19:I[15621,["/_next/static/immutable/chunks/3gm-8e62xn1qd.js","/_next/static/immutable/chunks/0n2yq6f-f75k2.js"],"ArticleReader"] 1a:T75a,

Dump of assembler code for function phase_2:
   0x0000000000400efc <+0>:     push   %rbp
   0x0000000000400efd <+1>:     push   %rbx
   0x0000000000400efe <+2>:     sub    $0x28,%rsp
   0x0000000000400f02 <+6>:     mov    %rsp,%rsi
   0x0000000000400f05 <+9>:     callq  0x40145c <read_six_numbers>
   0x0000000000400f0a <+14>:    cmpl   $0x1,(%rsp)
   0x0000000000400f0e <+18>:    je     0x400f30 <phase_2+52>
   0x0000000000400f10 <+20>:    callq  0x40143a <explode_bomb>
   0x0000000000400f15 <+25>:    jmp    0x400f30 <phase_2+52>
   0x0000000000400f17 <+27>:    mov    -0x4(%rbx),%eax
   0x0000000000400f1a <+30>:    add    %eax,%eax
   0x0000000000400f1c <+32>:    cmp    %eax,(%rbx)
   0x0000000000400f1e <+34>:    je     0x400f25 <phase_2+41>
   0x0000000000400f20 <+36>:    callq  0x40143a <explode_bomb>
   0x0000000000400f25 <+41>:    add    $0x4,%rbx
   0x0000000000400f29 <+45>:    cmp    %rbp,%rbx
   0x0000000000400f2c <+48>:    jne    0x400f17 <phase_2+27>
   0x0000000000400f2e <+50>:    jmp    0x400f3c <phase_2+64>
   0x0000000000400f30 <+52>:    lea    0x4(%rsp),%rbx
   0x0000000000400f35 <+57>:    lea    0x18(%rsp),%rbp
   0x0000000000400f3a <+62>:    jmp    0x400f17 <phase_2+27>
   0x0000000000400f3c <+64>:    add    $0x28,%rsp
   0x0000000000400f40 <+68>:    pop    %rbx
   0x0000000000400f41 <+69>:    pop    %rbp
   0x0000000000400f42 <+70>:    retq   
End of assembler dump.

1b:T4ca,123456789101112131415161718192021222324252627Dump of assembler code for function phase_2: 0x0000000000400efc <+0>: push %rbp 0x0000000000400efd <+1>: push %rbx 0x0000000000400efe <+2>: sub $0x28,%rsp 0x0000000000400f02 <+6>: mov %rsp,%rsi 0x0000000000400f05 <+9>: callq 0x40145c 0x0000000000400f0a <+14>: cmpl $0x1,(%rsp) 0x0000000000400f0e <+18>: je 0x400f30 0x0000000000400f10 <+20>: callq 0x40143a 0x0000000000400f15 <+25>: jmp 0x400f30 0x0000000000400f17 <+27>: mov -0x4(%rbx),%eax 0x0000000000400f1a <+30>: add %eax,%eax 0x0000000000400f1c <+32>: cmp %eax,(%rbx) 0x0000000000400f1e <+34>: je 0x400f25 0x0000000000400f20 <+36>: callq 0x40143a 0x0000000000400f25 <+41>: add $0x4,%rbx 0x0000000000400f29 <+45>: cmp %rbp,%rbx 0x0000000000400f2c <+48>: jne 0x400f17 0x0000000000400f2e <+50>: jmp 0x400f3c 0x0000000000400f30 <+52>: lea 0x4(%rsp),%rbx 0x0000000000400f35 <+57>: lea 0x18(%rsp),%rbp 0x0000000000400f3a <+62>: jmp 0x400f17 0x0000000000400f3c <+64>: add $0x28,%rsp 0x0000000000400f40 <+68>: pop %rbx 0x0000000000400f41 <+69>: pop %rbp 0x0000000000400f42 <+70>: retq End of assembler dump.1c:T525,

Dump of assembler code for function read_six_numbers:
   0x000000000040145c <+0>:     sub    $0x18,%rsp
   0x0000000000401460 <+4>:     mov    %rsi,%rdx
   0x0000000000401463 <+7>:     lea    0x4(%rsi),%rcx
   0x0000000000401467 <+11>:    lea    0x14(%rsi),%rax
   0x000000000040146b <+15>:    mov    %rax,0x8(%rsp)
   0x0000000000401470 <+20>:    lea    0x10(%rsi),%rax
   0x0000000000401474 <+24>:    mov    %rax,(%rsp)
   0x0000000000401478 <+28>:    lea    0xc(%rsi),%r9
   0x000000000040147c <+32>:    lea    0x8(%rsi),%r8
   0x0000000000401480 <+36>:    mov    $0x4025c3,%esi
   0x0000000000401485 <+41>:    mov    $0x0,%eax
   0x000000000040148a <+46>:    callq  0x400bf0 <__isoc99_sscanf@plt>
   0x000000000040148f <+51>:    cmp    $0x5,%eax
   0x0000000000401492 <+54>:    jg     0x401499 <read_six_numbers+61>
   0x0000000000401494 <+56>:    callq  0x40143a <explode_bomb>
   0x0000000000401499 <+61>:    add    $0x18,%rsp
   0x000000000040149d <+65>:    retq   
End of assembler dump.

1d:Taa9,

Dump of assembler code for function phase_3:
   0x0000000000400f43 <+0>:     sub    $0x18,%rsp
   0x0000000000400f47 <+4>:     lea    0xc(%rsp),%rcx
   0x0000000000400f4c <+9>:     lea    0x8(%rsp),%rdx
   0x0000000000400f51 <+14>:    mov    $0x4025cf,%esi
   0x0000000000400f56 <+19>:    mov    $0x0,%eax
   0x0000000000400f5b <+24>:    callq  0x400bf0 <__isoc99_sscanf@plt>
   0x0000000000400f60 <+29>:    cmp    $0x1,%eax
   0x0000000000400f63 <+32>:    jg     0x400f6a <phase_3+39>
   0x0000000000400f65 <+34>:    callq  0x40143a <explode_bomb>
   0x0000000000400f6a <+39>:    cmpl   $0x7,0x8(%rsp)
   0x0000000000400f6f <+44>:    ja     0x400fad <phase_3+106>
   0x0000000000400f71 <+46>:    mov    0x8(%rsp),%eax
   0x0000000000400f75 <+50>:    jmpq   *0x402470(,%rax,8)
   0x0000000000400f7c <+57>:    mov    $0xcf,%eax
   0x0000000000400f81 <+62>:    jmp    0x400fbe <phase_3+123>
   0x0000000000400f83 <+64>:    mov    $0x2c3,%eax
   0x0000000000400f88 <+69>:    jmp    0x400fbe <phase_3+123>
   0x0000000000400f8a <+71>:    mov    $0x100,%eax
   0x0000000000400f8f <+76>:    jmp    0x400fbe <phase_3+123>
   0x0000000000400f91 <+78>:    mov    $0x185,%eax
   0x0000000000400f96 <+83>:    jmp    0x400fbe <phase_3+123>
   0x0000000000400f98 <+85>:    mov    $0xce,%eax
   0x0000000000400f9d <+90>:    jmp    0x400fbe <phase_3+123>
   0x0000000000400f9f <+92>:    mov    $0x2aa,%eax
   0x0000000000400fa4 <+97>:    jmp    0x400fbe <phase_3+123>
   0x0000000000400fa6 <+99>:    mov    $0x147,%eax
   0x0000000000400fab <+104>:   jmp    0x400fbe <phase_3+123>
   0x0000000000400fad <+106>:   callq  0x40143a <explode_bomb>
   0x0000000000400fb2 <+111>:   mov    $0x0,%eax
   0x0000000000400fb7 <+116>:   jmp    0x400fbe <phase_3+123>
   0x0000000000400fb9 <+118>:   mov    $0x137,%eax
   0x0000000000400fbe <+123>:   cmp    0xc(%rsp),%eax
   0x0000000000400fc2 <+127>:   je     0x400fc9 <phase_3+134>
   0x0000000000400fc4 <+129>:   callq  0x40143a <explode_bomb>
   0x0000000000400fc9 <+134>:   add    $0x18,%rsp
   0x0000000000400fcd <+138>:   retq

1e:T716,12345678910111213141516171819202122232425262728293031323334353637Dump of assembler code for function phase_3: 0x0000000000400f43 <+0>: sub $0x18,%rsp 0x0000000000400f47 <+4>: lea 0xc(%rsp),%rcx 0x0000000000400f4c <+9>: lea 0x8(%rsp),%rdx 0x0000000000400f51 <+14>: mov $0x4025cf,%esi 0x0000000000400f56 <+19>: mov $0x0,%eax 0x0000000000400f5b <+24>: callq 0x400bf0 <__isoc99_sscanf@plt> 0x0000000000400f60 <+29>: cmp $0x1,%eax 0x0000000000400f63 <+32>: jg 0x400f6a 0x0000000000400f65 <+34>: callq 0x40143a 0x0000000000400f6a <+39>: cmpl $0x7,0x8(%rsp) 0x0000000000400f6f <+44>: ja 0x400fad 0x0000000000400f71 <+46>: mov 0x8(%rsp),%eax 0x0000000000400f75 <+50>: jmpq *0x402470(,%rax,8) 0x0000000000400f7c <+57>: mov $0xcf,%eax 0x0000000000400f81 <+62>: jmp 0x400fbe 0x0000000000400f83 <+64>: mov $0x2c3,%eax 0x0000000000400f88 <+69>: jmp 0x400fbe 0x0000000000400f8a <+71>: mov $0x100,%eax 0x0000000000400f8f <+76>: jmp 0x400fbe 0x0000000000400f91 <+78>: mov $0x185,%eax 0x0000000000400f96 <+83>: jmp 0x400fbe 0x0000000000400f98 <+85>: mov $0xce,%eax 0x0000000000400f9d <+90>: jmp 0x400fbe 0x0000000000400f9f <+92>: mov $0x2aa,%eax 0x0000000000400fa4 <+97>: jmp 0x400fbe 0x0000000000400fa6 <+99>: mov $0x147,%eax 0x0000000000400fab <+104>: jmp 0x400fbe 0x0000000000400fad <+106>: callq 0x40143a 0x0000000000400fb2 <+111>: mov $0x0,%eax 0x0000000000400fb7 <+116>: jmp 0x400fbe 0x0000000000400fb9 <+118>: mov $0x137,%eax 0x0000000000400fbe <+123>: cmp 0xc(%rsp),%eax 0x0000000000400fc2 <+127>: je 0x400fc9 0x0000000000400fc4 <+129>: callq 0x40143a 0x0000000000400fc9 <+134>: add $0x18,%rsp 0x0000000000400fcd <+138>: retq1f:T6a3,

