问题
Yes, this is homework, and no I'm not asking you to do my homework. I need help with phase 3 of this binary bomb. I didn't have any trouble with phases 1 and 2 but phase 3 is just too much for me. I understand that there should be 3 inputs. I'm pretty sure one of them is a character input and two of them are integers, but I'm not sure in what order. Firstly, here is the disassembled code:
0x0000000000401163 <phase_3+0>: sub $0x18,%rsp
0x0000000000401167 <phase_3+4>: lea 0xf(%rsp),%rcx
0x000000000040116c <phase_3+9>: lea 0x14(%rsp),%rdx
0x0000000000401171 <phase_3+14>: lea 0x10(%rsp),%r8
0x0000000000401176 <phase_3+19>: mov $0x402650,%esi
0x000000000040117b <phase_3+24>: mov $0x0,%eax
0x0000000000401180 <phase_3+29>: callq 0x400b80 <sscanf@plt>
0x0000000000401185 <phase_3+34>: cmp $0x2,%eax
0x0000000000401188 <phase_3+37>: jg 0x40118f <phase_3+44>
0x000000000040118a <phase_3+39>: callq 0x4014b1 <explode_bomb>
0x000000000040118f <phase_3+44>: cmpl $0x7,0x14(%rsp)
0x0000000000401194 <phase_3+49>: ja 0x401294 <phase_3+305>
0x000000000040119a <phase_3+55>: mov 0x14(%rsp),%eax
0x000000000040119e <phase_3+59>: xchg %ax,%ax
0x00000000004011a0 <phase_3+61>: jmpq *0x402660(,%rax,8)
0x00000000004011a7 <phase_3+68>: cmpl $0x2c4,0x10(%rsp)
0x00000000004011af <phase_3+76>: nop
0x00000000004011b0 <phase_3+77>: je 0x4012a2 <phase_3+319>
0x00000000004011b6 <phase_3+83>: callq 0x4014b1 <explode_bomb>
0x00000000004011bb <phase_3+88>: mov $0x7a,%eax
0x00000000004011c0 <phase_3+93>: jmpq 0x4012a7 <phase_3+324>
0x00000000004011c5 <phase_3+98>: mov $0x6a,%eax
---Type <return> to continue, or q <return> to quit---
0x00000000004011ca <phase_3+103>: cmpl $0x327,0x10(%rsp)
0x00000000004011d2 <phase_3+111>: je 0x4012a7 <phase_3+324>
0x00000000004011d8 <phase_3+117>: callq 0x4014b1 <explode_bomb>
0x00000000004011dd <phase_3+122>: mov $0x6a,%eax
0x00000000004011e2 <phase_3+127>: jmpq 0x4012a7 <phase_3+324>
0x00000000004011e7 <phase_3+132>: mov $0x66,%eax
0x00000000004011ec <phase_3+137>: cmpl $0x136,0x10(%rsp)
0x00000000004011f4 <phase_3+145>: je 0x4012a7 <phase_3+324>
0x00000000004011fa <phase_3+151>: callq 0x4014b1 <explode_bomb>
0x00000000004011ff <phase_3+156>: mov $0x66,%eax
0x0000000000401204 <phase_3+161>: jmpq 0x4012a7 <phase_3+324>
0x0000000000401209 <phase_3+166>: mov $0x75,%eax
0x000000000040120e <phase_3+171>: cmpl $0x252,0x10(%rsp)
0x0000000000401216 <phase_3+179>: je 0x4012a7 <phase_3+324>
0x000000000040121c <phase_3+185>: callq 0x4014b1 <explode_bomb>
0x0000000000401221 <phase_3+190>: mov $0x75,%eax
0x0000000000401226 <phase_3+195>: jmpq 0x4012a7 <phase_3+324>
0x000000000040122b <phase_3+200>: mov $0x70,%eax
0x0000000000401230 <phase_3+205>: cmpl $0x240,0x10(%rsp)
0x0000000000401238 <phase_3+213>: je 0x4012a7 <phase_3+324>
0x000000000040123a <phase_3+215>: callq 0x4014b1 <explode_bomb>
0x000000000040123f <phase_3+220>: mov $0x70,%eax
0x0000000000401244 <phase_3+225>: jmp 0x4012a7 <phase_3+324>
