4 <phase_1+29> - 0x00005555555555df <+24>: add <span class="nv">$0</span>x8,%rsp - 0x00005555555555e3 <+28>: ret - 0x00005555555555e4 <+29>: call 0x555555555d4a <explode_bomb> - 0x00005555555555e9 <+34>: jmp 0x5555555555df <phase_1+24> -End of assembler dump. -<span class="o">(</span>gdb<span class="o">)</span> print 0x555555557150 -<span class="nv">$1</span> <span class="o">=</span> <span class="m">93824992244048</span> -<span class="o">(</span>gdb<span class="o">)</span> x/1s 0x555555557150 -0x555555557150: <span class="s2">"Controlling complexity is the essence of computer programming."</span> -<span class="o">(</span>gdb<span class="o">)</span> +Find<span class="w"> </span>the<span class="w"> </span>GDB<span class="w"> </span>manual<span class="w"> </span>and<span class="w"> </span>other<span class="w"> </span>documentation<span class="w"> </span>resources<span class="w"> </span>online<span class="w"> </span>at: +<span class="w"> </span><http://www.gnu.org/software/gdb/documentation/>. + +For<span class="w"> </span>help,<span class="w"> </span><span class="nb">type</span><span class="w"> </span><span class="s2">"help"</span>. +Type<span class="w"> </span><span class="s2">"apropos word"</span><span class="w"> </span>to<span class="w"> </span>search<span class="w"> </span><span class="k">for</span><span class="w"> </span>commands<span class="w"> </span>related<span class="w"> </span>to<span class="w"> </span><span class="s2">"word"</span>... +Reading<span class="w"> </span>symbols<span class="w"> </span>from<span class="w"> </span>./bomb... +Breakpoint<span class="w"> </span><span class="m">1</span><span class="w"> </span>at<span class="w"> </span>0x15c7 +Breakpoint<span class="w"> </span><span class="m">2</span><span class="w"> </span>at<span class="w"> </span>0x1d4a +Starting<span class="w"> </span>program:<span class="w"> </span>/home/joxxxn/lab2-bomblab-navanchauhan/bombbomb/bomb<span class="w"> </span> +<span class="o">[</span>Thread<span class="w"> </span>debugging<span class="w"> </span>using<span class="w"> </span>libthread_db<span class="w"> </span>enabled<span class="o">]</span> +Using<span class="w"> </span>host<span class="w"> </span>libthread_db<span class="w"> </span>library<span class="w"> </span><span class="s2">"/lib/x86_64-linux-gnu/libthread_db.so.1"</span>. +Welcome<span class="w"> </span>to<span class="w"> </span>my<span class="w"> </span>fiendish<span class="w"> </span>little<span class="w"> </span>bomb.<span class="w"> </span>You<span class="w"> </span>have<span class="w"> </span><span class="m">6</span><span class="w"> </span>phases<span class="w"> </span>with +which<span class="w"> </span>to<span class="w"> </span>blow<span class="w"> </span>yourself<span class="w"> </span>up.<span class="w"> </span>Have<span class="w"> </span>a<span class="w"> </span>nice<span class="w"> </span>day! +<span class="nb">test</span><span class="w"> </span>string + +Breakpoint<span class="w"> </span><span class="m">1</span>,<span class="w"> </span>0x00005555555555c7<span class="w"> </span><span class="k">in</span><span class="w"> </span>phase_1<span class="w"> </span><span class="o">()</span> +<span class="o">(</span>gdb<span class="o">)</span><span class="w"> </span>dias<span class="w"> </span>phase_1 +Undefined<span class="w"> </span>command:<span class="w"> </span><span class="s2">"dias"</span>.<span class="w"> </span>Try<span class="w"> </span><span class="s2">"help"</span>. +<span class="o">(</span>gdb<span class="o">)</span><span class="w"> </span>disas<span class="w"> </span>phase_1 +Dump<span class="w"> </span>of<span class="w"> </span>assembler<span class="w"> </span>code<span class="w"> </span><span class="k">for</span><span class="w"> </span><span class="k">function</span><span class="w"> </span>phase_1: +<span class="o">=</span>><span class="w"> </span>0x00005555555555c7<span class="w"> </span><+0>:<span class="w"> </span>endbr64<span class="w"> </span> +<span class="w"> </span>0x00005555555555cb<span class="w"> </span><+4>:<span class="w"> </span>sub<span class="w"> </span><span class="nv">$0</span>x8,%rsp +<span class="w"> </span>0x00005555555555cf<span class="w"> </span><+8>:<span class="w"> </span>lea<span class="w"> </span>0x1b7a<span class="o">(</span>%rip<span class="o">)</span>,%rsi<span class="w"> </span><span class="c1"># 0x555555557150</span> +<span class="w"> </span>0x00005555555555d6<span class="w"> </span><+15>:<span class="w"> </span>call<span class="w"> </span>0x555555555b31<span class="w"> </span><strings_not_equal> +<span class="w"> </span>0x00005555555555db<span class="w"> </span><+20>:<span class="w"> </span><span class="nb">test</span><span class="w"> </span>%eax,%eax +<span class="w"> </span>0x00005555555555dd<span class="w"> </span><+22>:<span class="w"> </span>jne<span class="w"> </span>0x5555555555e4<span class="w"> </span><phase_1+29> +<span class="w"> </span>0x00005555555555df<span class="w"> </span><+24>:<span class="w"> </span>add<span class="w"> </span><span class="nv">$0</span>x8,%rsp +<span class="w"> </span>0x00005555555555e3<span class="w"> </span><+28>:<span class="w"> </span>ret<span class="w"> </span> +<span class="w"> </span>0x00005555555555e4<span class="w"> </span><+29>:<span class="w"> </span>call<span class="w"> </span>0x555555555d4a<span class="w"> </span><explode_bomb> +<span class="w"> </span>0x00005555555555e9<span class="w"> </span><+34>:<span class="w"> </span>jmp<span class="w"> </span>0x5555555555df<span class="w"> </span><phase_1+24> +End<span class="w"> </span>of<span class="w"> </span>assembler<span class="w"> </span>dump. +<span class="o">(</span>gdb<span class="o">)</span><span class="w"> </span>print<span class="w"> </span>0x555555557150 +<span class="nv">$1</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="m">93824992244048</span> +<span class="o">(</span>gdb<span class="o">)</span><span class="w"> </span>x/1s<span class="w"> </span>0x555555557150 +0x555555557150:<span class="w"> </span><span class="s2">"Controlling complexity is the essence of computer programming."</span> +<span class="o">(</span>gdb<span class="o">)</span><span class="w"> </span> </code></pre> </div> <h2>Phase 2</h2> <div class="codehilite"> -<pre><span></span><code>Phase <span class="m">1</span> defused. How about the next one? -<span class="m">1</span> <span class="m">2</span> <span class="m">3</span> <span class="m">4</span> <span class="m">5</span> <span class="m">6</span> - -Breakpoint <span class="m">1</span>, 0x00005555555555eb <span class="k">in</span> phase_2 <span class="o">()</span> -<span class="o">(</span>gdb<span class="o">)</span> disas -Dump of assembler code <span class="k">for</span> <span class="k">function</span> phase_2: -<span class="o">=</span>> 0x00005555555555eb <+0>: endbr64 - 0x00005555555555ef <+4>: push %rbp - 0x00005555555555f0 <+5>: push %rbx - 0x00005555555555f1 <+6>: sub <span class="nv">$0</span>x28,%rsp - 0x00005555555555f5 <+10>: mov %rsp,%rsi - 0x00005555555555f8 <+13>: call 0x555555555d97 <read_six_numbers> - 0x00005555555555fd <+18>: cmpl <span class="nv">$0</span>x0,<span class="o">(</span>%rsp<span class="o">)</span> - 0x0000555555555601 <+22>: js 0x55555555560d <phase_2+34> - 0x0000555555555603 <+24>: mov %rsp,%rbp - 0x0000555555555606 <+27>: mov <span class="nv">$0</span>x1,%ebx - 0x000055555555560b <+32>: jmp 0x555555555620 <phase_2+53> - 0x000055555555560d <+34>: call 0x555555555d4a <explode_bomb> - 0x0000555555555612 <+39>: jmp 0x555555555603 <phase_2+24> - 0x0000555555555614 <+41>: add <span class="nv">$0</span>x1,%ebx - 0x0000555555555617 <+44>: add <span class="nv">$0</span>x4,%rbp - 0x000055555555561b <+48>: cmp <span class="nv">$0</span>x6,%ebx - 0x000055555555561e <+51>: je 0x555555555631 <phase_2+70> - 0x0000555555555620 <+53>: mov %ebx,%eax - 0x0000555555555622 <+55>: add 0x0<span class="o">(</span>%rbp<span class="o">)</span>,%eax - 0x0000555555555625 <+58>: cmp %eax,0x4<span class="o">(</span>%rbp<span class="o">)</span> - 0x0000555555555628 <+61>: je 0x555555555614 <phase_2+41> - 0x000055555555562a <+63>: call 0x555555555d4a <explode_bomb> - 0x000055555555562f <+68>: jmp 0x555555555614 <phase_2+41> - 0x0000555555555631 <+70>: add <span class="nv">$0</span>x28,%rsp - 0x0000555555555635 <+74>: pop %rbx - 0x0000555555555636 <+75>: pop %rbp - 0x0000555555555637 <+76>: ret -End of assembler dump. -<span class="o">(</span>gdb<span class="o">)</span> +<pre><span></span><code>Phase<span class="w"> </span><span class="m">1</span><span class="w"> </span>defused.<span class="w"> </span>How<span class="w"> </span>about<span class="w"> </span>the<span class="w"> </span>next<span class="w"> </span>one? +<span class="m">1</span><span class="w"> </span><span class="m">2</span><span class="w"> </span><span class="m">3</span><span class="w"> </span><span class="m">4</span><span class="w"> </span><span class="m">5</span><span class="w"> </span><span class="m">6</span> + +Breakpoint<span class="w"> </span><span class="m">1</span>,<span class="w"> </span>0x00005555555555eb<span class="w"> </span><span class="k">in</span><span class="w"> </span>phase_2<span class="w"> </span><span class="o">()</span> +<span class="o">(</span>gdb<span class="o">)</span><span class="w"> </span>disas +Dump<span class="w"> </span>of<span class="w"> </span>assembler<span class="w"> </span>code<span class="w"> </span><span class="k">for</span><span class="w"> </span><span class="k">function</span><span class="w"> </span>phase_2: +<span class="o">=</span>><span class="w"> </span>0x00005555555555eb<span class="w"> </span><+0>:<span class="w"> </span>endbr64<span class="w"> </span> +<span class="w"> </span>0x00005555555555ef<span class="w"> </span><+4>:<span class="w"> </span>push<span class="w"> </span>%rbp +<span class="w"> </span>0x00005555555555f0<span class="w"> </span><+5>:<span class="w"> </span>push<span class="w"> </span>%rbx +<span class="w"> </span>0x00005555555555f1<span class="w"> </span><+6>:<span class="w"> </span>sub<span class="w"> </span><span class="nv">$0</span>x28,%rsp +<span class="w"> </span>0x00005555555555f5<span class="w"> </span><+10>:<span class="w"> </span>mov<span class="w"> </span>%rsp,%rsi +<span class="w"> </span>0x00005555555555f8<span class="w"> </span><+13>:<span class="w"> </span>call<span class="w"> </span>0x555555555d97<span class="w"> </span><read_six_numbers> +<span class="w"> </span>0x00005555555555fd<span class="w"> </span><+18>:<span class="w"> </span>cmpl<span class="w"> </span><span class="nv">$0</span>x0,<span class="o">(</span>%rsp<span class="o">)</span> +<span class="w"> </span>0x0000555555555601<span class="w"> </span><+22>:<span class="w"> </span>js<span class="w"> </span>0x55555555560d<span class="w"> </span><phase_2+34> +<span class="w"> </span>0x0000555555555603<span class="w"> </span><+24>:<span class="w"> </span>mov<span class="w"> </span>%rsp,%rbp +<span class="w"> </span>0x0000555555555606<span class="w"> </span><+27>:<span class="w"> </span>mov<span class="w"> </span><span class="nv">$0</span>x1,%ebx +<span class="w"> </span>0x000055555555560b<span class="w"> </span><+32>:<span class="w"> </span>jmp<span class="w"> </span>0x555555555620<span class="w"> </span><phase_2+53> +<span class="w"> </span>0x000055555555560d<span class="w"> </span><+34>:<span class="w"> </span>call<span class="w"> </span>0x555555555d4a<span class="w"> </span><explode_bomb> +<span class="w"> </span>0x0000555555555612<span class="w"> </span><+39>:<span class="w"> </span>jmp<span class="w"> </span>0x555555555603<span class="w"> </span><phase_2+24> +<span class="w"> </span>0x0000555555555614<span class="w"> </span><+41>:<span class="w"> </span>add<span class="w"> </span><span class="nv">$0</span>x1,%ebx +<span class="w"> </span>0x0000555555555617<span class="w"> </span><+44>:<span class="w"> </span>add<span class="w"> </span><span class="nv">$0</span>x4,%rbp +<span class="w"> </span>0x000055555555561b<span class="w"> </span><+48>:<span class="w"> </span>cmp<span class="w"> </span><span class="nv">$0</span>x6,%ebx +<span class="w"> </span>0x000055555555561e<span class="w"> </span><+51>:<span class="w"> </span>je<span class="w"> </span>0x555555555631<span class="w"> </span><phase_2+70> +<span class="w"> </span>0x0000555555555620<span class="w"> </span><+53>:<span class="w"> </span>mov<span class="w"> </span>%ebx,%eax +<span class="w"> </span>0x0000555555555622<span class="w"> </span><+55>:<span class="w"> </span>add<span class="w"> </span>0x0<span class="o">(</span>%rbp<span class="o">)</span>,%eax +<span class="w"> </span>0x0000555555555625<span class="w"> </span><+58>:<span class="w"> </span>cmp<span class="w"> </span>%eax,0x4<span class="o">(</span>%rbp<span class="o">)</span> +<span class="w"> </span>0x0000555555555628<span class="w"> </span><+61>:<span class="w"> </span>je<span class="w"> </span>0x555555555614<span class="w"> </span><phase_2+41> +<span class="w"> </span>0x000055555555562a<span class="w"> </span><+63>:<span class="w"> </span>call<span class="w"> </span>0x555555555d4a<span class="w"> </span><explode_bomb> +<span class="w"> </span>0x000055555555562f<span class="w"> </span><+68>:<span class="w"> </span>jmp<span class="w"> </span>0x555555555614<span class="w"> </span><phase_2+41> +<span class="w"> </span>0x0000555555555631<span class="w"> </span><+70>:<span class="w"> </span>add<span class="w"> </span><span class="nv">$0</span>x28,%rsp +<span class="w"> </span>0x0000555555555635<span class="w"> </span><+74>:<span class="w"> </span>pop<span class="w"> </span>%rbx +<span class="w"> </span>0x0000555555555636<span class="w"> </span><+75>:<span class="w"> </span>pop<span class="w"> </span>%rbp +<span class="w"> </span>0x0000555555555637<span class="w"> </span><+76>:<span class="w"> </span>ret<span class="w"> </span> +End<span class="w"> </span>of<span class="w"> </span>assembler<span class="w"> </span>dump. +<span class="o">(</span>gdb<span class="o">)</span><span class="w"> </span> </code></pre> </div> <div class="codehilite"> -<pre><span></span><code> 0x00005555555555fd <+18>: cmpl <span class="nv">$0</span>x0,<span class="o">(</span>%rsp<span class="o">)</span> - 0x0000555555555601 <+22>: js 0x55555555560d <phase_2+34> +<pre><span></span><code><span class="w"> </span>0x00005555555555fd<span class="w"> </span><+18>:<span class="w"> </span>cmpl<span class="w"> </span><span class="nv">$0</span>x0,<span class="o">(</span>%rsp<span class="o">)</span> +<span class="w"> </span>0x0000555555555601<span class="w"> </span><+22>:<span class="w"> </span>js<span class="w"> </span>0x55555555560d<span class="w"> </span><phase_2+34> ... - 0x000055555555560d <+34>: call 0x555555555d4a <explode_bomb> +<span class="w"> </span>0x000055555555560d<span class="w"> </span><+34>:<span class="w"> </span>call<span class="w"> </span>0x555555555d4a<span class="w"> </span><explode_bomb> </code></pre> </div> -<p>The program first compares if the first number is not 0. If the number is not 0, then the <code>cmpl</code> instruction returns a negative value. The <code>js</code> instruction stands for jump if sign -> causing a jump to the specified address if the sign bit is set. This would result in the explode_bomb function being called. - <div class="codehilite"> - <pre><span></span><code>0x0000555555555603 <+24>: mov %rsp,%rbp - 0x0000555555555606 <+27>: mov <span class="nv">$0</span>x1,%ebx - </code></pre> - </div></p> +<p>The program first compares if the first number is not 0. If the number is not 0, then the <code>cmpl</code> instruction returns a negative value. The <code>js</code> instruction stands for jump if sign -> causing a jump to the specified address if the sign bit is set. This would result in the explode_bomb function being called.</p> + +<div class="codehilite"> +<pre><span></span><code><span class="w"> </span>0x0000555555555603<span class="w"> </span><+24>:<span class="w"> </span>mov<span class="w"> </span>%rsp,%rbp +<span class="w"> </span>0x0000555555555606<span class="w"> </span><+27>:<span class="w"> </span>mov<span class="w"> </span><span class="nv">$0</span>x1,%ebx +</code></pre> +</div> <p><code>%rsp</code> in x86-64 asm, is the stack pointer i.e. it points to the top of the current stack frame. Since the program just read six numbers, the top of the stack (<code>%rsp</code>) contains the address of the first number.</p> <p>By executing <code>mov %rsp,%rbp</code> we are setting the base pointer (<code>%rbp</code>) to point to this address.</p> -<p>Now, for the second instruction <code>mov $0x1,%ebx</code>, we are initalising the <code>%ebx</code> register with the value 1. Based on the assembly code, you can see that this is being used as a counter/index for the loop. - <div class="codehilite"> - <pre><span></span><code>0x000055555555560b <+32>: jmp 0x555555555620 <phase_2+53> - </code></pre> - </div></p> - -<p>The program now jumps to <phase_2+53> - <div class="codehilite"> - <pre><span></span><code>0x0000555555555620 <+53>: mov %ebx,%eax - 0x0000555555555622 <+55>: add 0x0<span class="o">(</span>%rbp<span class="o">)</span>,%eax - 0x0000555555555625 <+58>: cmp %eax,0x4<span class="o">(</span>%rbp<span class="o">)</span> - 0x0000555555555628 <+61>: je 0x555555555614 <phase_2+41> - </code></pre> - </div></p> +<p>Now, for the second instruction <code>mov $0x1,%ebx</code>, we are initalising the <code>%ebx</code> register with the value 1. Based on the assembly code, you can see that this is being used as a counter/index for the loop.</p> + +<div class="codehilite"> +<pre><span></span><code><span class="w"> </span>0x000055555555560b<span class="w"> </span><+32>:<span class="w"> </span>jmp<span class="w"> </span>0x555555555620<span class="w"> </span><phase_2+53> +</code></pre> +</div> + +<p>The program now jumps to <phase_2+53></p> + +<div class="codehilite"> +<pre><span></span><code><span class="w"> </span>0x0000555555555620<span class="w"> </span><+53>:<span class="w"> </span>mov<span class="w"> </span>%ebx,%eax +<span class="w"> </span>0x0000555555555622<span class="w"> </span><+55>:<span class="w"> </span>add<span class="w"> </span>0x0<span class="o">(</span>%rbp<span class="o">)</span>,%eax +<span class="w"> </span>0x0000555555555625<span class="w"> </span><+58>:<span class="w"> </span>cmp<span class="w"> </span>%eax,0x4<span class="o">(</span>%rbp<span class="o">)</span> +<span class="w"> </span>0x0000555555555628<span class="w"> </span><+61>:<span class="w"> </span>je<span class="w"> </span>0x555555555614<span class="w"> </span><phase_2+41> +</code></pre> +</div> <p>Here, the value from <code>%ebx</code> is copied to the <code>%eax</code> register. For this iteration, the value should be 1.</p> @@ -208,18 +211,19 @@ End of assembler dump. <p><code>cmp %eax,0x4(%rbp)</code> - The instruction compares the value in %eax to the value at the memory address <code>%rbp + 4</code>. Since Integers in this context are stored using a word of memory of 4 bytes, this indicates it checks against the second number in the sequence.</p> -<p><code>je 0x555555555614 <phase_2+41></code> - The program will jump to <code>phase_2+41</code> if the previous <code>cmp</code> instruction determined the values as equal. - <div class="codehilite"> - <pre><span></span><code>0x0000555555555614 <+41>: add <span class="nv">$0</span>x1,%ebx - 0x0000555555555617 <+44>: add <span class="nv">$0</span>x4,%rbp - 0x000055555555561b <+48>: cmp <span class="nv">$0</span>x6,%ebx - 0x000055555555561e <+51>: je 0x555555555631 <phase<em>2+70> - 0x0000555555555620 <+53>: mov %ebx,%eax - 0x0000555555555622 <+55>: add 0x0<span class="o">(</span>%rbp<span class="o">)</span>,%eax - 0x0000555555555625 <+58>: cmp %eax,0x4<span class="o">(</span>%rbp<span class="o">)</span> - 0x0000555555555628 <+61>: je 0x555555555614 <phase</em>2+41> - </code></pre> - </div></p> +<p><code>je 0x555555555614 <phase_2+41></code> - The program will jump to <code>phase_2+41</code> if the previous <code>cmp</code> instruction determined the values as equal. </p> + +<div class="codehilite"> +<pre><span></span><code><span class="w"> </span>0x0000555555555614<span class="w"> </span><+41>:<span class="w"> </span>add<span class="w"> </span><span class="nv">$0</span>x1,%ebx +<span class="w"> </span>0x0000555555555617<span class="w"> </span><+44>:<span class="w"> </span>add<span class="w"> </span><span class="nv">$0</span>x4,%rbp +<span class="w"> </span>0x000055555555561b<span class="w"> </span><+48>:<span class="w"> </span>cmp<span class="w"> </span><span class="nv">$0</span>x6,%ebx +<span class="w"> </span>0x000055555555561e<span class="w"> </span><+51>:<span class="w"> </span>je<span class="w"> </span>0x555555555631<span class="w"> </span><phase_2+70> +<span class="w"> </span>0x0000555555555620<span class="w"> </span><+53>:<span class="w"> </span>mov<span class="w"> </span>%ebx,%eax +<span class="w"> </span>0x0000555555555622<span class="w"> </span><+55>:<span class="w"> </span>add<span class="w"> </span>0x0<span class="o">(</span>%rbp<span class="o">)</span>,%eax +<span class="w"> </span>0x0000555555555625<span class="w"> </span><+58>:<span class="w"> </span>cmp<span class="w"> </span>%eax,0x4<span class="o">(</span>%rbp<span class="o">)</span> +<span class="w"> </span>0x0000555555555628<span class="w"> </span><+61>:<span class="w"> </span>je<span class="w"> </span>0x555555555614<span class="w"> </span><phase_2+41> +</code></pre> +</div> <p>Here, we can see that the program increments <code>%ebx</code> by 1, adds a 4 byte offset to <code>%rbp</code> (the number we will be matching now), and checks if <code>%ebx</code> is equal to 6. If it is, it breaks the loop and jumps to <code><phase_2+70></code> succesfully finishing this stage.