Dump of assembler code for function phase_4:
   0x000000000040100c <+0>:     sub    $0x18,%rsp
   0x0000000000401010 <+4>:     lea    0xc(%rsp),%rcx
   0x0000000000401015 <+9>:     lea    0x8(%rsp),%rdx
   0x000000000040101a <+14>:    mov    $0x4025cf,%esi
   0x000000000040101f <+19>:    mov    $0x0,%eax
   0x0000000000401024 <+24>:    callq  0x400bf0 <__isoc99_sscanf@plt>
   0x0000000000401029 <+29>:    cmp    $0x2,%eax
   0x000000000040102c <+32>:    jne    0x401035 <phase_4+41>
   0x000000000040102e <+34>:    cmpl   $0xe,0x8(%rsp)
   0x0000000000401033 <+39>:    jbe    0x40103a <phase_4+46>
   0x0000000000401035 <+41>:    callq  0x40143a <explode_bomb>
   0x000000000040103a <+46>:    mov    $0xe,%edx
   0x000000000040103f <+51>:    mov    $0x0,%esi
   0x0000000000401044 <+56>:    mov    0x8(%rsp),%edi
   0x0000000000401048 <+60>:    callq  0x400fce <func4>
   0x000000000040104d <+65>:    test   %eax,%eax
   0x000000000040104f <+67>:    jne    0x401058 <phase_4+76>
   0x0000000000401051 <+69>:    cmpl   $0x0,0xc(%rsp)
   0x0000000000401056 <+74>:    je     0x40105d <phase_4+81>
   0x0000000000401058 <+76>:    callq  0x40143a <explode_bomb>
   0x000000000040105d <+81>:    add    $0x18,%rsp
   0x0000000000401061 <+85>:    retq   
End of assembler dump.

20:T460,123456789101112131415161718192021222324Dump of assembler code for function phase_4: 0x000000000040100c <+0>: sub $0x18,%rsp 0x0000000000401010 <+4>: lea 0xc(%rsp),%rcx 0x0000000000401015 <+9>: lea 0x8(%rsp),%rdx 0x000000000040101a <+14>: mov $0x4025cf,%esi 0x000000000040101f <+19>: mov $0x0,%eax 0x0000000000401024 <+24>: callq 0x400bf0 <__isoc99_sscanf@plt> 0x0000000000401029 <+29>: cmp $0x2,%eax 0x000000000040102c <+32>: jne 0x401035 0x000000000040102e <+34>: cmpl $0xe,0x8(%rsp) 0x0000000000401033 <+39>: jbe 0x40103a 0x0000000000401035 <+41>: callq 0x40143a 0x000000000040103a <+46>: mov $0xe,%edx 0x000000000040103f <+51>: mov $0x0,%esi 0x0000000000401044 <+56>: mov 0x8(%rsp),%edi 0x0000000000401048 <+60>: callq 0x400fce 0x000000000040104d <+65>: test %eax,%eax 0x000000000040104f <+67>: jne 0x401058 0x0000000000401051 <+69>: cmpl $0x0,0xc(%rsp) 0x0000000000401056 <+74>: je 0x40105d 0x0000000000401058 <+76>: callq 0x40143a 0x000000000040105d <+81>: add $0x18,%rsp 0x0000000000401061 <+85>: retq End of assembler dump.21:T64f,

Dump of assembler code for function func4:
   0x0000000000400fce <+0>:     sub    $0x8,%rsp
   0x0000000000400fd2 <+4>:     mov    %edx,%eax
   0x0000000000400fd4 <+6>:     sub    %esi,%eax
   0x0000000000400fd6 <+8>:     mov    %eax,%ecx
   0x0000000000400fd8 <+10>:    shr    $0x1f,%ecx
   0x0000000000400fdb <+13>:    add    %ecx,%eax
   0x0000000000400fdd <+15>:    sar    %eax
   0x0000000000400fdf <+17>:    lea    (%rax,%rsi,1),%ecx
   0x0000000000400fe2 <+20>:    cmp    %edi,%ecx
   0x0000000000400fe4 <+22>:    jle    0x400ff2 <func4+36>
   0x0000000000400fe6 <+24>:    lea    -0x1(%rcx),%edx
   0x0000000000400fe9 <+27>:    callq  0x400fce <func4>
   0x0000000000400fee <+32>:    add    %eax,%eax
   0x0000000000400ff0 <+34>:    jmp    0x401007 <func4+57>
   0x0000000000400ff2 <+36>:    mov    $0x0,%eax
   0x0000000000400ff7 <+41>:    cmp    %edi,%ecx
   0x0000000000400ff9 <+43>:    jge    0x401007 <func4+57>
   0x0000000000400ffb <+45>:    lea    0x1(%rcx),%esi
   0x0000000000400ffe <+48>:    callq  0x400fce <func4>
   0x0000000000401003 <+53>:    lea    0x1(%rax,%rax,1),%eax
   0x0000000000401007 <+57>:    add    $0x8,%rsp
   0x000000000040100b <+61>:    retq   
End of assembler dump.

22:T417,123456789101112131415161718192021222324Dump of assembler code for function func4: 0x0000000000400fce <+0>: sub $0x8,%rsp 0x0000000000400fd2 <+4>: mov %edx,%eax 0x0000000000400fd4 <+6>: sub %esi,%eax 0x0000000000400fd6 <+8>: mov %eax,%ecx 0x0000000000400fd8 <+10>: shr $0x1f,%ecx 0x0000000000400fdb <+13>: add %ecx,%eax 0x0000000000400fdd <+15>: sar %eax 0x0000000000400fdf <+17>: lea (%rax,%rsi,1),%ecx 0x0000000000400fe2 <+20>: cmp %edi,%ecx 0x0000000000400fe4 <+22>: jle 0x400ff2 0x0000000000400fe6 <+24>: lea -0x1(%rcx),%edx 0x0000000000400fe9 <+27>: callq 0x400fce 0x0000000000400fee <+32>: add %eax,%eax 0x0000000000400ff0 <+34>: jmp 0x401007 0x0000000000400ff2 <+36>: mov $0x0,%eax 0x0000000000400ff7 <+41>: cmp %edi,%ecx 0x0000000000400ff9 <+43>: jge 0x401007 0x0000000000400ffb <+45>: lea 0x1(%rcx),%esi 0x0000000000400ffe <+48>: callq 0x400fce 0x0000000000401003 <+53>: lea 0x1(%rax,%rax,1),%eax 0x0000000000401007 <+57>: add $0x8,%rsp 0x000000000040100b <+61>: retq End of assembler dump.23:Tb26,

Dump of assembler code for function phase_5:
   0x0000000000401062 <+0>:     push   %rbx
   0x0000000000401063 <+1>:     sub    $0x20,%rsp
   0x0000000000401067 <+5>:     mov    %rdi,%rbx
   0x000000000040106a <+8>:     mov    %fs:0x28,%rax
   0x0000000000401073 <+17>:    mov    %rax,0x18(%rsp)
   0x0000000000401078 <+22>:    xor    %eax,%eax
   0x000000000040107a <+24>:    callq  0x40131b <string_length>
   0x000000000040107f <+29>:    cmp    $0x6,%eax
   0x0000000000401082 <+32>:    je     0x4010d2 <phase_5+112>
   0x0000000000401084 <+34>:    callq  0x40143a <explode_bomb>
   0x0000000000401089 <+39>:    jmp    0x4010d2 <phase_5+112>
   0x000000000040108b <+41>:    movzbl (%rbx,%rax,1),%ecx
   0x000000000040108f <+45>:    mov    %cl,(%rsp)
   0x0000000000401092 <+48>:    mov    (%rsp),%rdx
   0x0000000000401096 <+52>:    and    $0xf,%edx
   0x0000000000401099 <+55>:    movzbl 0x4024b0(%rdx),%edx
   0x00000000004010a0 <+62>:    mov    %dl,0x10(%rsp,%rax,1)
   0x00000000004010a4 <+66>:    add    $0x1,%rax
   0x00000000004010a8 <+70>:    cmp    $0x6,%rax
   0x00000000004010ac <+74>:    jne    0x40108b <phase_5+41>
   0x00000000004010ae <+76>:    movb   $0x0,0x16(%rsp)
   0x00000000004010b3 <+81>:    mov    $0x40245e,%esi
   0x00000000004010b8 <+86>:    lea    0x10(%rsp),%rdi
   0x00000000004010bd <+91>:    callq  0x401338 <strings_not_equal>
   0x00000000004010c2 <+96>:    test   %eax,%eax
   0x00000000004010c4 <+98>:    je     0x4010d9 <phase_5+119>
   0x00000000004010c6 <+100>:   callq  0x40143a <explode_bomb>
   0x00000000004010cb <+105>:   nopl   0x0(%rax,%rax,1)
   0x00000000004010d0 <+110>:   jmp    0x4010d9 <phase_5+119>
   0x00000000004010d2 <+112>:   mov    $0x0,%eax
   0x00000000004010d7 <+117>:   jmp    0x40108b <phase_5+41>
   0x00000000004010d9 <+119>:   mov    0x18(%rsp),%rax
   0x00000000004010de <+124>:   xor    %fs:0x28,%rax
   0x00000000004010e7 <+133>:   je     0x4010ee <phase_5+140>
   0x00000000004010e9 <+135>:   callq  0x400b30 <__stack_chk_fail@plt>
   0x00000000004010ee <+140>:   add    $0x20,%rsp
   0x00000000004010f2 <+144>:   pop    %rbx
   0x00000000004010f3 <+145>:   retq   
End of assembler dump.

