Cruyun's Blog

Talk is cheap, show you my code

Bomb Lab

• 标签: CSAPP, 汇编

$ gdb bomb

设置断点

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
(gdb) break explode_bomb
break phase_1
break phase_2
break phase_3
break phase_4
break phase_5
(gdb)  break explode_bomb
Breakpoint 1 at 0x40143a
(gdb) break phase_1
Breakpoint 2 at 0x400ee0
(gdb) break phase_2
Breakpoint 3 at 0x400efc
(gdb) break phase_3
Breakpoint 4 at 0x400f43
(gdb) break phase_4
Breakpoint 5 at 0x40100c
(gdb) break phase_5
Breakpoint 6 at 0x401062
(gdb) run

(gdb) disas
分析第一个phase

1
2
3
4
5
6
7
8
9
10
Dump of assembler code for function phase_1:
=> 0x0000000000400ee0 <+0>:   sub    $0x8,%rsp
0x0000000000400ee4 <+4>:   mov    $0x402400,%esi
0x0000000000400ee9 <+9>:   callq  0x401338 <strings_not_equal>
0x0000000000400eee <+14>:  test   %eax,%eax
0x0000000000400ef0 <+16>:  je     0x400ef7 <phase_1+23>
0x0000000000400ef2 <+18>:  callq  0x40143a <explode_bomb>
0x0000000000400ef7 <+23>:  add    $0x8,%rsp
0x0000000000400efb <+27>:  retq   
End of assembler dump.

看到mov $0x402400,%esi 之后调用了函数
disas 这个函数之后分析得出，$0x402400指向一个字符串，如果输入的字符串和这个指针指向的字符串完全相同则不触发bomb，