</p> @@ -236,13 +240,13 @@ End of assembler dump. <div class="codehilite"> <pre><span></span><code>... -Phase <span class="m">1</span> defused. How about the next one? -<span class="m">0</span> <span class="m">1</span> <span class="m">3</span> <span class="m">6</span> <span class="m">10</span> <span class="m">15</span> +Phase<span class="w"> </span><span class="m">1</span><span class="w"> </span>defused.<span class="w"> </span>How<span class="w"> </span>about<span class="w"> </span>the<span class="w"> </span>next<span class="w"> </span>one? +<span class="m">0</span><span class="w"> </span><span class="m">1</span><span class="w"> </span><span class="m">3</span><span class="w"> </span><span class="m">6</span><span class="w"> </span><span class="m">10</span><span class="w"> </span><span class="m">15</span> -Breakpoint <span class="m">1</span>, 0x00005555555555eb <span class="k">in</span> phase_2 <span class="o">()</span> -<span class="o">(</span>gdb<span class="o">)</span> <span class="k">continue</span> +Breakpoint<span class="w"> </span><span class="m">1</span>,<span class="w"> </span>0x00005555555555eb<span class="w"> </span><span class="k">in</span><span class="w"> </span>phase_2<span class="w"> </span><span class="o">()</span> +<span class="o">(</span>gdb<span class="o">)</span><span class="w"> </span><span class="k">continue</span> Continuing. -That<span class="err">'</span>s number <span class="m">2</span>. Keep going! +That<span class="err">'</span>s<span class="w"> </span>number<span class="w"> </span><span class="m">2</span>.<span class="w"> </span>Keep<span class="w"> </span>going! </code></pre> </div> @@ -251,96 +255,96 @@ That<span class="err">'</span>s number <span class="m">2</span>. Keep going <p>Let us look at the disassembled code first</p> <div class="codehilite"> -<pre><span></span><code><span class="m">0000000000001638</span> <phase_3>: - <span class="m">1638</span>: f3 0f 1e fa endbr64 - 163c: <span class="m">48</span> <span class="m">83</span> ec <span class="m">18</span> sub <span class="nv">$0</span>x18,%rsp - <span class="m">1640</span>: <span class="m">48</span> 8d 4c <span class="m">24</span> <span class="m">07</span> lea 0x7<span class="o">(</span>%rsp<span class="o">)</span>,%rcx - <span class="m">1645</span>: <span class="m">48</span> 8d <span class="m">54</span> <span class="m">24</span> 0c lea 0xc<span class="o">(</span>%rsp<span class="o">)</span>,%rdx - 164a: 4c 8d <span class="m">44</span> <span class="m">24</span> <span class="m">08</span> lea 0x8<span class="o">(</span>%rsp<span class="o">)</span>,%r8 - 164f: <span class="m">48</span> 8d <span class="m">35</span> <span class="m">60</span> 1b <span class="m">00</span> <span class="m">00</span> lea 0x1b60<span class="o">(</span>%rip<span class="o">)</span>,%rsi <span class="c1"># 31b6 <_IO_stdin_used+0x1b6></span> - <span class="m">1656</span>: b8 <span class="m">00</span> <span class="m">00</span> <span class="m">00</span> <span class="m">00</span> mov <span class="nv">$0</span>x0,%eax - 165b: e8 <span class="m">80</span> <span class="nb">fc</span> ff ff call 12e0 <__isoc99_sscanf@plt> - <span class="m">1660</span>: <span class="m">83</span> f8 <span class="m">02</span> cmp <span class="nv">$0</span>x2,%eax - <span class="m">1663</span>: 7e <span class="m">20</span> jle <span class="m">1685</span> <phase_3+0x4d> - <span class="m">1665</span>: <span class="m">83</span> 7c <span class="m">24</span> 0c <span class="m">07</span> cmpl <span class="nv">$0</span>x7,0xc<span class="o">(</span>%rsp<span class="o">)</span> - 166a: 0f <span class="m">87</span> 0d <span class="m">01</span> <span class="m">00</span> <span class="m">00</span> ja 177d <phase_3+0x145> - <span class="m">1670</span>: 8b <span class="m">44</span> <span class="m">24</span> 0c mov 0xc<span class="o">(</span>%rsp<span class="o">)</span>,%eax - <span class="m">1674</span>: <span class="m">48</span> 8d <span class="m">15</span> <span class="m">55</span> 1b <span class="m">00</span> <span class="m">00</span> lea 0x1b55<span class="o">(</span>%rip<span class="o">)</span>,%rdx <span class="c1"># 31d0 <_IO_stdin_used+0x1d0></span> - 167b: <span class="m">48</span> <span class="m">63</span> <span class="m">04</span> <span class="m">82</span> movslq <span class="o">(</span>%rdx,%rax,4<span class="o">)</span>,%rax - 167f: <span class="m">48</span> <span class="m">01</span> d0 add %rdx,%rax - <span class="m">1682</span>: 3e ff e0 notrack jmp *%rax - <span class="m">1685</span>: e8 c0 <span class="m">06</span> <span class="m">00</span> <span class="m">00</span> call 1d4a <explode_bomb> - 168a: eb d9 jmp <span class="m">1665</span> <phase_3+0x2d> - 168c: b8 <span class="m">63</span> <span class="m">00</span> <span class="m">00</span> <span class="m">00</span> mov <span class="nv">$0</span>x63,%eax - <span class="m">1691</span>: <span class="m">81</span> 7c <span class="m">24</span> <span class="m">08</span> 3d <span class="m">02</span> <span class="m">00</span> cmpl <span class="nv">$0</span>x23d,0x8<span class="o">(</span>%rsp<span class="o">)</span> - <span class="m">1698</span>: <span class="m">00</span> - <span class="m">1699</span>: 0f <span class="m">84</span> e8 <span class="m">00</span> <span class="m">00</span> <span class="m">00</span> je <span class="m">1787</span> <phase_3+0x14f> - 169f: e8 a6 <span class="m">06</span> <span class="m">00</span> <span class="m">00</span> call 1d4a <explode_bomb> - 16a4: b8 <span class="m">63</span> <span class="m">00</span> <span class="m">00</span> <span class="m">00</span> mov <span class="nv">$0</span>x63,%eax - 16a9: e9 d9 <span class="m">00</span> <span class="m">00</span> <span class="m">00</span> jmp <span class="m">1787</span> <phase_3+0x14f> - 16ae: b8 <span class="m">61</span> <span class="m">00</span> <span class="m">00</span> <span class="m">00</span> mov <span class="nv">$0</span>x61,%eax - 16b3: <span class="m">81</span> 7c <span class="m">24</span> <span class="m">08</span> <span class="m">27</span> <span class="m">01</span> <span class="m">00</span> cmpl <span class="nv">$0</span>x127,0x8<span class="o">(</span>%rsp<span class="o">)</span> - 16ba: <span class="m">00</span> - 16bb: 0f <span class="m">84</span> c6 <span class="m">00</span> <span class="m">00</span> <span class="m">00</span> je <span class="m">1787</span> <phase_3+0x14f> - 16c1: e8 <span class="m">84</span> <span class="m">06</span> <span class="m">00</span> <span class="m">00</span> call 1d4a <explode_bomb> - 16c6: b8 <span class="m">61</span> <span class="m">00</span> <span class="m">00</span> <span class="m">00</span> mov <span class="nv">$0</span>x61,%eax - 16cb: e9 b7 <span class="m">00</span> <span class="m">00</span> <span class="m">00</span> jmp <span class="m">1787</span> <phase_3+0x14f> - 16d0: b8 <span class="m">78</span> <span class="m">00</span> <span class="m">00</span> <span class="m">00</span> mov <span class="nv">$0</span>x78,%eax - 16d5: <span class="m">81</span> 7c <span class="m">24</span> <span class="m">08</span> e7 <span class="m">02</span> <span class="m">00</span> cmpl <span class="nv">$0</span>x2e7,0x8<span class="o">(</span>%rsp<span class="o">)</span> - 16dc: <span class="m">00</span> - 16dd: 0f <span class="m">84</span> a4 <span class="m">00</span> <span class="m">00</span> <span class="m">00</span> je <span class="m">1787</span> <phase_3+0x14f> - 16e3: e8 <span class="m">62</span> <span class="m">06</span> <span class="m">00</span> <span class="m">00</span> call 1d4a <explode_bomb> - 16e8: b8 <span class="m">78</span> <span class="m">00</span> <span class="m">00</span> <span class="m">00</span> mov <span class="nv">$0</span>x78,%eax - 16ed: e9 <span class="m">95</span> <span class="m">00</span> <span class="m">00</span> <span class="m">00</span> jmp <span class="m">1787</span> <phase_3+0x14f> - 16f2: b8 <span class="m">64</span> <span class="m">00</span> <span class="m">00</span> <span class="m">00</span> mov <span class="nv">$0</span>x64,%eax - 16f7: <span class="m">81</span> 7c <span class="m">24</span> <span class="m">08</span> <span class="m">80</span> <span class="m">02</span> <span class="m">00</span> cmpl <span class="nv">$0</span>x280,0x8<span class="o">(</span>%rsp<span class="o">)</span> - 16fe: <span class="m">00</span> - 16ff: 0f <span class="m">84</span> <span class="m">82</span> <span class="m">00</span> <span class="m">00</span> <span class="m">00</span> je <span class="m">1787</span> <phase_3+0x14f> - <span class="m">1705</span>: e8 <span class="m">40</span> <span class="m">06</span> <span class="m">00</span> <span class="m">00</span> call 1d4a <explode_bomb> - 170a: b8 <span class="m">64</span> <span class="m">00</span> <span class="m">00</span> <span class="m">00</span> mov <span class="nv">$0</span>x64,%eax - 170f: eb <span class="m">76</span> jmp <span class="m">1787</span> <phase_3+0x14f> - <span class="m">1711</span>: b8 6d <span class="m">00</span> <span class="m">00</span> <span class="m">00</span> mov <span class="nv">$0</span>x6d,%eax - <span class="m">1716</span>: <span class="m">81</span> 7c <span class="m">24</span> <span class="m">08</span> ff <span class="m">02</span> <span class="m">00</span> cmpl <span class="nv">$0</span>x2ff,0x8<span class="o">(</span>%rsp<span class="o">)</span> - 171d: <span class="m">00</span> - 171e: <span class="m">74</span> <span class="m">67</span> je <span class="m">1787</span> <phase_3+0x14f> - <span class="m">1720</span>: e8 <span class="m">25</span> <span class="m">06</span> <span class="m">00</span> <span class="m">00</span> call 1d4a <explode_bomb> - <span class="m">1725</span>: b8 6d <span class="m">00</span> <span class="m">00</span> <span class="m">00</span> mov <span class="nv">$0</span>x6d,%eax - 172a: eb 5b jmp <span class="m">1787</span> <phase_3+0x14f> - 172c: b8 <span class="m">71</span> <span class="m">00</span> <span class="m">00</span> <span class="m">00</span> mov <span class="nv">$0</span>x71,%eax - <span class="m">1731</span>: <span class="m">81</span> 7c <span class="m">24</span> <span class="m">08</span> <span class="m">75</span> <span class="m">03</span> <span class="m">00</span> cmpl <span class="nv">$0</span>x375,0x8<span class="o">(</span>%rsp<span class="o">)</span> - <span class="m">1738</span>: <span class="m">00</span> - <span class="m">1739</span>: <span class="m">74</span> 4c je <span class="m">1787</span> <phase_3+0x14f> - 173b: e8 0a <span class="m">06</span> <span class="m">00</span> <span class="m">00</span> call 1d4a <explode_bomb> - <span class="m">1740</span>: b8 <span class="m">71</span> <span class="m">00</span> <span class="m">00</span> <span class="m">00</span> mov <span class="nv">$0</span>x71,%eax - <span class="m">1745</span>: eb <span class="m">40</span> jmp <span class="m">1787</span> <phase_3+0x14f> - <span class="m">1747</span>: b8 <span class="m">79</span> <span class="m">00</span> <span class="m">00</span> <span class="m">00</span> mov <span class="nv">$0</span>x79,%eax - 174c: <span class="m">81</span> 7c <span class="m">24</span> <span class="m">08</span> <span class="m">94</span> <span class="m">02</span> <span class="m">00</span> cmpl <span class="nv">$0</span>x294,0x8<span class="o">(</span>%rsp<span class="o">)</span> - <span class="m">1753</span>: <span class="m">00</span> - <span class="m">1754</span>: <span class="m">74</span> <span class="m">31</span> je <span class="m">1787</span> <phase_3+0x14f> - <span class="m">1756</span>: e8 ef <span class="m">05</span> <span class="m">00</span> <span class="m">00</span> call 1d4a <explode_bomb> - 175b: b8 <span class="m">79</span> <span class="m">00</span> <span class="m">00</span> <span class="m">00</span> mov <span class="nv">$0</span>x79,%eax - <span class="m">1760</span>: eb <span class="m">25</span> jmp <span class="m">1787</span> <phase_3+0x14f> - <span class="m">1762</span>: b8 <span class="m">79</span> <span class="m">00</span> <span class="m">00</span> <span class="m">00</span> mov <span class="nv">$0</span>x79,%eax - <span class="m">1767</span>: <span class="m">81</span> 7c <span class="m">24</span> <span class="m">08</span> <span class="m">88</span> <span class="m">02</span> <span class="m">00</span> cmpl <span class="nv">$0</span>x288,0x8<span class="o">(</span>%rsp<span class="o">)</span> - 176e: <span class="m">00</span> - 176f: <span class="m">74</span> <span class="m">16</span> je <span class="m">1787</span> <phase_3+0x14f> - <span class="m">1771</span>: e8 d4 <span class="m">05</span> <span class="m">00</span> <span class="m">00</span> call 1d4a <explode_bomb> - <span class="m">1776</span>: b8 <span class="m">79</span> <span class="m">00</span> <span class="m">00</span> <span class="m">00</span> mov <span class="nv">$0</span>x79,%eax - 177b: eb 0a jmp <span class="m">1787</span> <phase_3+0x14f> - 177d: e8 c8 <span class="m">05</span> <span class="m">00</span> <span class="m">00</span> call 1d4a <explode_bomb> - <span class="m">1782</span>: b8 <span class="m">68</span> <span class="m">00</span> <span class="m">00</span> <span class="m">00</span> mov <span class="nv">$0</span>x68,%eax - <span class="m">1787</span>: <span class="m">38</span> <span class="m">44</span> <span class="m">24</span> <span class="m">07</span> cmp %al,0x7<span class="o">(</span>%rsp<span class="o">)</span> - 178b: <span class="m">75</span> <span class="m">05</span> jne <span class="m">1792</span> <phase_3+0x15a> - 178d: <span class="m">48</span> <span class="m">83</span> c4 <span class="m">18</span> add <span class="nv">$0</span>x18,%rsp - <span class="m">1791</span>: c3 ret - <span class="m">1792</span>: e8 b3 <span class="m">05</span> <span class="m">00</span> <span class="m">00</span> call 1d4a <explode_bomb> - <span class="m">1797</span>: eb f4 jmp 178d <phase_3+0x155> +<pre><span></span><code><span class="m">0000000000001638</span><span class="w"> </span><phase_3>: +<span class="w"> </span><span class="m">1638</span>:<span class="w"> </span>f3<span class="w"> </span>0f<span class="w"> </span>1e<span class="w"> </span>fa<span class="w"> </span>endbr64<span class="w"> </span> +<span class="w"> </span>163c:<span class="w"> </span><span class="m">48</span><span class="w"> </span><span class="m">83</span><span class="w"> </span>ec<span class="w"> </span><span class="m">18</span><span class="w"> </span>sub<span class="w"> </span><span class="nv">$0</span>x18,%rsp +<span class="w"> </span><span class="m">1640</span>:<span class="w"> </span><span class="m">48</span><span class="w"> </span>8d<span class="w"> </span>4c<span class="w"> </span><span class="m">24</span><span class="w"> </span><span class="m">07</span><span class="w"> </span>lea<span class="w"> </span>0x7<span class="o">(</span>%rsp<span class="o">)</span>,%rcx +<span class="w"> </span><span class="m">1645</span>:<span class="w"> </span><span class="m">48</span><span class="w"> </span>8d<span class="w"> </span><span class="m">54</span><span class="w"> </span><span class="m">24</span><span class="w"> </span>0c<span class="w"> </span>lea<span class="w"> </span>0xc<span class="o">(</span>%rsp<span class="o">)</span>,%rdx +<span class="w"> </span>164a:<span class="w"> </span>4c<span class="w"> </span>8d<span class="w"> </span><span class="m">44</span><span class="w"> </span><span class="m">24</span><span class="w"> </span><span class="m">08</span><span class="w"> </span>lea<span class="w"> </span>0x8<span class="o">(</span>%rsp<span class="o">)</span>,%r8 +<span class="w"> </span>164f:<span class="w"> </span><span class="m">48</span><span class="w"> </span>8d<span class="w"> </span><span class="m">35</span><span class="w"> </span><span class="m">60</span><span class="w"> </span>1b<span class="w"> </span><span class="m">00</span><span class="w"> </span><span class="m">00</span><span class="w"> </span>lea<span class="w"> </span>0x1b60<span class="o">(</span>%rip<span class="o">)</span>,%rsi<span class="w"> </span><span class="c1"># 31b6 <_IO_stdin_used+0x1b6></span> +<span class="w"> </span><span class="m">1656</span>:<span class="w"> </span>b8<span class="w"> </span><span class="m">00</span><span class="w"> </span><span class="m">00</span><span class="w"> </span><span class="m">00</span><span class="w"> </span><span class="m">00</span><span class="w"> </span>mov<span class="w"> </span><span class="nv">$0</span>x0,%eax +<span class="w"> </span>165b:<span class="w"> </span>e8<span class="w"> </span><span class="m">80</span><span class="w"> </span><span class="nb">fc</span><span class="w"> </span>ff<span class="w"> </span>ff<span class="w"> </span>call<span class="w"> </span>12e0<span class="w"> </span><__isoc99_sscanf@plt> +<span class="w"> </span><span class="m">1660</span>:<span class="w"> </span><span class="m">83</span><span class="w"> </span>f8<span class="w"> </span><span class="m">02</span><span class="w"> </span>cmp<span class="w"> </span><span class="nv">$0</span>x2,%eax +<span class="w"> </span><span class="m">1663</span>:<span class="w"> </span>7e<span class="w"> </span><span class="m">20</span><span class="w"> </span>jle<span class="w"> </span><span class="m">1685</span><span class="w"> </span><phase_3+0x4d> +<span class="w"> </span><span class="m">1665</span>:<span class="w"> </span><span class="m">83</span><span class="w"> </span>7c<span class="w"> </span><span class="m">24</span><span class="w"> </span>0c<span class="w"> </span><span class="m">07</span><span class="w"> </span>cmpl<span class="w"> </span><span class="nv">$0</span>x7,0xc<span class="o">(</span>%rsp<span class="o">)</span> +<span class="w"> </span>166a:<span class="w"> </span>0f<span class="w"> </span><span class="m">87</span><span class="w"> </span>0d<span class="w"> </span><span class="m">01</span><span class="w"> </span><span class="m">00</span><span class="w"> </span><span class="m">00</span><span class="w"> </span>ja<span class="w"> </span>177d<span class="w"> </span><phase_3+0x145> +<span class="w"> </span><span class="m">1670</span>:<span class="w"> </span>8b<span class="w"> </span><span class="m">44</span><span class="w"> </span><span class="m">24</span><span class="w"> </span>0c<span class="w"> </span>mov<span class="w"> </span>0xc<span class="o">(</span>%rsp<span class="o">)</span>,%eax +<span class="w"> </span><span class="m">1674</span>:<span class="w"> </span><span class="m">48</span><span class="w"> </span>8d<span class="w"> </span><span class="m">15</span><span class="w"> </span><span class="m">55</span><span class="w"> </span>1b<span class="w"> </span><span class="m">00</span><span class="w"> </span><span class="m">00</span><span class="w"> </span>lea<span class="w"> </span>0x1b55<span class="o">(</span>%rip<span class="o">)</span>,%rdx<span class="w"> </span><span class="c1"># 31d0 <_IO_stdin_used+0x1d0></span> +<span class="w"> </span>167b:<span class="w"> </span><span class="m">48</span><span class="w"> </span><span class="m">63</span><span class="w"> </span><span class="m">04</span><span class="w"> </span><span class="m">82</span><span class="w"> </span>movslq<span class="w"> </span><span class="o">(</span>%rdx,%rax,4<span class="o">)</span>,%rax +<span class="w"> </span>167f:<span class="w"> </span><span class="m">48</span><span class="w"> </span><span class="m">01</span><span class="w"> </span>d0<span class="w"> </span>add<span class="w"> </span>%rdx,%rax +<span class="w"> </span><span class="m">1682</span>:<span class="w"> </span>3e<span class="w"> </span>ff<span class="w"> </span>e0<span class="w"> </span>notrack<span class="w"> </span>jmp<span class="w"> </span>*%rax +<span class="w"> </span><span class="m">1685</span>:<span class="w"> </span>e8<span class="w"> </span>c0<span class="w"> </span><span class="m">06</span><span class="w"> </span><span class="m">00</span><span class="w"> </span><span class="m">00</span><span class="w"> </span>call<span class="w"> </span>1d4a<span class="w"> </span><explode_bomb> +<span class="w"> </span>168a:<span class="w"> </span>eb<span class="w"> </span>d9<span class="w"> </span>jmp<span class="w"> </span><span class="m">1665</span><span class="w"> </span><phase_3+0x2d> +<span class="w"> </span>168c:<span class="w"> </span>b8<span class="w"> </span><span class="m">63</span><span class="w"> </span><span class="m">00</span><span class="w"> </span><span class="m">00</span><span class="w"> </span><span class="m">00</span><span class="w"> </span>mov<span class="w"> </span><span class="nv">$0</span>x63,%eax +<span class="w"> </span><span class="m">1691</span>:<span class="w"> </span><span class="m">81</span><span class="w"> </span>7c<span class="w"> </span><span class="m">24</span><span class="w"> </span><span class="m">08</span><span class="w"> </span>3d<span class="w"> </span><span class="m">02</span><span class="w"> </span><span class="m">00</span><span class="w"> </span>cmpl<span class="w"> </span><span class="nv">$0</span>x23d,0x8<span class="o">(</span>%rsp<span class="o">)</span> +<span class="w"> </span><span class="m">1698</span>:<span class="w"> </span><span class="m">00</span><span class="w"> </span> +<span class="w"> </span><span class="m">1699</span>:<span class="w"> </span>0f<span class="w"> </span><span class="m">84</span><span class="w"> </span>e8<span class="w"> </span><span class="m">00</span><span class="w"> </span><span class="m">00</span><span class="w"> </span><span class="m">00</span><span class="w"> </span>je<span class="w"> </span><span class="m">1787</span><span class="w"> </span><phase_3+0x14f> +<span class="w"> </span>169f:<span class="w"> </span>e8<span class="w"> </span>a6<span class="w"> </span><span class="m">06</span><span class="w"> </span><span class="m">00</span><span class="w"> </span><span class="m">00</span><span class="w"> </span>call<span class="w"> </span>1d4a<span class="w"> </span><explode_bomb> +<span class="w"> </span>16a4:<span class="w"> </span>b8<span class="w"> </span><span class="m">63</span><span class="w"> </span><span class="m">00</span><span class="w"> </span><span class="m">00</span><span