Boom！！！计算机系统，从理解到爆炸，Bomblab
Posted 伟大的蚊子
tags:
篇首语：本文由小常识网(cha138.com)小编为大家整理，主要介绍了Boom！！！计算机系统，从理解到爆炸，Bomblab相关的知识，希望对你有一定的参考价值。
进入目录下
./bomb
开始运行炸弹
对于炸弹command not found之类的鬼畜情况：
chmod 777 bomb
然后再运行炸弹
objdump -d bomb > bomb.s
把整个代码打到文件里去，也可以进gdb看
gdb>disas phase_1
看第一步的代码
我是bomb_217
第一步直接找按地址寻找字符串
0000000000400ead <phase_1>:
400ead: 48 83 ec 08 sub $0x8,%rsp
400eb1: be b0 23 40 00 mov $0x4023b0,%esi //字符串就存这，x/s 0x4023b0就出来了
//I can see Russia from my house!
400eb6: e8 5c 04 00 00 callq 401317 <strings_not_equal>
400ebb: 85 c0 test %eax,%eax
400ebd: 74 05 je 400ec4 <phase_1+0x17>
400ebf: e8 52 05 00 00 callq 401416 <explode_bomb>
400ec4: 48 83 c4 08 add $0x8,%rsp
400ec8: c3 retq 第二部，输入6个数，我这里是要求是以1开头，公比为2的等比数列
0000000000400ec9 <phase_2>:
400ec9: 55 push %rbp
400eca: 53 push %rbx
400ecb: 48 83 ec 28 sub $0x28,%rsp
400ecf: 64 48 8b 04 25 28 00 mov %fs:0x28,%rax
400ed6: 00 00
400ed8: 48 89 44 24 18 mov %rax,0x18(%rsp)
400edd: 31 c0 xor %eax,%eax
400edf: 48 89 e6 mov %rsp,%rsi
400ee2: e8 51 05 00 00 callq 401438 <read_six_numbers> //read 6 个数字
400ee7: 83 3c 24 01 cmpl $0x1,(%rsp)
400eeb: 74 05 je 400ef2 <phase_2+0x29> //if !=1,爆炸
400eed: e8 24 05 00 00 callq 401416 <explode_bomb>
400ef2: 48 89 e3 mov %rsp,%rbx
400ef5: 48 8d 6c 24 14 lea 0x14(%rsp),%rbp
400efa: 8b 03 mov (%rbx),%eax
400efc: 01 c0 add %eax,%eax //*2
400efe: 39 43 04 cmp %eax,0x4(%rbx) //不等则爆炸,,,猜，六个数，等比数列，get
400f01: 74 05 je 400f08 <phase_2+0x3f>
400f03: e8 0e 05 00 00 callq 401416 <explode_bomb>
400f08: 48 83 c3 04 add $0x4,%rbx
400f0c: 48 39 eb cmp %rbp,%rbx
400f0f: 75 e9 jne 400efa <phase_2+0x31>
400f11: 48 8b 44 24 18 mov 0x18(%rsp),%rax
400f16: 64 48 33 04 25 28 00 xor %fs:0x28,%rax
400f1d: 00 00
400f1f: 74 05 je 400f26 <phase_2+0x5d>
400f21: e8 fa fb ff ff callq 400b20 <__stack_chk_fail@plt>
400f26: 48 83 c4 28 add $0x28,%rsp
400f2a: 5b pop %rbx
400f2b: 5d pop %rbp
400f2c: c3 retq 第三部，
输 x/s 0x40258f 看到”%d %d”，说明输入格式是两个int
switch语句，rax越大要干的事越少，懒一点吧
有多组解。。。。
0000000000400f2d <phase_3>:
400f2d: 48 83 ec 18 sub $0x18,%rsp
400f31: 64 48 8b 04 25 28 00 mov %fs:0x28,%rax
400f38: 00 00
400f3a: 48 89 44 24 08 mov %rax,0x8(%rsp)
