diff options
| -rw-r--r-- | bomblab/ans.txt | 3 | ||||
| -rw-r--r-- | bomblab/secret.asm | 54 | ||||
| -rw-r--r-- | bomblab/tree.txt | 50 |
3 files changed, 106 insertions, 1 deletions
diff --git a/bomblab/ans.txt b/bomblab/ans.txt index 1d54cee..fc619d3 100644 --- a/bomblab/ans.txt +++ b/bomblab/ans.txt @@ -1,6 +1,7 @@ Border relations with Canada have never been better. 1 2 4 8 16 32 7 327 -7 0 +7 0 DrEvil ionefg 4 3 2 1 6 5 +22 diff --git a/bomblab/secret.asm b/bomblab/secret.asm new file mode 100644 index 0000000..c4a33b1 --- /dev/null +++ b/bomblab/secret.asm @@ -0,0 +1,54 @@ +0000000000401242 <secret_phase>: + 401242: push %rbx + 401243: call 40149e <read_line> # returns char* + 401248: mov $0xa,%edx # rdx = 10 + 40124d: mov $0x0,%esi # rsi = 0 + 401252: mov %rax,%rdi # rdi = char* (return value of read_line) + 401255: call 400bd0 <strtol@plt> # convert input to long, store in rax + 40125a: mov %rax,%rbx # rbx = long number + 40125d: lea -0x1(%rax),%eax # rax-- + 401260: cmp $0x3e8,%eax + 401265: jbe 40126c <secret_phase+0x2a> # if (rax <= 1000) safe + 401267: call 40143a <explode_bomb> + + 40126c: mov %ebx,%esi # rsi = rbx + 40126e: mov $0x6030f0,%edi # rdi = an address (36) + 401273: call 401204 <fun7> + 401278: cmp $0x2,%eax # return 2, safe + 40127b: je 401282 <secret_phase+0x40> + 40127d: call 40143a <explode_bomb> + 401282: mov $0x402438,%edi + 401287: call 400b10 <puts@plt> + 40128c: call 4015c4 <phase_defused> + 401291: pop %rbx + 401292: ret + + +# fun7(long *x, long y) +0000000000401204 <fun7>: + 401204: sub $0x8,%rsp + 401208: test %rdi,%rdi + 40120b: je 401238 <fun7+0x34> # never + + + 40120d: mov (%rdi),%edx # rdx = *x + 40120f: cmp %esi,%edx + 401211: jle 401220 <fun7+0x1c> # if (*x <= y) ret + + 401213: mov 0x8(%rdi),%rdi # rdi = *(rdi+8) + 401217: call 401204 <fun7> + 40121c: add %eax,%eax # rax *= 2 + 40121e: jmp 40123d <fun7+0x39> + + 401220: mov $0x0,%eax # rax = 0 + 401225: cmp %esi,%edx + 401227: je 40123d <fun7+0x39> # if (*x == y) ret + 401229: mov 0x10(%rdi),%rdi # rdi = *(rdi+16) + 40122d: call 401204 <fun7> + 401232: lea 0x1(%rax,%rax,1),%eax # rax = 2*rax + 1 + 401236: jmp 40123d <fun7+0x39> + 401238: mov $0xffffffff,%eax + + + 40123d: add $0x8,%rsp + 401241: ret diff --git a/bomblab/tree.txt b/bomblab/tree.txt new file mode 100644 index 0000000..d0f903b --- /dev/null +++ b/bomblab/tree.txt @@ -0,0 +1,50 @@ +gef⤠x/72xg 0x6030f0 +0x6030f0 <n1>: 0x0000000000000024 0x0000000000603110 +0x603100 <n1+16>: 0x0000000000603130 0x0000000000000000 +0x603110 <n21>: 0x0000000000000008 0x0000000000603190 +0x603120 <n21+16>: 0x0000000000603150 0x0000000000000000 +0x603130 <n22>: 0x0000000000000032 0x0000000000603170 +0x603140 <n22+16>: 0x00000000006031b0 0x0000000000000000 +0x603150 <n32>: 0x0000000000000016 0x0000000000603270 +0x603160 <n32+16>: 0x0000000000603230 0x0000000000000000 +0x603170 <n33>: 0x000000000000002d 0x00000000006031d0 +0x603180 <n33+16>: 0x0000000000603290 0x0000000000000000 +0x603190 <n31>: 0x0000000000000006 0x00000000006031f0 +0x6031a0 <n31+16>: 0x0000000000603250 0x0000000000000000 +0x6031b0 <n34>: 0x000000000000006b 0x0000000000603210 +0x6031c0 <n34+16>: 0x00000000006032b0 0x0000000000000000 +0x6031d0 <n45>: 0x0000000000000028 0x0000000000000000 +0x6031e0 <n45+16>: 0x0000000000000000 0x0000000000000000 +0x6031f0 <n41>: 0x0000000000000001 0x0000000000000000 +0x603200 <n41+16>: 0x0000000000000000 0x0000000000000000 +0x603210 <n47>: 0x0000000000000063 0x0000000000000000 +0x603220 <n47+16>: 0x0000000000000000 0x0000000000000000 +0x603230 <n44>: 0x0000000000000023 0x0000000000000000 +0x603240 <n44+16>: 0x0000000000000000 0x0000000000000000 +0x603250 <n42>: 0x0000000000000007 0x0000000000000000 +0x603260 <n42+16>: 0x0000000000000000 0x0000000000000000 +0x603270 <n43>: 0x0000000000000014 0x0000000000000000 +0x603280 <n43+16>: 0x0000000000000000 0x0000000000000000 +0x603290 <n46>: 0x000000000000002f 0x0000000000000000 +0x6032a0 <n46+16>: 0x0000000000000000 0x0000000000000000 +0x6032b0 <n48>: 0x00000000000003e9 0x0000000000000000 +0x6032c0 <n48+16>: 0x0000000000000000 0x0000000000000000 +0x6032d0 <node1>: 0x000000010000014c 0x00000000006032e0 +0x6032e0 <node2>: 0x00000002000000a8 0x0000000000000000 +0x6032f0 <node3>: 0x000000030000039c 0x0000000000603300 +0x603300 <node4>: 0x00000004000002b3 0x0000000000603310 +0x603310 <node5>: 0x00000005000001dd 0x0000000000603320 +0x603320 <node6>: 0x00000006000001bb 0x00000000006032d0 + + + [n1] + 0x24 (36) + / \ + [n21] [n22] + 0x08 (8) 0x32 (50) + / \ / \ + [n31] [n32] [n33] [n34] + 0x06(6) 0x16(22) 0x2d(45) 0x6b(107) + / \ / \ / \ / \ + [n41] [n42] .. [n44] .. [n46] [n47] [n48] + 1 7 20 35 40 47 99 1001 |