24:T77d,12345678910111213141516171819202122232425262728293031323334353637383940Dump of assembler code for function phase_5: 0x0000000000401062 <+0>: push %rbx 0x0000000000401063 <+1>: sub $0x20,%rsp 0x0000000000401067 <+5>: mov %rdi,%rbx 0x000000000040106a <+8>: mov %fs:0x28,%rax 0x0000000000401073 <+17>: mov %rax,0x18(%rsp) 0x0000000000401078 <+22>: xor %eax,%eax 0x000000000040107a <+24>: callq 0x40131b 0x000000000040107f <+29>: cmp $0x6,%eax 0x0000000000401082 <+32>: je 0x4010d2 0x0000000000401084 <+34>: callq 0x40143a 0x0000000000401089 <+39>: jmp 0x4010d2 0x000000000040108b <+41>: movzbl (%rbx,%rax,1),%ecx 0x000000000040108f <+45>: mov %cl,(%rsp) 0x0000000000401092 <+48>: mov (%rsp),%rdx 0x0000000000401096 <+52>: and $0xf,%edx 0x0000000000401099 <+55>: movzbl 0x4024b0(%rdx),%edx 0x00000000004010a0 <+62>: mov %dl,0x10(%rsp,%rax,1) 0x00000000004010a4 <+66>: add $0x1,%rax 0x00000000004010a8 <+70>: cmp $0x6,%rax 0x00000000004010ac <+74>: jne 0x40108b 0x00000000004010ae <+76>: movb $0x0,0x16(%rsp) 0x00000000004010b3 <+81>: mov $0x40245e,%esi 0x00000000004010b8 <+86>: lea 0x10(%rsp),%rdi 0x00000000004010bd <+91>: callq 0x401338 0x00000000004010c2 <+96>: test %eax,%eax 0x00000000004010c4 <+98>: je 0x4010d9 0x00000000004010c6 <+100>: callq 0x40143a 0x00000000004010cb <+105>: nopl 0x0(%rax,%rax,1) 0x00000000004010d0 <+110>: jmp 0x4010d9 0x00000000004010d2 <+112>: mov $0x0,%eax 0x00000000004010d7 <+117>: jmp 0x40108b 0x00000000004010d9 <+119>: mov 0x18(%rsp),%rax 0x00000000004010de <+124>: xor %fs:0x28,%rax 0x00000000004010e7 <+133>: je 0x4010ee 0x00000000004010e9 <+135>: callq 0x400b30 <__stack_chk_fail@plt> 0x00000000004010ee <+140>: add $0x20,%rsp 0x00000000004010f2 <+144>: pop %rbx 0x00000000004010f3 <+145>: retq End of assembler dump.25:T492,

0x00000000004010ae <+76>:    movb   $0x0,0x16(%rsp)
0x00000000004010b3 <+81>:    mov    $0x40245e,%esi
0x00000000004010b8 <+86>:    lea    0x10(%rsp),%rdi
0x00000000004010bd <+91>:    callq  0x401338 <strings_not_equal>
0x00000000004010c2 <+96>:    test   %eax,%eax
0x00000000004010c4 <+98>:    je     0x4010d9 <phase_5+119>
0x00000000004010c6 <+100>:   callq  0x40143a <explode_bomb>
0x00000000004010cb <+105>:   nopl   0x0(%rax,%rax,1)
0x00000000004010d0 <+110>:   jmp    0x4010d9 <phase_5+119>
...
0x00000000004010d9 <+119>:   mov    0x18(%rsp),%rax
0x00000000004010de <+124>:   xor    %fs:0x28,%rax
0x00000000004010e7 <+133>:   je     0x4010ee <phase_5+140>
0x00000000004010e9 <+135>:   callq  0x400b30 <__stack_chk_fail@plt>
0x00000000004010ee <+140>:   add    $0x20,%rsp
0x00000000004010f2 <+144>:   pop    %rbx
0x00000000004010f3 <+145>:   retq

26:T1655,

0x00000000004010f4 <+0>:     push   %r14
0x00000000004010f6 <+2>:     push   %r13
0x00000000004010f8 <+4>:     push   %r12
0x00000000004010fa <+6>:     push   %rbp
0x00000000004010fb <+7>:     push   %rbx
0x00000000004010fc <+8>:     sub    $0x50,%rsp
0x0000000000401100 <+12>:    mov    %rsp,%r13
0x0000000000401103 <+15>:    mov    %rsp,%rsi
0x0000000000401106 <+18>:    callq  0x40145c <read_six_numbers>
0x000000000040110b <+23>:    mov    %rsp,%r14
0x000000000040110e <+26>:    mov    $0x0,%r12d
0x0000000000401114 <+32>:    mov    %r13,%rbp
0x0000000000401117 <+35>:    mov    0x0(%r13),%eax
0x000000000040111b <+39>:    sub    $0x1,%eax
0x000000000040111e <+42>:    cmp    $0x5,%eax
0x0000000000401121 <+45>:    jbe    0x401128 <phase_6+52>
0x0000000000401123 <+47>:    callq  0x40143a <explode_bomb>
0x0000000000401128 <+52>:    add    $0x1,%r12d
0x000000000040112c <+56>:    cmp    $0x6,%r12d
0x0000000000401130 <+60>:    je     0x401153 <phase_6+95>
0x0000000000401132 <+62>:    mov    %r12d,%ebx
0x0000000000401135 <+65>:    movslq %ebx,%rax
0x0000000000401138 <+68>:    mov    (%rsp,%rax,4),%eax
0x000000000040113b <+71>:    cmp    %eax,0x0(%rbp)
0x000000000040113e <+74>:    jne    0x401145 <phase_6+81>
0x0000000000401140 <+76>:    callq  0x40143a <explode_bomb>
0x0000000000401145 <+81>:    add    $0x1,%ebx
0x0000000000401148 <+84>:    cmp    $0x5,%ebx
0x000000000040114b <+87>:    jle    0x401135 <phase_6+65>
0x000000000040114d <+89>:    add    $0x4,%r13
0x0000000000401151 <+93>:    jmp    0x401114 <phase_6+32>
0x0000000000401153 <+95>:    lea    0x18(%rsp),%rsi
0x0000000000401158 <+100>:   mov    %r14,%rax
0x000000000040115b <+103>:   mov    $0x7,%ecx
0x0000000000401160 <+108>:   mov    %ecx,%edx
0x0000000000401162 <+110>:   sub    (%rax),%edx
0x0000000000401164 <+112>:   mov    %edx,(%rax)
0x0000000000401166 <+114>:   add    $0x4,%rax
0x000000000040116a <+118>:   cmp    %rsi,%rax
0x000000000040116d <+121>:   jne    0x401160 <phase_6+108>
0x000000000040116f <+123>:   mov    $0x0,%esi
0x0000000000401174 <+128>:   jmp    0x401197 <phase_6+163>
0x0000000000401176 <+130>:   mov    0x8(%rdx),%rdx
0x000000000040117a <+134>:   add    $0x1,%eax
0x000000000040117d <+137>:   cmp    %ecx,%eax
0x000000000040117f <+139>:   jne    0x401176 <phase_6+130>
0x0000000000401181 <+141>:   jmp    0x401188 <phase_6+148>
0x0000000000401183 <+143>:   mov    $0x6032d0,%edx
0x0000000000401188 <+148>:   mov    %rdx,0x20(%rsp,%rsi,2)
0x000000000040118d <+153>:   add    $0x4,%rsi
0x0000000000401191 <+157>:   cmp    $0x18,%rsi
0x0000000000401195 <+161>:   je     0x4011ab <phase_6+183>
0x0000000000401197 <+163>:   mov    (%rsp,%rsi,1),%ecx
0x000000000040119a <+166>:   cmp    $0x1,%ecx
0x000000000040119d <+169>:   jle    0x401183 <phase_6+143>
0x000000000040119f <+171>:   mov    $0x1,%eax
0x00000000004011a4 <+176>:   mov    $0x6032d0,%edx
0x00000000004011a9 <+181>:   jmp    0x401176 <phase_6+130>
0x00000000004011ab <+183>:   mov    0x20(%rsp),%rbx
0x00000000004011b0 <+188>:   lea    0x28(%rsp),%rax
0x00000000004011b5 <+193>:   lea    0x50(%rsp),%rsi
0x00000000004011ba <+198>:   mov    %rbx,%rcx
0x00000000004011bd <+201>:   mov    (%rax),%rdx
0x00000000004011c0 <+204>:   mov    %rdx,0x8(%rcx)
0x00000000004011c4 <+208>:   add    $0x8,%rax
0x00000000004011c8 <+212>:   cmp    %rsi,%rax
0x00000000004011cb <+215>:   je     0x4011d2 <phase_6+222>
0x00000000004011cd <+217>:   mov    %rdx,%rcx
0x00000000004011d0 <+220>:   jmp    0x4011bd <phase_6+201>
0x00000000004011d2 <+222>:   movq   $0x0,0x8(%rdx)
0x00000000004011da <+230>:   mov    $0x5,%ebp
0x00000000004011df <+235>:   mov    0x8(%rbx),%rax
0x00000000004011e3 <+239>:   mov    (%rax),%eax
0x00000000004011e5 <+241>:   cmp    %eax,(%rbx)
0x00000000004011e7 <+243>:   jge    0x4011ee <phase_6+250>
0x00000000004011e9 <+245>:   callq  0x40143a <explode_bomb>
0x00000000004011ee <+250>:   mov    0x8(%rbx),%rbx
0x00000000004011f2 <+254>:   sub    $0x1,%ebp
0x00000000004011f5 <+257>:   jne    0x4011df <phase_6+235>
0x00000000004011f7 <+259>:   add    $0x50,%rsp
0x00000000004011fb <+263>:   pop    %rbx
0x00000000004011fc <+264>:   pop    %rbp
0x00000000004011fd <+265>:   pop    %r12
0x00000000004011ff <+267>:   pop    %r13
0x0000000000401201 <+269>:   pop    %r14
0x0000000000401203 <+271>:   retq