(gdb) print (char*)0x402400```
1
```$1 = 0x402400 "Border relations with Canada have never been better."

所以答案就是Border relations with Canada have never been better.
(gdb) Quit
(gdb) run
The program being debugged has been started already.
Start it from the beginning? (y or n) y
Starting program: /home/cry/Desktop/bomb/bomb
Welcome to my fiendish little bomb. You have 6 phases with
which to blow yourself up. Have a nice day!
Border relations with Canada have never been better.

Breakpoint 2, 0x0000000000400ee0 in phase_1 ()

(gdb) continue //如果答案正确会显示Phase 1 defused. How about the next one?，否则bomb explode

Phase_2

1
2
3
4
5
6
Dump of assembler code for function phase_2:
=> 0x0000000000400efc <+0>:   push   %rbp
0x0000000000400efd <+1>:   push   %rbx
0x0000000000400efe <+2>:   sub    $0x28,%rsp  //%rsp-0x28
0x0000000000400f02 <+6>:   mov    %rsp,%rsi   //%rsi的值设为%rsp的值
0x0000000000400f05 <+9>:   callq  0x40145c <read_six_numbers> //读取六个数字，本题答案应为六个数字

(%rsp)中存放的值和0x1比较，如果相等，则跳转到，否则爆炸，所以第一个数字是1

1
2
0x0000000000400f0a <+14>:  cmpl   $0x1,(%rsp)
0x0000000000400f0e <+18>:  je     0x400f30 <phase_2+52>

接着跳到<+52>

1
2
3
0x0000000000400f30 <+52>:  lea    0x4(%rsp),%rbx //寄存器%rsp指向的指针+4,然后赋值给%rbx
0x0000000000400f35 <+57>:  lea    0x18(%rsp),%rbp //%rbp=%rsp+0x18
0x0000000000400f3a <+62>:  jmp    0x400f17 <phase_2+27>

划重点

1
2
3
4
5
0x0000000000400f17 <+27>:  mov    -0x4(%rbx),%eax //刚刚+4的指针-4，也就是第一个输入的数字
0x0000000000400f1a <+30>:  add    %eax,%eax//即%eax*=2，所以第二个数字是1*2=2
0x0000000000400f1c <+32>:  cmp    %eax,(%rbx)
0x0000000000400f1e <+34>:  je     0x400f25 <phase_2+41>
0x0000000000400f20 <+36>:  callq  0x40143a <explode_bomb>

<+32>比较 %eax,(%rbx)，假如相等，就跳转到，否则爆炸
所以其实这是一个循环，后一位数为前一个的两倍，所以答案是1 2 4 8 16 32

完整的phase_2：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
Dump of assembler code for function phase_2:
=> 0x0000000000400efc <+0>:   push   %rbp
0x0000000000400efd <+1>:   push   %rbx
0x0000000000400efe <+2>:   sub    $0x28,%rsp
0x0000000000400f02 <+6>:   mov    %rsp,%rsi
0x0000000000400f05 <+9>:   callq  0x40145c <read_six_numbers>
0x0000000000400f0a <+14>:  cmpl   $0x1,(%rsp)
0x0000000000400f0e <+18>:  je     0x400f30 <phase_2+52>
0x0000000000400f10 <+20>:  callq  0x40143a <explode_bomb>
0x0000000000400f15 <+25>:  jmp    0x400f30 <phase_2+52>
0x0000000000400f17 <+27>:  mov    -0x4(%rbx),%eax
0x0000000000400f1a <+30>:  add    %eax,%eax
0x0000000000400f1c <+32>:  cmp    %eax,(%rbx)
0x0000000000400f1e <+34>:  je     0x400f25 <phase_2+41>
0x0000000000400f20 <+36>:  callq  0x40143a <explode_bomb>
0x0000000000400f25 <+41>:  add    $0x4,%rbx
0x0000000000400f29 <+45>:  cmp    %rbp,%rbx
0x0000000000400f2c <+48>:  jne    0x400f17 <phase_2+27>
0x0000000000400f2e <+50>:  jmp    0x400f3c <phase_2+64>
0x0000000000400f30 <+52>:  lea    0x4(%rsp),%rbx
0x0000000000400f35 <+57>:  lea    0x18(%rsp),%rbp
0x0000000000400f3a <+62>:  jmp    0x400f17 <phase_2+27>
0x0000000000400f3c <+64>:  add    $0x28,%rsp
0x0000000000400f40 <+68>:  pop    %rbx
0x0000000000400f41 <+69>:  pop    %rbp
0x0000000000400f42 <+70>:  retq   
End of assembler dump.

Phase_3
这是一个switch语句，对应不同的case分支，有不同的答案。

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
Dump of assembler code for function phase_3:
=> 0x0000000000400f43 <+0>:   sub    $0x18,%rsp
0x0000000000400f47 <+4>:   lea    0xc(%rsp),%rcx
0x0000000000400f4c <+9>:   lea    0x8(%rsp),%rdx
0x0000000000400f51 <+14>:  mov    $0x4025cf,%esi
0x0000000000400f56 <+19>:  mov    $0x0,%eax //%eax先设为0
0x0000000000400f5b <+24>:  callq  0x400bf0 <__isoc99_sscanf@plt> //scanf，读入我们要输入的数的个数
0x0000000000400f60 <+29>:  cmp    $0x1,%eax
0x0000000000400f63 <+32>:  jg     0x400f6a <phase_3+39>
0x0000000000400f65 <+34>:  callq  0x40143a <explode_bomb>
0x0000000000400f6a <+39>:  cmpl   $0x7,0x8(%rsp)
0x0000000000400f6f <+44>:  ja     0x400fad <phase_3+106>
0x0000000000400f71 <+46>:  mov    0x8(%rsp),%eax
0x0000000000400f75 <+50>:  jmpq   *0x402470(,%rax,8)
0x0000000000400f7c <+57>:  mov    $0xcf,%eax
0x0000000000400f81 <+62>:  jmp    0x400fbe <phase_3+123>
0x0000000000400f83 <+64>:  mov    $0x2c3,%eax
0x0000000000400f88 <+69>:  jmp    0x400fbe <phase_3+123>
0x0000000000400f8a <+71>:  mov    $0x100,%eax
