15-213 Bomb Lab

bomb lab是一道学习汇编语言的题,一共有六个阶段,全部解开即可完成

phase_1

 0x0000000000400e32 <+>:    callq  0x40149e <read_line>
 0x0000000000400e37 <+>:    mov    %rax,%rdi
 0x0000000000400e3a <+>:    callq  0x400ee0 <phase_1>

这三个指令就是phase_1了,第一条是一个调用read_line的命令,众所周知...%rax代表返回值,所以第二条命令则是指:将%rax的值赋给%rdi,记住这个rdi,待会儿有用,然后调用第三条指令phase_1

 0x0000000000400ee0 <+>:    sub    $0x8,%rsp
 0x0000000000400ee4 <+>:    mov    $0x402400,%esi
 0x0000000000400ee9 <+>:    callq  0x401338 <strings_not_equal>
 0x0000000000400eee <+>:    test   %eax,%eax
 0x0000000000400ef0 <+>:    je     0x400ef7 <phase_1+>
 0x0000000000400ef2 <+>:    callq  0x40143a <explode_bomb>
 0x0000000000400ef7 <+>:    add    $0x8,%rsp
 0x0000000000400efb <+>:    retq   

第一条和第八条就不看了,从第二条开始,将0x402400赋给了%esi,记住这个数,然后调用了strings_not_equal,这个函数很好理解,判断两个字符串是否相等,这个函数是这样的(一部分)

 0x000000000040133c <+>:    mov    %rdi,%rbx
 0x000000000040133f <+>:    mov    %rsi,%rbp

从这两行可以看出,这个函数的参数是%rdi和%rsi,%rdi是read_line得到的值,%rsi是0x402400,回到phase_1,第四条指令test判断strings_not_euqal的返回值是否为0,若为零则跳转到0x400ef7,若不为零则会执行explode_bomb,这就是这个炸弹函数,我们不能执行它,所以,我们需要让%eax为零,也就是让%rdi和%rsi的字符串相等,我们使用命令x/s 0x402400查看内存,可以看到如下输出

 0x402400:    "Border relations with Canada have never been better."

这就是我们第一题的答案了

phase_2

接下来是phase_2,我们还是像第一阶段一样,先看看代码

    0x0000000000400efc <+>:    push   %rbp
    0x0000000000400efd <+>:    push   %rbx
    0x0000000000400efe <+>:    sub    $0x28,%rsp
    0x0000000000400f02 <+>:    mov    %rsp,%rsi
    0x0000000000400f05 <+>:    callq  0x40145c <read_six_numbers>
    0x0000000000400f0a <+>:    cmpl   $0x1,(%rsp)
    0x0000000000400f0e <+>:    je     0x400f30 <phase_2+>
    0x0000000000400f10 <+>:    callq  0x40143a <explode_bomb>
    0x0000000000400f15 <+>:    jmp    0x400f30 <phase_2+>
    0x0000000000400f17 <+>:    mov    -0x4(%rbx),%eax
    0x0000000000400f1a <+>:    add    %eax,%eax
    0x0000000000400f1c <+>:    cmp    %eax,(%rbx)
    0x0000000000400f1e <+>:    je     0x400f25 <phase_2+>
    0x0000000000400f20 <+>:    callq  0x40143a <explode_bomb>
    0x0000000000400f25 <+>:    add    $0x4,%rbx
    0x0000000000400f29 <+>:    cmp    %rbp,%rbx
    0x0000000000400f2c <+>:    jne    0x400f17 <phase_2+>
    0x0000000000400f2e <+>:    jmp    0x400f3c <phase_2+>
    0x0000000000400f30 <+>:    lea    0x4(%rsp),%rbx
    0x0000000000400f35 <+>:    lea    0x18(%rsp),%rbp
    0x0000000000400f3a <+>:    jmp    0x400f17 <phase_2+>
    0x0000000000400f3c <+>:    add    $0x28,%rsp
    0x0000000000400f40 <+>:    pop    %rbx
    0x0000000000400f41 <+>:    pop    %rbp
    0x0000000000400f42 <+>:    retq   

首先将rsp减28,将rsp赋值给rsi

这样,rsi和rsp都指向-28

然后调用read_six_numbers

    0x000000000040145c <+>:    sub    $0x18,%rsp
    0x0000000000401460 <+>:    mov    %rsi,%rdx
    0x0000000000401463 <+>:    lea    0x4(%rsi),%rcx
    0x0000000000401467 <+>:    lea    0x14(%rsi),%rax
    0x000000000040146b <+>:    mov    %rax,0x8(%rsp)
    0x0000000000401470 <+>:    lea    0x10(%rsi),%rax
    0x0000000000401474 <+>:    mov    %rax,(%rsp)
    0x0000000000401478 <+>:    lea    0xc(%rsi),%r9
    0x000000000040147c <+>:    lea    0x8(%rsi),%r8
    0x0000000000401480 <+>:    mov    $0x4025c3,%esi
    0x0000000000401485 <+>:    mov    $0x0,%eax
    0x000000000040148a <+>:    callq  0x400bf0 <__isoc99_sscanf@plt>
    0x000000000040148f <+>:    cmp    $0x5,%eax
    0x0000000000401492 <+>:    jg     0x401499 <read_six_numbers+>
    0x0000000000401494 <+>:    callq  0x40143a <explode_bomb>
    0x0000000000401499 <+>:    add    $0x18,%rsp
    0x000000000040149d <+>:    retq   