class="w"> </span><span class="m">00</span><span class="w"> </span>mov<span class="w"> </span><span class="nv">$0</span>x63,%eax +<span class="w"> </span>16a9:<span class="w"> </span>e9<span class="w"> </span>d9<span class="w"> </span><span class="m">00</span><span class="w"> </span><span class="m">00</span><span class="w"> </span><span class="m">00</span><span class="w"> </span>jmp<span class="w"> </span><span class="m">1787</span><span class="w"> </span><phase_3+0x14f> +<span class="w"> </span>16ae:<span class="w"> </span>b8<span class="w"> </span><span class="m">61</span><span class="w"> </span><span class="m">00</span><span class="w"> </span><span class="m">00</span><span class="w"> </span><span class="m">00</span><span class="w"> </span>mov<span class="w"> </span><span class="nv">$0</span>x61,%eax +<span class="w"> </span>16b3:<span class="w"> </span><span class="m">81</span><span class="w"> </span>7c<span class="w"> </span><span class="m">24</span><span class="w"> </span><span class="m">08</span><span class="w"> </span><span class="m">27</span><span class="w"> </span><span class="m">01</span><span class="w"> </span><span class="m">00</span><span class="w"> </span>cmpl<span class="w"> </span><span class="nv">$0</span>x127,0x8<span class="o">(</span>%rsp<span class="o">)</span> +<span class="w"> </span>16ba:<span class="w"> </span><span class="m">00</span><span class="w"> </span> +<span class="w"> </span>16bb:<span class="w"> </span>0f<span class="w"> </span><span class="m">84</span><span class="w"> </span>c6<span class="w"> </span><span class="m">00</span><span class="w"> </span><span class="m">00</span><span class="w"> </span><span class="m">00</span><span class="w"> </span>je<span class="w"> </span><span class="m">1787</span><span class="w"> </span><phase_3+0x14f> +<span class="w"> </span>16c1:<span class="w"> </span>e8<span class="w"> </span><span class="m">84</span><span class="w"> </span><span class="m">06</span><span class="w"> </span><span class="m">00</span><span class="w"> </span><span class="m">00</span><span class="w"> </span>call<span class="w"> </span>1d4a<span class="w"> </span><explode_bomb> +<span class="w"> </span>16c6:<span class="w"> </span>b8<span class="w"> </span><span class="m">61</span><span class="w"> </span><span class="m">00</span><span class="w"> </span><span class="m">00</span><span class="w"> </span><span class="m">00</span><span class="w"> </span>mov<span class="w"> </span><span class="nv">$0</span>x61,%eax +<span class="w"> </span>16cb:<span class="w"> </span>e9<span class="w"> </span>b7<span class="w"> </span><span class="m">00</span><span class="w"> </span><span class="m">00</span><span class="w"> </span><span class="m">00</span><span class="w"> </span>jmp<span class="w"> </span><span class="m">1787</span><span class="w"> </span><phase_3+0x14f> +<span class="w"> </span>16d0:<span class="w"> </span>b8<span class="w"> </span><span class="m">78</span><span class="w"> </span><span class="m">00</span><span class="w"> </span><span class="m">00</span><span class="w"> </span><span class="m">00</span><span class="w"> </span>mov<span class="w"> </span><span class="nv">$0</span>x78,%eax +<span class="w"> </span>16d5:<span class="w"> </span><span class="m">81</span><span class="w"> </span>7c<span class="w"> </span><span class="m">24</span><span class="w"> </span><span class="m">08</span><span class="w"> </span>e7<span class="w"> </span><span class="m">02</span><span class="w"> </span><span class="m">00</span><span class="w"> </span>cmpl<span class="w"> </span><span class="nv">$0</span>x2e7,0x8<span class="o">(</span>%rsp<span class="o">)</span> +<span class="w"> </span>16dc:<span class="w"> </span><span class="m">00</span><span class="w"> </span> +<span class="w"> </span>16dd:<span class="w"> </span>0f<span class="w"> </span><span class="m">84</span><span class="w"> </span>a4<span class="w"> </span><span class="m">00</span><span class="w"> </span><span class="m">00</span><span class="w"> </span><span class="m">00</span><span class="w"> </span>je<span class="w"> </span><span class="m">1787</span><span class="w"> </span><phase_3+0x14f> +<span class="w"> </span>16e3:<span class="w"> </span>e8<span class="w"> </span><span class="m">62</span><span class="w"> </span><span class="m">06</span><span class="w"> </span><span class="m">00</span><span class="w"> </span><span class="m">00</span><span class="w"> </span>call<span class="w"> </span>1d4a<span class="w"> </span><explode_bomb> +<span class="w"> </span>16e8:<span class="w"> </span>b8<span class="w"> </span><span class="m">78</span><span class="w"> </span><span class="m">00</span><span class="w"> </span><span class="m">00</span><span class="w"> </span><span class="m">00</span><span class="w"> </span>mov<span class="w"> </span><span class="nv">$0</span>x78,%eax +<span class="w"> </span>16ed:<span class="w"> </span>e9<span class="w"> </span><span class="m">95</span><span class="w"> </span><span class="m">00</span><span class="w"> </span><span class="m">00</span><span class="w"> </span><span class="m">00</span><span class="w"> </span>jmp<span class="w"> </span><span class="m">1787</span><span class="w"> </span><phase_3+0x14f> +<span class="w"> </span>16f2:<span class="w"> </span>b8<span class="w"> </span><span class="m">64</span><span class="w"> </span><span class="m">00</span><span class="w"> </span><span class="m">00</span><span class="w"> </span><span class="m">00</span><span class="w"> </span>mov<span class="w"> </span><span class="nv">$0</span>x64,%eax +<span class="w"> </span>16f7:<span class="w"> </span><span class="m">81</span><span class="w"> </span>7c<span class="w"> </span><span class="m">24</span><span class="w"> </span><span class="m">08</span><span class="w"> </span><span class="m">80</span><span class="w"> </span><span class="m">02</span><span class="w"> </span><span class="m">00</span><span class="w"> </span>cmpl<span class="w"> </span><span class="nv">$0</span>x280,0x8<span class="o">(</span>%rsp<span class="o">)</span> +<span class="w"> </span>16fe:<span class="w"> </span><span class="m">00</span><span class="w"> </span> +<span class="w"> </span>16ff:<span class="w"> </span>0f<span class="w"> </span><span class="m">84</span><span class="w"> </span><span class="m">82</span><span class="w"> </span><span class="m">00</span><span class="w"> </span><span class="m">00</span><span class="w"> </span><span class="m">00</span><span class="w"> </span>je<span class="w"> </span><span class="m">1787</span><span class="w"> </span><phase_3+0x14f> +<span class="w"> </span><span class="m">1705</span>:<span class="w"> </span>e8<span class="w"> </span><span class="m">40</span><span class="w"> </span><span class="m">06</span><span class="w"> </span><span class="m">00</span><span class="w"> </span><span class="m">00</span><span class="w"> </span>call<span class="w"> </span>1d4a<span class="w"> </span><explode_bomb> +<span class="w"> </span>170a:<span class="w"> </span>b8<span class="w"> </span><span class="m">64</span><span class="w"> </span><span class="m">00</span><span class="w"> </span><span class="m">00</span><span class="w"> </span><span class="m">00</span><span class="w"> </span>mov<span class="w"> </span><span class="nv">$0</span>x64,%eax +<span class="w"> </span>170f:<span class="w"> </span>eb<span class="w"> </span><span class="m">76</span><span class="w"> </span>jmp<span class="w"> </span><span class="m">1787</span><span class="w"> </span><phase_3+0x14f> +<span class="w"> </span><span class="m">1711</span>:<span class="w"> </span>b8<span class="w"> </span>6d<span class="w"> </span><span class="m">00</span><span class="w"> </span><span class="m">00</span><span class="w"> </span><span class="m">00</span><span class="w"> </span>mov<span class="w"> </span><span class="nv">$0</span>x6d,%eax +<span class="w"> </span><span class="m">1716</span>:<span class="w"> </span><span class="m">81</span><span class="w"> </span>7c<span class="w"> </span><span class="m">24</span><span class="w"> </span><span class="m">08</span><span class="w"> </span>ff<span class="w"> </span><span class="m">02</span><span class="w"> </span><span class="m">00</span><span class="w"> </span>cmpl<span class="w"> </span><span class="nv">$0</span>x2ff,0x8<span class="o">(</span>%rsp<span class="o">)</span> +<span class="w"> </span>171d:<span class="w"> </span><span class="m">00</span><span class="w"> </span> +<span class="w"> </span>171e:<span class="w"> </span><span class="m">74</span><span class="w"> </span><span class="m">67</span><span class="w"> </span>je<span class="w"> </span><span class="m">1787</span><span class="w"> </span><phase_3+0x14f> +<span class="w"> </span><span class="m">1720</span>:<span class="w"> </span>e8<span class="w"> </span><span class="m">25</span><span class="w"> </span><span class="m">06</span><span class="w"> </span><span class="m">00</span><span class="w"> </span><span class="m">00</span><span class="w"> </span>call<span class="w"> </span>1d4a<span class="w"> </span><explode_bomb> +<span class="w"> </span><span class="m">1725</span>:<span class="w"> </span>b8<span class="w"> </span>6d<span class="w"> </span><span class="m">00</span><span class="w"> </span><span class="m">00</span><span class="w"> </span><span class="m">00</span><span class="w"> </span>mov<span class="w"> </span><span class="nv">$0</span>x6d,%eax +<span class="w"> </span>172a:<span class="w"> </span>eb<span class="w"> </span>5b<span class="w"> </span>jmp<span class="w"> </span><span class="m">1787</span><span class="w"> </span><phase_3+0x14f> +<span class="w"> </span>172c:<span class="w"> </span>b8<span class="w"> </span><span class="m">71</span><span class="w"> </span><span class="m">00</span><span class="w"> </span><span class="m">00</span><span class="w"> </span><span class="m">00</span><span class="w"> </span>mov<span class="w"> </span><span class="nv">$0</span>x71,%eax +<span class="w"> </span><span class="m">1731</span>:<span class="w"> </span><span class="m">81</span><span class="w"> </span>7c<span class="w"> </span><span class="m">24</span><span class="w"> </span><span class="m">08</span><span class="w"> </span><span class="m">75</span><span class="w"> </span><span class="m">03</span><span class="w"> </span><span class="m">00</span><span class="w"> </span>cmpl<span class="w"> </span><span class="nv">$0</span>x375,0x8<span class="o">(</span>%rsp<span class="o">)</span> +<span class="w"> </span><span class="m">1738</span>:<span class="w"> </span><span class="m">00</span><span class="w"> </span> +<span class="w"> </span><span class="m">1739</span>:<span class="w"> </span><span class="m">74</span><span class="w"> </span>4c<span class="w"> </span>je<span class="w"> </span><span class="m">1787</span><span class="w"> </span><phase_3+0x14f> +<span class="w"> </span>173b:<span class="w"> </span>e8<span class="w"> </span>0a<span class="w"> </span><span class="m">06</span><span class="w"> </span><span class="m">00</span><span class="w"> </span><span class="m">00</span><span class="w"> </span>call<span class="w"> </span>1d4a<span class="w"> </span><explode_bomb> +<span class="w"> </span><span class="m">1740</span>:<span class="w"> </span>b8<span class="w"> </span><span class="m">71</span><span class="w"> </span><span class="m">00</span><span class="w"> </span><span class="m">00</span><span class="w"> </span><span class="m">00</span><span class="w"> </span>mov<span class="w"> </span><span class="nv">$0</span>x71,%eax +<span class="w"> </span><span class="m">1745</span>:<span class="w"> </span>eb<span class="w"> </span><span class="m">40</span><span class="w"> </span>jmp<span class="w"> </span><span class="m">1787</span><span class="w"> </span><phase_3+0x14f> +<span class="w"> </span><span class="m">1747</span>:<span class="w"> </span>b8<span class="w"> </span><span class="m">79</span><span class="w"> </span><span class="m">00</span><span class="w"> </span><span class="m">00</span><span class="w"> </span><span class="m">00</span><span class="w"> </span>mov<span class="w"> </span><span class="nv">$0</span>x79,%eax +<span class="w"> </span>174c:<span class="w"> </span><span class="m">81</span><span class="w"> </span>7c<span class="w"> </span><span class="m">24</span><span class="w"> </span><span class="m">08</span><span class="w"> </span><span class="m">94</span><span class="w"> </span><span class="m">02</span><span class="w"> </span><span class="m">00</span><span class="w"> </span>cmpl<span class="w"> </span><span class="nv">$0</span>x294,0x8<span class="o">(</span>%rsp<span class="o">)</span> +<span class="w"> </span><span class="m">1753</span>:<span class="w"> </span><span class="m">00</span><span class="w"> </span> +<span class="w"> </span><span class="m">1754</span>:<span class="w"> </span><span class="m">74</span><span class="w"> </span><span class="m">31</span><span class="w"> </span>je<span class="w"> </span><span class="m">1787</span><span class="w"> </span><phase_3+0x14f> +<span class="w"> </span><span class="m">1756</span>:<span class="w"> </span>e8<span class="w"> </span>ef<span class="w"> </span><span class="m">05</span><span class="w"> </span><span class="m">00</span><span class="w"> </span><span class="m">00</span><span class="w"> </span>call<span class="w"> </span>1d4a<span class="w"> </span><explode_bomb> +<span class="w"> </span>175b:<span class="w"> </span>b8<span class="w"> </span><span class="m">79</span><span class="w"> </span><span class="m">00</span><span class="w"> </span><span class="m">00</span><span class="w"> </span><span class="m">00</span><span class="w"> </span>mov<span class="w"> </span><span class="nv">$0</span>x79,%eax +<span class="w"> </span><span class="m">1760</span>:<span class="w"> </span>eb<span class="w"> </span><span class="m">25</span><span class="w"> </span>jmp<span class="w"> </span><span class="m">1787</span><span class="w"> </span><phase_3+0x14f> +<span class="w"> </span><span class="m">1762</span>:<span class="w"> </span>b8<span class="w"> </span><span class="m">79</span><span class="w"> </span><span class="m">00</span><span class="w"> </span><span class="m">00</span><span class="w"> </span><span class="m">00</span><span class="w"> </span>mov<span class="w"> </span><span class="nv">$0</span>x79,%eax +<span class="w"> </span><span class="m">1767</span>:<span class="w"> </span><span class="m">81</span><span class="w"> </span>7c<span class="w"> </span><span class="m">24</span><span class="w"> </span><span class="m">08</span><span class="w"> </span><span class="m">88</span><span class="w"> </span><span class="m">02</span><span class="w"> </span><span class="m">00</span><span class="w"> </span>cmpl<span class="w"> </span><span class="nv">$0</span>x288,0x8<span class="o">(</span>%rsp<span class="o">)</span> +<span class="w"> </span>176e:<span class="w"> </span><span class="m">00</span><span class="w"> </span> +<span class="w"> </span>176f:<span class="w"> </span><span class="m">74</span><span class="w"> </span><span class="m">16</span><span class="w"> </span>je<span class="w"> </span><span class="m">1787</span><span class="w"> </span><phase_3+0x14f> +<span class="w"> </span><span class="m">1771</span>:<span class="w"> </span>e8<span class="w"> </span>d4<span class="w"> </span><span class="m">05</span><span class="w"> </span><span class="m">00</span><span class="w"> </span><span class="m">00</span><span class="w"> </span>call<span class="w"> </span>1d4a<span class="w"> </span><explode_bomb> +<span class="w"> </span><span class="m">1776</span>:<span class="w"> </span>b8<span class="w"> </span><span class="m">79</span><span class="w"> </span><span class="m">00</span><span class="w"> </span><span class="m">00</span><span class="w"> </span><span class="m">00</span><span class="w"> </span>mov<span class="w"> </span><span class="nv">$0</span>x79,%eax +<span class="w"> </span>177b:<span class="w"> </span>eb<span class="w"> </span>0a<span class="w"> </span>jmp<span class="w"> </span><span class="m">1787</span><span class="w"> </span><phase_3+0x14f> +<span class="w"> </span>177d:<span class="w"> </span>e8<span class="w"> </span>c8<span class="w"> </span><span class="m">05</span><span class="w"> </span><span class="m">00</span><span class="w"> </span><span class="m">00</span><span class="w"> </span>call<span class="w"> </span>1d4a<span class="w"> </span><explode_bomb> +<span class="w"> </span><span class="m">1782</span>:<span class="w"> </span>b8<span class="w"> </span><span class="m">68</span><span class="w"> </span><span class="m">00</span><span class="w"> </span><span class="m">00</span><span class="w"> </span><span class="m">00</span><span class="w"> </span>mov<span class="w"> </span><span class="nv">$0</span>x68,%eax +<span class="w"> </span><span class="m">1787</span>:<span class="w"> </span><span class="m">38</span><span class="w"> </span><span class="m">44</span><span class="w"> </span><span class="m">24</span><span class="w"> </span><span class="m">07</span><span class="w"> </span>cmp<span class="w"> </span>%al,0x7<span class="o">(</span>%rsp<span class="o">)</span> +<span class="w"> </span>178b:<span class="w"> </span><span class="m">75</span><span class="w"> </span><span class="m">05</span><span class="w"> </span>jne<span class="w"> </span><span class="m">1792</span><span class="w"> </span><phase_3+0x15a> +<span class="w"> </span>178d:<span class="w"> </span><span class="m">48</span><span class="w"> </span><span class="m">83</span><span class="w"> </span>c4<span class="w"> </span><span class="m">18</span><span class="w"> </span>add<span class="w"> </span><span class="nv">$0</span>x18,%rsp +<span class="w"> </span><span class="m">1791</span>:<span class="w"> </span>c3<span class="w"> </span>ret<span class="w"> </span> +<span class="w"> </span><span class="m">1792</span>:<span class="w"> </span>e8<span class="w"> </span>b3<span class="w"> </span><span class="m">05</span><span class="w"> </span><span class="m">00</span><span class="w"> </span><span class="m">00</span><span class="w"> </span>call<span class="w"> </span>1d4a<span class="w"> </span><explode_bomb> +<span class="w"> </span><span class="m">1797</span>:<span class="w"> </span>eb<span class="w"> </span>f4<span class="w"> </span>jmp<span class="w"> </span>178d<span class="w"> </span><phase_3+0x155> </code></pre> </div> <div class="codehilite"> <pre><span></span><code>... - 165b: e8 <span class="m">80</span> <span class="nb">fc</span> ff ff call 12e0 <__isoc99_sscanf@plt> +<span class="w"> </span>165b:<span class="w"> </span>e8<span class="w"> </span><span class="m">80</span><span class="w"> </span><span class="nb">fc</span><span class="w"> </span>ff<span class="w"> </span>ff<span class="w"> </span>call<span class="w"> </span>12e0<span class="w"> </span><__isoc99_sscanf@plt> ... </code></pre> </div> @@ -350,82 +354,82 @@ That<span class="err">'</span>s number <span class="m">2</span>. Keep going <p>Because I do not want to enter the solutions to phases 1 and 2 again and again, I am goig to pass a file which has these solutions.