bomb lab是一道学习汇编语言的题,一共有六个阶段,全部解开即可完成
phase_1
0x0000000000400e32 <+>: callq 0x40149e <read_line>
0x0000000000400e37 <+>: mov %rax,%rdi
0x0000000000400e3a <+>: callq 0x400ee0 <phase_1>
这三个指令就是phase_1了,第一条是一个调用read_line的命令,众所周知...%rax代表返回值,所以第二条命令则是指:将%rax的值赋给%rdi,记住这个rdi,待会儿有用,然后调用第三条指令phase_1
0x0000000000400ee0 <+>: sub $0x8,%rsp
0x0000000000400ee4 <+>: mov $0x402400,%esi
0x0000000000400ee9 <+>: callq 0x401338 <strings_not_equal>
0x0000000000400eee <+>: test %eax,%eax
0x0000000000400ef0 <+>: je 0x400ef7 <phase_1+>
0x0000000000400ef2 <+>: callq 0x40143a <explode_bomb>
0x0000000000400ef7 <+>: add $0x8,%rsp
0x0000000000400efb <+>: retq
第一条和第八条就不看了,从第二条开始,将0x402400赋给了%esi,记住这个数,然后调用了strings_not_equal,这个函数很好理解,判断两个字符串是否相等,这个函数是这样的(一部分)
0x000000000040133c <+>: mov %rdi,%rbx
0x000000000040133f <+>: mov %rsi,%rbp
从这两行可以看出,这个函数的参数是%rdi和%rsi,%rdi是read_line得到的值,%rsi是0x402400,回到phase_1,第四条指令test判断strings_not_euqal的返回值是否为0,若为零则跳转到0x400ef7,若不为零则会执行explode_bomb,这就是这个炸弹函数,我们不能执行它,所以,我们需要让%eax为零,也就是让%rdi和%rsi的字符串相等,我们使用命令x/s 0x402400查看内存,可以看到如下输出
0x402400: "Border relations with Canada have never been better."
这就是我们第一题的答案了
phase_2
接下来是phase_2,我们还是像第一阶段一样,先看看代码
0x0000000000400efc <+>: push %rbp
0x0000000000400efd <+>: push %rbx
0x0000000000400efe <+>: sub $0x28,%rsp
0x0000000000400f02 <+>: mov %rsp,%rsi
0x0000000000400f05 <+>: callq 0x40145c <read_six_numbers>
0x0000000000400f0a <+>: cmpl $0x1,(%rsp)
0x0000000000400f0e <+>: je 0x400f30 <phase_2+>
0x0000000000400f10 <+>: callq 0x40143a <explode_bomb>
0x0000000000400f15 <+>: jmp 0x400f30 <phase_2+>
0x0000000000400f17 <+>: mov -0x4(%rbx),%eax
0x0000000000400f1a <+>: add %eax,%eax
0x0000000000400f1c <+>: cmp %eax,(%rbx)
0x0000000000400f1e <+>: je 0x400f25 <phase_2+>
0x0000000000400f20 <+>: callq 0x40143a <explode_bomb>
0x0000000000400f25 <+>: add $0x4,%rbx
0x0000000000400f29 <+>: cmp %rbp,%rbx
0x0000000000400f2c <+>: jne 0x400f17 <phase_2+>
0x0000000000400f2e <+>: jmp 0x400f3c <phase_2+>
0x0000000000400f30 <+>: lea 0x4(%rsp),%rbx
0x0000000000400f35 <+>: lea 0x18(%rsp),%rbp
0x0000000000400f3a <+>: jmp 0x400f17 <phase_2+>
0x0000000000400f3c <+>: add $0x28,%rsp
0x0000000000400f40 <+>: pop %rbx
0x0000000000400f41 <+>: pop %rbp
0x0000000000400f42 <+>: retq
首先将rsp减28,将rsp赋值给rsi
这样,rsi和rsp都指向-28
然后调用read_six_numbers
0x000000000040145c <+>: sub $0x18,%rsp
0x0000000000401460 <+>: mov %rsi,%rdx
0x0000000000401463 <+>: lea 0x4(%rsi),%rcx
0x0000000000401467 <+>: lea 0x14(%rsi),%rax
0x000000000040146b <+>: mov %rax,0x8(%rsp)
0x0000000000401470 <+>: lea 0x10(%rsi),%rax
0x0000000000401474 <+>: mov %rax,(%rsp)
0x0000000000401478 <+>: lea 0xc(%rsi),%r9
0x000000000040147c <+>: lea 0x8(%rsi),%r8
0x0000000000401480 <+>: mov $0x4025c3,%esi
0x0000000000401485 <+>: mov $0x0,%eax
0x000000000040148a <+>: callq 0x400bf0 <__isoc99_sscanf@plt>
0x000000000040148f <+>: cmp $0x5,%eax
0x0000000000401492 <+>: jg 0x401499 <read_six_numbers+>
0x0000000000401494 <+>: callq 0x40143a <explode_bomb>
0x0000000000401499 <+>: add $0x18,%rsp
0x000000000040149d <+>: retq
这个的话主要作用是调用sscanf函数,这是一个c语言函数
大概是这样的
int sscanf(const char *str, const char *format, ...)