27:Tf3c,12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485860x00000000004010f4 <+0>: push %r140x00000000004010f6 <+2>: push %r130x00000000004010f8 <+4>: push %r120x00000000004010fa <+6>: push %rbp0x00000000004010fb <+7>: push %rbx0x00000000004010fc <+8>: sub $0x50,%rsp0x0000000000401100 <+12>: mov %rsp,%r130x0000000000401103 <+15>: mov %rsp,%rsi0x0000000000401106 <+18>: callq 0x40145c 0x000000000040110b <+23>: mov %rsp,%r140x000000000040110e <+26>: mov $0x0,%r12d0x0000000000401114 <+32>: mov %r13,%rbp0x0000000000401117 <+35>: mov 0x0(%r13),%eax0x000000000040111b <+39>: sub $0x1,%eax0x000000000040111e <+42>: cmp $0x5,%eax0x0000000000401121 <+45>: jbe 0x401128 0x0000000000401123 <+47>: callq 0x40143a 0x0000000000401128 <+52>: add $0x1,%r12d0x000000000040112c <+56>: cmp $0x6,%r12d0x0000000000401130 <+60>: je 0x401153 0x0000000000401132 <+62>: mov %r12d,%ebx0x0000000000401135 <+65>: movslq %ebx,%rax0x0000000000401138 <+68>: mov (%rsp,%rax,4),%eax0x000000000040113b <+71>: cmp %eax,0x0(%rbp)0x000000000040113e <+74>: jne 0x401145 0x0000000000401140 <+76>: callq 0x40143a 0x0000000000401145 <+81>: add $0x1,%ebx0x0000000000401148 <+84>: cmp $0x5,%ebx0x000000000040114b <+87>: jle 0x401135 0x000000000040114d <+89>: add $0x4,%r130x0000000000401151 <+93>: jmp 0x401114 0x0000000000401153 <+95>: lea 0x18(%rsp),%rsi0x0000000000401158 <+100>: mov %r14,%rax0x000000000040115b <+103>: mov $0x7,%ecx0x0000000000401160 <+108>: mov %ecx,%edx0x0000000000401162 <+110>: sub (%rax),%edx0x0000000000401164 <+112>: mov %edx,(%rax)0x0000000000401166 <+114>: add $0x4,%rax0x000000000040116a <+118>: cmp %rsi,%rax0x000000000040116d <+121>: jne 0x401160 0x000000000040116f <+123>: mov $0x0,%esi0x0000000000401174 <+128>: jmp 0x401197 0x0000000000401176 <+130>: mov 0x8(%rdx),%rdx0x000000000040117a <+134>: add $0x1,%eax0x000000000040117d <+137>: cmp %ecx,%eax0x000000000040117f <+139>: jne 0x401176 0x0000000000401181 <+141>: jmp 0x401188 0x0000000000401183 <+143>: mov $0x6032d0,%edx0x0000000000401188 <+148>: mov %rdx,0x20(%rsp,%rsi,2)0x000000000040118d <+153>: add $0x4,%rsi0x0000000000401191 <+157>: cmp $0x18,%rsi0x0000000000401195 <+161>: je 0x4011ab 0x0000000000401197 <+163>: mov (%rsp,%rsi,1),%ecx0x000000000040119a <+166>: cmp $0x1,%ecx0x000000000040119d <+169>: jle 0x401183 0x000000000040119f <+171>: mov $0x1,%eax0x00000000004011a4 <+176>: mov $0x6032d0,%edx0x00000000004011a9 <+181>: jmp 0x401176 0x00000000004011ab <+183>: mov 0x20(%rsp),%rbx0x00000000004011b0 <+188>: lea 0x28(%rsp),%rax0x00000000004011b5 <+193>: lea 0x50(%rsp),%rsi0x00000000004011ba <+198>: mov %rbx,%rcx0x00000000004011bd <+201>: mov (%rax),%rdx0x00000000004011c0 <+204>: mov %rdx,0x8(%rcx)0x00000000004011c4 <+208>: add $0x8,%rax0x00000000004011c8 <+212>: cmp %rsi,%rax0x00000000004011cb <+215>: je 0x4011d2 0x00000000004011cd <+217>: mov %rdx,%rcx0x00000000004011d0 <+220>: jmp 0x4011bd 0x00000000004011d2 <+222>: movq $0x0,0x8(%rdx)0x00000000004011da <+230>: mov $0x5,%ebp0x00000000004011df <+235>: mov 0x8(%rbx),%rax0x00000000004011e3 <+239>: mov (%rax),%eax0x00000000004011e5 <+241>: cmp %eax,(%rbx)0x00000000004011e7 <+243>: jge 0x4011ee 0x00000000004011e9 <+245>: callq 0x40143a 0x00000000004011ee <+250>: mov 0x8(%rbx),%rbx0x00000000004011f2 <+254>: sub $0x1,%ebp0x00000000004011f5 <+257>: jne 0x4011df 0x00000000004011f7 <+259>: add $0x50,%rsp0x00000000004011fb <+263>: pop %rbx0x00000000004011fc <+264>: pop %rbp0x00000000004011fd <+265>: pop %r120x00000000004011ff <+267>: pop %r130x0000000000401201 <+269>: pop %r140x0000000000401203 <+271>: retq28:T5f5,

0x000000000040110b <+23>:    mov    %rsp,%r14
0x000000000040110e <+26>:    mov    $0x0,%r12d
0x0000000000401114 <+32>:    mov    %r13,%rbp
0x0000000000401117 <+35>:    mov    0x0(%r13),%eax
0x000000000040111b <+39>:    sub    $0x1,%eax
0x000000000040111e <+42>:    cmp    $0x5,%eax
0x0000000000401121 <+45>:    jbe    0x401128 <phase_6+52>
0x0000000000401123 <+47>:    callq  0x40143a <explode_bomb>
0x0000000000401128 <+52>:    add    $0x1,%r12d
0x000000000040112c <+56>:    cmp    $0x6,%r12d
0x0000000000401130 <+60>:    je     0x401153 <phase_6+95>
0x0000000000401132 <+62>:    mov    %r12d,%ebx
0x0000000000401135 <+65>:    movslq %ebx,%rax
0x0000000000401138 <+68>:    mov    (%rsp,%rax,4),%eax
0x000000000040113b <+71>:    cmp    %eax,0x0(%rbp)
0x000000000040113e <+74>:    jne    0x401145 <phase_6+81>
0x0000000000401140 <+76>:    callq  0x40143a <explode_bomb>
0x0000000000401145 <+81>:    add    $0x1,%ebx
0x0000000000401148 <+84>:    cmp    $0x5,%ebx
0x000000000040114b <+87>:    jle    0x401135 <phase_6+65>
0x000000000040114d <+89>:    add    $0x4,%r13
0x0000000000401151 <+93>:    jmp    0x401114 <phase_6+32>

29:T500,

0x000000000040116f <+123>:   mov    $0x0,%esi
0x0000000000401174 <+128>:   jmp    0x401197 <phase_6+163>
0x0000000000401176 <+130>:   mov    0x8(%rdx),%rdx
0x000000000040117a <+134>:   add    $0x1,%eax
0x000000000040117d <+137>:   cmp    %ecx,%eax
0x000000000040117f <+139>:   jne    0x401176 <phase_6+130>
0x0000000000401181 <+141>:   jmp    0x401188 <phase_6+148>
0x0000000000401183 <+143>:   mov    $0x6032d0,%edx
0x0000000000401188 <+148>:   mov    %rdx,0x20(%rsp,%rsi,2)
0x000000000040118d <+153>:   add    $0x4,%rsi
0x0000000000401191 <+157>:   cmp    $0x18,%rsi
0x0000000000401195 <+161>:   je     0x4011ab <phase_6+183>
0x0000000000401197 <+163>:   mov    (%rsp,%rsi,1),%ecx
0x000000000040119a <+166>:   cmp    $0x1,%ecx
0x000000000040119d <+169>:   jle    0x401183 <phase_6+143>
0x000000000040119f <+171>:   mov    $0x1,%eax
0x00000000004011a4 <+176>:   mov    $0x6032d0,%edx
0x00000000004011a9 <+181>:   jmp    0x401176 <phase_6+130>