0x0000000000400f8f <+76>:  jmp    0x400fbe <phase_3+123>
0x0000000000400f91 <+78>:  mov    $0x185,%eax
0x0000000000400f96 <+83>:  jmp    0x400fbe <phase_3+123>
0x0000000000400f98 <+85>:  mov    $0xce,%eax
0x0000000000400f9d <+90>:  jmp    0x400fbe <phase_3+123>
0x0000000000400f9f <+92>:  mov    $0x2aa,%eax
0x0000000000400fa4 <+97>:  jmp    0x400fbe <phase_3+123>
0x0000000000400fa6 <+99>:  mov    $0x147,%eax
0x0000000000400fab <+104>: jmp    0x400fbe <phase_3+123>
0x0000000000400fad <+106>: callq  0x40143a <explode_bomb>
0x0000000000400fb2 <+111>: mov    $0x0,%eax
0x0000000000400fb7 <+116>: jmp    0x400fbe <phase_3+123>
0x0000000000400fb9 <+118>: mov    $0x137,%eax
0x0000000000400fbe <+123>: cmp    0xc(%rsp),%eax
0x0000000000400fc2 <+127>: je     0x400fc9 <phase_3+134>
0x0000000000400fc4 <+129>: callq  0x40143a <explode_bomb>
0x0000000000400fc9 <+134>: add    $0x18,%rsp
0x0000000000400fcd <+138>: retq   
End of assembler dump.

mov $0x4025cf,%esi这个地址里的数据传进%esi，打印看看里面是什么
(gdb) x/sb 0x4025cf
0x4025cf: "%d %d"这样子就知道这道题我们要输入的数据的格式

1
2
3
4
5
6
0x0000000000400f56 <+19>:  mov    $0x0,%eax //%eax先设为0
0x0000000000400f5b <+24>:  callq  0x400bf0 <__isoc99_sscanf@plt>
0x0000000000400f60 <+29>:  cmp    $0x1,%eax
0x0000000000400f63 <+32>:  jg     0x400f6a <phase_3+39>
0x0000000000400f65 <+34>:  callq  0x40143a <explode_bomb>
0x0000000000400f6a <+39>:  cmpl   $0x7,0x8(%rsp)

看出case应该是0~7共八个数，否则爆炸。
假如我输入0，来到这里
0x0000000000400f75 <+50>: jmpq *0x402470(,%rax,8)
看看0x402470对应哪个，我们来print一下
print *0x402470,得到0x400f7c，也就是这一步
0x0000000000400f7c <+57>: mov $0xcf,%eax，0xcf就是207，所以其中一个答案是0 207。
0x0000000000400f75 <+50>: jmpq *0x402470(,%rax,8)假如输入1，地址+8，。。。（待续）
0x0000000000400fb9 <+118>: mov $0x137,%eax

Breakpoint 5, 0x000000000040100c in phase_4 ()
(gdb) disas

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
Dump of assembler code for function phase_4:
=> 0x000000000040100c <+0>:   sub    $0x18,%rsp
0x0000000000401010 <+4>:   lea    0xc(%rsp),%rcx
0x0000000000401015 <+9>:   lea    0x8(%rsp),%rdx
0x000000000040101a <+14>:  mov    $0x4025cf,%esi
0x000000000040101f <+19>:  mov    $0x0,%eax
0x0000000000401024 <+24>:  callq  0x400bf0 <__isoc99_sscanf@plt>
0x0000000000401029 <+29>:  cmp    $0x2,%eax
0x000000000040102c <+32>:  jne    0x401035 <phase_4+41>
0x000000000040102e <+34>:  cmpl   $0xe,0x8(%rsp)
0x0000000000401033 <+39>:  jbe    0x40103a <phase_4+46>
0x0000000000401035 <+41>:  callq  0x40143a <explode_bomb>
0x000000000040103a <+46>:  mov    $0xe,%edx
0x000000000040103f <+51>:  mov    $0x0,%esi
0x0000000000401044 <+56>:  mov    0x8(%rsp),%edi
0x0000000000401048 <+60>:  callq  0x400fce <func4>
0x000000000040104d <+65>:  test   %eax,%eax
0x000000000040104f <+67>:  jne    0x401058 <phase_4+76>
0x0000000000401051 <+69>:  cmpl   $0x0,0xc(%rsp)
0x0000000000401056 <+74>:  je     0x40105d <phase_4+81>
0x0000000000401058 <+76>:  callq  0x40143a <explode_bomb>
0x000000000040105d <+81>:  add    $0x18,%rsp
0x0000000000401061 <+85>:  retq   
End of assembler dump.
(gdb) (gdb) disas func4

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
Dump of assembler code for function func4:
0x0000000000400fce <+0>:   sub    $0x8,%rsp
0x0000000000400fd2 <+4>:   mov    %edx,%eax
0x0000000000400fd4 <+6>:   sub    %esi,%eax
0x0000000000400fd6 <+8>:   mov    %eax,%ecx
0x0000000000400fd8 <+10>:  shr    $0x1f,%ecx
0x0000000000400fdb <+13>:  add    %ecx,%eax
0x0000000000400fdd <+15>:  sar    %eax
0x0000000000400fdf <+17>:  lea    (%rax,%rsi,1),%ecx
0x0000000000400fe2 <+20>:  cmp    %edi,%ecx
0x0000000000400fe4 <+22>:  jle    0x400ff2 <func4+36>
0x0000000000400fe6 <+24>:  lea    -0x1(%rcx),%edx
0x0000000000400fe9 <+27>:  callq  0x400fce <func4>
0x0000000000400fee <+32>:  add    %eax,%eax
0x0000000000400ff0 <+34>:  jmp    0x401007 <func4+57>
0x0000000000400ff2 <+36>:  mov    $0x0,%eax
0x0000000000400ff7 <+41>:  cmp    %edi,%ecx
0x0000000000400ff9 <+43>:  jge    0x401007 <func4+57>
0x0000000000400ffb <+45>:  lea    0x1(%rcx),%esi
0x0000000000400ffe <+48>:  callq  0x400fce <func4>
0x0000000000401003 <+53>:  lea    0x1(%rax,%rax,1),%eax
0x0000000000401007 <+57>:  add    $0x8,%rsp
0x000000000040100b <+61>:  retq   
End of assembler dump.

（待续）