From aacbd334c3204f4abc5921a7e6a2bea485b1f371 Mon Sep 17 00:00:00 2001
From: ov-4 <hausemasterstream@gmail.com>
Date: Tue, 20 Jan 2026 14:31:06 +0000
Subject: Solved secret phase

---
 bomblab/ans.txt    |  3 ++-
 bomblab/secret.asm | 54 ++++++++++++++++++++++++++++++++++++++++++++++++++++++
 bomblab/tree.txt   | 50 ++++++++++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 106 insertions(+), 1 deletion(-)
 create mode 100644 bomblab/secret.asm
 create mode 100644 bomblab/tree.txt

(limited to 'bomblab')

diff --git a/bomblab/ans.txt b/bomblab/ans.txt
index 1d54cee..fc619d3 100644
--- a/bomblab/ans.txt
+++ b/bomblab/ans.txt
@@ -1,6 +1,7 @@
 Border relations with Canada have never been better.
 1 2 4 8 16 32
 7 327
-7 0
+7 0 DrEvil
 ionefg
 4 3 2 1 6 5
+22
diff --git a/bomblab/secret.asm b/bomblab/secret.asm
new file mode 100644
index 0000000..c4a33b1
--- /dev/null
+++ b/bomblab/secret.asm
@@ -0,0 +1,54 @@
+0000000000401242 <secret_phase>:
+  401242:	push   %rbx
+  401243:	call   40149e <read_line>             # returns char*
+  401248:	mov    $0xa,%edx                      # rdx = 10
+  40124d:	mov    $0x0,%esi                      # rsi = 0
+  401252:	mov    %rax,%rdi                      # rdi = char* (return value of read_line)
+  401255:	call   400bd0 <strtol@plt>            # convert input to long, store in rax
+  40125a:	mov    %rax,%rbx                      # rbx = long number
+  40125d:	lea    -0x1(%rax),%eax                # rax--
+  401260:	cmp    $0x3e8,%eax
+  401265:	jbe    40126c <secret_phase+0x2a>     # if (rax <= 1000) safe
+  401267:	call   40143a <explode_bomb>
+
+  40126c:	mov    %ebx,%esi                      # rsi = rbx
+  40126e:	mov    $0x6030f0,%edi                 # rdi = an address (36)
+  401273:	call   401204 <fun7>
+  401278:	cmp    $0x2,%eax                      # return 2, safe
+  40127b:	je     401282 <secret_phase+0x40>
+  40127d:	call   40143a <explode_bomb>
+  401282:	mov    $0x402438,%edi
+  401287:	call   400b10 <puts@plt>
+  40128c:	call   4015c4 <phase_defused>
+  401291:	pop    %rbx
+  401292:	ret
+
+
+# fun7(long *x, long y)
+0000000000401204 <fun7>:
+  401204:	sub    $0x8,%rsp
+  401208:	test   %rdi,%rdi
+  40120b:	je     401238 <fun7+0x34>     # never
+
+
+  40120d:	mov    (%rdi),%edx            # rdx = *x
+  40120f:	cmp    %esi,%edx
+  401211:	jle    401220 <fun7+0x1c>     # if (*x <= y) ret
+
+  401213:	mov    0x8(%rdi),%rdi         # rdi = *(rdi+8)
+  401217:	call   401204 <fun7>
+  40121c:	add    %eax,%eax              # rax *= 2
+  40121e:	jmp    40123d <fun7+0x39>
+
+  401220:	mov    $0x0,%eax              # rax = 0
+  401225:	cmp    %esi,%edx
+  401227:	je     40123d <fun7+0x39>     # if (*x == y) ret
+  401229:	mov    0x10(%rdi),%rdi        # rdi = *(rdi+16)
+  40122d:	call   401204 <fun7>
+  401232:	lea    0x1(%rax,%rax,1),%eax  # rax = 2*rax + 1
+  401236:	jmp    40123d <fun7+0x39>
+  401238:	mov    $0xffffffff,%eax
+
+
+  40123d:	add    $0x8,%rsp