</p> <div class="codehilite"> -<pre><span></span><code>joxxxn@jupyter-nxxh6xx8:~/lab2-bomblab-navanchauhan/bombbomb$ gdb -ex <span class="s1">'break phase_3'</span> -ex <span class="s1">'break explode_bomb'</span> -ex <span class="s1">'run'</span> -args ./bomb sol.txt -GNU gdb <span class="o">(</span>Ubuntu <span class="m">12</span>.1-0ubuntu1~22.04<span class="o">)</span> <span class="m">12</span>.1 -Copyright <span class="o">(</span>C<span class="o">)</span> <span class="m">2022</span> Free Software Foundation, Inc. -License GPLv3+: GNU GPL version <span class="m">3</span> or later <http://gnu.org/licenses/gpl.html> -This is free software: you are free to change and redistribute it. -There is NO WARRANTY, to the extent permitted by law. -Type <span class="s2">"show copying"</span> and <span class="s2">"show warranty"</span> <span class="k">for</span> details. -This GDB was configured as <span class="s2">"x86_64-linux-gnu"</span>. -Type <span class="s2">"show configuration"</span> <span class="k">for</span> configuration details. -For bug reporting instructions, please see: +<pre><span></span><code>joxxxn@jupyter-nxxh6xx8:~/lab2-bomblab-navanchauhan/bombbomb$<span class="w"> </span>gdb<span class="w"> </span>-ex<span class="w"> </span><span class="s1">'break phase_3'</span><span class="w"> </span>-ex<span class="w"> </span><span class="s1">'break explode_bomb'</span><span class="w"> </span>-ex<span class="w"> </span><span class="s1">'run'</span><span class="w"> </span>-args<span class="w"> </span>./bomb<span class="w"> </span>sol.txt<span class="w"> </span> +GNU<span class="w"> </span>gdb<span class="w"> </span><span class="o">(</span>Ubuntu<span class="w"> </span><span class="m">12</span>.1-0ubuntu1~22.04<span class="o">)</span><span class="w"> </span><span class="m">12</span>.1 +Copyright<span class="w"> </span><span class="o">(</span>C<span class="o">)</span><span class="w"> </span><span class="m">2022</span><span class="w"> </span>Free<span class="w"> </span>Software<span class="w"> </span>Foundation,<span class="w"> </span>Inc. +License<span class="w"> </span>GPLv3+:<span class="w"> </span>GNU<span class="w"> </span>GPL<span class="w"> </span>version<span class="w"> </span><span class="m">3</span><span class="w"> </span>or<span class="w"> </span>later<span class="w"> </span><http://gnu.org/licenses/gpl.html> +This<span class="w"> </span>is<span class="w"> </span>free<span class="w"> </span>software:<span class="w"> </span>you<span class="w"> </span>are<span class="w"> </span>free<span class="w"> </span>to<span class="w"> </span>change<span class="w"> </span>and<span class="w"> </span>redistribute<span class="w"> </span>it. +There<span class="w"> </span>is<span class="w"> </span>NO<span class="w"> </span>WARRANTY,<span class="w"> </span>to<span class="w"> </span>the<span class="w"> </span>extent<span class="w"> </span>permitted<span class="w"> </span>by<span class="w"> </span>law. +Type<span class="w"> </span><span class="s2">"show copying"</span><span class="w"> </span>and<span class="w"> </span><span class="s2">"show warranty"</span><span class="w"> </span><span class="k">for</span><span class="w"> </span>details. +This<span class="w"> </span>GDB<span class="w"> </span>was<span class="w"> </span>configured<span class="w"> </span>as<span class="w"> </span><span class="s2">"x86_64-linux-gnu"</span>. +Type<span class="w"> </span><span class="s2">"show configuration"</span><span class="w"> </span><span class="k">for</span><span class="w"> </span>configuration<span class="w"> </span>details. +For<span class="w"> </span>bug<span class="w"> </span>reporting<span class="w"> </span>instructions,<span class="w"> </span>please<span class="w"> </span>see: <https://www.gnu.org/software/gdb/bugs/>. -Find the GDB manual and other documentation resources online at: - <http://www.gnu.org/software/gdb/documentation/>. - -For help, <span class="nb">type</span> <span class="s2">"help"</span>. -Type <span class="s2">"apropos word"</span> to search <span class="k">for</span> commands related to <span class="s2">"word"</span>... -Reading symbols from ./bomb... -Breakpoint <span class="m">1</span> at 0x1638 -Breakpoint <span class="m">2</span> at 0x1d4a -Starting program: /home/joxxxn/lab2-bomblab-navanchauhan/bombbomb/bomb sol.txt -<span class="o">[</span>Thread debugging using libthread_db enabled<span class="o">]</span> -Using host libthread_db library <span class="s2">"/lib/x86_64-linux-gnu/libthread_db.so.1"</span>. -Welcome to my fiendish little bomb. You have <span class="m">6</span> phases with -which to blow yourself up. Have a nice day! -Phase <span class="m">1</span> defused. How about the next one? -That<span class="err">'</span>s number <span class="m">2</span>. Keep going! -random string - -Breakpoint <span class="m">1</span>, 0x0000555555555638 <span class="k">in</span> phase_3 <span class="o">()</span> -<span class="o">(</span>gdb<span class="o">)</span> disas -Dump of assembler code <span class="k">for</span> <span class="k">function</span> phase_3: -<span class="o">=</span>> 0x0000555555555638 <+0>: endbr64 - 0x000055555555563c <+4>: sub <span class="nv">$0</span>x18,%rsp - 0x0000555555555640 <+8>: lea 0x7<span class="o">(</span>%rsp<span class="o">)</span>,%rcx - 0x0000555555555645 <+13>: lea 0xc<span class="o">(</span>%rsp<span class="o">)</span>,%rdx - 0x000055555555564a <+18>: lea 0x8<span class="o">(</span>%rsp<span class="o">)</span>,%r8 - 0x000055555555564f <+23>: lea 0x1b60<span class="o">(</span>%rip<span class="o">)</span>,%rsi <span class="c1"># 0x5555555571b6</span> - 0x0000555555555656 <+30>: mov <span class="nv">$0</span>x0,%eax - 0x000055555555565b <+35>: call 0x5555555552e0 <__isoc99_sscanf@plt> - 0x0000555555555660 <+40>: cmp <span class="nv">$0</span>x2,%eax - 0x0000555555555663 <+43>: jle 0x555555555685 <phase_3+77> - 0x0000555555555665 <+45>: cmpl <span class="nv">$0</span>x7,0xc<span class="o">(</span>%rsp<span class="o">)</span> - 0x000055555555566a <+50>: ja 0x55555555577d <phase_3+325> - 0x0000555555555670 <+56>: mov 0xc<span class="o">(</span>%rsp<span class="o">)</span>,%eax - 0x0000555555555674 <+60>: lea 0x1b55<span class="o">(</span>%rip<span class="o">)</span>,%rdx <span class="c1"># 0x5555555571d0</span> - 0x000055555555567b <+67>: movslq <span class="o">(</span>%rdx,%rax,4<span class="o">)</span>,%rax - 0x000055555555567f <+71>: add %rdx,%rax - 0x0000555555555682 <+74>: notrack jmp *%rax - 0x0000555555555685 <+77>: call 0x555555555d4a <explode_bomb> - 0x000055555555568a <+82>: jmp 0x555555555665 <phase_3+45> - 0x000055555555568c <+84>: mov <span class="nv">$0</span>x63,%eax - 0x0000555555555691 <+89>: cmpl <span class="nv">$0</span>x23d,0x8<span class="o">(</span>%rsp<span class="o">)</span> - 0x0000555555555699 <+97>: je 0x555555555787 <phase_3+335> - 0x000055555555569f <+103>: call 0x555555555d4a <explode_bomb> - 0x00005555555556a4 <+108>: mov <span class="nv">$0</span>x63,%eax - 0x00005555555556a9 <+113>: jmp 0x555555555787 <phase_3+335> ---Type <RET> <span class="k">for</span> more, q to quit, c to <span class="k">continue</span> without paging-- +Find<span class="w"> </span>the<span class="w"> </span>GDB<span class="w"> </span>manual<span class="w"> </span>and<span class="w"> </span>other<span class="w"> </span>documentation<span class="w"> </span>resources<span class="w"> </span>online<span class="w"> </span>at: +<span class="w"> </span><http://www.gnu.org/software/gdb/documentation/>. + +For<span class="w"> </span>help,<span class="w"> </span><span class="nb">type</span><span class="w"> </span><span class="s2">"help"</span>. +Type<span class="w"> </span><span class="s2">"apropos word"</span><span class="w"> </span>to<span class="w"> </span>search<span class="w"> </span><span class="k">for</span><span class="w"> </span>commands<span class="w"> </span>related<span class="w"> </span>to<span class="w"> </span><span class="s2">"word"</span>... +Reading<span class="w"> </span>symbols<span class="w"> </span>from<span class="w"> </span>./bomb... +Breakpoint<span class="w"> </span><span class="m">1</span><span class="w"> </span>at<span class="w"> </span>0x1638 +Breakpoint<span class="w"> </span><span class="m">2</span><span class="w"> </span>at<span class="w"> </span>0x1d4a +Starting<span class="w"> </span>program:<span class="w"> </span>/home/joxxxn/lab2-bomblab-navanchauhan/bombbomb/bomb<span class="w"> </span>sol.txt +<span class="o">[</span>Thread<span class="w"> </span>debugging<span class="w"> </span>using<span class="w"> </span>libthread_db<span class="w"> </span>enabled<span class="o">]</span> +Using<span class="w"> </span>host<span class="w"> </span>libthread_db<span class="w"> </span>library<span class="w"> </span><span class="s2">"/lib/x86_64-linux-gnu/libthread_db.so.1"</span>. +Welcome<span class="w"> </span>to<span class="w"> </span>my<span class="w"> </span>fiendish<span class="w"> </span>little<span class="w"> </span>bomb.<span class="w"> </span>You<span class="w"> </span>have<span class="w"> </span><span class="m">6</span><span class="w"> </span>phases<span class="w"> </span>with +which<span class="w"> </span>to<span class="w"> </span>blow<span class="w"> </span>yourself<span class="w"> </span>up.<span class="w"> </span>Have<span class="w"> </span>a<span class="w"> </span>nice<span class="w"> </span>day! +Phase<span class="w"> </span><span class="m">1</span><span class="w"> </span>defused.<span class="w"> </span>How<span class="w"> </span>about<span class="w"> </span>the<span class="w"> </span>next<span class="w"> </span>one? +That<span class="err">'</span>s<span class="w"> </span>number<span class="w"> </span><span class="m">2</span>.<span class="w"> </span>Keep<span class="w"> </span>going! +random<span class="w"> </span>string + +Breakpoint<span class="w"> </span><span class="m">1</span>,<span class="w"> </span>0x0000555555555638<span class="w"> </span><span class="k">in</span><span class="w"> </span>phase_3<span class="w"> </span><span class="o">()</span> +<span class="o">(</span>gdb<span class="o">)</span><span class="w"> </span>disas +Dump<span class="w"> </span>of<span class="w"> </span>assembler<span class="w"> </span>code<span class="w"> </span><span class="k">for</span><span class="w"> </span><span class="k">function</span><span class="w"> </span>phase_3: +<span class="o">=</span>><span class="w"> </span>0x0000555555555638<span class="w"> </span><+0>:<span class="w"> </span>endbr64<span class="w"> </span> +<span class="w"> </span>0x000055555555563c<span class="w"> </span><+4>:<span class="w"> </span>sub<span class="w"> </span><span class="nv">$0</span>x18,%rsp +<span class="w"> </span>0x0000555555555640<span class="w"> </span><+8>:<span class="w"> </span>lea<span class="w"> </span>0x7<span class="o">(</span>%rsp<span class="o">)</span>,%rcx +<span class="w"> </span>0x0000555555555645<span class="w"> </span><+13>:<span class="w"> </span>lea<span class="w"> </span>0xc<span class="o">(</span>%rsp<span class="o">)</span>,%rdx +<span class="w"> </span>0x000055555555564a<span class="w"> </span><+18>:<span class="w"> </span>lea<span class="w"> </span>0x8<span class="o">(</span>%rsp<span class="o">)</span>,%r8 +<span class="w"> </span>0x000055555555564f<span class="w"> </span><+23>:<span class="w"> </span>lea<span class="w"> </span>0x1b60<span class="o">(</span>%rip<span class="o">)</span>,%rsi<span class="w"> </span><span class="c1"># 0x5555555571b6</span> +<span class="w"> </span>0x0000555555555656<span class="w"> </span><+30>:<span class="w"> </span>mov<span class="w"> </span><span class="nv">$0</span>x0,%eax +<span class="w"> </span>0x000055555555565b<span class="w"> </span><+35>:<span class="w"> </span>call<span class="w"> </span>0x5555555552e0<span class="w"> </span><__isoc99_sscanf@plt> +<span class="w"> </span>0x0000555555555660<span class="w"> </span><+40>:<span class="w"> </span>cmp<span class="w"> </span><span class="nv">$0</span>x2,%eax +<span class="w"> </span>0x0000555555555663<span class="w"> </span><+43>:<span class="w"> </span>jle<span class="w"> </span>0x555555555685<span class="w"> </span><phase_3+77> +<span class="w"> </span>0x0000555555555665<span class="w"> </span><+45>:<span class="w"> </span>cmpl<span class="w"> </span><span class="nv">$0</span>x7,0xc<span class="o">(</span>%rsp<span class="o">)</span> +<span class="w"> </span>0x000055555555566a<span class="w"> </span><+50>:<span class="w"> </span>ja<span class="w"> </span>0x55555555577d<span class="w"> </span><phase_3+325> +<span class="w"> </span>0x0000555555555670<span class="w"> </span><+56>:<span class="w"> </span>mov<span class="w"> </span>0xc<span class="o">(</span>%rsp<span class="o">)</span>,%eax +<span class="w"> </span>0x0000555555555674<span class="w"> </span><+60>:<span class="w"> </span>lea<span class="w"> </span>0x1b55<span class="o">(</span>%rip<span class="o">)</span>,%rdx<span class="w"> </span><span class="c1"># 0x5555555571d0</span> +<span class="w"> </span>0x000055555555567b<span class="w"> </span><+67>:<span class="w"> </span>movslq<span class="w"> </span><span class="o">(</span>%rdx,%rax,4<span class="o">)</span>,%rax +<span class="w"> </span>0x000055555555567f<span class="w"> </span><+71>:<span class="w"> </span>add<span class="w"> </span>%rdx,%rax +<span class="w"> </span>0x0000555555555682<span class="w"> </span><+74>:<span class="w"> </span>notrack<span class="w"> </span>jmp<span class="w"> </span>*%rax +<span class="w"> </span>0x0000555555555685<span class="w"> </span><+77>:<span class="w"> </span>call<span class="w"> </span>0x555555555d4a<span class="w"> </span><explode_bomb> +<span class="w"> </span>0x000055555555568a<span class="w"> </span><+82>:<span class="w"> </span>jmp<span class="w"> </span>0x555555555665<span class="w"> </span><phase_3+45> +<span class="w"> </span>0x000055555555568c<span class="w"> </span><+84>:<span class="w"> </span>mov<span class="w"> </span><span class="nv">$0</span>x63,%eax +<span class="w"> </span>0x0000555555555691<span class="w"> </span><+89>:<span class="w"> </span>cmpl<span class="w"> </span><span class="nv">$0</span>x23d,0x8<span class="o">(</span>%rsp<span class="o">)</span> +<span class="w"> </span>0x0000555555555699<span class="w"> </span><+97>:<span class="w"> </span>je<span class="w"> </span>0x555555555787<span class="w"> </span><phase_3+335> +<span class="w"> </span>0x000055555555569f<span class="w"> </span><+103>:<span class="w"> </span>call<span class="w"> </span>0x555555555d4a<span class="w"> </span><explode_bomb> +<span class="w"> </span>0x00005555555556a4<span class="w"> </span><+108>:<span class="w"> </span>mov<span class="w"> </span><span class="nv">$0</span>x63,%eax +<span class="w"> </span>0x00005555555556a9<span class="w"> </span><+113>:<span class="w"> </span>jmp<span class="w"> </span>0x555555555787<span class="w"> </span><phase_3+335> +--Type<span class="w"> </span><RET><span class="w"> </span><span class="k">for</span><span class="w"> </span>more,<span class="w"> </span>q<span class="w"> </span>to<span class="w"> </span>quit,<span class="w"> </span>c<span class="w"> </span>to<span class="w"> </span><span class="k">continue</span><span class="w"> </span>without<span class="w"> </span>paging-- </code></pre> </div> <p><code>gdb</code> has thankfully marked the address which is being passed to <code>scanf</code>. We can access the value:</p> <div class="codehilite"> -<pre><span></span><code><span class="o">(</span>gdb<span class="o">)</span> x/1s 0x5555555571b6 -0x5555555571b6: <span class="s2">"%d %c %d"</span> -<span class="o">(</span>gdb<span class="o">)</span> +<pre><span></span><code><span class="o">(</span>gdb<span class="o">)</span><span class="w"> </span>x/1s<span class="w"> </span>0x5555555571b6 +0x5555555571b6:<span class="w"> </span><span class="s2">"%d %c %d"</span> +<span class="o">(</span>gdb<span class="o">)</span><span class="w"> </span> </code></pre> </div> <p>BINGO! The program expects an integer, character, and another integer. Onwards.</p> <div class="codehilite"> -<pre><span></span><code> 0x0000555555555660 <+40>: cmp <span class="nv">$0</span>x2,%eax - 0x0000555555555663 <+43>: jle 0x555555555685 <phase_3+77> +<pre><span></span><code><span class="w"> </span>0x0000555555555660<span class="w"> </span><+40>:<span class="w"> </span>cmp<span class="w"> </span><span class="nv">$0</span>x2,%eax +<span class="w"> </span>0x0000555555555663<span class="w"> </span><+43>:<span class="w"> </span>jle<span class="w"> </span>0x555555555685<span class="w"> </span><phase_3+77> ... - 0x0000555555555685 <+77>: call 0x555555555d4a <explode_bomb> +<span class="w"> </span>0x0000555555555685<span class="w"> </span><+77>:<span class="w"> </span>call<span class="w"> </span>0x555555555d4a<span class="w"> </span><explode_bomb> </code></pre> </div> @@ -434,23 +438,24 @@ Dump of assembler code <span class="k">for</span> <span class="k">function</span <p><em>Note: <code>scanf</code> returns the number of fields that were succesfully converted and assigned</em></p> <div class="codehilite"> -<pre><span></span><code> 0x0000555555555665 <+45>: cmpl <span class="nv">$0</span>x7,0xc<span class="o">(</span>%rsp<span class="o">)</span> - 0x000055555555566a <+50>: ja 0x55555555577d <phase_3+325> +<pre><span></span><code><span class="w"> </span>0x0000555555555665<span class="w"> </span><+45>:<span class="w"> </span>cmpl<span class="w"> </span><span class="nv">$0</span>x7,0xc<span class="o">(</span>%rsp<span class="o">)</span> +<span class="w"> </span>0x000055555555566a<span class="w"> </span><+50>:<span class="w"> </span>ja<span class="w"> </span>0x55555555577d<span class="w"> </span><phase_3+325> ... - 0x000055555555577d <+325>: call 0x555555555d4a <explode_bomb> +<span class="w"> </span>0x000055555555577d<span class="w"> </span><+325>:<span class="w"> </span>call<span class="w"> </span>0x555555555d4a<span class="w"> </span><explode_bomb> </code></pre> </div> -<p>Similarly, the program checks and ensures the returned value is not > 7. - <div class="codehilite"> - <pre><span></span><code>0x0000555555555670 <+56>: mov 0xc<span class="o">(</span>%rsp<span class="o">)</span>,%eax - 0x0000555555555674 <+60>: lea 0x1b55<span class="o">(</span>%rip<span class="o">)</span>,%rdx <span class="c1"># 0x5555555571d0</span> - 0x000055555555567b <+67>: movslq <span class="o">(</span>%rdx,%rax,4<span class="o">)</span>,%rax - 0x000055555555567f <+71>: add %rdx,%rax - 0x0000555555555682 <+74>: notrack jmp *%rax - 0x0000555555555685 <+77>: call 0x555555555d4a <explode_bomb> - </code></pre> - </div></p> +<p>Similarly, the program checks and ensures the returned value is not > 7. </p> + +<div class="codehilite"> +<pre><span></span><code><span class="w"> </span>0x0000555555555670<span class="w"> </span><+56>:<span class="w"> </span>mov<span class="w"> </span>0xc<span class="o">(</span>%rsp<span class="o">)</span>,%eax +<span class="w"> </span>0x0000555555555674<span class="w"> </span><+60>:<span class="w"> </span>lea<span class="w"> </span>0x1b55<span class="o">(</span>%rip<span class="o">)</span>,%rdx<span class="w"> </span><span class="c1"># 0x5555555571d0</span> +<span class="w"> </span>0x000055555555567b<span class="w"> </span><+67>:<span class="w"> </span>movslq<span class="w"> </span><span class="o">(</span>%rdx,%rax,4<span class="o">)</span>,%rax +<span class="w"> </span>0x000055555555567f<span class="w"> </span><+71>:<span class="w"> </span>add<span class="w"> </span>%rdx,%rax +<span class="w"> </span>0x0000555555555682<span class="w"> </span><+74>:<span class="w"> </span>notrack<span class="w"> </span>jmp<span class="w"> </span>*%rax +<span class="w"> </span>0x0000555555555685<span class="w"> </span><+77>:<span class="w"> </span>call<span class="w"> </span>0x555555555d4a<span class="w"> </span><explode_bomb> +</code></pre> +</div> <ul> <li><code>0x0000555555555670 <+56>: mov 0xc(%rsp),%eax</code> - Moves value located at <code>0xc</code> (12 in Decimal) bytes above the stack pointer to <code>%eax</code> register. </li> @@ -480,34 +485,36 @@ $1 = 3 <p><img src="/assets/bomb-lab/phase-3.png" alt="Screenshot of GDB terminal depicting us checking the value of the instruction to be jumped to" /></p> -<p>We can see that this makes us jump to <code><phase_3+186></code> (Continue to step through the code by using <code>ni</code>) - <div class="codehilite"> - <pre><span></span><code>0x00005555555556f2 <+186>: mov <span class="nv">$0</span>x64,%eax - 0x00005555555556f7 <+191>: cmpl <span class="nv">$0</span>x280,0x8<span class="o">(</span>%rsp<span class="o">)</span> - 0x00005555555556ff <+199>: je 0x555555555787 <phase<em>3+335> - 0x0000555555555705 <+205>: call 0x555555555d4a <explode</em>bomb> - </code></pre> - </div></p> - -<p>We see that <code>0x64</code> (Decimal 100) is being stored in <code>%eax</code>. Then, the program compares <code>0x280</code> (Decimal 640) with memory address <code>0x8</code> bytes above the stack pointer (<code>%rsp</code>). If the values are equal, then it jumps to <code><phase_3+335></code>, otherwise <code>explode_bomb</code> is called. - <div class="codehilite"> - <pre><span></span><code>0x0000555555555787 <+335>: cmp %al,0x7<span class="o">(</span>%rsp<span class="o">)</span> - 0x000055555555578b <+339>: jne 0x555555555792 <phase<em>3+346> - 0x000055555555578d <+341>: add <span class="nv">$0</span>x18,%rsp - 0x0000555555555791 <+345>: ret <br /> - 0x0000555555555792 <+346>: call 0x555555555d4a <explode</em>bomb> - </code></pre> - </div></p> +<p>We can see that this makes us jump to <code><phase_3+186></code> (Continue to step through the code by using <code>ni</code>)</p> + +<div class="codehilite"> +<pre><span></span><code><span class="w"> </span>0x00005555555556f2<span class="w"> </span><+186>:<span class="w"> </span>mov<span class="w"> </span><span class="nv">$0</span>x64,%eax +<span class="w"> </span>0x00005555555556f7<span class="w"> </span><+191>:<span class="w"> </span>cmpl<span class="w"> </span><span class="nv">$0</span>x280,0x8<span class="o">(</span>%rsp<span class="o">)</span> +<span class="w"> </span>0x00005555555556ff<span class="w"> </span><+199>:<span class="w"> </span>je<span class="w"> </span>0x555555555787<span class="w"> </span><phase_3+335> +<span class="w"> </span>0x0000555555555705<span class="w"> </span><+205>:<span class="w"> </span>call<span class="w"> </span>0x555555555d4a<span class="w"> </span><explode_bomb> +</code></pre> +</div> + +<p>We see that <code>0x64</code> (Decimal 100) is being stored in <code>%eax</code>. Then, the program compares <code>0x280</code> (Decimal 640) with memory address <code>0x8</code> bytes above the stack pointer (<code>%rsp</code>). If the values are equal, then it jumps to <code><phase_3+335></code>, otherwise <code>explode_bomb</code> is called.</p> + +<div class="codehilite"> +<pre><span></span><code><span class="w"> </span>0x0000555555555787<span class="w"> </span><+335>:<span class="w"> </span>cmp<span class="w"> </span>%al,0x7<span class="o">(</span>%rsp<span class="o">)</span> +<span class="w"> </span>0x000055555555578b<span class="w"> </span><+339>:<span class="w"> </span>jne<span class="w"> </span>0x555555555792<span class="w"> </span><phase_3+346> +<span class="w"> </span>0x000055555555578d<span class="w"> </span><+341>:<span class="w"> </span>add<span class="w"> </span><span class="nv">$0</span>x18,%rsp +<span class="w"> </span>0x0000555555555791<span class="w"> </span><+345>:<span class="w"> </span>ret<span class="w"> </span> +<span class="w"> </span>0x0000555555555792<span class="w"> </span><+346>:<span class="w"> </span>call<span class="w"> </span>0x555555555d4a<span class="w"> </span><explode_bomb> +</code></pre> +</div> <p>Here, the program is comparing the value of our given character to the value stored in <code>%al</code> (lower 8 bits of <code>EAX</code>), and checks if they are not equal.</p> <p>Knowing that the character is stored at an offset of 7 bytes to <code>%rsp</code>, we can print and check the value by running:</p> <div class="codehilite"> -<pre><span></span><code><span class="o">(</span>gdb<span class="o">)</span> x/1cw <span class="nv">$rsp</span>+7 +<pre><span></span><code><span class="o">(</span>gdb<span class="o">)</span><span class="w"> </span>x/1cw<span class="w"> </span><span class="nv">$rsp</span>+7 c -<span class="o">(</span>gdb<span class="o">)</span> print <span class="nv">$al</span> -<span class="nv">$1</span> <span class="o">=</span> <span class="m">100</span> +<span class="o">(</span>gdb<span class="o">)</span><span class="w"> </span>print<span class="w"> </span><span class="nv">$al</span> +<span class="nv">$1</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="m">100</span> </code></pre> </div> @@ -515,114 +522,116 @@ c <div class="codehilite"> <pre><span></span><code>... -That<span class="err">'</span>s number <span class="m">2</span>. Keep going! -<span class="m">3</span> d <span class="m">640</span> +That<span class="err">'</span>s<span class="w"> </span>number<span class="w"> </span><span class="m">2</span>.