400f3f: 31 c0 xor %eax,%eax
400f41: 48 8d 4c 24 04 lea 0x4(%rsp),%rcx
400f46: 48 89 e2 mov %rsp,%rdx
400f49: be 8f 25 40 00 mov $0x40258f,%esi //x/s 0x40258f: "%d %d"
400f4e: e8 8d fc ff ff callq 400be0 <__isoc99_sscanf@plt>
400f53: 83 f8 01 cmp $0x1,%eax
400f56: 7f 05 jg 400f5d <phase_3+0x30>
400f58: e8 b9 04 00 00 callq 401416 <explode_bomb> //if (%eax<=1) 炸
400f5d: 83 3c 24 07 cmpl $0x7,(%rsp)
400f61: 77 5b ja 400fbe <phase_3+0x91> //if (%rsp>7) 炸
400f63: 8b 04 24 mov (%rsp),%eax
400f66: ff 24 c5 00 24 40 00 jmpq *0x402400(,%rax,8) //x/x 0x402400 0x6d %rax=0
//x/x 0x402408 0x74 %rax=1
//x/x 0x402410 0x80 %rax=2
//x/x 0x402418 0x8c %rax=3
//x/x 0x402420 0x96 %rax=4
//x/x 0x402428 0xa0 %rax=5
//x/x 0x402430 0xaa %rax=6 boom 见下面的！！！
//x/x 0x402438 0xb4 %rax=7 boom
400f6d: b8 7c 01 00 00 mov $0x17c,%eax
400f72: eb 05 jmp 400f79 <phase_3+0x4c>
400f74: b8 00 00 00 00 mov $0x0,%eax
400f79: 2d de 03 00 00 sub $0x3de,%eax
400f7e: eb 05 jmp 400f85 <phase_3+0x58>
400f80: b8 00 00 00 00 mov $0x0,%eax
400f85: 05 49 01 00 00 add $0x149,%eax
400f8a: eb 05 jmp 400f91 <phase_3+0x64>
400f8c: b8 00 00 00 00 mov $0x0,%eax
400f91: 83 e8 3f sub $0x3f,%eax
400f94: eb 05 jmp 400f9b <phase_3+0x6e>
400f96: b8 00 00 00 00 mov $0x0,%eax //%rax=4 太烦的事我都不太会做
400f9b: 83 c0 3f add $0x3f,%eax
400f9e: eb 05 jmp 400fa5 <phase_3+0x78>
400fa0: b8 00 00 00 00 mov $0x0,%eax //%rax=5 算出来是-0x3f=-63,get,懒惰即美德
400fa5: 83 e8 3f sub $0x3f,%eax
400fa8: eb 05 jmp 400faf <phase_3+0x82>
400faa: b8 00 00 00 00 mov $0x0,%eax
400faf: 83 c0 3f add $0x3f,%eax
400fb2: eb 05 jmp 400fb9 <phase_3+0x8c>
400fb4: b8 00 00 00 00 mov $0x0,%eax //%rax=7,不能太懒啊
400fb9: 83 e8 3f sub $0x3f,%eax
400fbc: eb 0a jmp 400fc8 <phase_3+0x9b>
400fbe: e8 53 04 00 00 callq 401416 <explode_bomb>
400fc3: b8 00 00 00 00 mov $0x0,%eax
400fc8: 83 3c 24 05 cmpl $0x5,(%rsp)
400fcc: 7f 06 jg 400fd4 <phase_3+0xa7> //>5,炸！！！
400fce: 3b 44 24 04 cmp 0x4(%rsp),%eax
400fd2: 74 05 je 400fd9 <phase_3+0xac>
400fd4: e8 3d 04 00 00 callq 401416 <explode_bomb> //与输入的不等,炸
400fd9: 48 8b 44 24 08 mov 0x8(%rsp),%rax
400fde: 64 48 33 04 25 28 00 xor %fs:0x28,%rax
400fe5: 00 00
400fe7: 74 05 je 400fee <phase_3+0xc1>