2a:Ta08,

Dump of assembler code for function phase_defused:
   0x00000000004015c4 <+0>:     sub    $0x78,%rsp
   0x00000000004015c8 <+4>:     mov    %fs:0x28,%rax
   0x00000000004015d1 <+13>:    mov    %rax,0x68(%rsp)
   0x00000000004015d6 <+18>:    xor    %eax,%eax
   0x00000000004015d8 <+20>:    cmpl   $0x6,0x202181(%rip)        # 0x603760 <num_input_strings>
   0x00000000004015df <+27>:    jne    0x40163f <phase_defused+123>
   0x00000000004015e1 <+29>:    lea    0x10(%rsp),%r8
   0x00000000004015e6 <+34>:    lea    0xc(%rsp),%rcx
   0x00000000004015eb <+39>:    lea    0x8(%rsp),%rdx
   0x00000000004015f0 <+44>:    mov    $0x402619,%esi
   0x00000000004015f5 <+49>:    mov    $0x603870,%edi
   0x00000000004015fa <+54>:    callq  0x400bf0 <__isoc99_sscanf@plt>
   0x00000000004015ff <+59>:    cmp    $0x3,%eax
   0x0000000000401602 <+62>:    jne    0x401635 <phase_defused+113>
   0x0000000000401604 <+64>:    mov    $0x402622,%esi
   0x0000000000401609 <+69>:    lea    0x10(%rsp),%rdi
   0x000000000040160e <+74>:    callq  0x401338 <strings_not_equal>
   0x0000000000401613 <+79>:    test   %eax,%eax
   0x0000000000401615 <+81>:    jne    0x401635 <phase_defused+113>
   0x0000000000401617 <+83>:    mov    $0x4024f8,%edi
   0x000000000040161c <+88>:    callq  0x400b10 <puts@plt>
   0x0000000000401621 <+93>:    mov    $0x402520,%edi
   0x0000000000401626 <+98>:    callq  0x400b10 <puts@plt>
   0x000000000040162b <+103>:   mov    $0x0,%eax
   0x0000000000401630 <+108>:   callq  0x401242 <secret_phase>
   0x0000000000401635 <+113>:   mov    $0x402558,%edi
   0x000000000040163a <+118>:   callq  0x400b10 <puts@plt>
   0x000000000040163f <+123>:   mov    0x68(%rsp),%rax
   0x0000000000401644 <+128>:   xor    %fs:0x28,%rax
   0x000000000040164d <+137>:   je     0x401654 <phase_defused+144>
   0x000000000040164f <+139>:   callq  0x400b30 <__stack_chk_fail@plt>
   0x0000000000401654 <+144>:   add    $0x78,%rsp
   0x0000000000401658 <+148>:   retq

2b:T6cb,12345678910111213141516171819202122232425262728293031323334Dump of assembler code for function phase_defused: 0x00000000004015c4 <+0>: sub $0x78,%rsp 0x00000000004015c8 <+4>: mov %fs:0x28,%rax 0x00000000004015d1 <+13>: mov %rax,0x68(%rsp) 0x00000000004015d6 <+18>: xor %eax,%eax 0x00000000004015d8 <+20>: cmpl $0x6,0x202181(%rip) # 0x603760 0x00000000004015df <+27>: jne 0x40163f 0x00000000004015e1 <+29>: lea 0x10(%rsp),%r8 0x00000000004015e6 <+34>: lea 0xc(%rsp),%rcx 0x00000000004015eb <+39>: lea 0x8(%rsp),%rdx 0x00000000004015f0 <+44>: mov $0x402619,%esi 0x00000000004015f5 <+49>: mov $0x603870,%edi 0x00000000004015fa <+54>: callq 0x400bf0 <__isoc99_sscanf@plt> 0x00000000004015ff <+59>: cmp $0x3,%eax 0x0000000000401602 <+62>: jne 0x401635 0x0000000000401604 <+64>: mov $0x402622,%esi 0x0000000000401609 <+69>: lea 0x10(%rsp),%rdi 0x000000000040160e <+74>: callq 0x401338 0x0000000000401613 <+79>: test %eax,%eax 0x0000000000401615 <+81>: jne 0x401635 0x0000000000401617 <+83>: mov $0x4024f8,%edi 0x000000000040161c <+88>: callq 0x400b10 0x0000000000401621 <+93>: mov $0x402520,%edi 0x0000000000401626 <+98>: callq 0x400b10 0x000000000040162b <+103>: mov $0x0,%eax 0x0000000000401630 <+108>: callq 0x401242 0x0000000000401635 <+113>: mov $0x402558,%edi 0x000000000040163a <+118>: callq 0x400b10 0x000000000040163f <+123>: mov 0x68(%rsp),%rax 0x0000000000401644 <+128>: xor %fs:0x28,%rax 0x000000000040164d <+137>: je 0x401654 0x000000000040164f <+139>: callq 0x400b30 <__stack_chk_fail@plt> 0x0000000000401654 <+144>: add $0x78,%rsp 0x0000000000401658 <+148>: retq2c:T6a2,

Dump of assembler code for function secret_phase:
   0x0000000000401242 <+0>:     push   %rbx
   0x0000000000401243 <+1>:     callq  0x40149e <read_line>
   0x0000000000401248 <+6>:     mov    $0xa,%edx
   0x000000000040124d <+11>:    mov    $0x0,%esi
   0x0000000000401252 <+16>:    mov    %rax,%rdi
   0x0000000000401255 <+19>:    callq  0x400bd0 <strtol@plt>
   0x000000000040125a <+24>:    mov    %rax,%rbx
   0x000000000040125d <+27>:    lea    -0x1(%rax),%eax
   0x0000000000401260 <+30>:    cmp    $0x3e8,%eax
   0x0000000000401265 <+35>:    jbe    0x40126c <secret_phase+42>
   0x0000000000401267 <+37>:    callq  0x40143a <explode_bomb>
   0x000000000040126c <+42>:    mov    %ebx,%esi
   0x000000000040126e <+44>:    mov    $0x6030f0,%edi
   0x0000000000401273 <+49>:    callq  0x401204 <fun7>
   0x0000000000401278 <+54>:    cmp    $0x2,%eax
   0x000000000040127b <+57>:    je     0x401282 <secret_phase+64>
   0x000000000040127d <+59>:    callq  0x40143a <explode_bomb>
   0x0000000000401282 <+64>:    mov    $0x402438,%edi
   0x0000000000401287 <+69>:    callq  0x400b10 <puts@plt>
   0x000000000040128c <+74>:    callq  0x4015c4 <phase_defused>
   0x0000000000401291 <+79>:    pop    %rbx
   0x0000000000401292 <+80>:    retq   
End of assembler dump.

2d:T45d,123456789101112131415161718192021222324Dump of assembler code for function secret_phase: 0x0000000000401242 <+0>: push %rbx 0x0000000000401243 <+1>: callq 0x40149e 0x0000000000401248 <+6>: mov $0xa,%edx 0x000000000040124d <+11>: mov $0x0,%esi 0x0000000000401252 <+16>: mov %rax,%rdi 0x0000000000401255 <+19>: callq 0x400bd0 0x000000000040125a <+24>: mov %rax,%rbx 0x000000000040125d <+27>: lea -0x1(%rax),%eax 0x0000000000401260 <+30>: cmp $0x3e8,%eax 0x0000000000401265 <+35>: jbe 0x40126c 0x0000000000401267 <+37>: callq 0x40143a 0x000000000040126c <+42>: mov %ebx,%esi 0x000000000040126e <+44>: mov $0x6030f0,%edi 0x0000000000401273 <+49>: callq 0x401204 0x0000000000401278 <+54>: cmp $0x2,%eax 0x000000000040127b <+57>: je 0x401282 0x000000000040127d <+59>: callq 0x40143a 0x0000000000401282 <+64>: mov $0x402438,%edi 0x0000000000401287 <+69>: callq 0x400b10 0x000000000040128c <+74>: callq 0x4015c4 0x0000000000401291 <+79>: pop %rbx 0x0000000000401292 <+80>: retq End of assembler dump.2e:T62c,

Dump of assembler code for function fun7:
   0x0000000000401204 <+0>:     sub    $0x8,%rsp
   0x0000000000401208 <+4>:     test   %rdi,%rdi
   0x000000000040120b <+7>:     je     0x401238 <fun7+52>
   
   0x000000000040120d <+9>:     mov    (%rdi),%edx
   0x000000000040120f <+11>:    cmp    %esi,%edx
   0x0000000000401211 <+13>:    jle    0x401220 <fun7+28>
   
   0x0000000000401213 <+15>:    mov    0x8(%rdi),%rdi
   0x0000000000401217 <+19>:    callq  0x401204 <fun7>
   0x000000000040121c <+24>:    add    %eax,%eax
   0x000000000040121e <+26>:    jmp    0x40123d <fun7+57>
   
   0x0000000000401220 <+28>:    mov    $0x0,%eax
   0x0000000000401225 <+33>:    cmp    %esi,%edx
   0x0000000000401227 <+35>:    je     0x40123d <fun7+57>
   0x0000000000401229 <+37>:    mov    0x10(%rdi),%rdi
   0x000000000040122d <+41>:    callq  0x401204 <fun7>
   0x0000000000401232 <+46>:    lea    0x1(%rax,%rax,1),%eax
   0x0000000000401236 <+50>:    jmp    0x40123d <fun7+57>
   
   0x0000000000401238 <+52>:    mov    $0xffffffff,%eax
   
   0x000000000040123d <+57>:    add    $0x8,%rsp
   0x0000000000401241 <+61>:    retq   
End of assembler dump.

