diff options
| author | ov-4 <hausemasterstream@gmail.com> | 2026-01-16 16:36:19 +0000 |
|---|---|---|
| committer | ov-4 <hausemasterstream@gmail.com> | 2026-01-16 16:36:19 +0000 |
| commit | a2fc278fa4ce3a2fc32169512706beffea999c35 (patch) | |
| tree | 1b4ff59064e44cf42310e6e0d1a5ce0b6aea90aa /bomblab | |
| parent | 24815f4b3f0990e811e7adf0492358e79933656d (diff) | |
Phase 5 passed
Diffstat (limited to 'bomblab')
| -rw-r--r-- | bomblab/solution.md | 64 |
1 files changed, 56 insertions, 8 deletions
diff --git a/bomblab/solution.md b/bomblab/solution.md index 267a50e..7934ba9 100644 --- a/bomblab/solution.md +++ b/bomblab/solution.md @@ -46,6 +46,8 @@ English version will be available soon `delete checkpoint <id>`: 删除快照。 +`objdump -s -j .rodata bomb` 查看静态只读数据 + # Phase 1 @@ -133,26 +135,26 @@ func4运行完之后还会检测第二个数字，别被坑了（第二个很简 # mid = left + (range/2) - 400fe4: 7e 0c jle 400ff2 <func4+0x24> # if (mid > input), left part + 400fe4: 7e 0c jle 400ff2 <func4+0x24> # if (mid > input), left part # left part # [left, mid-1] - 400fe6: 8d 51 ff lea -0x1(%mid),%right # right = mid - 1 + 400fe6: 8d 51 ff lea -0x1(%mid),%right # right = mid - 1 400fe9: e8 e0 ff ff ff call 400fce <func4> - 400fee: 01 c0 add %range,%range # range = 2 * range + 400fee: 01 c0 add %range,%range # range = 2 * range 400ff0: eb 15 jmp 401007 <func4+0x39> # right part # [mid+1, right] 400ff2: b8 00 00 00 00 mov $0x0,%range 400ff7: 39 f9 cmp %input,%mid - 400ff9: 7d 0c jge 401007 <func4+0x39> # if (mid >= input) ret - 400ffb: 8d 71 01 lea 0x1(%mid),%left # left = mid + 1 + 400ff9: 7d 0c jge 401007 <func4+0x39> # if (mid >= input) ret + 400ffb: 8d 71 01 lea 0x1(%mid),%left # left = mid + 1 400ffe: e8 cb ff ff ff call 400fce <func4> - 401003: 8d 44 00 01 lea 0x1(%range,%range,1),%range # range = 2*range + 1 + 401003: 8d 44 00 01 lea 0x1(%range,%range,1),%range # range = 2*range + 1 401007: 48 83 c4 08 add $0x8,%rsp - 40100b: c3 ret # ret range (eax) + 40100b: c3 ret # ret range (eax) # all caller saved @@ -163,6 +165,50 @@ func4运行完之后还会检测第二个数字，别被坑了（第二个很简 ``` + +# Phase 5 + +字符转码表 +`4024b0 maduiersnfotvbyl` + +答案 +`40245e flyers` + +简单的for循环，遍历每个字符，然后查表转换之后放到stack + +```asm +# OBJDUMP + +# phase_5(char* input) +# %index = %rax +# %input = %rdi + +# FOR loop, index = [0, 6) + 40108b: 0f b6 0c 03 movzbl (%rbx,%index,1),%ecx # rcx = *(input + index), get each input char + 40108f: 88 0c 24 mov %cl,(%rsp) # stacktop = rcx + 401092: 48 8b 14 24 mov (%rsp),%rdx # rdx = stacktop = rcx + 401096: 83 e2 0f and $0xf,%edx # rdx = stacktop & 0xF + 401099: 0f b6 92 b0 24 40 00 movzbl 0x4024b0(%rdx),%edx # rdx = *(0x4024b0 + rdx), get lower 4 bits + + # rdx = *[*(input+index) & 0xF + 0x4024b0] + # find 0x4024b0 + bias + + 4010a0: 88 54 04 10 mov %dl,0x10(%rsp,%index,1) # *(rsp+index+10) = rdx (the correspoding data) + 4010a4: 48 83 c0 01 add $0x1,%index # index++ + 4010a8: 48 83 f8 06 cmp $0x6,%index # if (index == 6) break + 4010ac: 75 dd jne 40108b <phase_5+0x29> + # rsp+(10 to 15) are where passwords are saved, on stack + + + 4010ae: c6 44 24 16 00 movb $0x0,0x16(%rsp) # \0 + 4010b3: be 5e 24 40 00 mov $0x40245e,%esi + 4010b8: 48 8d 7c 24 10 lea 0x10(%rsp),%rdi # compare (coded input) against ($0x40245e) + 4010bd: e8 76 02 00 00 call 401338 <strings_not_equal> + 4010c2: 85 c0 test %index,%index + 4010c4: 74 13 je 4010d9 <phase_5+0x77> +``` + + ## Solution Border relations with Canada have never been better. @@ -171,4 +217,6 @@ Border relations with Canada have never been better. 7 327 -7 0
\ No newline at end of file +7 0 + +ionefg
\ No newline at end of file |