<span class="w"> </span>Keep<span class="w"> </span>going! +<span class="m">3</span><span class="w"> </span>d<span class="w"> </span><span class="m">640</span> -Breakpoint <span class="m">1</span>, 0x0000555555555638 <span class="k">in</span> phase_3 <span class="o">()</span> -<span class="o">(</span>gdb<span class="o">)</span> <span class="k">continue</span> +Breakpoint<span class="w"> </span><span class="m">1</span>,<span class="w"> </span>0x0000555555555638<span class="w"> </span><span class="k">in</span><span class="w"> </span>phase_3<span class="w"> </span><span class="o">()</span> +<span class="o">(</span>gdb<span class="o">)</span><span class="w"> </span><span class="k">continue</span> Continuing. -Halfway there! +Halfway<span class="w"> </span>there! </code></pre> </div> <h2>Phase 4</h2> <div class="codehilite"> -<pre><span></span><code>joxxxn@jupyter-nxxh6xx8:~/lab2-bomblab-navanchauhan/bombbomb$ gdb -ex <span class="s1">'break phase_4'</span> -ex <span class="s1">'break explode_bomb'</span> -ex <span class="s1">'run'</span> -args ./bomb sol.txt -GNU gdb <span class="o">(</span>Ubuntu <span class="m">12</span>.1-0ubuntu1~22.04<span class="o">)</span> <span class="m">12</span>.1 -Copyright <span class="o">(</span>C<span class="o">)</span> <span class="m">2022</span> Free Software Foundation, Inc. -License GPLv3+: GNU GPL version <span class="m">3</span> or later <http://gnu.org/licenses/gpl.html> -This is free software: you are free to change and redistribute it. -There is NO WARRANTY, to the extent permitted by law. -Type <span class="s2">"show copying"</span> and <span class="s2">"show warranty"</span> <span class="k">for</span> details. -This GDB was configured as <span class="s2">"x86_64-linux-gnu"</span>. -Type <span class="s2">"show configuration"</span> <span class="k">for</span> configuration details. -For bug reporting instructions, please see: +<pre><span></span><code>joxxxn@jupyter-nxxh6xx8:~/lab2-bomblab-navanchauhan/bombbomb$<span class="w"> </span>gdb<span class="w"> </span>-ex<span class="w"> </span><span class="s1">'break phase_4'</span><span class="w"> </span>-ex<span class="w"> </span><span class="s1">'break explode_bomb'</span><span class="w"> </span>-ex<span class="w"> </span><span class="s1">'run'</span><span class="w"> </span>-args<span class="w"> </span>./bomb<span class="w"> </span>sol.txt<span class="w"> </span> +GNU<span class="w"> </span>gdb<span class="w"> </span><span class="o">(</span>Ubuntu<span class="w"> </span><span class="m">12</span>.1-0ubuntu1~22.04<span class="o">)</span><span class="w"> </span><span class="m">12</span>.1 +Copyright<span class="w"> </span><span class="o">(</span>C<span class="o">)</span><span class="w"> </span><span class="m">2022</span><span class="w"> </span>Free<span class="w"> </span>Software<span class="w"> </span>Foundation,<span class="w"> </span>Inc. +License<span class="w"> </span>GPLv3+:<span class="w"> </span>GNU<span class="w"> </span>GPL<span class="w"> </span>version<span class="w"> </span><span class="m">3</span><span class="w"> </span>or<span class="w"> </span>later<span class="w"> </span><http://gnu.org/licenses/gpl.html> +This<span class="w"> </span>is<span class="w"> </span>free<span class="w"> </span>software:<span class="w"> </span>you<span class="w"> </span>are<span class="w"> </span>free<span class="w"> </span>to<span class="w"> </span>change<span class="w"> </span>and<span class="w"> </span>redistribute<span class="w"> </span>it. +There<span class="w"> </span>is<span class="w"> </span>NO<span class="w"> </span>WARRANTY,<span class="w"> </span>to<span class="w"> </span>the<span class="w"> </span>extent<span class="w"> </span>permitted<span class="w"> </span>by<span class="w"> </span>law. +Type<span class="w"> </span><span class="s2">"show copying"</span><span class="w"> </span>and<span class="w"> </span><span class="s2">"show warranty"</span><span class="w"> </span><span class="k">for</span><span class="w"> </span>details. +This<span class="w"> </span>GDB<span class="w"> </span>was<span class="w"> </span>configured<span class="w"> </span>as<span class="w"> </span><span class="s2">"x86_64-linux-gnu"</span>. +Type<span class="w"> </span><span class="s2">"show configuration"</span><span class="w"> </span><span class="k">for</span><span class="w"> </span>configuration<span class="w"> </span>details. +For<span class="w"> </span>bug<span class="w"> </span>reporting<span class="w"> </span>instructions,<span class="w"> </span>please<span class="w"> </span>see: <https://www.gnu.org/software/gdb/bugs/>. -Find the GDB manual and other documentation resources online at: - <http://www.gnu.org/software/gdb/documentation/>. - -For help, <span class="nb">type</span> <span class="s2">"help"</span>. -Type <span class="s2">"apropos word"</span> to search <span class="k">for</span> commands related to <span class="s2">"word"</span>... -Reading symbols from ./bomb... -Breakpoint <span class="m">1</span> at 0x17d3 -Breakpoint <span class="m">2</span> at 0x1d4a -Starting program: /home/joxxxn/lab2-bomblab-navanchauhan/bombbomb/bomb sol.txt -<span class="o">[</span>Thread debugging using libthread_db enabled<span class="o">]</span> -Using host libthread_db library <span class="s2">"/lib/x86_64-linux-gnu/libthread_db.so.1"</span>. -Welcome to my fiendish little bomb. You have <span class="m">6</span> phases with -which to blow yourself up. Have a nice day! -Phase <span class="m">1</span> defused. How about the next one? -That<span class="err">'</span>s number <span class="m">2</span>. Keep going! -Halfway there! -<span class="nb">test</span> string - -Breakpoint <span class="m">1</span>, 0x00005555555557d3 <span class="k">in</span> phase_4 <span class="o">()</span> -<span class="o">(</span>gdb<span class="o">)</span> disas phase_4 -Dump of assembler code <span class="k">for</span> <span class="k">function</span> phase_4: -<span class="o">=</span>> 0x00005555555557d3 <+0>: endbr64 - 0x00005555555557d7 <+4>: sub <span class="nv">$0</span>x18,%rsp - 0x00005555555557db <+8>: lea 0x8<span class="o">(</span>%rsp<span class="o">)</span>,%rcx - 0x00005555555557e0 <+13>: lea 0xc<span class="o">(</span>%rsp<span class="o">)</span>,%rdx - 0x00005555555557e5 <+18>: lea 0x1bba<span class="o">(</span>%rip<span class="o">)</span>,%rsi <span class="c1"># 0x5555555573a6</span> - 0x00005555555557ec <+25>: mov <span class="nv">$0</span>x0,%eax - 0x00005555555557f1 <+30>: call 0x5555555552e0 <__isoc99_sscanf@plt> - 0x00005555555557f6 <+35>: cmp <span class="nv">$0</span>x2,%eax - 0x00005555555557f9 <+38>: jne 0x555555555802 <phase_4+47> - 0x00005555555557fb <+40>: cmpl <span class="nv">$0</span>xe,0xc<span class="o">(</span>%rsp<span class="o">)</span> - 0x0000555555555800 <+45>: jbe 0x555555555807 <phase_4+52> - 0x0000555555555802 <+47>: call 0x555555555d4a <explode_bomb> - 0x0000555555555807 <+52>: mov <span class="nv">$0</span>xe,%edx - 0x000055555555580c <+57>: mov <span class="nv">$0</span>x0,%esi - 0x0000555555555811 <+62>: mov 0xc<span class="o">(</span>%rsp<span class="o">)</span>,%edi - 0x0000555555555815 <+66>: call 0x555555555799 <func4> - 0x000055555555581a <+71>: cmp <span class="nv">$0</span>x2,%eax - 0x000055555555581d <+74>: jne 0x555555555826 <phase_4+83> - 0x000055555555581f <+76>: cmpl <span class="nv">$0</span>x2,0x8<span class="o">(</span>%rsp<span class="o">)</span> - 0x0000555555555824 <+81>: je 0x55555555582b <phase_4+88> - 0x0000555555555826 <+83>: call 0x555555555d4a <explode_bomb> - 0x000055555555582b <+88>: add <span class="nv">$0</span>x18,%rsp - 0x000055555555582f <+92>: ret -End of assembler dump. -<span class="o">(</span>gdb<span class="o">)</span> +Find<span class="w"> </span>the<span class="w"> </span>GDB<span class="w"> </span>manual<span class="w"> </span>and<span class="w"> </span>other<span class="w"> </span>documentation<span class="w"> </span>resources<span class="w"> </span>online<span class="w"> </span>at: +<span class="w"> </span><http://www.gnu.org/software/gdb/documentation/>. + +For<span class="w"> </span>help,<span class="w"> </span><span class="nb">type</span><span class="w"> </span><span class="s2">"help"</span>. +Type<span class="w"> </span><span class="s2">"apropos word"</span><span class="w"> </span>to<span class="w"> </span>search<span class="w"> </span><span class="k">for</span><span class="w"> </span>commands<span class="w"> </span>related<span class="w"> </span>to<span class="w"> </span><span class="s2">"word"</span>... +Reading<span class="w"> </span>symbols<span class="w"> </span>from<span class="w"> </span>./bomb... +Breakpoint<span class="w"> </span><span class="m">1</span><span class="w"> </span>at<span class="w"> </span>0x17d3 +Breakpoint<span class="w"> </span><span class="m">2</span><span class="w"> </span>at<span class="w"> </span>0x1d4a +Starting<span class="w"> </span>program:<span class="w"> </span>/home/joxxxn/lab2-bomblab-navanchauhan/bombbomb/bomb<span class="w"> </span>sol.txt +<span class="o">[</span>Thread<span class="w"> </span>debugging<span class="w"> </span>using<span class="w"> </span>libthread_db<span class="w"> </span>enabled<span class="o">]</span> +Using<span class="w"> </span>host<span class="w"> </span>libthread_db<span class="w"> </span>library<span class="w"> </span><span class="s2">"/lib/x86_64-linux-gnu/libthread_db.so.1"</span>. +Welcome<span class="w"> </span>to<span class="w"> </span>my<span class="w"> </span>fiendish<span class="w"> </span>little<span class="w"> </span>bomb.<span class="w"> </span>You<span class="w"> </span>have<span class="w"> </span><span class="m">6</span><span class="w"> </span>phases<span class="w"> </span>with +which<span class="w"> </span>to<span class="w"> </span>blow<span class="w"> </span>yourself<span class="w"> </span>up.<span class="w"> </span>Have<span class="w"> </span>a<span class="w"> </span>nice<span class="w"> </span>day! +Phase<span class="w"> </span><span class="m">1</span><span class="w"> </span>defused.<span class="w"> </span>How<span class="w"> </span>about<span class="w"> </span>the<span class="w"> </span>next<span class="w"> </span>one? +That<span class="err">'</span>s<span class="w"> </span>number<span class="w"> </span><span class="m">2</span>.<span class="w"> </span>Keep<span class="w"> </span>going! +Halfway<span class="w"> </span>there! +<span class="nb">test</span><span class="w"> </span>string + +Breakpoint<span class="w"> </span><span class="m">1</span>,<span class="w"> </span>0x00005555555557d3<span class="w"> </span><span class="k">in</span><span class="w"> </span>phase_4<span class="w"> </span><span class="o">()</span> +<span class="o">(</span>gdb<span class="o">)</span><span class="w"> </span>disas<span class="w"> </span>phase_4 +Dump<span class="w"> </span>of<span class="w"> </span>assembler<span class="w"> </span>code<span class="w"> </span><span class="k">for</span><span class="w"> </span><span class="k">function</span><span class="w"> </span>phase_4: +<span class="o">=</span>><span class="w"> </span>0x00005555555557d3<span class="w"> </span><+0>:<span class="w"> </span>endbr64<span class="w"> </span> +<span class="w"> </span>0x00005555555557d7<span class="w"> </span><+4>:<span class="w"> </span>sub<span class="w"> </span><span class="nv">$0</span>x18,%rsp +<span class="w"> </span>0x00005555555557db<span class="w"> </span><+8>:<span class="w"> </span>lea<span class="w"> </span>0x8<span class="o">(</span>%rsp<span class="o">)</span>,%rcx +<span class="w"> </span>0x00005555555557e0<span class="w"> </span><+13>:<span class="w"> </span>lea<span class="w"> </span>0xc<span class="o">(</span>%rsp<span class="o">)</span>,%rdx +<span class="w"> </span>0x00005555555557e5<span class="w"> </span><+18>:<span class="w"> </span>lea<span class="w"> </span>0x1bba<span class="o">(</span>%rip<span class="o">)</span>,%rsi<span class="w"> </span><span class="c1"># 0x5555555573a6</span> +<span class="w"> </span>0x00005555555557ec<span class="w"> </span><+25>:<span class="w"> </span>mov<span class="w"> </span><span class="nv">$0</span>x0,%eax +<span class="w"> </span>0x00005555555557f1<span class="w"> </span><+30>:<span class="w"> </span>call<span class="w"> </span>0x5555555552e0<span class="w"> </span><__isoc99_sscanf@plt> +<span class="w"> </span>0x00005555555557f6<span class="w"> </span><+35>:<span class="w"> </span>cmp<span class="w"> </span><span class="nv">$0</span>x2,%eax +<span class="w"> </span>0x00005555555557f9<span class="w"> </span><+38>:<span class="w"> </span>jne<span class="w"> </span>0x555555555802<span class="w"> </span><phase_4+47> +<span class="w"> </span>0x00005555555557fb<span class="w"> </span><+40>:<span class="w"> </span>cmpl<span class="w"> </span><span class="nv">$0</span>xe,0xc<span class="o">(</span>%rsp<span class="o">)</span> +<span class="w"> </span>0x0000555555555800<span class="w"> </span><+45>:<span class="w"> </span>jbe<span class="w"> </span>0x555555555807<span class="w"> </span><phase_4+52> +<span class="w"> </span>0x0000555555555802<span class="w"> </span><+47>:<span class="w"> </span>call<span class="w"> </span>0x555555555d4a<span class="w"> </span><explode_bomb> +<span class="w"> </span>0x0000555555555807<span class="w"> </span><+52>:<span class="w"> </span>mov<span class="w"> </span><span class="nv">$0</span>xe,%edx +<span class="w"> </span>0x000055555555580c<span class="w"> </span><+57>:<span class="w"> </span>mov<span class="w"> </span><span class="nv">$0</span>x0,%esi +<span class="w"> </span>0x0000555555555811<span class="w"> </span><+62>:<span class="w"> </span>mov<span class="w"> </span>0xc<span class="o">(</span>%rsp<span class="o">)</span>,%edi +<span class="w"> </span>0x0000555555555815<span class="w"> </span><+66>:<span class="w"> </span>call<span class="w"> </span>0x555555555799<span class="w"> </span><func4> +<span class="w"> </span>0x000055555555581a<span class="w"> </span><+71>:<span class="w"> </span>cmp<span class="w"> </span><span class="nv">$0</span>x2,%eax +<span class="w"> </span>0x000055555555581d<span class="w"> </span><+74>:<span class="w"> </span>jne<span class="w"> </span>0x555555555826<span class="w"> </span><phase_4+83> +<span class="w"> </span>0x000055555555581f<span class="w"> </span><+76>:<span class="w"> </span>cmpl<span class="w"> </span><span class="nv">$0</span>x2,0x8<span class="o">(</span>%rsp<span class="o">)</span> +<span class="w"> </span>0x0000555555555824<span class="w"> </span><+81>:<span class="w"> </span>je<span class="w"> </span>0x55555555582b<span class="w"> </span><phase_4+88> +<span class="w"> </span>0x0000555555555826<span class="w"> </span><+83>:<span class="w"> </span>call<span class="w"> </span>0x555555555d4a<span class="w"> </span><explode_bomb> +<span class="w"> </span>0x000055555555582b<span class="w"> </span><+88>:<span class="w"> </span>add<span class="w"> </span><span class="nv">$0</span>x18,%rsp +<span class="w"> </span>0x000055555555582f<span class="w"> </span><+92>:<span class="w"> </span>ret<span class="w"> </span> +End<span class="w"> </span>of<span class="w"> </span>assembler<span class="w"> </span>dump. +<span class="o">(</span>gdb<span class="o">)</span><span class="w"> </span> </code></pre> </div> <p>Again, <code>gdb</code> has marked the string being passed to <code>scanf</code></p> <div class="codehilite"> -<pre><span></span><code><span class="o">(</span>gdb<span class="o">)</span> x/1s 0x5555555573a6 -0x5555555573a6: <span class="s2">"%d %d"</span> +<pre><span></span><code><span class="o">(</span>gdb<span class="o">)</span><span class="w"> </span>x/1s<span class="w"> </span>0x5555555573a6 +0x5555555573a6:<span class="w"> </span><span class="s2">"%d %d"</span> </code></pre> </div> -<p>Okay, so this time we are supposed to enter 2 numbers. - <div class="codehilite"> - <pre><span></span><code>0x00005555555557f6 <+35>: cmp <span class="nv">$0</span>x2,%eax - 0x00005555555557f9 <+38>: jne 0x555555555802 <phase_4+47> - </code></pre> - </div></p> +<p>Okay, so this time we are supposed to enter 2 numbers.</p> -<p>Checks if there were 2 values read from calling <code>scanf</code>, if not -> jump to <code><phase_4+47></code> which calls <code><explode_bomb></code>. - <div class="codehilite"> - <pre><span></span><code>0x00005555555557fb <+40>: cmpl <span class="nv">$0</span>xe,0xc<span class="o">(</span>%rsp<span class="o">)</span> - 0x0000555555555800 <+45>: jbe 0x555555555807 <phase_4+52> - </code></pre> - </div></p> +<div class="codehilite"> +<pre><span></span><code><span class="w"> </span>0x00005555555557f6<span class="w"> </span><+35>:<span class="w"> </span>cmp<span class="w"> </span><span class="nv">$0</span>x2,%eax +<span class="w"> </span>0x00005555555557f9<span class="w"> </span><+38>:<span class="w"> </span>jne<span class="w"> </span>0x555555555802<span class="w"> </span><phase_4+47> +</code></pre> +</div> + +<p>Checks if there were 2 values read from calling <code>scanf</code>, if not -> jump to <code><phase_4+47></code> which calls <code><explode_bomb></code>.</p> + +<div class="codehilite"> +<pre><span></span><code><span class="w"> </span>0x00005555555557fb<span class="w"> </span><+40>:<span class="w"> </span>cmpl<span class="w"> </span><span class="nv">$0</span>xe,0xc<span class="o">(</span>%rsp<span class="o">)</span> +<span class="w"> </span>0x0000555555555800<span class="w"> </span><+45>:<span class="w"> </span>jbe<span class="w"> </span>0x555555555807<span class="w"> </span><phase_4+52> +</code></pre> +</div> <p>Compare <code>0xe</code> (14 in Decimal) and value stored at <code>$rsp</code> + <code>0xc</code> bytes (Decimal 12). If this condition is met (<= 14), jump to <code><phase_4+52></code>. If not, then explode bomb.</p> <div class="codehilite"> <pre><span></span><code>... - 0x0000555555555807 <+52>: mov <span class="nv">$0</span>xe,%edx - 0x000055555555580c <+57>: mov <span class="nv">$0</span>x0,%esi - 0x0000555555555811 <+62>: mov 0xc<span class="o">(</span>%rsp<span class="o">)</span>,%edi - 0x0000555555555815 <+66>: call 0x555555555799 <func4> - 0x000055555555581a <+71>: cmp <span class="nv">$0</span>x2,%eax - 0x000055555555581d <+74>: jne 0x555555555826 <phase_4+83> - 0x000055555555581f <+76>: cmpl <span class="nv">$0</span>x2,0x8<span class="o">(</span>%rsp<span class="o">)</span> - 0x0000555555555824 <+81>: je 0x55555555582b <phase_4+88> - 0x0000555555555826 <+83>: call 0x555555555d4a <explode_bomb> +<span class="w"> </span>0x0000555555555807<span class="w"> </span><+52>:<span class="w"> </span>mov<span class="w"> </span><span class="nv">$0</span>xe,%edx +<span class="w"> </span>0x000055555555580c<span class="w"> </span><+57>:<span class="w"> </span>mov<span class="w"> </span><span class="nv">$0</span>x0,%esi +<span class="w"> </span>0x0000555555555811<span class="w"> </span><+62>:<span class="w"> </span>mov<span class="w"> </span>0xc<span class="o">(</span>%rsp<span class="o">)</span>,%edi +<span class="w"> </span>0x0000555555555815<span class="w"> </span><+66>:<span class="w"> </span>call<span class="w"> </span>0x555555555799<span class="w"> </span><func4> +<span class="w"> </span>0x000055555555581a<span class="w"> </span><+71>:<span class="w"> </span>cmp<span class="w"> </span><span class="nv">$0</span>x2,%eax +<span class="w"> </span>0x000055555555581d<span class="w"> </span><+74>:<span class="w"> </span>jne<span class="w"> </span>0x555555555826<span class="w"> </span><phase_4+83> +<span class="w"> </span>0x000055555555581f<span class="w"> </span><+76>:<span class="w"> </span>cmpl<span class="w"> </span><span class="nv">$0</span>x2,0x8<span class="o">(</span>%rsp<span class="o">)</span> +<span class="w"> </span>0x0000555555555824<span class="w"> </span><+81>:<span class="w"> </span>je<span class="w"> </span>0x55555555582b<span class="w"> </span><phase_4+88> +<span class="w"> </span>0x0000555555555826<span class="w"> </span><+83>:<span class="w"> </span>call<span class="w"> </span>0x555555555d4a<span class="w"> </span><explode_bomb> </code></pre> </div> @@ -634,28 +643,28 @@ End of assembler dump. <p>Let us look into <code>func4</code></p> <div class="codehilite"> -<pre><span></span><code><span class="o">(</span>gdb<span class="o">)</span> disas func4 -Dump of assembler code <span class="k">for</span> <span class="k">function</span> func4: - 0x0000555555555799 <+0>: endbr64 - 0x000055555555579d <+4>: sub <span class="nv">$0</span>x8,%rsp - 0x00005555555557a1 <+8>: mov %edx,%ecx - 0x00005555555557a3 <+10>: sub %esi,%ecx - 0x00005555555557a5 <+12>: shr %ecx - 0x00005555555557a7 <+14>: add %esi,%ecx - 0x00005555555557a9 <+16>: cmp %edi,%ecx - 0x00005555555557ab <+18>: ja 0x5555555557b9 <func4+32> - 0x00005555555557ad <+20>: mov <span class="nv">$0</span>x0,%eax - 0x00005555555557b2 <+25>: jb 0x5555555557c5 <func4+44> - 0x00005555555557b4 <+27>: add <span class="nv">$0</span>x8,%rsp - 0x00005555555557b8 <+31>: ret - 0x00005555555557b9 <+32>: lea -0x1<span class="o">(</span>%rcx<span class="o">)</span>,%edx - 0x00005555555557bc <+35>: call 0x555555555799 <func4> - 0x00005555555557c1 <+40>: add %eax,%eax - 0x00005555555557c3 <+42>: jmp 0x5555555557b4 <func4+27> - 0x00005555555557c5 <+44>: lea 0x1<span class="o">(</span>%rcx<span class="o">)</span>,%esi - 0x00005555555557c8 <+47>: call 0x555555555799 <func4> - 0x00005555555557cd <+52>: lea 0x1<span class="o">(</span>%rax,%rax,1<span class="o">)</span>,%eax - 0x00005555555557d1 <+56>: jmp 0x5555555557b4 <func4+27> +<pre><span></span><code><span class="o">(</span>gdb<span