diff options
Diffstat (limited to 'bomblab/solution.md')
| -rw-r--r-- | bomblab/solution.md | 56 |
1 files changed, 50 insertions, 6 deletions
diff --git a/bomblab/solution.md b/bomblab/solution.md index 7934ba9..7458165 100644 --- a/bomblab/solution.md +++ b/bomblab/solution.md @@ -10,6 +10,21 @@ remember to set a breakpoint for ALL `<explode_bomb>`, so that your GPA won't be English version will be available soon +👍😍❤️ _ov4 + +``` +➜ bomblab git:(main) ✗ ./bomb ans.txt +Welcome to my fiendish little bomb. You have 6 phases with +which to blow yourself up. Have a nice day! +Phase 1 defused. How about the next one? +That's number 2. Keep going! +Halfway there! +So you got that one. Try this one. +Good work! On to the next... +Congratulations! You've defused the bomb! +➜ bomblab git:(main) ✗ +``` + # commands @@ -209,14 +224,43 @@ func4运行完之后还会检测第二个数字，别被坑了（第二个很简 ``` -## Solution +# Phase 6 + +汇编太长了，自己去`phase6.asm`看，有完整的注释 + +1. 输入`6`个数组，检测是否在`[1, 6]`，并且没有重复 + +2. 假设原来的输入是`x`，将它转换成`7-x`，存储在`[rsp, rsp+20]` （`rsp+23`是最后一个占用的字节） + +3. 按coded input的顺序，将地址提取到`rsp+32`开始的连续内存；如果coded input是`4 5 1 2 3`，那么rsp+32开始的指针对应的就是`node 4, 5, 2, 1, 3`的地址 + +4. 更新`node.next`，指向重新连接之后的下一个`node`，使得`next`的顺序与`[rsp+32, rsp+72]`存储的顺序相符（ie. 不要了`rsp+32`之后的内容，也知道重新连接之后的链表的顺序） -Border relations with Canada have never been better. +5. 检测顺序（要求是降序）；很明显 ，`node 3, 4, 5, 6, 1, 2`排序时刚好降序，答案自然就出来了 -1 2 4 8 16 32 -7 327 -7 0 +```c +// 16 bytes each +struct idk { + int num; // 4 bytes + int index; // 4 bytes + idk *next; // 8 bytes +} node[6]; +``` + +``` +gef➤ x/24dwx 0x6032d0 +0x6032d0 <node1>: 0x0000014c 0x00000001 0x006032e0 0x00000000 +0x6032e0 <node2>: 0x000000a8 0x00000002 0x006032f0 0x00000000 +0x6032f0 <node3>: 0x0000039c 0x00000003 0x00603300 0x00000000 +0x603300 <node4>: 0x000002b3 0x00000004 0x00603310 0x00000000 +0x603310 <node5>: 0x000001dd 0x00000005 0x00603320 0x00000000 +0x603320 <node6>: 0x000001bb 0x00000006 0x00000000 0x00000000 +``` + + + +## Solution -ionefg
\ No newline at end of file +See `ans.txt` |