这个的话主要作用是调用sscanf函数,这是一个c语言函数

大概是这样的

 int sscanf(const char *str, const char *format, ...)

str就是我们要输入的字符串,而format是模板,这个模板存在0x4025c3所在的内存中,我们通过x指令看一下

 0x4025c3:    "%d %d %d %d %d %d"

6个数字,很清晰

而sscanf还可以接受任意个参数,用来解析模板中的数字,这6个参数分别是:rdx/rcx/r8/r9/栈顶/栈顶-1

为了不触发炸弹,我们从汇编代码中推测出rsp指向的内存为1,而整个循环则是判断高位的数是否是低位的2倍,那么就可以得知,从rsp开始的6个数为1,2,4,8,16,32了

答案便是"1 2 4 8 16 32"

phase_3

    0x0000000000400f43 <+>:    sub    $0x18,%rsp
    0x0000000000400f47 <+>:    lea    0xc(%rsp),%rcx
    0x0000000000400f4c <+>:    lea    0x8(%rsp),%rdx
    0x0000000000400f51 <+>:    mov    $0x4025cf,%esi
    0x0000000000400f56 <+>:    mov    $0x0,%eax
    0x0000000000400f5b <+>:    callq  0x400bf0 <__isoc99_sscanf@plt>
    0x0000000000400f60 <+>:    cmp    $0x1,%eax
    0x0000000000400f63 <+>:    jg     0x400f6a <phase_3+>
    0x0000000000400f65 <+>:    callq  0x40143a <explode_bomb>
    0x0000000000400f6a <+>:    cmpl   $0x7,0x8(%rsp)
    0x0000000000400f6f <+>:    ja     0x400fad <phase_3+>
    0x0000000000400f71 <+>:    mov    0x8(%rsp),%eax
    0x0000000000400f75 <+>:    jmpq   *0x402470(,%rax,)
    0x0000000000400f7c <+>:    mov    $0xcf,%eax
    0x0000000000400f81 <+>:    jmp    0x400fbe <phase_3+>
    0x0000000000400f83 <+>:    mov    $0x2c3,%eax
    0x0000000000400f88 <+>:    jmp    0x400fbe <phase_3+>
    0x0000000000400f8a <+>:    mov    $0x100,%eax
    0x0000000000400f8f <+>:    jmp    0x400fbe <phase_3+>
    0x0000000000400f91 <+>:    mov    $0x185,%eax
    0x0000000000400f96 <+>:    jmp    0x400fbe <phase_3+>
    0x0000000000400f98 <+>:    mov    $0xce,%eax
    0x0000000000400f9d <+>:    jmp    0x400fbe <phase_3+>
    0x0000000000400f9f <+>:    mov    $0x2aa,%eax
    0x0000000000400fa4 <+>:    jmp    0x400fbe <phase_3+>
    0x0000000000400fa6 <+>:    mov    $0x147,%eax
    0x0000000000400fab <+>:    jmp    0x400fbe <phase_3+>
    0x0000000000400fad <+>:    callq  0x40143a <explode_bomb>
    0x0000000000400fb2 <+>:    mov    $0x0,%eax
    0x0000000000400fb7 <+>:    jmp    0x400fbe <phase_3+>
 ---Type <return> to continue, or q <return> to quit---
    0x0000000000400fb9 <+>:    mov    $0x137,%eax
    0x0000000000400fbe <+>:    cmp    0xc(%rsp),%eax
    0x0000000000400fc2 <+>:    je     0x400fc9 <phase_3+>
    0x0000000000400fc4 <+>:    callq  0x40143a <explode_bomb>
    0x0000000000400fc9 <+>:    add    $0x18,%rsp
    0x0000000000400fcd <+>:    retq   

还是sscanf,首先确定rdx和rcx的位置分别是+8和+c,这就是你要输的两个数字,然后关注+39行,将rdx和7比较,大于则bomb,然后根据rdx的值去访问(0x402470+rdx*8)代表的内存,然后以这个值作为地址,进行跳转

从0x402470开始的8个跳转地址分别是:

 0x402470:    0x400f7c <phase_3+>    0x400fb9 <phase_3+>
 0x402480:    0x400f83 <phase_3+>    0x400f8a <phase_3+>
 0x402490:    0x400f91 <phase_3+>    0x400f98 <phase_3+>
 0x4024a0:    0x400f9f <phase_3+>    0x400fa6 <phase_3+>

尖括号内则是跳转的地址,我们可以知道,如果rdx是7,跳到99,让rcx与0x147比较,相等则成功,这里有8个地址

根据rdx的不同,rcx的值也不同,从7到0分别是:0x147,0x2aa,0xce,0x185,0x100,0x203,0x137,0xcf,那么答案就显而易见了

顺便,那个模板的样式是这样的

 0x4025cf:    "%d %d"