class="o">)</span><span class="w"> </span>disas<span class="w"> </span>func4 +Dump<span class="w"> </span>of<span class="w"> </span>assembler<span class="w"> </span>code<span class="w"> </span><span class="k">for</span><span class="w"> </span><span class="k">function</span><span class="w"> </span>func4: +<span class="w"> </span>0x0000555555555799<span class="w"> </span><+0>:<span class="w"> </span>endbr64<span class="w"> </span> +<span class="w"> </span>0x000055555555579d<span class="w"> </span><+4>:<span class="w"> </span>sub<span class="w"> </span><span class="nv">$0</span>x8,%rsp +<span class="w"> </span>0x00005555555557a1<span class="w"> </span><+8>:<span class="w"> </span>mov<span class="w"> </span>%edx,%ecx +<span class="w"> </span>0x00005555555557a3<span class="w"> </span><+10>:<span class="w"> </span>sub<span class="w"> </span>%esi,%ecx +<span class="w"> </span>0x00005555555557a5<span class="w"> </span><+12>:<span class="w"> </span>shr<span class="w"> </span>%ecx +<span class="w"> </span>0x00005555555557a7<span class="w"> </span><+14>:<span class="w"> </span>add<span class="w"> </span>%esi,%ecx +<span class="w"> </span>0x00005555555557a9<span class="w"> </span><+16>:<span class="w"> </span>cmp<span class="w"> </span>%edi,%ecx +<span class="w"> </span>0x00005555555557ab<span class="w"> </span><+18>:<span class="w"> </span>ja<span class="w"> </span>0x5555555557b9<span class="w"> </span><func4+32> +<span class="w"> </span>0x00005555555557ad<span class="w"> </span><+20>:<span class="w"> </span>mov<span class="w"> </span><span class="nv">$0</span>x0,%eax +<span class="w"> </span>0x00005555555557b2<span class="w"> </span><+25>:<span class="w"> </span>jb<span class="w"> </span>0x5555555557c5<span class="w"> </span><func4+44> +<span class="w"> </span>0x00005555555557b4<span class="w"> </span><+27>:<span class="w"> </span>add<span class="w"> </span><span class="nv">$0</span>x8,%rsp +<span class="w"> </span>0x00005555555557b8<span class="w"> </span><+31>:<span class="w"> </span>ret<span class="w"> </span> +<span class="w"> </span>0x00005555555557b9<span class="w"> </span><+32>:<span class="w"> </span>lea<span class="w"> </span>-0x1<span class="o">(</span>%rcx<span class="o">)</span>,%edx +<span class="w"> </span>0x00005555555557bc<span class="w"> </span><+35>:<span class="w"> </span>call<span class="w"> </span>0x555555555799<span class="w"> </span><func4> +<span class="w"> </span>0x00005555555557c1<span class="w"> </span><+40>:<span class="w"> </span>add<span class="w"> </span>%eax,%eax +<span class="w"> </span>0x00005555555557c3<span class="w"> </span><+42>:<span class="w"> </span>jmp<span class="w"> </span>0x5555555557b4<span class="w"> </span><func4+27> +<span class="w"> </span>0x00005555555557c5<span class="w"> </span><+44>:<span class="w"> </span>lea<span class="w"> </span>0x1<span class="o">(</span>%rcx<span class="o">)</span>,%esi +<span class="w"> </span>0x00005555555557c8<span class="w"> </span><+47>:<span class="w"> </span>call<span class="w"> </span>0x555555555799<span class="w"> </span><func4> +<span class="w"> </span>0x00005555555557cd<span class="w"> </span><+52>:<span class="w"> </span>lea<span class="w"> </span>0x1<span class="o">(</span>%rax,%rax,1<span class="o">)</span>,%eax +<span class="w"> </span>0x00005555555557d1<span class="w"> </span><+56>:<span class="w"> </span>jmp<span class="w"> </span>0x5555555557b4<span class="w"> </span><func4+27> </code></pre> </div> @@ -665,25 +674,25 @@ Dump of assembler code <span class="k">for</span> <span class="k">function</span <div class="codehilite"> <pre><span></span><code>endbr64 -sub <span class="nv">$0</span>x8,%rsp // subtract <span class="m">8</span> bytes from the stack pointer -mov %edx,%ecx // Move the value <span class="k">in</span> register %edx to %ecx -sub %esi,%ecx // Subtract the value <span class="k">in</span> %esi from %ecx -shr %ecx // Right <span class="nb">shift</span> the value <span class="k">in</span> %ecx by one bit <span class="o">(</span>dividing the value by <span class="m">2</span><span class="o">)</span> -add %esi,%ecx // Add the value <span class="k">in</span> %esi to %ecx -cmp %edi,%ecx // Compare -ja 0x5555555557b9 <func4+32> // If %ecx > %edi -> jump to instruction at offset +32 -mov <span class="nv">$0</span>x0,%eax // Move <span class="m">0</span> to %eax -jb 0x5555555557c5 <func4+44> // If %ecx < %edi -> jump to instruction at offset +44. -add <span class="nv">$0</span>x8,%rsp // add <span class="m">8</span> bytes to the stack pointer -ret // <span class="k">return</span> -lea -0x1<span class="o">(</span>%rcx<span class="o">)</span>,%edx // LEA of <span class="nv">$rxc</span> - <span class="m">1</span> into <span class="nv">$edx</span> -call 0x555555555799 <func4> // Call itself -add %eax,%eax // Double the value <span class="k">in</span> %eax -jmp 0x5555555557b4 <func4+27> // jump to the instruction at offset +27 -lea 0x1<span class="o">(</span>%rcx<span class="o">)</span>,%esi -call 0x555555555799 <func4> -lea 0x1<span class="o">(</span>%rax,%rax,1<span class="o">)</span>,%eax // LEA of %rax * <span class="m">2</span> + <span class="m">1</span> into <span class="nv">$eax</span> -jmp 0x5555555557b4 <func4+27> +sub<span class="w"> </span><span class="nv">$0</span>x8,%rsp<span class="w"> </span>//<span class="w"> </span>subtract<span class="w"> </span><span class="m">8</span><span class="w"> </span>bytes<span class="w"> </span>from<span class="w"> </span>the<span class="w"> </span>stack<span class="w"> </span>pointer +mov<span class="w"> </span>%edx,%ecx<span class="w"> </span>//<span class="w"> </span>Move<span class="w"> </span>the<span class="w"> </span>value<span class="w"> </span><span class="k">in</span><span class="w"> </span>register<span class="w"> </span>%edx<span class="w"> </span>to<span class="w"> </span>%ecx +sub<span class="w"> </span>%esi,%ecx<span class="w"> </span>//<span class="w"> </span>Subtract<span class="w"> </span>the<span class="w"> </span>value<span class="w"> </span><span class="k">in</span><span class="w"> </span>%esi<span class="w"> </span>from<span class="w"> </span>%ecx +shr<span class="w"> </span>%ecx<span class="w"> </span>//<span class="w"> </span>Right<span class="w"> </span><span class="nb">shift</span><span class="w"> </span>the<span class="w"> </span>value<span class="w"> </span><span class="k">in</span><span class="w"> </span>%ecx<span class="w"> </span>by<span class="w"> </span>one<span class="w"> </span>bit<span class="w"> </span><span class="o">(</span>dividing<span class="w"> </span>the<span class="w"> </span>value<span class="w"> </span>by<span class="w"> </span><span class="m">2</span><span class="o">)</span> +add<span class="w"> </span>%esi,%ecx<span class="w"> </span>//<span class="w"> </span>Add<span class="w"> </span>the<span class="w"> </span>value<span class="w"> </span><span class="k">in</span><span class="w"> </span>%esi<span class="w"> </span>to<span class="w"> </span>%ecx +cmp<span class="w"> </span>%edi,%ecx<span class="w"> </span>//<span class="w"> </span>Compare +ja<span class="w"> </span>0x5555555557b9<span class="w"> </span><func4+32><span class="w"> </span>//<span class="w"> </span>If<span class="w"> </span>%ecx<span class="w"> </span>><span class="w"> </span>%edi<span class="w"> </span>-><span class="w"> </span>jump<span class="w"> </span>to<span class="w"> </span>instruction<span class="w"> </span>at<span class="w"> </span>offset<span class="w"> </span>+32 +mov<span class="w"> </span><span class="nv">$0</span>x0,%eax<span class="w"> </span>//<span class="w"> </span>Move<span class="w"> </span><span class="m">0</span><span class="w"> </span>to<span class="w"> </span>%eax +jb<span class="w"> </span>0x5555555557c5<span class="w"> </span><func4+44><span class="w"> </span>//<span class="w"> </span>If<span class="w"> </span>%ecx<span class="w"> </span><<span class="w"> </span>%edi<span class="w"> </span>-><span class="w"> </span>jump<span class="w"> </span>to<span class="w"> </span>instruction<span class="w"> </span>at<span class="w"> </span>offset<span class="w"> </span>+44. +add<span class="w"> </span><span class="nv">$0</span>x8,%rsp<span class="w"> </span>//<span class="w"> </span>add<span class="w"> </span><span class="m">8</span><span class="w"> </span>bytes<span class="w"> </span>to<span class="w"> </span>the<span class="w"> </span>stack<span class="w"> </span>pointer +ret<span class="w"> </span>//<span class="w"> </span><span class="k">return</span> +lea<span class="w"> </span>-0x1<span class="o">(</span>%rcx<span class="o">)</span>,%edx<span class="w"> </span>//<span class="w"> </span>LEA<span class="w"> </span>of<span class="w"> </span><span class="nv">$rxc</span><span class="w"> </span>-<span class="w"> </span><span class="m">1</span><span class="w"> </span>into<span class="w"> </span><span class="nv">$edx</span> +call<span class="w"> </span>0x555555555799<span class="w"> </span><func4><span class="w"> </span>//<span class="w"> </span>Call<span class="w"> </span>itself +add<span class="w"> </span>%eax,%eax<span class="w"> </span>//<span class="w"> </span>Double<span class="w"> </span>the<span class="w"> </span>value<span class="w"> </span><span class="k">in</span><span class="w"> </span>%eax +jmp<span class="w"> </span>0x5555555557b4<span class="w"> </span><func4+27><span class="w"> </span>//<span class="w"> </span>jump<span class="w"> </span>to<span class="w"> </span>the<span class="w"> </span>instruction<span class="w"> </span>at<span class="w"> </span>offset<span class="w"> </span>+27 +lea<span class="w"> </span>0x1<span class="o">(</span>%rcx<span class="o">)</span>,%esi +call<span class="w"> </span>0x555555555799<span class="w"> </span><func4> +lea<span class="w"> </span>0x1<span class="o">(</span>%rax,%rax,1<span class="o">)</span>,%eax<span class="w"> </span>//<span class="w"> </span>LEA<span class="w"> </span>of<span class="w"> </span>%rax<span class="w"> </span>*<span class="w"> </span><span class="m">2</span><span class="w"> </span>+<span class="w"> </span><span class="m">1</span><span class="w"> </span>into<span class="w"> </span><span class="nv">$eax</span><span class="w"> </span> +jmp<span class="w"> </span>0x5555555557b4<span class="w"> </span><func4+27> </code></pre> </div> @@ -710,79 +719,80 @@ jmp 0x5555555557b4 <func4+27> <p>Okay, so we know that the number needed to be passed to <code>func4</code> is 5. But, what about the second digit?</p> -<p>If we go back to the code for <code><phase_4></code>, we can see that: - <div class="codehilite"> - <pre><span></span><code>0x000055555555581f <+76>: cmpl <span class="nv">$0</span>x2,0x8<span class="o">(</span>%rsp<span class="o">)</span> - 0x0000555555555824 <+81>: je 0x55555555582b <phase_4+88> - </code></pre> - </div></p> +<p>If we go back to the code for <code><phase_4></code>, we can see that:</p> + +<div class="codehilite"> +<pre><span></span><code><span class="w"> </span>0x000055555555581f<span class="w"> </span><+76>:<span class="w"> </span>cmpl<span class="w"> </span><span class="nv">$0</span>x2,0x8<span class="o">(</span>%rsp<span class="o">)</span> +<span class="w"> </span>0x0000555555555824<span class="w"> </span><+81>:<span class="w"> </span>je<span class="w"> </span>0x55555555582b<span class="w"> </span><phase_4+88> +</code></pre> +</div> <p>The value at <code>$rsp+8</code> should be equal to 2. So, let us try passing <code>5 2</code> as our input.</p> <div class="codehilite"> <pre><span></span><code>... -Phase <span class="m">1</span> defused. How about the next one? -That<span class="err">'</span>s number <span class="m">2</span>. Keep going! -Halfway there! -<span class="m">5</span> <span class="m">2</span> +Phase<span class="w"> </span><span class="m">1</span><span class="w"> </span>defused.<span class="w"> </span>How<span class="w"> </span>about<span class="w"> </span>the<span class="w"> </span>next<span class="w"> </span>one? +That<span class="err">'</span>s<span class="w"> </span>number<span class="w"> </span><span class="m">2</span>.<span class="w"> </span>Keep<span class="w"> </span>going! +Halfway<span class="w"> </span>there! +<span class="m">5</span><span class="w"> </span><span class="m">2</span> -Breakpoint <span class="m">1</span>, 0x00005555555557d3 <span class="k">in</span> phase_4 <span class="o">()</span> -<span class="o">(</span>gdb<span class="o">)</span> <span class="k">continue</span> +Breakpoint<span class="w"> </span><span class="m">1</span>,<span class="w"> </span>0x00005555555557d3<span class="w"> </span><span class="k">in</span><span class="w"> </span>phase_4<span class="w"> </span><span class="o">()</span> +<span class="o">(</span>gdb<span class="o">)</span><span class="w"> </span><span class="k">continue</span> Continuing. -So you got that one. Try this one. +So<span class="w"> </span>you<span class="w"> </span>got<span class="w"> </span>that<span class="w"> </span>one.<span class="w"> </span>Try<span class="w"> </span>this<span class="w"> </span>one. </code></pre> </div> <h2>Phase 5</h2> <div class="codehilite"> -<pre><span></span><code>So you got that one. Try this one. -<span class="nb">test</span> string - -Breakpoint <span class="m">1</span>, 0x0000555555555830 <span class="k">in</span> phase_5 <span class="o">()</span> -<span class="o">(</span>gdb<span class="o">)</span> disas phase_5 -Dump of assembler code <span class="k">for</span> <span class="k">function</span> phase_5: -<span class="o">=</span>> 0x0000555555555830 <+0>: endbr64 - 0x0000555555555834 <+4>: push %rbx - 0x0000555555555835 <+5>: sub <span class="nv">$0</span>x10,%rsp - 0x0000555555555839 <+9>: mov %rdi,%rbx - 0x000055555555583c <+12>: call 0x555555555b10 <string_length> - 0x0000555555555841 <+17>: cmp <span class="nv">$0</span>x6,%eax - 0x0000555555555844 <+20>: jne 0x55555555588b <phase_5+91> - 0x0000555555555846 <+22>: mov <span class="nv">$0</span>x0,%eax - 0x000055555555584b <+27>: lea 0x199e<span class="o">(</span>%rip<span class="o">)</span>,%rcx <span class="c1"># 0x5555555571f0 <array.0></span> - 0x0000555555555852 <+34>: movzbl <span class="o">(</span>%rbx,%rax,1<span class="o">)</span>,%edx - 0x0000555555555856 <+38>: and <span class="nv">$0</span>xf,%edx - 0x0000555555555859 <+41>: movzbl <span class="o">(</span>%rcx,%rdx,1<span class="o">)</span>,%edx - 0x000055555555585d <+45>: mov %dl,0x9<span class="o">(</span>%rsp,%rax,1<span class="o">)</span> - 0x0000555555555861 <+49>: add <span class="nv">$0</span>x1,%rax - 0x0000555555555865 <+53>: cmp <span class="nv">$0</span>x6,%rax - 0x0000555555555869 <+57>: jne 0x555555555852 <phase_5+34> - 0x000055555555586b <+59>: movb <span class="nv">$0</span>x0,0xf<span class="o">(</span>%rsp<span class="o">)</span> - 0x0000555555555870 <+64>: lea 0x9<span class="o">(</span>%rsp<span class="o">)</span>,%rdi - 0x0000555555555875 <+69>: lea 0x1943<span class="o">(</span>%rip<span class="o">)</span>,%rsi <span class="c1"># 0x5555555571bf</span> - 0x000055555555587c <+76>: call 0x555555555b31 <strings_not_equal> - 0x0000555555555881 <+81>: <span class="nb">test</span> %eax,%eax - 0x0000555555555883 <+83>: jne 0x555555555892 <phase_5+98> - 0x0000555555555885 <+85>: add <span class="nv">$0</span>x10,%rsp - 0x0000555555555889 <+89>: pop %rbx - 0x000055555555588a <+90>: ret - 0x000055555555588b <+91>: call 0x555555555d4a <explode_bomb> - 0x0000555555555890 <+96>: jmp 0x555555555846 <phase_5+22> - 0x0000555555555892 <+98>: call 0x555555555d4a <explode_bomb> - 0x0000555555555897 <+103>: jmp 0x555555555885 <phase_5+85> -End of assembler dump. -<span class="o">(</span>gdb<span class="o">)</span> +<pre><span></span><code>So<span class="w"> </span>you<span class="w"> </span>got<span class="w"> </span>that<span class="w"> </span>one.<span class="w"> </span>Try<span class="w"> </span>this<span class="w"> </span>one. +<span class="nb">test</span><span class="w"> </span>string + +Breakpoint<span class="w"> </span><span class="m">1</span>,<span class="w"> </span>0x0000555555555830<span class="w"> </span><span class="k">in</span><span class="w"> </span>phase_5<span class="w"> </span><span class="o">()</span> +<span class="o">(</span>gdb<span class="o">)</span><span class="w"> </span>disas<span class="w"> </span>phase_5 +Dump<span class="w"> </span>of<span class="w"> </span>assembler<span class="w"> </span>code<span class="w"> </span><span class="k">for</span><span class="w"> </span><span class="k">function</span><span class="w"> </span>phase_5: +<span class="o">=</span>><span class="w"> </span>0x0000555555555830<span class="w"> </span><+0>:<span class="w"> </span>endbr64<span class="w"> </span> +<span class="w"> </span>0x0000555555555834<span class="w"> </span><+4>:<span class="w"> </span>push<span class="w"> </span>%rbx +<span class="w"> </span>0x0000555555555835<span class="w"> </span><+5>:<span class="w"> </span>sub<span class="w"> </span><span class="nv">$0</span>x10,%rsp +<span class="w"> </span>0x0000555555555839<span class="w"> </span><+9>:<span class="w"> </span>mov<span class="w"> </span>%rdi,%rbx +<span class="w"> </span>0x000055555555583c<span class="w"> </span><+12>:<span class="w"> </span>call<span class="w"> </span>0x555555555b10<span class="w"> </span><string_length> +<span class="w"> </span>0x0000555555555841<span class="w"> </span><+17>:<span class="w"> </span>cmp<span class="w"> </span><span class="nv">$0</span>x6,%eax +<span class="w"> </span>0x0000555555555844<span class="w"> </span><+20>:<span class="w"> </span>jne<span class="w"> </span>0x55555555588b<span class="w"> </span><phase_5+91> +<span class="w"> </span>0x0000555555555846<span class="w"> </span><+22>:<span class="w"> </span>mov<span class="w"> </span><span class="nv">$0</span>x0,%eax +<span class="w"> </span>0x000055555555584b<span class="w"> </span><+27>:<span class="w"> </span>lea<span class="w"> </span>0x199e<span class="o">(</span>%rip<span class="o">)</span>,%rcx<span class="w"> </span><span class="c1"># 0x5555555571f0 <array.0></span> +<span class="w"> </span>0x0000555555555852<span class="w"> </span><+34>:<span class="w"> </span>movzbl<span class="w"> </span><span class="o">(</span>%rbx,%rax,1<span class="o">)</span>,%edx +<span class="w"> </span>0x0000555555555856<span class="w"> </span><+38>:<span class="w"> </span>and<span class="w"> </span><span class="nv">$0</span>xf,%edx +<span class="w"> </span>0x0000555555555859<span class="w"> </span><+41>:<span class="w"> </span>movzbl<span class="w"> </span><span class="o">(</span>%rcx,%rdx,1<span class="o">)</span>,%edx +<span class="w"> </span>0x000055555555585d<span class="w"> </span><+45>:<span class="w"> </span>mov<span class="w"> </span>%dl,0x9<span class="o">(</span>%rsp,%rax,1<span class="o">)</span> +<span class="w"> </span>0x0000555555555861<span class="w"> </span><+49>:<span class="w"> </span>add<span class="w"> </span><span class="nv">$0</span>x1,%rax +<span class="w"> </span>0x0000555555555865<span class="w"> </span><+53>:<span class="w"> </span>cmp<span class="w"> </span><span class="nv">$0</span>x6,%rax +<span class="w"> </span>0x0000555555555869<span class="w"> </span><+57>:<span class="w"> </span>jne<span class="w"> </span>0x555555555852<span class="w"> </span><phase_5+34> +<span class="w"> </span>0x000055555555586b<span class="w"> </span><+59>:<span class="w"> </span>movb<span class="w"> </span><span class="nv">$0</span>x0,0xf<span class="o">(</span>%rsp<span class="o">)</span> +<span class="w"> </span>0x0000555555555870<span class="w"> </span><+64>:<span class="w"> </span>lea<span class="w"> </span>0x9<span class="o">(</span>%rsp<span class="o">)</span>,%rdi +<span class="w"> </span>0x0000555555555875<span class="w"> </span><+69>:<span class="w"> </span>lea<span class="w"> </span>0x1943<span class="o">(</span>%rip<span class="o">)</span>,%rsi<span class="w"> </span><span class="c1"># 0x5555555571bf</span> +<span class="w"> </span>0x000055555555587c<span class="w"> </span><+76>:<span class="w"> </span>call<span class="w"> </span>0x555555555b31<span class="w"> </span><strings_not_equal> +<span class="w"> </span>0x0000555555555881<span class="w"> </span><+81>:<span class="w"> </span><span class="nb">test</span><span class="w"> </span>%eax,%eax +<span class="w"> </span>0x0000555555555883<span class="w"> </span><+83>:<span class="w"> </span>jne<span class="w"> </span>0x555555555892<span class="w"> </span><phase_5+98> +<span class="w"> </span>0x0000555555555885<span class="w"> </span><+85>:<span class="w"> </span>add<span class="w"> </span><span class="nv">$0</span>x10,%rsp +<span class="w"> </span>0x0000555555555889<span class="w"> </span><+89>:<span class="w"> </span>pop<span class="w"> </span>%rbx +<span class="w"> </span>0x000055555555588a<span class="w"> </span><+90>:<span class="w"> </span>ret<span class="w"> </span> +<span class="w"> </span>0x000055555555588b<span class="w"> </span><+91>:<span class="w"> </span>call<span class="w"> </span>0x555555555d4a<span class="w"> </span><explode_bomb> +<span class="w"> </span>0x0000555555555890<span class="w"> </span><+96>:<span class="w"> </span>jmp<span class="w"> </span>0x555555555846<span class="w"> </span><phase_5+22> +<span class="w"> </span>0x0000555555555892<span class="w"> </span><+98>:<span class="w"> </span>call<span class="w"> </span>0x555555555d4a<span class="w"> </span><explode_bomb> +<span class="w"> </span>0x0000555555555897<span class="w"> </span><+103>:<span class="w"> </span>jmp<span class="w"> </span>0x555555555885<span class="w"> </span><phase_5+85> +End<span class="w"> </span>of<span class="w"> </span>assembler<span class="w"> </span>dump. +<span class="o">(</span>gdb<span class="o">)</span><span class="w"> </span> </code></pre> </div> <div class="codehilite"> <pre><span></span><code>... - 0x000055555555583c <+12>: call 0x555555555b10 <string_length> - 0x0000555555555841 <+17>: cmp <span class="nv">$0</span>x6,%eax - 0x0000555555555844 <+20>: jne 0x55555555588b <phase_5+91> +<span class="w"> </span>0x000055555555583c<span class="w"> </span><+12>:<span class="w"> </span>call<span class="w"> </span>0x555555555b10<span class="w"> </span><string_length> +<span class="w"> </span>0x0000555555555841<span class="w"> </span><+17>:<span class="w"> </span>cmp<span class="w"> </span><span class="nv">$0</span>x6,%eax +<span class="w"> </span>0x0000555555555844<span class="w"> </span><+20>:<span class="w"> </span>jne<span class="w"> </span>0x55555555588b<span class="w"> </span><phase_5+91> ... - 0x000055555555588b <+91>: call 0x555555555d4a <explode_bomb> +<span class="w"> </span>0x000055555555588b<span class="w"> </span><+91>:<span class="w"> </span>call<span class="w"> </span>0x555555555d4a<span class="w"> </span><explode_bomb> ... </code></pre> </div> @@ -810,11 +820,11 @@ End of assembler dump. <p>We can check the reference string we need, which <code>gdb</code> has marked as <code># 0x5555555571bf</code>, and the lookup table marked as <code># 0x5555555571f0 <array.0></code></p> <div class="codehilite"> -<pre><span></span><code><span class="o">(</span>gdb<span class="o">)</span> x/s 0x5555555571bf -0x5555555571bf: <span class="s2">"bruins"</span> -<span class="o">(</span>gdb<span class="o">)</span> x/s 0x5555555571f0 -0x5555555571f0 <array.0>: <span class="s2">"maduiersnfotvbylSo you think you can stop the bomb with ctrl-c, do you?"