---Type <return> to continue, or q <return> to quit---
0x0000000000401246 <phase_3+227>: cmpl $0x269,0x10(%rsp)
0x000000000040124e <phase_3+235>: xchg %ax,%ax
0x0000000000401250 <phase_3+237>: je 0x4012a2 <phase_3+319>
0x0000000000401252 <phase_3+239>: callq 0x4014b1 <explode_bomb>
0x0000000000401257 <phase_3+244>: mov $0x7a,%eax
0x000000000040125c <phase_3+249>: jmp 0x4012a7 <phase_3+324>
0x000000000040125e <phase_3+251>: mov $0x6b,%eax
0x0000000000401263 <phase_3+256>: cmpl $0x201,0x10(%rsp)
0x000000000040126b <phase_3+264>: je 0x4012a7 <phase_3+324>
0x000000000040126d <phase_3+266>: callq 0x4014b1 <explode_bomb>
0x0000000000401272 <phase_3+271>: mov $0x6b,%eax
0x0000000000401277 <phase_3+276>: jmp 0x4012a7 <phase_3+324>
0x0000000000401279 <phase_3+278>: mov $0x74,%eax
0x000000000040127e <phase_3+283>: cmpl $0x358,0x10(%rsp)
0x0000000000401286 <phase_3+291>: je 0x4012a7 <phase_3+324>
0x0000000000401288 <phase_3+293>: callq 0x4014b1 <explode_bomb>
0x000000000040128d <phase_3+298>: mov $0x74,%eax
0x0000000000401292 <phase_3+303>: jmp 0x4012a7 <phase_3+324>
0x0000000000401294 <phase_3+305>: callq 0x4014b1 <explode_bomb>
0x0000000000401299 <phase_3+310>: mov $0x75,%eax
0x000000000040129e <phase_3+315>: xchg %ax,%ax
0x00000000004012a0 <phase_3+317>: jmp 0x4012a7 <phase_3+324>
0x00000000004012a2 <phase_3+319>: mov $0x7a,%eax
---Type <return> to continue, or q <return> to quit---
0x00000000004012a7 <phase_3+324>: cmp 0xf(%rsp),%al
0x00000000004012ab <phase_3+328>: je 0x4012b2 <phase_3+335>
0x00000000004012ad <phase_3+330>: callq 0x4014b1 <explode_bomb>
0x00000000004012b2 <phase_3+335>: add $0x18,%rsp
0x00000000004012b6 <phase_3+339>: retq
I inputted something like 4 112 z, just to try it out and run through the steps.
The code runs up to 0x0000000000401230 <phase_3+205>: cmpl $0x240,0x10(%rsp)
What I'm really confused about is what 0x10(%rsp) indicates. I looked at the decimal value stored in rsp and it's in the negatives. It seems like the first input of 4 worked out fine, and the code kept running, but I'm wondering why it's comparing rsp to 576, and what the 0x10 in front of it indicates. Any sort of insight would be helpful.
回答1:
It isn't comparing %rsp to 0x240. Rather, it is comparing whatever is stored at the memory location %rsp + 0x10 to 0x240, in other words, it's comparing a constant to what you'd call a "local variable" in most languages.
回答2:
A note about scanf... the input string is usually somewhere in memory (e.g. "%d %d %c %s")... Recall that arguments are pushed onto the stack prior to calling a function. If you see a memory address placed somewhere on the stack, use the x /s 0x.... command to view whats been placed there. In my bomb it was the instruction "mov 0x804a27d, 0x4(%esp)" I used x /s 0x804a27d to view the input string. This reveals not only the order but also the data types of the answer.
来源：https://stackoverflow.com/questions/18961406/binary-bomb-phase-3-assembly