str就是我们要输入的字符串,而format是模板,这个模板存在0x4025c3所在的内存中,我们通过x指令看一下
0x4025c3: "%d %d %d %d %d %d"
6个数字,很清晰
而sscanf还可以接受任意个参数,用来解析模板中的数字,这6个参数分别是:rdx/rcx/r8/r9/栈顶/栈顶-1
为了不触发炸弹,我们从汇编代码中推测出rsp指向的内存为1,而整个循环则是判断高位的数是否是低位的2倍,那么就可以得知,从rsp开始的6个数为1,2,4,8,16,32了
答案便是"1 2 4 8 16 32"
phase_3
0x0000000000400f43 <+>: sub $0x18,%rsp
0x0000000000400f47 <+>: lea 0xc(%rsp),%rcx
0x0000000000400f4c <+>: lea 0x8(%rsp),%rdx
0x0000000000400f51 <+>: mov $0x4025cf,%esi
0x0000000000400f56 <+>: mov $0x0,%eax
0x0000000000400f5b <+>: callq 0x400bf0 <__isoc99_sscanf@plt>
0x0000000000400f60 <+>: cmp $0x1,%eax
0x0000000000400f63 <+>: jg 0x400f6a <phase_3+>
0x0000000000400f65 <+>: callq 0x40143a <explode_bomb>
0x0000000000400f6a <+>: cmpl $0x7,0x8(%rsp)
0x0000000000400f6f <+>: ja 0x400fad <phase_3+>
0x0000000000400f71 <+>: mov 0x8(%rsp),%eax
0x0000000000400f75 <+>: jmpq *0x402470(,%rax,)
0x0000000000400f7c <+>: mov $0xcf,%eax
0x0000000000400f81 <+>: jmp 0x400fbe <phase_3+>
0x0000000000400f83 <+>: mov $0x2c3,%eax
0x0000000000400f88 <+>: jmp 0x400fbe <phase_3+>
0x0000000000400f8a <+>: mov $0x100,%eax
0x0000000000400f8f <+>: jmp 0x400fbe <phase_3+>
0x0000000000400f91 <+>: mov $0x185,%eax
0x0000000000400f96 <+>: jmp 0x400fbe <phase_3+>
0x0000000000400f98 <+>: mov $0xce,%eax
0x0000000000400f9d <+>: jmp 0x400fbe <phase_3+>
0x0000000000400f9f <+>: mov $0x2aa,%eax
0x0000000000400fa4 <+>: jmp 0x400fbe <phase_3+>
0x0000000000400fa6 <+>: mov $0x147,%eax
0x0000000000400fab <+>: jmp 0x400fbe <phase_3+>
0x0000000000400fad <+>: callq 0x40143a <explode_bomb>
0x0000000000400fb2 <+>: mov $0x0,%eax
0x0000000000400fb7 <+>: jmp 0x400fbe <phase_3+>
---Type <return> to continue, or q <return> to quit---
0x0000000000400fb9 <+>: mov $0x137,%eax
0x0000000000400fbe <+>: cmp 0xc(%rsp),%eax
0x0000000000400fc2 <+>: je 0x400fc9 <phase_3+>
0x0000000000400fc4 <+>: callq 0x40143a <explode_bomb>
0x0000000000400fc9 <+>: add $0x18,%rsp
0x0000000000400fcd <+>: retq
还是sscanf,首先确定rdx和rcx的位置分别是+8和+c,这就是你要输的两个数字,然后关注+39行,将rdx和7比较,大于则bomb,然后根据rdx的值去访问(0x402470+rdx*8)代表的内存,然后以这个值作为地址,进行跳转
从0x402470开始的8个跳转地址分别是:
0x402470: 0x400f7c <phase_3+> 0x400fb9 <phase_3+>
0x402480: 0x400f83 <phase_3+> 0x400f8a <phase_3+>
0x402490: 0x400f91 <phase_3+> 0x400f98 <phase_3+>
0x4024a0: 0x400f9f <phase_3+> 0x400fa6 <phase_3+>
尖括号内则是跳转的地址,我们可以知道,如果rdx是7,跳到99,让rcx与0x147比较,相等则成功,这里有8个地址
根据rdx的不同,rcx的值也不同,从7到0分别是:0x147,0x2aa,0xce,0x185,0x100,0x203,0x137,0xcf,那么答案就显而易见了
顺便,那个模板的样式是这样的
0x4025cf: "%d %d"