2f:T961,

(gdb) x/60xg 0x6030f0
0x6030f0 <n1>:  0x0000000000000024      0x0000000000603110
0x603100 <n1+16>:       0x0000000000603130      0x0000000000000000
0x603110 <n21>: 0x0000000000000008      0x0000000000603190
0x603120 <n21+16>:      0x0000000000603150      0x0000000000000000
0x603130 <n22>: 0x0000000000000032      0x0000000000603170
0x603140 <n22+16>:      0x00000000006031b0      0x0000000000000000
0x603150 <n32>: 0x0000000000000016      0x0000000000603270
0x603160 <n32+16>:      0x0000000000603230      0x0000000000000000
0x603170 <n33>: 0x000000000000002d      0x00000000006031d0
0x603180 <n33+16>:      0x0000000000603290      0x0000000000000000
0x603190 <n31>: 0x0000000000000006      0x00000000006031f0
0x6031a0 <n31+16>:      0x0000000000603250      0x0000000000000000
0x6031b0 <n34>: 0x000000000000006b      0x0000000000603210
0x6031c0 <n34+16>:      0x00000000006032b0      0x0000000000000000
0x6031d0 <n45>: 0x0000000000000028      0x0000000000000000
0x6031e0 <n45+16>:      0x0000000000000000      0x0000000000000000
0x6031f0 <n41>: 0x0000000000000001      0x0000000000000000
0x603200 <n41+16>:      0x0000000000000000      0x0000000000000000
0x603210 <n47>: 0x0000000000000063      0x0000000000000000
0x603220 <n47+16>:      0x0000000000000000      0x0000000000000000
0x603230 <n44>: 0x0000000000000023      0x0000000000000000
0x603240 <n44+16>:      0x0000000000000000      0x0000000000000000
0x603250 <n42>: 0x0000000000000007      0x0000000000000000
0x603260 <n42+16>:      0x0000000000000000      0x0000000000000000
0x603270 <n43>: 0x0000000000000014      0x0000000000000000
0x603280 <n43+16>:      0x0000000000000000      0x0000000000000000
0x603290 <n46>: 0x000000000000002f      0x0000000000000000
0x6032a0 <n46+16>:      0x0000000000000000      0x0000000000000000
0x6032b0 <n48>: 0x00000000000003e9      0x0000000000000000
0x6032c0 <n48+16>:      0x0000000000000000      0x0000000000000000

30:T6ab,12345678910111213141516171819202122232425262728293031(gdb) x/60xg 0x6030f00x6030f0 : 0x0000000000000024 0x00000000006031100x603100 : 0x0000000000603130 0x00000000000000000x603110 : 0x0000000000000008 0x00000000006031900x603120 : 0x0000000000603150 0x00000000000000000x603130 : 0x0000000000000032 0x00000000006031700x603140 : 0x00000000006031b0 0x00000000000000000x603150 : 0x0000000000000016 0x00000000006032700x603160 : 0x0000000000603230 0x00000000000000000x603170 : 0x000000000000002d 0x00000000006031d00x603180 : 0x0000000000603290 0x00000000000000000x603190 : 0x0000000000000006 0x00000000006031f00x6031a0 : 0x0000000000603250 0x00000000000000000x6031b0 : 0x000000000000006b 0x00000000006032100x6031c0 : 0x00000000006032b0 0x00000000000000000x6031d0 : 0x0000000000000028 0x00000000000000000x6031e0 : 0x0000000000000000 0x00000000000000000x6031f0 : 0x0000000000000001 0x00000000000000000x603200 : 0x0000000000000000 0x00000000000000000x603210 : 0x0000000000000063 0x00000000000000000x603220 : 0x0000000000000000 0x00000000000000000x603230 : 0x0000000000000023 0x00000000000000000x603240 : 0x0000000000000000 0x00000000000000000x603250 : 0x0000000000000007 0x00000000000000000x603260 : 0x0000000000000000 0x00000000000000000x603270 : 0x0000000000000014 0x00000000000000000x603280 : 0x0000000000000000 0x00000000000000000x603290 : 0x000000000000002f 0x00000000000000000x6032a0 : 0x0000000000000000 0x00000000000000000x6032b0 : 0x00000000000003e9 0x00000000000000000x6032c0 : 0x0000000000000000 0x000000000000000031:T961,

(gdb) x/60xg 0x6030f0
0x6030f0 <n1>:  0x0000000000000024      0x0000000000603110
0x603100 <n1+16>:       0x0000000000603130      0x0000000000000000
0x603110 <n21>: 0x0000000000000008      0x0000000000603190
0x603120 <n21+16>:      0x0000000000603150      0x0000000000000000
0x603130 <n22>: 0x0000000000000032      0x0000000000603170
0x603140 <n22+16>:      0x00000000006031b0      0x0000000000000000
0x603150 <n32>: 0x0000000000000016      0x0000000000603270
0x603160 <n32+16>:      0x0000000000603230      0x0000000000000000
0x603170 <n33>: 0x000000000000002d      0x00000000006031d0
0x603180 <n33+16>:      0x0000000000603290      0x0000000000000000
0x603190 <n31>: 0x0000000000000006      0x00000000006031f0
0x6031a0 <n31+16>:      0x0000000000603250      0x0000000000000000
0x6031b0 <n34>: 0x000000000000006b      0x0000000000603210
0x6031c0 <n34+16>:      0x00000000006032b0      0x0000000000000000
0x6031d0 <n45>: 0x0000000000000028      0x0000000000000000
0x6031e0 <n45+16>:      0x0000000000000000      0x0000000000000000
0x6031f0 <n41>: 0x0000000000000001      0x0000000000000000
0x603200 <n41+16>:      0x0000000000000000      0x0000000000000000
0x603210 <n47>: 0x0000000000000063      0x0000000000000000
0x603220 <n47+16>:      0x0000000000000000      0x0000000000000000
0x603230 <n44>: 0x0000000000000023      0x0000000000000000
0x603240 <n44+16>:      0x0000000000000000      0x0000000000000000
0x603250 <n42>: 0x0000000000000007      0x0000000000000000
0x603260 <n42+16>:      0x0000000000000000      0x0000000000000000
0x603270 <n43>: 0x0000000000000014      0x0000000000000000
0x603280 <n43+16>:      0x0000000000000000      0x0000000000000000
0x603290 <n46>: 0x000000000000002f      0x0000000000000000
0x6032a0 <n46+16>:      0x0000000000000000      0x0000000000000000
0x6032b0 <n48>: 0x00000000000003e9      0x0000000000000000
0x6032c0 <n48+16>:      0x0000000000000000      0x0000000000000000

32:T6ab,12345678910111213141516171819202122232425262728293031(gdb) x/60xg 0x6030f00x6030f0 : 0x0000000000000024 0x00000000006031100x603100 : 0x0000000000603130 0x00000000000000000x603110 : 0x0000000000000008 0x00000000006031900x603120 : 0x0000000000603150 0x00000000000000000x603130 : 0x0000000000000032 0x00000000006031700x603140 : 0x00000000006031b0 0x00000000000000000x603150 : 0x0000000000000016 0x00000000006032700x603160 : 0x0000000000603230 0x00000000000000000x603170 : 0x000000000000002d 0x00000000006031d00x603180 : 0x0000000000603290 0x00000000000000000x603190 : 0x0000000000000006 0x00000000006031f00x6031a0 : 0x0000000000603250 0x00000000000000000x6031b0 : 0x000000000000006b 0x00000000006032100x6031c0 : 0x00000000006032b0 0x00000000000000000x6031d0 : 0x0000000000000028 0x00000000000000000x6031e0 : 0x0000000000000000 0x00000000000000000x6031f0 : 0x0000000000000001 0x00000000000000000x603200 : 0x0000000000000000 0x00000000000000000x603210 : 0x0000000000000063 0x00000000000000000x603220 : 0x0000000000000000 0x00000000000000000x603230 : 0x0000000000000023 0x00000000000000000x603240 : 0x0000000000000000 0x00000000000000000x603250 : 0x0000000000000007 0x00000000000000000x603260 : 0x0000000000000000 0x00000000000000000x603270 : 0x0000000000000014 0x00000000000000000x603280 : 0x0000000000000000 0x00000000000000000x603290 : 0x000000000000002f 0x00000000000000000x6032a0 : 0x0000000000000000 0x00000000000000000x6032b0 : 0x00000000000003e9 0x00000000000000000x6032c0 : 0x0000000000000000 0x000000000000000011:["$","main",null,{"className":"reader-page","children":[["$","div",null,{"className":"reader-kicker","children":[["$","$L10",null,{"href":"/sources/fceb9a1735a82e47","children":[["$","svg",null,{"ref":"$undefined","xmlns":"http://www.w3.org/2000/svg","width":16,"height":16,"viewBox":"0 0 24 24","fill":"none","stroke":"currentColor","strokeWidth":2,"strokeLinecap":"round","strokeLinejoin":"round","className":"lucide lucide-arrow-left","children":[["$","path","1l729n",{"d":"m12 19-7-7 7-7"}],["$","path","x3x0zl",{"d":"M19 12H5"}],"$undefined"]}]," 返回 ","Louis C Deng's Blog"]}],["$","span",null,{"children":"工程"}]]}],["$","header",null,{"className":"article-meta","children":[["$","span",null,{"children":["FROM · ","Louis C Deng's Blog"]}],["$","div",null,{"children":[["$","svg",null,{"ref":"$undefined","xmlns":"http://www.w3.org/2000/svg","width":15,"height":15,"viewBox":"0 0 24 24","fill":"none","stroke":"currentColor","strokeWidth":2,"strokeLinecap":"round","strokeLinejoin":"round","className":"lucide lucide-calendar-days","children":[["$","path","1cmpym",{"d":"M8 2v4"}],["$","path","4m81vk",{"d":"M16 2v4"}],["$","rect","1hopcy",{"width":"18","height":"18","x":"3","y":"4","rx":"2"}],["$","path","8toen8",{"d":"M3 10h18"}],["$","path","6423bh",{"d":"M8 14h.01"}],["$","path","1etili",{"d":"M12 14h.01"}],["$","path","1gbofw",{"d":"M16 14h.01"}],["$","path","lrp35t",{"d":"M8 18h.01"}],["$","path","mhygvu",{"d":"M12 18h.01"}],["$","path","kzsmim",{"d":"M16 18h.01"}],"$undefined"]}]," ","2025年12月20日"," · Louis C Deng"]}]]}],["$","$L19",null,{"article":{"title":"CSAPP Bomb Lab 解析","byline":"Louis C Deng","publishedAt":"2025-12-20T18:45:09.000Z","language":"en","blocks":[{"id":"b0","type":"paragraph","html":"

做完了 CSAPP Bomb Lab，寫一篇解析。

","text":"做完了 CSAPP Bomb Lab，寫一篇解析。"},{"id":"b1","type":"heading","html":"

題目要求

","text":"題目要求"},{"id":"b2","type":"paragraph","html":"

運行一個二進制文件 bomb，它包括六個”階段(phase)”，每個階段要求學生通過 stdin 輸入一個特定的字串。如果輸入了預期的字串，那麼該階段被”拆除”，進入下一個階段，直到所有炸彈被成功”拆除”。否則，炸彈就會”爆炸”，列印出”BOOM!!!”

