1

是的,这是作业,不,我不是要你做我的作业。我需要关于这个二元炸弹第 3 阶段的帮助。第 1 阶段和第 2 阶段我没有遇到任何问题,但第 3 阶段对我来说太过分了。我知道应该有3个输入。我很确定其中一个是字符输入,其中两个是整数,但我不确定顺序是什么。首先,这是反汇编代码:

0x0000000000401163 <phase_3+0>: sub    $0x18,%rsp
0x0000000000401167 <phase_3+4>: lea    0xf(%rsp),%rcx
0x000000000040116c <phase_3+9>: lea    0x14(%rsp),%rdx
0x0000000000401171 <phase_3+14>:        lea    0x10(%rsp),%r8
0x0000000000401176 <phase_3+19>:        mov    $0x402650,%esi
0x000000000040117b <phase_3+24>:        mov    $0x0,%eax
0x0000000000401180 <phase_3+29>:        callq  0x400b80 <sscanf@plt>
0x0000000000401185 <phase_3+34>:        cmp    $0x2,%eax
0x0000000000401188 <phase_3+37>:        jg     0x40118f <phase_3+44>
0x000000000040118a <phase_3+39>:        callq  0x4014b1 <explode_bomb>
0x000000000040118f <phase_3+44>:        cmpl   $0x7,0x14(%rsp)
0x0000000000401194 <phase_3+49>:        ja     0x401294 <phase_3+305>
0x000000000040119a <phase_3+55>:        mov    0x14(%rsp),%eax
0x000000000040119e <phase_3+59>:        xchg   %ax,%ax
0x00000000004011a0 <phase_3+61>:        jmpq   *0x402660(,%rax,8)
0x00000000004011a7 <phase_3+68>:        cmpl   $0x2c4,0x10(%rsp)
0x00000000004011af <phase_3+76>:        nop
0x00000000004011b0 <phase_3+77>:        je     0x4012a2 <phase_3+319>
0x00000000004011b6 <phase_3+83>:        callq  0x4014b1 <explode_bomb>
0x00000000004011bb <phase_3+88>:        mov    $0x7a,%eax
0x00000000004011c0 <phase_3+93>:        jmpq   0x4012a7 <phase_3+324>
0x00000000004011c5 <phase_3+98>:        mov    $0x6a,%eax
---Type <return> to continue, or q <return> to quit---
0x00000000004011ca <phase_3+103>:       cmpl   $0x327,0x10(%rsp)
0x00000000004011d2 <phase_3+111>:       je     0x4012a7 <phase_3+324>
0x00000000004011d8 <phase_3+117>:       callq  0x4014b1 <explode_bomb>
0x00000000004011dd <phase_3+122>:       mov    $0x6a,%eax
0x00000000004011e2 <phase_3+127>:       jmpq   0x4012a7 <phase_3+324>
0x00000000004011e7 <phase_3+132>:       mov    $0x66,%eax
0x00000000004011ec <phase_3+137>:       cmpl   $0x136,0x10(%rsp)
0x00000000004011f4 <phase_3+145>:       je     0x4012a7 <phase_3+324>
0x00000000004011fa <phase_3+151>:       callq  0x4014b1 <explode_bomb>
0x00000000004011ff <phase_3+156>:       mov    $0x66,%eax
0x0000000000401204 <phase_3+161>:       jmpq   0x4012a7 <phase_3+324>
0x0000000000401209 <phase_3+166>:       mov    $0x75,%eax
0x000000000040120e <phase_3+171>:       cmpl   $0x252,0x10(%rsp)
0x0000000000401216 <phase_3+179>:       je     0x4012a7 <phase_3+324>
0x000000000040121c <phase_3+185>:       callq  0x4014b1 <explode_bomb>
0x0000000000401221 <phase_3+190>:       mov    $0x75,%eax
0x0000000000401226 <phase_3+195>:       jmpq   0x4012a7 <phase_3+324>
0x000000000040122b <phase_3+200>:       mov    $0x70,%eax
0x0000000000401230 <phase_3+205>:       cmpl   $0x240,0x10(%rsp)
0x0000000000401238 <phase_3+213>:       je     0x4012a7 <phase_3+324>
0x000000000040123a <phase_3+215>:       callq  0x4014b1 <explode_bomb>
0x000000000040123f <phase_3+220>:       mov    $0x70,%eax
0x0000000000401244 <phase_3+225>:       jmp    0x4012a7 <phase_3+324>
---Type <return> to continue, or q <return> to quit---
0x0000000000401246 <phase_3+227>:       cmpl   $0x269,0x10(%rsp)
0x000000000040124e <phase_3+235>:       xchg   %ax,%ax
0x0000000000401250 <phase_3+237>:       je     0x4012a2 <phase_3+319>
0x0000000000401252 <phase_3+239>:       callq  0x4014b1 <explode_bomb>
0x0000000000401257 <phase_3+244>:       mov    $0x7a,%eax
0x000000000040125c <phase_3+249>:       jmp    0x4012a7 <phase_3+324>
0x000000000040125e <phase_3+251>:       mov    $0x6b,%eax
0x0000000000401263 <phase_3+256>:       cmpl   $0x201,0x10(%rsp)
0x000000000040126b <phase_3+264>:       je     0x4012a7 <phase_3+324>
0x000000000040126d <phase_3+266>:       callq  0x4014b1 <explode_bomb>
0x0000000000401272 <phase_3+271>:       mov    $0x6b,%eax
0x0000000000401277 <phase_3+276>:       jmp    0x4012a7 <phase_3+324>
0x0000000000401279 <phase_3+278>:       mov    $0x74,%eax
0x000000000040127e <phase_3+283>:       cmpl   $0x358,0x10(%rsp)
0x0000000000401286 <phase_3+291>:       je     0x4012a7 <phase_3+324>
0x0000000000401288 <phase_3+293>:       callq  0x4014b1 <explode_bomb>
0x000000000040128d <phase_3+298>:       mov    $0x74,%eax
0x0000000000401292 <phase_3+303>:       jmp    0x4012a7 <phase_3+324>
0x0000000000401294 <phase_3+305>:       callq  0x4014b1 <explode_bomb>
0x0000000000401299 <phase_3+310>:       mov    $0x75,%eax
0x000000000040129e <phase_3+315>:       xchg   %ax,%ax
0x00000000004012a0 <phase_3+317>:       jmp    0x4012a7 <phase_3+324>
0x00000000004012a2 <phase_3+319>:       mov    $0x7a,%eax
---Type <return> to continue, or q <return> to quit---
0x00000000004012a7 <phase_3+324>:       cmp    0xf(%rsp),%al
0x00000000004012ab <phase_3+328>:       je     0x4012b2 <phase_3+335>
0x00000000004012ad <phase_3+330>:       callq  0x4014b1 <explode_bomb>
0x00000000004012b2 <phase_3+335>:       add    $0x18,%rsp
0x00000000004012b6 <phase_3+339>:       retq

