Passed phase 4 LOL

1 files changed, 83 insertions, 1 deletions

diff --git a/bomblab/solution.md b/bomblab/solution.md
index fb8afe5..267a50e 100644
--- a/bomblab/solution.md
+++ b/bomblab/solution.md
@@ -1,4 +1,17 @@
 
+## NB
+
+The default assembly codes are generated by GDB in runtime. 
+
+Those generated by Objdump would be commited with `# OBJDUMP`
+
+If it's connected to a grading system (eg. when this app is sent by your professor)
+remember to set a breakpoint for ALL `<explode_bomb>`, so that your GPA won't be affected :)
+
+English version will be available soon
+
+
+# commands
 
 `set disassembly-flavor att` nano ~/.gdbinit
 
@@ -83,10 +96,79 @@ int sscanf(const char *str, const char *format, ...);
 之后找到cmp，答案就在寄存器里面
 
 
+# Phase 4
+
+func返回值需要是0，才能通关
+
+如果第一次就(mid <= input) 并且 (mid >= input)，明显只有7满足，那就会直接返回0
+
+如果第一次不是7，那么要确保每次都走左边
+
+如果最深层的right - left = 1，那么range在400fe6为0，400fee操作之后也保持0
+
+最终最外层的func4也会返回0
+
+func4运行完之后还会检测第二个数字，别被坑了（第二个很简单的）
+
+```asm
+     0x401048 <phase_4+003c>   call   0x400fce <func4>
+     0x40104d <phase_4+0041>   test   %eax, %eax
+     0x40104f <phase_4+0043>   jne    0x401058 <phase_4+76>     TAKEN [Reason: !Z]
+   ↳    0x401058 <phase_4+004c>   call   0x40143a <explode_bomb>
+```
+```asm
+# OBJDUMP
+0000000000400fce <func4>:
+  400fce:	48 83 ec 08          	sub    $0x8,%rsp
+
+  400fd2:	89 d0                	mov    %right,%range
+  400fd4:	29 f0                	sub    %left,%range
+  400fd6:	89 c1                	mov    %range,%mid
+  400fd8:	c1 e9 1f             	shr    $0x1f,%mid
+  400fdb:	01 c8                	add    %mid,%range
+  400fdd:	d1 f8                	sar    $1,%range
+  400fdf:	8d 0c 30             	lea    (%range,%left,1),%mid
+  400fe2:	39 f9                	cmp    %input,%mid
+  # range = right - left
+  # mid = left + (range/2)
+
+
+  400fe4:	7e 0c                	jle    400ff2 <func4+0x24> # if (mid > input), left part
+
+  # left part
+  # [left, mid-1]
+  400fe6:	8d 51 ff             	lea    -0x1(%mid),%right # right = mid - 1
+  400fe9:	e8 e0 ff ff ff       	call   400fce <func4>
+  400fee:	01 c0                	add    %range,%range # range = 2 * range
+  400ff0:	eb 15                	jmp    401007 <func4+0x39>
+
+  # right part
+  # [mid+1, right]
+  400ff2:	b8 00 00 00 00       	mov    $0x0,%range
+  400ff7:	39 f9                	cmp    %input,%mid
+  400ff9:	7d 0c                	jge    401007 <func4+0x39> # if (mid >= input) ret
+  400ffb:	8d 71 01             	lea    0x1(%mid),%left # left = mid + 1
+  400ffe:	e8 cb ff ff ff       	call   400fce <func4>
+  401003:	8d 44 00 01          	lea    0x1(%range,%range,1),%range # range = 2*range + 1
+
+  401007:	48 83 c4 08          	add    $0x8,%rsp
+  40100b:	c3                   	ret # ret range (eax)
+
+
+# all caller saved
+# range --- eax
+# left --- esi
+# right --- edx
+# input --- rdi (constant)
+```
+
+
 ## Solution
 
 Border relations with Canada have never been better.
 
 1 2 4 8 16 32
 
-7 327
\ No newline at end of file
+7 327
+
+7 0
\ No newline at end of file