","text":"運行一個二進制文件 bomb，它包括六個”階段(phase)”，每個階段要求學生通過 stdin 輸入一個特定的字串。如果輸入了預期的字串，那麼該階段被”拆除”，進入下一個階段，直到所有炸彈被成功”拆除”。否則，炸彈就會”爆炸”，列印出”BOOM!!!”"},{"id":"b3","type":"heading","html":"

環境

","text":"環境"},{"id":"b4","type":"paragraph","html":"

這個系統是在 x86_64 Linux 上運行的，而筆者的環境是 ARM 架構的 macOS (Apple Silicon)。

","text":"這個系統是在 x86_64 Linux 上運行的，而筆者的環境是 ARM 架構的 macOS (Apple Silicon)。"},{"id":"b5","type":"paragraph","html":"

弄了半天 docker，虛擬化一個 x86_64 Ubuntu 出來，結果裡面的 gdb 不能用，不想折騰。

","text":"弄了半天 docker，虛擬化一個 x86_64 Ubuntu 出來，結果裡面的 gdb 不能用，不想折騰。"},{"id":"b6","type":"paragraph","html":"

發現 educoder 上面有環境，可以直接用，而且免費，於是就在 educoder 上面完成了本實驗。

","text":"發現 educoder 上面有環境，可以直接用，而且免費，於是就在 educoder 上面完成了本實驗。"},{"id":"b7","type":"paragraph","html":"

地址：https://www.educoder.net/paths/6g398fky

","text":"地址：https://www.educoder.net/paths/6g398fky"},{"id":"b8","type":"heading","html":"

前置知識

","text":"前置知識"},{"id":"b9","type":"paragraph","html":"

本實驗要求掌握 gdb 的一些指令。

","text":"本實驗要求掌握 gdb 的一些指令。"},{"id":"b10","type":"heading","html":"

1. 啟動與退出 (Startup & Exit)

","text":"1. 啟動與退出 (Startup & Exit)"},{"id":"b11","type":"heading","html":"

2. 斷點管理 (Breakpoints)

","text":"2. 斷點管理 (Breakpoints)"},{"id":"b12","type":"heading","html":"

3. 執行控制 (Execution Control)

","text":"3. 執行控制 (Execution Control)"},{"id":"b13","type":"heading","html":"

4. 查看數據 (Inspection)

","text":"4. 查看數據 (Inspection)"},{"id":"b14","type":"heading","html":"

5. 堆棧與上下文 (Stack & Context)

","text":"5. 堆棧與上下文 (Stack & Context)"},{"id":"b15","type":"heading","html":"

6. 提升體驗：TUI 模式 (Text User Interface)

","text":"6. 提升體驗：TUI 模式 (Text User Interface)"},{"id":"b16","type":"list","html":"

layout src：螢幕分為兩半，上面顯示原始碼和當前執行行，下面是命令窗口。（強烈推薦）
layout asm：顯示匯編代碼。
layout split：同時顯示原始碼和匯編。

","text":"layout src：螢幕分為兩半，上面顯示原始碼和當前執行行，下面是命令窗口。（強烈推薦） layout asm：顯示匯編代碼。 layout split：同時顯示原始碼和匯編。"},{"id":"b17","type":"heading","html":"

反匯編

","text":"反匯編"},{"id":"b18","type":"paragraph","html":"

我們可以使用 objdump 直接進行反匯編，查看匯編原始碼。

","text":"我們可以使用 objdump 直接進行反匯編，查看匯編原始碼。"},{"id":"b19","type":"paragraph","html":"

objdump -d bomb > bomb.asm

","text":"1objdump -d bomb > bomb.asm"},{"id":"b20","type":"paragraph","html":"

我們可以觀察到，幾個 phase 其實是幾個函數，phase_x()。

","text":"我們可以觀察到，幾個 phase 其實是幾個函數，phase_x()。"},{"id":"b21","type":"heading","html":"

strings

","text":"strings"},{"id":"b22","type":"paragraph","html":"

在終端輸入：

","text":"在終端輸入："},{"id":"b23","type":"paragraph","html":"

strings bomb

","text":"1strings bomb"},{"id":"b24","type":"paragraph","html":"

這會把 bomb 文件裡所有連續的可列印字元（ASCII）都列印出來。

","text":"這會把 bomb 文件裡所有連續的可列印字元（ASCII）都列印出來。"},{"id":"b25","type":"heading","html":"

Phase 1

","text":"Phase 1"},{"id":"b26","type":"paragraph","html":"

我們先看看 phase_1 長什麼樣子，disas phase_1

","text":"我們先看看 phase_1 長什麼樣子，disas phase_1"},{"id":"b27","type":"paragraph","html":"

Dump of assembler code for function phase_1:
   0x0000000000400ee0 <+0>:     sub    $0x8,%rsp
   0x0000000000400ee4 <+4>:     mov    $0x402400,%esi
   0x0000000000400ee9 <+9>:     callq  0x401338 <strings_not_equal>
   0x0000000000400eee <+14>:    test   %eax,%eax
   0x0000000000400ef0 <+16>:    je     0x400ef7 <phase_1+23>
   0x0000000000400ef2 <+18>:    callq  0x40143a <explode_bomb>
   0x0000000000400ef7 <+23>:    add    $0x8,%rsp
   0x0000000000400efb <+27>:    retq   
End of assembler dump.

","text":"12345678910Dump of assembler code for function phase_1: 0x0000000000400ee0 <+0>: sub $0x8,%rsp 0x0000000000400ee4 <+4>: mov $0x402400,%esi 0x0000000000400ee9 <+9>: callq 0x401338 0x0000000000400eee <+14>: test %eax,%eax 0x0000000000400ef0 <+16>: je 0x400ef7 0x0000000000400ef2 <+18>: callq 0x40143a 0x0000000000400ef7 <+23>: add $0x8,%rsp 0x0000000000400efb <+27>: retq End of assembler dump."},{"id":"b28","type":"paragraph","html":"

sub $0x8,%rsp 是設置棧幀，在這裡不用管。

","text":"sub $0x8,%rsp 是設置棧幀，在這裡不用管。"},{"id":"b29","type":"paragraph","html":"

mov $0x402400,%esi 和 callq 0x401338 <strings_not_equal> 似乎進行了字串的 strcmp。

","text":"mov $0x402400,%esi 和 callq 0x401338 似乎進行了字串的 strcmp。"},{"id":"b30","type":"paragraph","html":"

接下來 je 0x400ef7 <phase_1+23> 就很明顯了，如果相等跳出炸彈。

","text":"接下來 je 0x400ef7 就很明顯了，如果相等跳出炸彈。"},{"id":"b31","type":"paragraph","html":"

設置斷點，b phase_1

","text":"設置斷點，b phase_1"},{"id":"b32","type":"paragraph","html":"

之後運行程序，r，隨便輸入一些內容，就可以觸發斷點

","text":"之後運行程序，r，隨便輸入一些內容，就可以觸發斷點"},{"id":"b33","type":"paragraph","html":"

以字串形式查看 0x402400 所指向的記憶體：x/s 0x402400

","text":"以字串形式查看 0x402400 所指向的記憶體：x/s 0x402400"},{"id":"b34","type":"paragraph","html":"

0x402400:       \"Border relations with Canada have never been better.\"

","text":"10x402400: \"Border relations with Canada have never been better.\""},{"id":"b35","type":"paragraph","html":"

我們找到了答案。

","text":"我們找到了答案。"},{"id":"b36","type":"heading","html":"

Phase 2

","text":"Phase 2"},{"id":"b37","type":"paragraph","html":"

還是先反匯編：

","text":"還是先反匯編："},{"id":"b38","type":"paragraph","html":"$1a","text":"$1b"},{"id":"b39","type":"paragraph","html":"

0x0000000000400f05 <+9>: callq 0x40145c <read_six_numbers> 這裡看到 read_six_numbers

","text":"0x0000000000400f05 <+9>: callq 0x40145c 這裡看到 read_six_numbers"},{"id":"b40","type":"paragraph","html":"

我們可以反匯編 read_six_numbers

","text":"我們可以反匯編 read_six_numbers"},{"id":"b41","type":"paragraph","html":"$1c","text":"12345678910111213141516171819Dump of assembler code for function read_six_numbers: 0x000000000040145c <+0>: sub $0x18,%rsp 0x0000000000401460 <+4>: mov %rsi,%rdx 0x0000000000401463 <+7>: lea 0x4(%rsi),%rcx 0x0000000000401467 <+11>: lea 0x14(%rsi),%rax 0x000000000040146b <+15>: mov %rax,0x8(%rsp) 0x0000000000401470 <+20>: lea 0x10(%rsi),%rax 0x0000000000401474 <+24>: mov %rax,(%rsp) 0x0000000000401478 <+28>: lea 0xc(%rsi),%r9 0x000000000040147c <+32>: lea 0x8(%rsi),%r8 0x0000000000401480 <+36>: mov $0x4025c3,%esi 0x0000000000401485 <+41>: mov $0x0,%eax 0x000000000040148a <+46>: callq 0x400bf0 <__isoc99_sscanf@plt> 0x000000000040148f <+51>: cmp $0x5,%eax 0x0000000000401492 <+54>: jg 0x401499 0x0000000000401494 <+56>: callq 0x40143a 0x0000000000401499 <+61>: add $0x18,%rsp 0x000000000040149d <+65>: retq End of assembler dump."},{"id":"b42","type":"paragraph","html":"

看到有一行 callq 0x400bf0 <__isoc99_sscanf@plt>，調用了 sscanf

","text":"看到有一行 callq 0x400bf0 <__isoc99_sscanf@plt>，調用了 sscanf"},{"id":"b43","type":"paragraph","html":"