400fe9: e8 32 fb ff ff callq 400b20 <__stack_chk_fail@plt>
400fee: 48 83 c4 18 add $0x18,%rsp
400ff2: c3 retq 第四步，递归函数
偷了个懒，地柜函数没有认真看（其实是看哭了）
然后发现了数据很小
第一个数0xe之内，第二个数是7
我们可以用“爆炸穷举法”（自己yy的名字）
把答案搞出来就好了,(智障只能这么乱搞了)
0000000000400ff3 <func4>:
400ff3: 48 83 ec 08 sub $0x8,%rsp
400ff7: 89 d0 mov %edx,%eax
400ff9: 29 f0 sub %esi,%eax
400ffb: 89 c1 mov %eax,%ecx //qnmd递归函数看不懂
400ffd: c1 e9 1f shr $0x1f,%ecx
401000: 01 c8 add %ecx,%eax
401002: d1 f8 sar %eax
401004: 8d 0c 30 lea (%rax,%rsi,1),%ecx
401007: 39 f9 cmp %edi,%ecx
401009: 7e 0c jle 401017 <func4+0x24> //if (%ecx>=%edi)
40100b: 8d 51 ff lea -0x1(%rcx),%edx
40100e: e8 e0 ff ff ff callq 400ff3 <func4>
401013: 01 c0 add %eax,%eax
401015: eb 15 jmp 40102c <func4+0x39> //return
401017: b8 00 00 00 00 mov $0x0,%eax
40101c: 39 f9 cmp %edi,%ecx
40101e: 7d 0c jge 40102c <func4+0x39> // if (%ecx>=%edi)return
401020: 8d 71 01 lea 0x1(%rcx),%esi
401023: e8 cb ff ff ff callq 400ff3 <func4>
401028: 8d 44 00 01 lea 0x1(%rax,%rax,1),%eax
40102c: 48 83 c4 08 add $0x8,%rsp
401030: c3 retq
0000000000401031 <phase_4>:
401031: 48 83 ec 18 sub $0x18,%rsp
401035: 64 48 8b 04 25 28 00 mov %fs:0x28,%rax
40103c: 00 00
40103e: 48 89 44 24 08 mov %rax,0x8(%rsp)
401043: 31 c0 xor %eax,%eax //%eax=0
401045: 48 8d 4c 24 04 lea 0x4(%rsp),%rcx
40104a: 48 89 e2 mov %rsp,%rdx
40104d: be 8f 25 40 00 mov $0x40258f,%esi //x/s 40258f "%d %d"
401052: e8 89 fb ff ff callq 400be0 <__isoc99_sscanf@plt>
401057: 83 f8 02 cmp $0x2,%eax
40105a: 75 06 jne 401062 <phase_4+0x31>// %eax!=2,boom,读入数字数量!=2
40105c: 83 3c 24 0e cmpl $0xe,(%rsp)
401060: 76 05 jbe 401067 <phase_4+0x36> //(%rsp)>e,boom
401062: e8 af 03 00 00 callq 401416 <explode_bomb>
401067: ba 0e 00 00 00 mov $0xe,%edx
40106c: be 00 00 00 00 mov $0x0,%esi//第二个数字是7，第一个数字是e范围内的
401071: 8b 3c 24 mov (%rsp),%edi //穷举吧，哈哈，我懒
401074: e8 7a ff ff ff callq 400ff3 <func4> //14 7，妈的从0开始穷举，累死了
401079: 83 f8 07 cmp $0x7,%eax //%eax!=7,boom
40107c: 75 07 jne 401085 <phase_4+0x54>
40107e: 83 7c 24 04 07 cmpl $0x7,0x4(%rsp)
401083: 74 05 je 40108a <phase_4+0x59> //(%rsp)+4!=7,boom
401085: e8 8c 03 00 00 callq 401416 <explode_bomb>