</span> -<span class="o">(</span>gdb<span class="o">)</span> +<pre><span></span><code><span class="o">(</span>gdb<span class="o">)</span><span class="w"> </span>x/s<span class="w"> </span>0x5555555571bf +0x5555555571bf:<span class="w"> </span><span class="s2">"bruins"</span> +<span class="o">(</span>gdb<span class="o">)</span><span class="w"> </span>x/s<span class="w"> </span>0x5555555571f0 +0x5555555571f0<span class="w"> </span><array.0>:<span class="w"> </span><span class="s2">"maduiersnfotvbylSo you think you can stop the bomb with ctrl-c, do you?"</span> +<span class="o">(</span>gdb<span class="o">)</span><span class="w"> </span> </code></pre> </div> @@ -850,15 +860,15 @@ s -> g <div class="codehilite"> <pre><span></span><code>... -That<span class="err">'</span>s number <span class="m">2</span>. Keep going! -Halfway there! -So you got that one. Try this one. +That<span class="err">'</span>s<span class="w"> </span>number<span class="w"> </span><span class="m">2</span>.<span class="w"> </span>Keep<span class="w"> </span>going! +Halfway<span class="w"> </span>there! +So<span class="w"> </span>you<span class="w"> </span>got<span class="w"> </span>that<span class="w"> </span>one.<span class="w"> </span>Try<span class="w"> </span>this<span class="w"> </span>one. mfcdhg -Breakpoint <span class="m">1</span>, 0x0000555555555830 <span class="k">in</span> phase_5 <span class="o">()</span> -<span class="o">(</span>gdb<span class="o">)</span> <span class="k">continue</span> +Breakpoint<span class="w"> </span><span class="m">1</span>,<span class="w"> </span>0x0000555555555830<span class="w"> </span><span class="k">in</span><span class="w"> </span>phase_5<span class="w"> </span><span class="o">()</span> +<span class="o">(</span>gdb<span class="o">)</span><span class="w"> </span><span class="k">continue</span> Continuing. -Good work! On to the next... +Good<span class="w"> </span>work!<span class="w"> </span>On<span class="w"> </span>to<span class="w"> </span>the<span class="w"> </span>next... </code></pre> </div> @@ -867,122 +877,123 @@ Good work! On to the next... <h2>Phase 6</h2> <div class="codehilite"> -<pre><span></span><code>Good work! On to the next... -<span class="nb">test</span> string - -Breakpoint <span class="m">1</span>, 0x0000555555555899 <span class="k">in</span> phase_6 <span class="o">()</span> -<span class="o">(</span>gdb<span class="o">)</span> disas phase_6 -Dump of assembler code <span class="k">for</span> <span class="k">function</span> phase_6: -<span class="o">=</span>> 0x0000555555555899 <+0>: endbr64 - 0x000055555555589d <+4>: push %r15 - 0x000055555555589f <+6>: push %r14 - 0x00005555555558a1 <+8>: push %r13 - 0x00005555555558a3 <+10>: push %r12 - 0x00005555555558a5 <+12>: push %rbp - 0x00005555555558a6 <+13>: push %rbx - 0x00005555555558a7 <+14>: sub <span class="nv">$0</span>x68,%rsp - 0x00005555555558ab <+18>: lea 0x40<span class="o">(</span>%rsp<span class="o">)</span>,%rax - 0x00005555555558b0 <+23>: mov %rax,%r14 - 0x00005555555558b3 <+26>: mov %rax,0x8<span class="o">(</span>%rsp<span class="o">)</span> - 0x00005555555558b8 <+31>: mov %rax,%rsi - 0x00005555555558bb <+34>: call 0x555555555d97 <read_six_numbers> - 0x00005555555558c0 <+39>: mov %r14,%r12 - 0x00005555555558c3 <+42>: mov <span class="nv">$0</span>x1,%r15d - 0x00005555555558c9 <+48>: mov %r14,%r13 - 0x00005555555558cc <+51>: jmp 0x555555555997 <phase_6+254> - 0x00005555555558d1 <+56>: call 0x555555555d4a <explode_bomb> - 0x00005555555558d6 <+61>: jmp 0x5555555559a9 <phase_6+272> - 0x00005555555558db <+66>: add <span class="nv">$0</span>x1,%rbx - 0x00005555555558df <+70>: cmp <span class="nv">$0</span>x5,%ebx - 0x00005555555558e2 <+73>: jg 0x55555555598f <phase_6+246> - 0x00005555555558e8 <+79>: mov 0x0<span class="o">(</span>%r13,%rbx,4<span class="o">)</span>,%eax - 0x00005555555558ed <+84>: cmp %eax,0x0<span class="o">(</span>%rbp<span class="o">)</span> - 0x00005555555558f0 <+87>: jne 0x5555555558db <phase_6+66> - 0x00005555555558f2 <+89>: call 0x555555555d4a <explode_bomb> - 0x00005555555558f7 <+94>: jmp 0x5555555558db <phase_6+66> - 0x00005555555558f9 <+96>: mov 0x8<span class="o">(</span>%rsp<span class="o">)</span>,%rdx - 0x00005555555558fe <+101>: add <span class="nv">$0</span>x18,%rdx - 0x0000555555555902 <+105>: mov <span class="nv">$0</span>x7,%ecx - 0x0000555555555907 <+110>: mov %ecx,%eax - 0x0000555555555909 <+112>: sub <span class="o">(</span>%r12<span class="o">)</span>,%eax - 0x000055555555590d <+116>: mov %eax,<span class="o">(</span>%r12<span class="o">)</span> - 0x0000555555555911 <+120>: add <span class="nv">$0</span>x4,%r12 - 0x0000555555555915 <+124>: cmp %r12,%rdx - 0x0000555555555918 <+127>: jne 0x555555555907 <phase_6+110> - 0x000055555555591a <+129>: mov <span class="nv">$0</span>x0,%esi - 0x000055555555591f <+134>: mov 0x40<span class="o">(</span>%rsp,%rsi,4<span class="o">)</span>,%ecx - 0x0000555555555923 <+138>: mov <span class="nv">$0</span>x1,%eax - 0x0000555555555928 <+143>: lea 0x3d01<span class="o">(</span>%rip<span class="o">)</span>,%rdx <span class="c1"># 0x555555559630 <node1></span> ---Type <RET> <span class="k">for</span> more, q to quit, c to <span class="k">continue</span> without paging-- - 0x000055555555592f <+150>: cmp <span class="nv">$0</span>x1,%ecx - 0x0000555555555932 <+153>: jle 0x55555555593f <phase_6+166> - 0x0000555555555934 <+155>: mov 0x8<span class="o">(</span>%rdx<span class="o">)</span>,%rdx - 0x0000555555555938 <+159>: add <span class="nv">$0</span>x1,%eax - 0x000055555555593b <+162>: cmp %ecx,%eax - 0x000055555555593d <+164>: jne 0x555555555934 <phase_6+155> - 0x000055555555593f <+166>: mov %rdx,0x10<span class="o">(</span>%rsp,%rsi,8<span class="o">)</span> - 0x0000555555555944 <+171>: add <span class="nv">$0</span>x1,%rsi - 0x0000555555555948 <+175>: cmp <span class="nv">$0</span>x6,%rsi - 0x000055555555594c <+179>: jne 0x55555555591f <phase_6+134> - 0x000055555555594e <+181>: mov 0x10<span class="o">(</span>%rsp<span class="o">)</span>,%rbx - 0x0000555555555953 <+186>: mov 0x18<span class="o">(</span>%rsp<span class="o">)</span>,%rax - 0x0000555555555958 <+191>: mov %rax,0x8<span class="o">(</span>%rbx<span class="o">)</span> - 0x000055555555595c <+195>: mov 0x20<span class="o">(</span>%rsp<span class="o">)</span>,%rdx - 0x0000555555555961 <+200>: mov %rdx,0x8<span class="o">(</span>%rax<span class="o">)</span> - 0x0000555555555965 <+204>: mov 0x28<span class="o">(</span>%rsp<span class="o">)</span>,%rax - 0x000055555555596a <+209>: mov %rax,0x8<span class="o">(</span>%rdx<span class="o">)</span> - 0x000055555555596e <+213>: mov 0x30<span class="o">(</span>%rsp<span class="o">)</span>,%rdx - 0x0000555555555973 <+218>: mov %rdx,0x8<span class="o">(</span>%rax<span class="o">)</span> - 0x0000555555555977 <+222>: mov 0x38<span class="o">(</span>%rsp<span class="o">)</span>,%rax - 0x000055555555597c <+227>: mov %rax,0x8<span class="o">(</span>%rdx<span class="o">)</span> - 0x0000555555555980 <+231>: movq <span class="nv">$0</span>x0,0x8<span class="o">(</span>%rax<span class="o">)</span> - 0x0000555555555988 <+239>: mov <span class="nv">$0</span>x5,%ebp - 0x000055555555598d <+244>: jmp 0x5555555559c4 <phase_6+299> - 0x000055555555598f <+246>: add <span class="nv">$0</span>x1,%r15 - 0x0000555555555993 <+250>: add <span class="nv">$0</span>x4,%r14 - 0x0000555555555997 <+254>: mov %r14,%rbp - 0x000055555555599a <+257>: mov <span class="o">(</span>%r14<span class="o">)</span>,%eax - 0x000055555555599d <+260>: sub <span class="nv">$0</span>x1,%eax - 0x00005555555559a0 <+263>: cmp <span class="nv">$0</span>x5,%eax - 0x00005555555559a3 <+266>: ja 0x5555555558d1 <phase_6+56> - 0x00005555555559a9 <+272>: cmp <span class="nv">$0</span>x5,%r15d - 0x00005555555559ad <+276>: jg 0x5555555558f9 <phase_6+96> - 0x00005555555559b3 <+282>: mov %r15,%rbx - 0x00005555555559b6 <+285>: jmp 0x5555555558e8 <phase_6+79> - 0x00005555555559bb <+290>: mov 0x8<span class="o">(</span>%rbx<span class="o">)</span>,%rbx - 0x00005555555559bf <+294>: sub <span class="nv">$0</span>x1,%ebp - 0x00005555555559c2 <+297>: je 0x5555555559d5 <phase_6+316> - 0x00005555555559c4 <+299>: mov 0x8<span class="o">(</span>%rbx<span class="o">)</span>,%rax - 0x00005555555559c8 <+303>: mov <span class="o">(</span>%rax<span class="o">)</span>,%eax - 0x00005555555559ca <+305>: cmp %eax,<span class="o">(</span>%rbx<span class="o">)</span> ---Type <RET> <span class="k">for</span> more, q to quit, c to <span class="k">continue</span> without paging-- - 0x00005555555559cc <+307>: jge 0x5555555559bb <phase_6+290> - 0x00005555555559ce <+309>: call 0x555555555d4a <explode_bomb> - 0x00005555555559d3 <+314>: jmp 0x5555555559bb <phase_6+290> - 0x00005555555559d5 <+316>: add <span class="nv">$0</span>x68,%rsp - 0x00005555555559d9 <+320>: pop %rbx - 0x00005555555559da <+321>: pop %rbp - 0x00005555555559db <+322>: pop %r12 - 0x00005555555559dd <+324>: pop %r13 - 0x00005555555559df <+326>: pop %r14 - 0x00005555555559e1 <+328>: pop %r15 - 0x00005555555559e3 <+330>: ret -End of assembler dump. -<span class="o">(</span>gdb<span class="o">)</span> +<pre><span></span><code>Good<span class="w"> </span>work!<span class="w"> </span>On<span class="w"> </span>to<span class="w"> </span>the<span class="w"> </span>next... +<span class="nb">test</span><span class="w"> </span>string + +Breakpoint<span class="w"> </span><span class="m">1</span>,<span class="w"> </span>0x0000555555555899<span class="w"> </span><span class="k">in</span><span class="w"> </span>phase_6<span class="w"> </span><span class="o">()</span> +<span class="o">(</span>gdb<span class="o">)</span><span class="w"> </span>disas<span class="w"> </span>phase_6 +Dump<span class="w"> </span>of<span class="w"> </span>assembler<span class="w"> </span>code<span class="w"> </span><span class="k">for</span><span class="w"> </span><span class="k">function</span><span class="w"> </span>phase_6: +<span class="o">=</span>><span class="w"> </span>0x0000555555555899<span class="w"> </span><+0>:<span class="w"> </span>endbr64<span class="w"> </span> +<span class="w"> </span>0x000055555555589d<span class="w"> </span><+4>:<span class="w"> </span>push<span class="w"> </span>%r15 +<span class="w"> </span>0x000055555555589f<span class="w"> </span><+6>:<span class="w"> </span>push<span class="w"> </span>%r14 +<span class="w"> </span>0x00005555555558a1<span class="w"> </span><+8>:<span class="w"> </span>push<span class="w"> </span>%r13 +<span class="w"> </span>0x00005555555558a3<span class="w"> </span><+10>:<span class="w"> </span>push<span class="w"> </span>%r12 +<span class="w"> </span>0x00005555555558a5<span class="w"> </span><+12>:<span class="w"> </span>push<span class="w"> </span>%rbp +<span class="w"> </span>0x00005555555558a6<span class="w"> </span><+13>:<span class="w"> </span>push<span class="w"> </span>%rbx +<span class="w"> </span>0x00005555555558a7<span class="w"> </span><+14>:<span class="w"> </span>sub<span class="w"> </span><span class="nv">$0</span>x68,%rsp +<span class="w"> </span>0x00005555555558ab<span class="w"> </span><+18>:<span class="w"> </span>lea<span class="w"> </span>0x40<span class="o">(</span>%rsp<span class="o">)</span>,%rax +<span class="w"> </span>0x00005555555558b0<span class="w"> </span><+23>:<span class="w"> </span>mov<span class="w"> </span>%rax,%r14 +<span class="w"> </span>0x00005555555558b3<span class="w"> </span><+26>:<span class="w"> </span>mov<span class="w"> </span>%rax,0x8<span class="o">(</span>%rsp<span class="o">)</span> +<span class="w"> </span>0x00005555555558b8<span class="w"> </span><+31>:<span class="w"> </span>mov<span class="w"> </span>%rax,%rsi +<span class="w"> </span>0x00005555555558bb<span class="w"> </span><+34>:<span class="w"> </span>call<span class="w"> </span>0x555555555d97<span class="w"> </span><read_six_numbers> +<span class="w"> </span>0x00005555555558c0<span class="w"> </span><+39>:<span class="w"> </span>mov<span class="w"> </span>%r14,%r12 +<span class="w"> </span>0x00005555555558c3<span class="w"> </span><+42>:<span class="w"> </span>mov<span class="w"> </span><span class="nv">$0</span>x1,%r15d +<span class="w"> </span>0x00005555555558c9<span class="w"> </span><+48>:<span class="w"> </span>mov<span class="w"> </span>%r14,%r13 +<span class="w"> </span>0x00005555555558cc<span class="w"> </span><+51>:<span class="w"> </span>jmp<span class="w"> </span>0x555555555997<span class="w"> </span><phase_6+254> +<span class="w"> </span>0x00005555555558d1<span class="w"> </span><+56>:<span class="w"> </span>call<span class="w"> </span>0x555555555d4a<span class="w"> </span><explode_bomb> +<span class="w"> </span>0x00005555555558d6<span class="w"> </span><+61>:<span class="w"> </span>jmp<span class="w"> </span>0x5555555559a9<span class="w"> </span><phase_6+272> +<span class="w"> </span>0x00005555555558db<span class="w"> </span><+66>:<span class="w"> </span>add<span class="w"> </span><span class="nv">$0</span>x1,%rbx +<span class="w"> </span>0x00005555555558df<span class="w"> </span><+70>:<span class="w"> </span>cmp<span class="w"> </span><span class="nv">$0</span>x5,%ebx +<span class="w"> </span>0x00005555555558e2<span class="w"> </span><+73>:<span class="w"> </span>jg<span class="w"> </span>0x55555555598f<span class="w"> </span><phase_6+246> +<span class="w"> </span>0x00005555555558e8<span class="w"> </span><+79>:<span class="w"> </span>mov<span class="w"> </span>0x0<span class="o">(</span>%r13,%rbx,4<span class="o">)</span>,%eax +<span class="w"> </span>0x00005555555558ed<span class="w"> </span><+84>:<span class="w"> </span>cmp<span class="w"> </span>%eax,0x0<span class="o">(</span>%rbp<span class="o">)</span> +<span class="w"> </span>0x00005555555558f0<span class="w"> </span><+87>:<span class="w"> </span>jne<span class="w"> </span>0x5555555558db<span class="w"> </span><phase_6+66> +<span class="w"> </span>0x00005555555558f2<span class="w"> </span><+89>:<span class="w"> </span>call<span class="w"> </span>0x555555555d4a<span class="w"> </span><explode_bomb> +<span class="w"> </span>0x00005555555558f7<span class="w"> </span><+94>:<span class="w"> </span>jmp<span class="w"> </span>0x5555555558db<span class="w"> </span><phase_6+66> +<span class="w"> </span>0x00005555555558f9<span class="w"> </span><+96>:<span class="w"> </span>mov<span class="w"> </span>0x8<span class="o">(</span>%rsp<span class="o">)</span>,%rdx +<span class="w"> </span>0x00005555555558fe<span class="w"> </span><+101>:<span class="w"> </span>add<span class="w"> </span><span class="nv">$0</span>x18,%rdx +<span class="w"> </span>0x0000555555555902<span class="w"> </span><+105>:<span class="w"> </span>mov<span class="w"> </span><span class="nv">$0</span>x7,%ecx +<span class="w"> </span>0x0000555555555907<span class="w"> </span><+110>:<span class="w"> </span>mov<span class="w"> </span>%ecx,%eax +<span class="w"> </span>0x0000555555555909<span class="w"> </span><+112>:<span class="w"> </span>sub<span class="w"> </span><span class="o">(</span>%r12<span class="o">)</span>,%eax +<span class="w"> </span>0x000055555555590d<span class="w"> </span><+116>:<span class="w"> </span>mov<span class="w"> </span>%eax,<span class="o">(</span>%r12<span class="o">)</span> +<span class="w"> </span>0x0000555555555911<span class="w"> </span><+120>:<span class="w"> </span>add<span class="w"> </span><span class="nv">$0</span>x4,%r12 +<span class="w"> </span>0x0000555555555915<span class="w"> </span><+124>:<span class="w"> </span>cmp<span class="w"> </span>%r12,%rdx +<span class="w"> </span>0x0000555555555918<span class="w"> </span><+127>:<span class="w"> </span>jne<span class="w"> </span>0x555555555907<span class="w"> </span><phase_6+110> +<span class="w"> </span>0x000055555555591a<span class="w"> </span><+129>:<span class="w"> </span>mov<span class="w"> </span><span class="nv">$0</span>x0,%esi +<span class="w"> </span>0x000055555555591f<span class="w"> </span><+134>:<span class="w"> </span>mov<span class="w"> </span>0x40<span class="o">(</span>%rsp,%rsi,4<span class="o">)</span>,%ecx +<span class="w"> </span>0x0000555555555923<span class="w"> </span><+138>:<span class="w"> </span>mov<span class="w"> </span><span class="nv">$0</span>x1,%eax +<span class="w"> </span>0x0000555555555928<span class="w"> </span><+143>:<span class="w"> </span>lea<span class="w"> </span>0x3d01<span class="o">(</span>%rip<span class="o">)</span>,%rdx<span class="w"> </span><span class="c1"># 0x555555559630 <node1></span> +--Type<span class="w"> </span><RET><span class="w"> </span><span class="k">for</span><span class="w"> </span>more,<span class="w"> </span>q<span class="w"> </span>to<span class="w"> </span>quit,<span class="w"> </span>c<span class="w"> </span>to<span class="w"> </span><span class="k">continue</span><span class="w"> </span>without<span class="w"> </span>paging-- +<span class="w"> </span>0x000055555555592f<span class="w"> </span><+150>:<span class="w"> </span>cmp<span class="w"> </span><span class="nv">$0</span>x1,%ecx +<span class="w"> </span>0x0000555555555932<span class="w"> </span><+153>:<span class="w"> </span>jle<span class="w"> </span>0x55555555593f<span class="w"> </span><phase_6+166> +<span class="w"> </span>0x0000555555555934<span class="w"> </span><+155>:<span class="w"> </span>mov<span class="w"> </span>0x8<span class="o">(</span>%rdx<span class="o">)</span>,%rdx +<span class="w"> </span>0x0000555555555938<span class="w"> </span><+159>:<span class="w"> </span>add<span class="w"> </span><span class="nv">$0</span>x1,%eax +<span class="w"> </span>0x000055555555593b<span class="w"> </span><+162>:<span class="w"> </span>cmp<span class="w"> </span>%ecx,%eax +<span class="w"> </span>0x000055555555593d<span class="w"> </span><+164>:<span class="w"> </span>jne<span class="w"> </span>0x555555555934<span class="w"> </span><phase_6+155> +<span class="w"> </span>0x000055555555593f<span class="w"> </span><+166>:<span class="w"> </span>mov<span class="w"> </span>%rdx,0x10<span class="o">(</span>%rsp,%rsi,8<span class="o">)</span> +<span class="w"> </span>0x0000555555555944<span class="w"> </span><+171>:<span class="w"> </span>add<span class="w"> </span><span class="nv">$0</span>x1,%rsi +<span class="w"> </span>0x0000555555555948<span class="w"> </span><+175>:<span class="w"> </span>cmp<span class="w"> </span><span class="nv">$0</span>x6,%rsi +<span class="w"> </span>0x000055555555594c<span class="w"> </span><+179>:<span class="w"> </span>jne<span class="w"> </span>0x55555555591f<span class="w"> </span><phase_6+134> +<span class="w"> </span>0x000055555555594e<span class="w"> </span><+181>:<span class="w"> </span>mov<span class="w"> </span>0x10<span class="o">(</span>%rsp<span class="o">)</span>,%rbx +<span class="w"> </span>0x0000555555555953<span class="w"> </span><+186>:<span class="w"> </span>mov<span class="w"> </span>0x18<span class="o">(</span>%rsp<span class="o">)</span>,%rax +<span class="w"> </span>0x0000555555555958<span class="w"> </span><+191>:<span class="w"> </span>mov<span class="w"> </span>%rax,0x8<span class="o">(</span>%rbx<span class="o">)</span> +<span class="w"> </span>0x000055555555595c<span class="w"> </span><+195>:<span class="w"> </span>mov<span class="w"> </span>0x20<span class="o">(</span>%rsp<span class="o">)</span>,%rdx +<span class="w"> </span>0x0000555555555961<span class="w"> </span><+200>:<span class="w"> </span>mov<span class="w"> </span>%rdx,0x8<span class="o">(</span>%rax<span class="o">)</span> +<span class="w"> </span>0x0000555555555965<span class="w"> </span><+204>:<span class="w"> </span>mov<span class="w"> </span>0x28<span class="o">(</span>%rsp<span class="o">)</span>,%rax +<span class="w"> </span>0x000055555555596a<span class="w"> </span><+209>:<span class="w"> </span>mov<span class="w"> </span>%rax,0x8<span class="o">(</span>%rdx<span class="o">)</span> +<span class="w"> </span>0x000055555555596e<span class="w"> </span><+213>:<span class="w"> </span>mov<span class="w"> </span>0x30<span class="o">(</span>%rsp<span class="o">)</span>,%rdx +<span class="w"> </span>0x0000555555555973<span class="w"> </span><+218>:<span class="w"> </span>mov<span class="w"> </span>%rdx,0x8<span class="o">(</span>%rax<span class="o">)</span> +<span class="w"> </span>0x0000555555555977<span class="w"> </span><+222>:<span class="w"> </span>mov<span class="w"> </span>0x38<span class="o">(</span>%rsp<span class="o">)</span>,%rax +<span class="w"> </span>0x000055555555597c<span class="w"> </span><+227>:<span