diff options
| -rw-r--r-- | bomblab/solution.md | 84 |
1 files changed, 83 insertions, 1 deletions
diff --git a/bomblab/solution.md b/bomblab/solution.md index fb8afe5..267a50e 100644 --- a/bomblab/solution.md +++ b/bomblab/solution.md @@ -1,4 +1,17 @@ +## NB + +The default assembly codes are generated by GDB in runtime. + +Those generated by Objdump would be commited with `# OBJDUMP` + +If it's connected to a grading system (eg. when this app is sent by your professor) +remember to set a breakpoint for ALL `<explode_bomb>`, so that your GPA won't be affected :) + +English version will be available soon + + +# commands `set disassembly-flavor att` nano ~/.gdbinit @@ -83,10 +96,79 @@ int sscanf(const char *str, const char *format, ...); 之后找到cmp，答案就在寄存器里面 +# Phase 4 + +func返回值需要是0，才能通关 + +如果第一次就(mid <= input) 并且 (mid >= input)，明显只有7满足，那就会直接返回0 + +如果第一次不是7，那么要确保每次都走左边 + +如果最深层的right - left = 1，那么range在400fe6为0，400fee操作之后也保持0 + +最终最外层的func4也会返回0 + +func4运行完之后还会检测第二个数字，别被坑了（第二个很简单的） + +```asm + 0x401048 <phase_4+003c> call 0x400fce <func4> + 0x40104d <phase_4+0041> test %eax, %eax + 0x40104f <phase_4+0043> jne 0x401058 <phase_4+76> TAKEN [Reason: !Z] + ↳ 0x401058 <phase_4+004c> call 0x40143a <explode_bomb> +``` +```asm +# OBJDUMP +0000000000400fce <func4>: + 400fce: 48 83 ec 08 sub $0x8,%rsp + + 400fd2: 89 d0 mov %right,%range + 400fd4: 29 f0 sub %left,%range + 400fd6: 89 c1 mov %range,%mid + 400fd8: c1 e9 1f shr $0x1f,%mid + 400fdb: 01 c8 add %mid,%range + 400fdd: d1 f8 sar $1,%range + 400fdf: 8d 0c 30 lea (%range,%left,1),%mid + 400fe2: 39 f9 cmp %input,%mid + # range = right - left + # mid = left + (range/2) + + + 400fe4: 7e 0c jle 400ff2 <func4+0x24> # if (mid > input), left part + + # left part + # [left, mid-1] + 400fe6: 8d 51 ff lea -0x1(%mid),%right # right = mid - 1 + 400fe9: e8 e0 ff ff ff call 400fce <func4> + 400fee: 01 c0 add %range,%range # range = 2 * range + 400ff0: eb 15 jmp 401007 <func4+0x39> + + # right part + # [mid+1, right] + 400ff2: b8 00 00 00 00 mov $0x0,%range + 400ff7: 39 f9 cmp %input,%mid + 400ff9: 7d 0c jge 401007 <func4+0x39> # if (mid >= input) ret + 400ffb: 8d 71 01 lea 0x1(%mid),%left # left = mid + 1 + 400ffe: e8 cb ff ff ff call 400fce <func4> + 401003: 8d 44 00 01 lea 0x1(%range,%range,1),%range # range = 2*range + 1 + + 401007: 48 83 c4 08 add $0x8,%rsp + 40100b: c3 ret # ret range (eax) + + +# all caller saved +# range --- eax +# left --- esi +# right --- edx +# input --- rdi (constant) +``` + + ## Solution Border relations with Canada have never been better. 1 2 4 8 16 32 -7 327
\ No newline at end of file +7 327 + +7 0
\ No newline at end of file |