40108a: 48 8b 44 24 08 mov 0x8(%rsp),%rax
40108f: 64 48 33 04 25 28 00 xor %fs:0x28,%rax
401096: 00 00
401098: 74 05 je 40109f <phase_4+0x6e>
40109a: e8 81 fa ff ff callq 400b20 <__stack_chk_fail@plt>
40109f: 48 83 c4 18 add $0x18,%rsp
4010a3: c3 retq 看到代码这么短，还没有递归
是不是感觉很简单的感觉。。。。
你们啊。NAIVE
恶心，恶心，恶心
输入一个长度为6的字符串
然后要求以其ascii码值最后一位的为*4的数组下标的那个元素，加起来=一个值（我这是2d）
是不是拗口的一笔？？？
看下面的注释吧，要看数组元素 ，x/x 0x402440@16 。。好像是这个，，忘了
下面有个for循环，就是取字符串每一位
根据看到的数组里面元素，把字符串凑出来就好了
00000000004010a4 <phase_5>:
4010a4: 53 push %rbx
4010a5: 48 89 fb mov %rdi,%rbx
4010a8: e8 4c 02 00 00 callq 4012f9 <string_length>
4010ad: 83 f8 06 cmp $0x6,%eax
4010b0: 74 05 je 4010b7 <phase_5+0x13> //%eax=6=length
4010b2: e8 5f 03 00 00 callq 401416 <explode_bomb>
4010b7: 48 89 d8 mov %rbx,%rax
4010ba: 48 8d 7b 06 lea 0x6(%rbx),%rdi
4010be: b9 00 00 00 00 mov $0x0,%ecx
4010c3: 0f b6 10 movzbl (%rax),%edx //for
4010c6: 83 e2 0f and $0xf,%edx//字符的16进制最后一位，对应下面的数组中元素（16进制）
4010c9: 03 0c 95 40 24 40 00 add 0x402440(,%rdx,4),%ecx //array=2,a,6,1,c,10,9,3,4,7,e,5,b,8,f,d
4010d0: 48 83 c0 01 add $0x1,%rax
4010d4: 48 39 f8 cmp %rdi,%rax //rax=rdi break
4010d7: 75 ea jne 4010c3 <phase_5+0x1f> //endfor
4010d9: 83 f9 2d cmp $0x2d,%ecx //we need ecx=2d
4010dc: 74 05 je 4010e3 <phase_5+0x3f>
4010de: e8 33 03 00 00 callq 401416 <explode_bomb>
4010e3: 5b pop %rbx
4010e4: c3 retq 最后一步，，卧艹艹艹艹艹艹艹艹艹艹艹艹
怎么可以这么长！！！！！！
大体就是输入6个数，1到6范围，不重复
最后对应的数组元素递减（其实是链表辣，数组好理解一点是不是）
x/x 0x6032f0,,,数组就出来了
然后排序吧，
00000000004010e5 <phase_6>:
4010e5: 41 55 push %r13
4010e7: 41 54 push %r12
4010e9: 55 push %rbp
4010ea: 53 push %rbx
4010eb: 48 83 ec 68 sub $0x68,%rsp
4010ef: 64 48 8b 04 25 28 00 mov %fs:0x28,%rax
4010f6: 00 00
4010f8: 48 89 44 24 58 mov %rax,0x58(%rsp)
4010fd: 31 c0 xor %eax,%eax
4010ff: 48 89 e6 mov %rsp,%rsi
401102: e8 31 03 00 00 callq 401438 <read_six_numbers> //6 nums
401107: 49 89 e4 mov %rsp,%r12
40110a: 41 bd 00 00 00 00 mov $0x0,%r13d
401110: 4c 89 e5 mov %r12,%rbp
401113: 41 8b 04 24 mov (%r12),%eax
401117: 83 e8 01 sub $0x1,%eax
40111a: 83 f8 05 cmp $0x5,%eax
40111d: 76 05 jbe 401124 <phase_6+0x3f>
40111f: e8 f2 02 00 00 callq 401416 <explode_bomb> //num!=6,boom