我输入了 4 112 z 之类的东西,只是为了尝试一下并完成这些步骤。

代码运行到0x0000000000401230 <phase_3+205>: cmpl $0x240,0x10(%rsp)

我真正感到困惑的是 0x10(%rsp) 表示什么。我查看了存储在 rsp 中的十进制值,它是负数。似乎 4 的第一个输入运行良好,并且代码继续运行,但我想知道为什么它将 rsp 与 576 进行比较,以及它前面的 0x10 表示什么。任何形式的洞察力都会有所帮助。

4

2 回答 2

3

不是比较%rsp0x240。相反,它将存储在内存位置的任何内容与 进行比较%rsp + 0x100x240换句话说,它将一个常量与您在大多数语言中称为“局部变量”的内容进行比较。

于 2013-09-23T14:21:49.143 回答
2

关于 scanf 的注释...输入字符串通常在内存中的某个位置(例如“%d %d %c %s”)...回想一下,参数在调用函数之前被压入堆栈。如果您看到堆栈中某处放置了内存地址,请使用 x /s 0x.... 命令查看放置在那里的内容。在我的炸弹中,它是指令“mov 0x804a27d, 0x4(%esp)”,我使用 x /s 0x804a27d 来查看输入字符串。这不仅揭示了答案的顺序,还揭示了答案的数据类型。

于 2013-11-12T23:45:51.767 回答