class="w"> </span>mov<span class="w"> </span>%rax,0x8<span class="o">(</span>%rdx<span class="o">)</span> +<span class="w"> </span>0x0000555555555980<span class="w"> </span><+231>:<span class="w"> </span>movq<span class="w"> </span><span class="nv">$0</span>x0,0x8<span class="o">(</span>%rax<span class="o">)</span> +<span class="w"> </span>0x0000555555555988<span class="w"> </span><+239>:<span class="w"> </span>mov<span class="w"> </span><span class="nv">$0</span>x5,%ebp +<span class="w"> </span>0x000055555555598d<span class="w"> </span><+244>:<span class="w"> </span>jmp<span class="w"> </span>0x5555555559c4<span class="w"> </span><phase_6+299> +<span class="w"> </span>0x000055555555598f<span class="w"> </span><+246>:<span class="w"> </span>add<span class="w"> </span><span class="nv">$0</span>x1,%r15 +<span class="w"> </span>0x0000555555555993<span class="w"> </span><+250>:<span class="w"> </span>add<span class="w"> </span><span class="nv">$0</span>x4,%r14 +<span class="w"> </span>0x0000555555555997<span class="w"> </span><+254>:<span class="w"> </span>mov<span class="w"> </span>%r14,%rbp +<span class="w"> </span>0x000055555555599a<span class="w"> </span><+257>:<span class="w"> </span>mov<span class="w"> </span><span class="o">(</span>%r14<span class="o">)</span>,%eax +<span class="w"> </span>0x000055555555599d<span class="w"> </span><+260>:<span class="w"> </span>sub<span class="w"> </span><span class="nv">$0</span>x1,%eax +<span class="w"> </span>0x00005555555559a0<span class="w"> </span><+263>:<span class="w"> </span>cmp<span class="w"> </span><span class="nv">$0</span>x5,%eax +<span class="w"> </span>0x00005555555559a3<span class="w"> </span><+266>:<span class="w"> </span>ja<span class="w"> </span>0x5555555558d1<span class="w"> </span><phase_6+56> +<span class="w"> </span>0x00005555555559a9<span class="w"> </span><+272>:<span class="w"> </span>cmp<span class="w"> </span><span class="nv">$0</span>x5,%r15d +<span class="w"> </span>0x00005555555559ad<span class="w"> </span><+276>:<span class="w"> </span>jg<span class="w"> </span>0x5555555558f9<span class="w"> </span><phase_6+96> +<span class="w"> </span>0x00005555555559b3<span class="w"> </span><+282>:<span class="w"> </span>mov<span class="w"> </span>%r15,%rbx +<span class="w"> </span>0x00005555555559b6<span class="w"> </span><+285>:<span class="w"> </span>jmp<span class="w"> </span>0x5555555558e8<span class="w"> </span><phase_6+79> +<span class="w"> </span>0x00005555555559bb<span class="w"> </span><+290>:<span class="w"> </span>mov<span class="w"> </span>0x8<span class="o">(</span>%rbx<span class="o">)</span>,%rbx +<span class="w"> </span>0x00005555555559bf<span class="w"> </span><+294>:<span class="w"> </span>sub<span class="w"> </span><span class="nv">$0</span>x1,%ebp +<span class="w"> </span>0x00005555555559c2<span class="w"> </span><+297>:<span class="w"> </span>je<span class="w"> </span>0x5555555559d5<span class="w"> </span><phase_6+316> +<span class="w"> </span>0x00005555555559c4<span class="w"> </span><+299>:<span class="w"> </span>mov<span class="w"> </span>0x8<span class="o">(</span>%rbx<span class="o">)</span>,%rax +<span class="w"> </span>0x00005555555559c8<span class="w"> </span><+303>:<span class="w"> </span>mov<span class="w"> </span><span class="o">(</span>%rax<span class="o">)</span>,%eax +<span class="w"> </span>0x00005555555559ca<span class="w"> </span><+305>:<span class="w"> </span>cmp<span class="w"> </span>%eax,<span class="o">(</span>%rbx<span class="o">)</span> +--Type<span class="w"> </span><RET><span class="w"> </span><span class="k">for</span><span class="w"> </span>more,<span class="w"> </span>q<span class="w"> </span>to<span class="w"> </span>quit,<span class="w"> </span>c<span class="w"> </span>to<span class="w"> </span><span class="k">continue</span><span class="w"> </span>without<span class="w"> </span>paging-- +<span class="w"> </span>0x00005555555559cc<span class="w"> </span><+307>:<span class="w"> </span>jge<span class="w"> </span>0x5555555559bb<span class="w"> </span><phase_6+290> +<span class="w"> </span>0x00005555555559ce<span class="w"> </span><+309>:<span class="w"> </span>call<span class="w"> </span>0x555555555d4a<span class="w"> </span><explode_bomb> +<span class="w"> </span>0x00005555555559d3<span class="w"> </span><+314>:<span class="w"> </span>jmp<span class="w"> </span>0x5555555559bb<span class="w"> </span><phase_6+290> +<span class="w"> </span>0x00005555555559d5<span class="w"> </span><+316>:<span class="w"> </span>add<span class="w"> </span><span class="nv">$0</span>x68,%rsp +<span class="w"> </span>0x00005555555559d9<span class="w"> </span><+320>:<span class="w"> </span>pop<span class="w"> </span>%rbx +<span class="w"> </span>0x00005555555559da<span class="w"> </span><+321>:<span class="w"> </span>pop<span class="w"> </span>%rbp +<span class="w"> </span>0x00005555555559db<span class="w"> </span><+322>:<span class="w"> </span>pop<span class="w"> </span>%r12 +<span class="w"> </span>0x00005555555559dd<span class="w"> </span><+324>:<span class="w"> </span>pop<span class="w"> </span>%r13 +<span class="w"> </span>0x00005555555559df<span class="w"> </span><+326>:<span class="w"> </span>pop<span class="w"> </span>%r14 +<span class="w"> </span>0x00005555555559e1<span class="w"> </span><+328>:<span class="w"> </span>pop<span class="w"> </span>%r15 +<span class="w"> </span>0x00005555555559e3<span class="w"> </span><+330>:<span class="w"> </span>ret<span class="w"> </span> +End<span class="w"> </span>of<span class="w"> </span>assembler<span class="w"> </span>dump. +<span class="o">(</span>gdb<span class="o">)</span><span class="w"> </span> </code></pre> </div> <p>Again, we see the familiar <code>read_six_digits</code> function.</p> -<p>Let us analyse this function in chunks: - <div class="codehilite"> - <pre><span></span><code>0x00005555555558bb <+34>: call 0x555555555d97 <read<em>six</em>numbers> - 0x00005555555558c0 <+39>: mov %r14,%r12 - 0x00005555555558c3 <+42>: mov <span class="nv">$0</span>x1,%r15d - 0x00005555555558c9 <+48>: mov %r14,%r13 - 0x00005555555558cc <+51>: jmp 0x555555555997 <phase_6+254> - </code></pre> - </div></p> +<p>Let us analyse this function in chunks:</p> + +<div class="codehilite"> +<pre><span></span><code><span class="w"> </span>0x00005555555558bb<span class="w"> </span><+34>:<span class="w"> </span>call<span class="w"> </span>0x555555555d97<span class="w"> </span><read_six_numbers> +<span class="w"> </span>0x00005555555558c0<span class="w"> </span><+39>:<span class="w"> </span>mov<span class="w"> </span>%r14,%r12 +<span class="w"> </span>0x00005555555558c3<span class="w"> </span><+42>:<span class="w"> </span>mov<span class="w"> </span><span class="nv">$0</span>x1,%r15d +<span class="w"> </span>0x00005555555558c9<span class="w"> </span><+48>:<span class="w"> </span>mov<span class="w"> </span>%r14,%r13 +<span class="w"> </span>0x00005555555558cc<span class="w"> </span><+51>:<span class="w"> </span>jmp<span class="w"> </span>0x555555555997<span class="w"> </span><phase_6+254> +</code></pre> +</div> <ol> <li>Read six numbers</li> @@ -990,17 +1001,20 @@ End of assembler dump. 2.1. <code>mov %r14,%r12</code>: <code>%r14</code> should be pointing to the location of the stack where the numbers were read into. This address is copied onto <code>%r12</code> 2.2. <code>mov $0x1,%r15d</code>: The value <code>1</code> is moved into <code>%r15</code> register (probably acting like a counter) 2.3. <code>mov %r14,%r13</code>: The value is also copied to <code>%r13</code></li> -<li><p>Jump to start of loop:</p> +<li>Jump to start of loop:</li> +</ol> <div class="codehilite"> -<pre><span></span><code>0x0000555555555997 <+254>: mov %r14,%rbp -0x000055555555599a <+257>: mov <span class="o">(</span>%r14<span class="o">)</span>,%eax -0x000055555555599d <+260>: sub <span class="nv">$0</span>x1,%eax -0x00005555555559a0 <+263>: cmp <span class="nv">$0</span>x5,%eax -0x00005555555559a3 <+266>: ja 0x5555555558d1 <phase_6+56> +<pre><span></span><code><span class="w"> </span>0x0000555555555997<span class="w"> </span><+254>:<span class="w"> </span>mov<span class="w"> </span>%r14,%rbp +<span class="w"> </span>0x000055555555599a<span class="w"> </span><+257>:<span class="w"> </span>mov<span class="w"> </span><span class="o">(</span>%r14<span class="o">)</span>,%eax +<span class="w"> </span>0x000055555555599d<span class="w"> </span><+260>:<span class="w"> </span>sub<span class="w"> </span><span class="nv">$0</span>x1,%eax +<span class="w"> </span>0x00005555555559a0<span class="w"> </span><+263>:<span class="w"> </span>cmp<span class="w"> </span><span class="nv">$0</span>x5,%eax +<span class="w"> </span>0x00005555555559a3<span class="w"> </span><+266>:<span class="w"> </span>ja<span class="w"> </span>0x5555555558d1<span class="w"> </span><phase_6+56> </code></pre> -</div></li> -<li><p>Initialise register and point to first number in sequence</p></li> +</div> + +<ol> +<li>Initialise register and point to first number in sequence</li> <li>Adjust number(s): 2.1. <code>mov (%r14),%eax</code> -> load the current number in the sequence 2.2. <code>sub $0x1,%eax</code> -> decrement number by 1</li> @@ -1009,40 +1023,44 @@ End of assembler dump. 3.2. <code>ja 0x5555555558d1 <phase_6+56></code>: jump if given value is > 5 or < 0</li> </ol> -<p>=> All numbers should be between 1 and 6. - <div class="codehilite"> - <pre><span></span><code>0x00005555555559a9 <+272>: cmp <span class="nv">$0</span>x5,%r15d - 0x00005555555559ad <+276>: jg 0x5555555558f9 <phase_6+96> - </code></pre> - </div></p> - -<p>This checks if the value stored in <code>%r15</code> is > 5, if it is then it jumps somewhere else. This validates our assumption that <code>%r15</code> is acting as a counter. - <div class="codehilite"> - <pre><span></span><code>0x00005555555559b3 <+282>: mov %r15,%rbx - 0x00005555555559b6 <+285>: jmp 0x5555555558e8 <phase_6+79> - </code></pre> - </div></p> - -<p>Let us jump to +79 - <div class="codehilite"> - <pre><span></span><code>0x00005555555558e8 <+79>: mov 0x0<span class="o">(</span>%r13,%rbx,4<span class="o">)</span>,%eax - 0x00005555555558ed <+84>: cmp %eax,0x0<span class="o">(</span>%rbp<span class="o">)</span> - 0x00005555555558f0 <+87>: jne 0x5555555558db <phase<em>6+66> - 0x00005555555558f2 <+89>: call 0x555555555d4a <explode</em>bomb> - 0x00005555555558f7 <+94>: jmp 0x5555555558db <phase_6+66> - </code></pre> - </div></p> - -<p>This section deals with checking if all the numbers in the sequence are unique or not. Thus, we need to ensure out 6 digits are unique - <div class="codehilite"> - <pre><span></span><code>0x00005555555558db <+66>: add <span class="nv">$0</span>x1,%rbx // Increments by <span class="m">1</span> - 0x00005555555558df <+70>: cmp <span class="nv">$0</span>x5,%ebx - 0x00005555555558e2 <+73>: jg 0x55555555598f <phase<em>6+246> // Jump <span class="k">if</span> > <span class="m">5</span> <span class="o">(</span>Loop iterations are <span class="nb">complete</span><span class="o">)</span> - 0x00005555555558e8 <+79>: mov 0x0<span class="o">(</span>%r13,%rbx,4<span class="o">)</span>,%eax - 0x00005555555558ed <+84>: cmp %eax,0x0<span class="o">(</span>%rbp<span class="o">)</span> - 0x00005555555558f0 <+87>: jne 0x5555555558db <phase</em>6+66> // Again, check <span class="k">if</span> the number being seen is unique - </code></pre> - </div></p> +<p>=> All numbers should be between 1 and 6.</p> + +<div class="codehilite"> +<pre><span></span><code><span class="w"> </span>0x00005555555559a9<span class="w"> </span><+272>:<span class="w"> </span>cmp<span class="w"> </span><span class="nv">$0</span>x5,%r15d +<span class="w"> </span>0x00005555555559ad<span class="w"> </span><+276>:<span class="w"> </span>jg<span class="w"> </span>0x5555555558f9<span class="w"> </span><phase_6+96> +</code></pre> +</div> + +<p>This checks if the value stored in <code>%r15</code> is > 5, if it is then it jumps somewhere else. This validates our assumption that <code>%r15</code> is acting as a counter.</p> + +<div class="codehilite"> +<pre><span></span><code><span class="w"> </span>0x00005555555559b3<span class="w"> </span><+282>:<span class="w"> </span>mov<span class="w"> </span>%r15,%rbx +<span class="w"> </span>0x00005555555559b6<span class="w"> </span><+285>:<span class="w"> </span>jmp<span class="w"> </span>0x5555555558e8<span class="w"> </span><phase_6+79> +</code></pre> +</div> + +<p>Let us jump to +79</p> + +<div class="codehilite"> +<pre><span></span><code><span class="w"> </span>0x00005555555558e8<span class="w"> </span><+79>:<span class="w"> </span>mov<span class="w"> </span>0x0<span class="o">(</span>%r13,%rbx,4<span class="o">)</span>,%eax +<span class="w"> </span>0x00005555555558ed<span class="w"> </span><+84>:<span class="w"> </span>cmp<span class="w"> </span>%eax,0x0<span class="o">(</span>%rbp<span class="o">)</span> +<span class="w"> </span>0x00005555555558f0<span class="w"> </span><+87>:<span class="w"> </span>jne<span class="w"> </span>0x5555555558db<span class="w"> </span><phase_6+66> +<span class="w"> </span>0x00005555555558f2<span class="w"> </span><+89>:<span class="w"> </span>call<span class="w"> </span>0x555555555d4a<span class="w"> </span><explode_bomb> +<span class="w"> </span>0x00005555555558f7<span class="w"> </span><+94>:<span class="w"> </span>jmp<span class="w"> </span>0x5555555558db<span class="w"> </span><phase_6+66> +</code></pre> +</div> + +<p>This section deals with checking if all the numbers in the sequence are unique or not. Thus, we need to ensure out 6 digits are unique</p> + +<div class="codehilite"> +<pre><span></span><code><span class="w"> </span>0x00005555555558db<span class="w"> </span><+66>:<span class="w"> </span>add<span class="w"> </span><span class="nv">$0</span>x1,%rbx<span class="w"> </span>//<span class="w"> </span>Increments<span class="w"> </span>by<span class="w"> </span><span class="m">1</span> +<span class="w"> </span>0x00005555555558df<span class="w"> </span><+70>:<span class="w"> </span>cmp<span class="w"> </span><span class="nv">$0</span>x5,%ebx<span class="w"> </span> +<span class="w"> </span>0x00005555555558e2<span class="w"> </span><+73>:<span class="w"> </span>jg<span class="w"> </span>0x55555555598f<span class="w"> </span><phase_6+246><span class="w"> </span>//<span class="w"> </span>Jump<span class="w"> </span><span class="k">if</span><span class="w"> </span>><span class="w"> </span><span class="m">5</span><span class="w"> </span><span class="o">(</span>Loop<span class="w"> </span>iterations<span class="w"> </span>are<span class="w"> </span><span class="nb">complete</span><span class="o">)</span> +<span class="w"> </span>0x00005555555558e8<span class="w"> </span><+79>:<span class="w"> </span>mov<span class="w"> </span>0x0<span class="o">(</span>%r13,%rbx,4<span class="o">)</span>,%eax<span class="w"> </span> +<span class="w"> </span>0x00005555555558ed<span class="w"> </span><+84>:<span class="w"> </span>cmp<span class="w"> </span>%eax,0x0<span class="o">(</span>%rbp<span class="o">)</span> +<span class="w"> </span>0x00005555555558f0<span class="w"> </span><+87>:<span class="w"> </span>jne<span class="w"> </span>0x5555555558db<span class="w"> </span><phase_6+66><span class="w"> </span>//<span class="w"> </span>Again,<span class="w"> </span>check<span class="w"> </span><span class="k">if</span><span class="w"> </span>the<span class="w"> </span>number<span class="w"> </span>being<span class="w"> </span>seen<span class="w"> </span>is<span class="w"> </span>unique +</code></pre> +</div> <p>Now we know that the numbers are unique, between 1-6 (inclusive).</p> @@ -1053,36 +1071,36 @@ End of assembler dump. <p>Let us try to figure out what <code>0x0000555555555928 <+143>: lea 0x3d01(%rip),%rdx # 0x555555559630 <node1></code> is:</p> <div class="codehilite"> -<pre><span></span><code><span class="o">(</span>gdb<span class="o">)</span> x/30wx 0x555555559630 -0x555555559630 <node1>: 0x000000d9 0x00000001 0x55559640 0x00005555 -0x555555559640 <node2>: 0x000003ab 0x00000002 0x55559650 0x00005555 -0x555555559650 <node3>: 0x0000014f 0x00000003 0x55559660 0x00005555 -0x555555559660 <node4>: 0x000000a1 0x00000004 0x55559670 0x00005555 -0x555555559670 <node5>: 0x000001b3 0x00000005 0x55559120 0x00005555 -0x555555559680 <host_table>: 0x555573f5 0x00005555 0x5555740f 0x00005555 -0x555555559690 <host_table+16>: 0x55557429 0x00005555 0x00000000 0x00000000 -0x5555555596a0 <host_table+32>: 0x00000000 0x00000000 -<span class="o">(</span>gdb<span class="o">)</span> x/30wx 0x555555559120 -0x555555559120 <node6>: 0x000002da 0x00000006 0x00000000 0x00000000 -0x555555559130: 0x00000000 0x00000000 0x00000000 0x00000000 -0x555555559140 <userid>: 0x61767861 0x38383535 0x00000000 0x00000000 -0x555555559150 <userid+16>: 0x00000000 0x00000000 0x00000000 0x00000000 -0x555555559160 <userid+32>: 0x00000000 0x00000000 0x00000000 0x00000000 -0x555555559170 <userid+48>: 0x00000000 0x00000000 0x00000000 0x00000000 -0x555555559180 <userid+64>: 0x00000000 0x00000000 0x00000000 0x00000000 -0x555555559190 <userid+80>: 0x00000000 0x00000000 -<span class="o">(</span>gdb<span class="o">)</span> +<pre><span></span><code><span class="o">(</span>gdb<span class="o">)</span><span class="w"> </span>x/30wx<span class="w"> </span>0x555555559630 +0x555555559630<span class="w"> </span><node1>:<span class="w"> </span>0x000000d9<span class="w"> </span>0x00000001<span class="w"> </span>0x55559640<span class="w"> </span>0x00005555 +0x555555559640<span class="w"> </span><node2>:<span class="w"> </span>0x000003ab<span class="w"> </span>0x00000002<span class="w"> </span>0x55559650<span class="w"> </span>0x00005555 +0x555555559650<span class="w"> </span><node3>:<span class="w"> </span>0x0000014f<span class="w"> </span>0x00000003<span class="w"> </span>0x55559660<span class="w"> </span>0x00005555 +0x555555559660<span class="w"> </span><node4>:<span class="w"> </span>0x000000a1<span class="w"> </span>0x00000004<span class="w"> </span>0x55559670<span class="w"> </span>0x00005555 +0x555555559670<span class="w"> </span><node5>:<span class="w"> </span>0x000001b3<span class="w"> </span>0x00000005<span class="w"> </span>0x55559120<span class="w"> </span>0x00005555 +0x555555559680<span class="w"> </span><host_table>:<span class="w"> </span>0x555573f5<span class="w"> </span>0x00005555<span class="w"> </span>0x5555740f<span class="w"> </span>0x00005555 +0x555555559690<span class="w"> </span><host_table+16>:<span class="w"> </span>0x55557429<span class="w"> </span>0x00005555<span class="w"> </span>0x00000000<span class="w"> </span>0x00000000 +0x5555555596a0<span class="w"> </span><host_table+32>:<span class="w"> </span>0x00000000<span class="w"> </span>0x00000000 +<span class="o">(</span>gdb<span class="o">)</span><span class="w"> </span>x/30wx<span class="w"> </span>0x555555559120 +0x555555559120<span class="w"> </span><node6>:<span class="w"> </span>0x000002da<span class="w"> </span>0x00000006<span class="w"> </span>0x00000000<span class="w"> </span>0x00000000 +0x555555559130:<span class="w"> </span>0x00000000<span class="w"> </span>0x00000000<span class="w"> </span>0x00000000<span class="w"> </span>0x00000000 +0x555555559140<span class="w"> </span><userid>:<span class="w"> </span>0x61767861<span class="w"> </span>0x38383535<span class="w"> </span>0x00000000<span class="w"> </span>0x00000000 +0x555555559150<span class="w"> </span><userid+16>:<span class="w"> </span>0x00000000<span class="w"> </span>0x00000000<span class="w"> </span>0x00000000<span class="w"> </span>0x00000000 +0x555555559160<span class="w"> </span><userid+32>:<span class="w"> </span>0x00000000<span class="w"> </span>0x00000000<span class="w"> </span>0x00000000<span class="w"> </span>0x00000000 +0x555555559170<span class="w"> </span><userid+48>:<span class="w"> </span>0x00000000<span class="w"> </span>0x00000000<span class="w"> </span>0x00000000<span class="w"> </span>0x00000000 +0x555555559180<span class="w"> </span><userid+64>:<span class="w"> </span>0x00000000<span class="w"> </span>0x00000000<span class="w"> </span>0x00000000<span class="w"> </span>0x00000000 +0x555555559190<span class="w"> </span><userid+80>:<span class="w"> </span>0x00000000<span class="w"> </span>0x00000000 +<span class="o">(</span>gdb<span class="o">)</span><span class="w"> </span> </code></pre> </div> <p>It appears that this is a linked list. With roughly the following structure:</p> <div class="codehilite"> -<pre><span></span><code><span class="k">struct</span><span class="w"> </span><span class="nc">node</span><span class="w"> </span><span class="p">{</span><span class="w"></span> -<span class="w"> </span><span class="kt">int</span><span class="w"> </span><span class="n">value</span><span class="p">;</span><span class="w"></span> -<span class="w"> </span><span class="kt">int</span><span class="w"> </span><span class="n">index</span><span class="p">;</span><span class="w"></span> -<span class="w"> </span><span class="k">struct</span><span class="w"> </span><span class="nc">node</span><span class="w"> </span><span class="o">*</span><span class="n">next</span><span class="p">;</span><span class="w"></span> -<span class="p">};</span><span class="w"></span> +<pre><span></span><code><span class="k">struct</span><span class="w"> </span><span class="nc">node</span><span class="w"> </span><span class="p">{</span> +<span class="w"> </span><span class="kt">int</span><span class="w"> </span><span class="n">value</span><span class="p">;</span> +<span class="w"> </span><span class="kt">int</span><span class="w"> </span><span class="n">index</span><span class="p">;</span> +<span class="w"> </span><span class="k">struct</span><span class="w"> </span><span class="nc">node</span><span class="w"> </span><span class="o">*</span><span class="n">next</span><span class="p">;</span> +<span class="p">};</span> </code></pre> </div> |