401124: 41 83 c5 01 add $0x1,%r13d
401128: 41 83 fd 06 cmp $0x6,%r13d
40112c: 74 3d je 40116b <phase_6+0x86>
40112e: 44 89 eb mov %r13d,%ebx
401131: 48 63 c3 movslq %ebx,%rax
401134: 8b 04 84 mov (%rsp,%rax,4),%eax
401137: 39 45 00 cmp %eax,0x0(%rbp)
40113a: 75 05 jne 401141 <phase_6+0x5c>
40113c: e8 d5 02 00 00 callq 401416 <explode_bomb> //>6,boom
401141: 83 c3 01 add $0x1,%ebx
401144: 83 fb 05 cmp $0x5,%ebx
401147: 7e e8 jle 401131 <phase_6+0x4c>
401149: 49 83 c4 04 add $0x4,%r12
40114d: eb c1 jmp 401110 <phase_6+0x2b>
40114f: 48 8b 52 08 mov 0x8(%rdx),%rdx
401153: 83 c0 01 add $0x1,%eax
401156: 39 c8 cmp %ecx,%eax
401158: 75 f5 jne 40114f <phase_6+0x6a>
40115a: 48 89 54 74 20 mov %rdx,0x20(%rsp,%rsi,2)
40115f: 48 83 c6 04 add $0x4,%rsi
401163: 48 83 fe 18 cmp $0x18,%rsi
401167: 75 07 jne 401170 <phase_6+0x8b>
401169: eb 19 jmp 401184 <phase_6+0x9f>
40116b: be 00 00 00 00 mov $0x0,%esi
401170: 8b 0c 34 mov (%rsp,%rsi,1),%ecx
401173: b8 01 00 00 00 mov $0x1,%eax
401178: ba f0 32 60 00 mov $0x6032f0,%edx //array
40117d: 83 f9 01 cmp $0x1,%ecx
401180: 7f cd jg 40114f <phase_6+0x6a>
401182: eb d6 jmp 40115a <phase_6+0x75>
401184: 48 8b 5c 24 20 mov 0x20(%rsp),%rbx
401189: 48 8d 44 24 20 lea 0x20(%rsp),%rax
40118e: 48 8d 74 24 48 lea 0x48(%rsp),%rsi
401193: 48 89 d9 mov %rbx,%rcx
401196: 48 8b 50 08 mov 0x8(%rax),%rdx
40119a: 48 89 51 08 mov %rdx,0x8(%rcx)
40119e: 48 83 c0 08 add $0x8,%rax
4011a2: 48 89 d1 mov %rdx,%rcx
4011a5: 48 39 f0 cmp %rsi,%rax
4011a8: 75 ec jne 401196 <phase_6+0xb1>
4011aa: 48 c7 42 08 00 00 00 movq $0x0,0x8(%rdx)
4011b1: 00
4011b2: bd 05 00 00 00 mov $0x5,%ebp
4011b7: 48 8b 43 08 mov 0x8(%rbx),%rax
4011bb: 8b 00 mov (%rax),%eax
4011bd: 39 03 cmp %eax,(%rbx)
4011bf: 7e 05 jle 4011c6 <phase_6+0xe1>
4011c1: e8 50 02 00 00 callq 401416 <explode_bomb> //若递增，boom
4011c6: 48 8b 5b 08 mov 0x8(%rbx),%rbx
4011ca: 83 ed 01 sub $0x1,%ebp
4011cd: 75 e8 jne 4011b7 <phase_6+0xd2>
4011cf: 48 8b 44 24 58 mov 0x58(%rsp),%rax
4011d4: 64 48 33 04 25 28 00 xor %fs:0x28,%rax
4011db: 00 00
4011dd: 74 05 je 4011e4 <phase_6+0xff>
4011df: e8 3c f9 ff ff callq 以上是关于Boom！！！计算机系统，从理解到爆炸，Bomblab的主要内容，如果未能解决你的问题，请参考以下文章