+  401241:	ret
diff --git a/bomblab/tree.txt b/bomblab/tree.txt
new file mode 100644
index 0000000..d0f903b
--- /dev/null
+++ b/bomblab/tree.txt
@@ -0,0 +1,50 @@
+gef➤  x/72xg 0x6030f0
+0x6030f0 <n1>:  0x0000000000000024      0x0000000000603110
+0x603100 <n1+16>:       0x0000000000603130      0x0000000000000000
+0x603110 <n21>: 0x0000000000000008      0x0000000000603190
+0x603120 <n21+16>:      0x0000000000603150      0x0000000000000000
+0x603130 <n22>: 0x0000000000000032      0x0000000000603170
+0x603140 <n22+16>:      0x00000000006031b0      0x0000000000000000
+0x603150 <n32>: 0x0000000000000016      0x0000000000603270
+0x603160 <n32+16>:      0x0000000000603230      0x0000000000000000
+0x603170 <n33>: 0x000000000000002d      0x00000000006031d0
+0x603180 <n33+16>:      0x0000000000603290      0x0000000000000000
+0x603190 <n31>: 0x0000000000000006      0x00000000006031f0
+0x6031a0 <n31+16>:      0x0000000000603250      0x0000000000000000
+0x6031b0 <n34>: 0x000000000000006b      0x0000000000603210
+0x6031c0 <n34+16>:      0x00000000006032b0      0x0000000000000000
+0x6031d0 <n45>: 0x0000000000000028      0x0000000000000000
+0x6031e0 <n45+16>:      0x0000000000000000      0x0000000000000000
+0x6031f0 <n41>: 0x0000000000000001      0x0000000000000000
+0x603200 <n41+16>:      0x0000000000000000      0x0000000000000000
+0x603210 <n47>: 0x0000000000000063      0x0000000000000000
+0x603220 <n47+16>:      0x0000000000000000      0x0000000000000000
+0x603230 <n44>: 0x0000000000000023      0x0000000000000000
+0x603240 <n44+16>:      0x0000000000000000      0x0000000000000000
+0x603250 <n42>: 0x0000000000000007      0x0000000000000000
+0x603260 <n42+16>:      0x0000000000000000      0x0000000000000000
+0x603270 <n43>: 0x0000000000000014      0x0000000000000000
+0x603280 <n43+16>:      0x0000000000000000      0x0000000000000000
+0x603290 <n46>: 0x000000000000002f      0x0000000000000000
+0x6032a0 <n46+16>:      0x0000000000000000      0x0000000000000000
+0x6032b0 <n48>: 0x00000000000003e9      0x0000000000000000
+0x6032c0 <n48+16>:      0x0000000000000000      0x0000000000000000
+0x6032d0 <node1>:       0x000000010000014c      0x00000000006032e0
+0x6032e0 <node2>:       0x00000002000000a8      0x0000000000000000
+0x6032f0 <node3>:       0x000000030000039c      0x0000000000603300
+0x603300 <node4>:       0x00000004000002b3      0x0000000000603310
+0x603310 <node5>:       0x00000005000001dd      0x0000000000603320
+0x603320 <node6>:       0x00000006000001bb      0x00000000006032d0
+
+
+                   [n1]
+                0x24 (36)
+               /         \
+           [n21]         [n22]
+         0x08 (8)       0x32 (50)
+         /     \        /       \
+     [n31]    [n32]   [n33]    [n34]
+    0x06(6)  0x16(22) 0x2d(45) 0x6b(107)
+    /   \     /   \    /   \     /    \
+ [n41] [n42] ..  [n44] .. [n46] [n47] [n48]
+   1     7   20   35   40   47    99   1001
-- 
cgit v1.3.1-4-g156e