我們看一眼 $0x4025c3，x/s 0x4025c3，得到 %d %d %d %d %d %d，確實是讀了六個數字。

","text":"我們看一眼 $0x4025c3，x/s 0x4025c3，得到 %d %d %d %d %d %d，確實是讀了六個數字。"},{"id":"b44","type":"paragraph","html":"

函數調用時，參數多於六個，就會丟到棧裡面去。我們看到：

","text":"函數調用時，參數多於六個，就會丟到棧裡面去。我們看到："},{"id":"b45","type":"paragraph","html":"

0x0000000000401460 <+4>:     mov    %rsi,%rdx
0x0000000000401463 <+7>:     lea    0x4(%rsi),%rcx
0x0000000000401467 <+11>:    lea    0x14(%rsi),%rax
0x000000000040146b <+15>:    mov    %rax,0x8(%rsp)
0x0000000000401470 <+20>:    lea    0x10(%rsi),%rax
0x0000000000401474 <+24>:    mov    %rax,(%rsp)
0x0000000000401478 <+28>:    lea    0xc(%rsi),%r9
0x000000000040147c <+32>:    lea    0x8(%rsi),%r8

","text":"123456780x0000000000401460 <+4>: mov %rsi,%rdx0x0000000000401463 <+7>: lea 0x4(%rsi),%rcx0x0000000000401467 <+11>: lea 0x14(%rsi),%rax0x000000000040146b <+15>: mov %rax,0x8(%rsp)0x0000000000401470 <+20>: lea 0x10(%rsi),%rax0x0000000000401474 <+24>: mov %rax,(%rsp)0x0000000000401478 <+28>: lea 0xc(%rsi),%r90x000000000040147c <+32>: lea 0x8(%rsi),%r8"},{"id":"b46","type":"paragraph","html":"

參數順序：rdi, rsi, rdx, rcx, r8, r9，超過了六個參數。rsp 為棧頂指針，多於六個的參數存在棧上。

","text":"參數順序：rdi, rsi, rdx, rcx, r8, r9，超過了六個參數。rsp 為棧頂指針，多於六個的參數存在棧上。"},{"id":"b47","type":"paragraph","html":"

於是讀取的六個數字依次存為：rsi, rsi+4, rsi+8, rsi+12, rsi+16 (0x10 = 16), rsi+20 (0x14 = 20)

","text":"於是讀取的六個數字依次存為：rsi, rsi+4, rsi+8, rsi+12, rsi+16 (0x10 = 16), rsi+20 (0x14 = 20)"},{"id":"b48","type":"paragraph","html":"

再回到 phase_2

","text":"再回到 phase_2"},{"id":"b49","type":"paragraph","html":"

0x0000000000400f02 <+6>:     mov    %rsp,%rsi

","text":"10x0000000000400f02 <+6>: mov %rsp,%rsi"},{"id":"b50","type":"paragraph","html":"

棧頂指針作為參數傳入了 read_six_numbers，因此，這六個數字應該是在 phase_2 對應棧幀的棧上

","text":"棧頂指針作為參數傳入了 read_six_numbers，因此，這六個數字應該是在 phase_2 對應棧幀的棧上"},{"id":"b51","type":"paragraph","html":"

1
2
3

0x0000000000400f0a <+14>:    cmpl   $0x1,(%rsp)
0x0000000000400f0e <+18>:    je     0x400f30 <phase_2+52>
0x0000000000400f10 <+20>:    callq  0x40143a <explode_bomb>

","text":"1230x0000000000400f0a <+14>: cmpl $0x1,(%rsp)0x0000000000400f0e <+18>: je 0x400f30 0x0000000000400f10 <+20>: callq 0x40143a "},{"id":"b52","type":"paragraph","html":"

這裡判斷棧頂元素是否是 1，也就是說第一個元素是否是 1

","text":"這裡判斷棧頂元素是否是 1，也就是說第一個元素是否是 1"},{"id":"b53","type":"paragraph","html":"

之後跳轉到了 0x400f30

","text":"之後跳轉到了 0x400f30"},{"id":"b54","type":"paragraph","html":"

0x0000000000400f17 <+27>:    mov    -0x4(%rbx),%eax
0x0000000000400f1a <+30>:    add    %eax,%eax
0x0000000000400f1c <+32>:    cmp    %eax,(%rbx)
0x0000000000400f1e <+34>:    je     0x400f25 <phase_2+41>
0x0000000000400f20 <+36>:    callq  0x40143a <explode_bomb>
0x0000000000400f25 <+41>:    add    $0x4,%rbx
0x0000000000400f29 <+45>:    cmp    %rbp,%rbx
0x0000000000400f2c <+48>:    jne    0x400f17 <phase_2+27>
0x0000000000400f2e <+50>:    jmp    0x400f3c <phase_2+64>
0x0000000000400f30 <+52>:    lea    0x4(%rsp),%rbx
0x0000000000400f35 <+57>:    lea    0x18(%rsp),%rbp
0x0000000000400f3a <+62>:    jmp    0x400f17 <phase_2+27>

","text":"1234567891011120x0000000000400f17 <+27>: mov -0x4(%rbx),%eax0x0000000000400f1a <+30>: add %eax,%eax0x0000000000400f1c <+32>: cmp %eax,(%rbx)0x0000000000400f1e <+34>: je 0x400f25 0x0000000000400f20 <+36>: callq 0x40143a 0x0000000000400f25 <+41>: add $0x4,%rbx0x0000000000400f29 <+45>: cmp %rbp,%rbx0x0000000000400f2c <+48>: jne 0x400f17 0x0000000000400f2e <+50>: jmp 0x400f3c 0x0000000000400f30 <+52>: lea 0x4(%rsp),%rbx0x0000000000400f35 <+57>: lea 0x18(%rsp),%rbp0x0000000000400f3a <+62>: jmp 0x400f17 "},{"id":"b55","type":"paragraph","html":"

這裡很顯然是一個循環，依次讀取六個數位（每次移動四個位元組，正好是 int 的長度）

","text":"這裡很顯然是一個循環，依次讀取六個數位（每次移動四個位元組，正好是 int 的長度）"},{"id":"b56","type":"paragraph","html":"

1
2
3

0x0000000000400f1a <+30>:    add    %eax,%eax
0x0000000000400f1c <+32>:    cmp    %eax,(%rbx)
0x0000000000400f1e <+34>:    je     0x400f25 <phase_2+41>

","text":"1230x0000000000400f1a <+30>: add %eax,%eax0x0000000000400f1c <+32>: cmp %eax,(%rbx)0x0000000000400f1e <+34>: je 0x400f25 "},{"id":"b57","type":"paragraph","html":"

這六個數字，後一個是前一個的兩倍。

","text":"這六個數字，後一個是前一個的兩倍。"},{"id":"b58","type":"paragraph","html":"

於是我們可以得到答案：1 2 4 8 16 32

","text":"於是我們可以得到答案：1 2 4 8 16 32"},{"id":"b59","type":"paragraph","html":"

我們也可以把代碼翻譯成 C 語言：

","text":"我們也可以把代碼翻譯成 C 語言："},{"id":"b60","type":"paragraph","html":"

for (int i = 1; i < 6; i++) {
    
    int previous = num[i-1];
    
    int expected = previous + previous; 
    
    if (num[i] != expected) {
        explode_bomb();
    }
}

","text":"12345678910for (int i = 1; i < 6; i++) { int previous = num[i-1]; int expected = previous + previous; if (num[i] != expected) { explode_bomb(); }}"},{"id":"b61","type":"heading","html":"

Phase 3

","text":"Phase 3"},{"id":"b62","type":"paragraph","html":"

反匯編：

","text":"反匯編："},{"id":"b63","type":"paragraph","html":"$1d","text":"$1e"},{"id":"b64","type":"paragraph","html":"

看著有點複雜，觀察到 sscanf

","text":"看著有點複雜，觀察到 sscanf"},{"id":"b65","type":"paragraph","html":"

看一眼 0x4025cf，x/s 0x4025cf，得到 %d %d，看起來是輸入了兩個整數

","text":"看一眼 0x4025cf，x/s 0x4025cf，得到 %d %d，看起來是輸入了兩個整數"},{"id":"b66","type":"paragraph","html":"

1
2

0x0000000000400f47 <+4>:     lea    0xc(%rsp),%rcx
0x0000000000400f4c <+9>:     lea    0x8(%rsp),%rdx

","text":"120x0000000000400f47 <+4>: lea 0xc(%rsp),%rcx0x0000000000400f4c <+9>: lea 0x8(%rsp),%rdx"},{"id":"b67","type":"paragraph","html":"

這兩個整數依次存為 rsp+8, rsp+c

","text":"這兩個整數依次存為 rsp+8, rsp+c"},{"id":"b68","type":"paragraph","html":"

1
2

0x0000000000400f6a <+39>:    cmpl   $0x7,0x8(%rsp)
0x0000000000400f6f <+44>:    ja     0x400fad <phase_3+106>

","text":"120x0000000000400f6a <+39>: cmpl $0x7,0x8(%rsp)0x0000000000400f6f <+44>: ja 0x400fad "},{"id":"b69","type":"paragraph","html":"

這裡判斷了第一個數，如果這個數大於 7，就會引爆

","text":"這裡判斷了第一個數，如果這個數大於 7，就會引爆"},{"id":"b70","type":"paragraph","html":"

1
2

0x0000000000400f71 <+46>:    mov    0x8(%rsp),%eax
0x0000000000400f75 <+50>:    jmpq   *0x402470(,%rax,8)

","text":"120x0000000000400f71 <+46>: mov 0x8(%rsp),%eax0x0000000000400f75 <+50>: jmpq *0x402470(,%rax,8)"},{"id":"b71","type":"paragraph","html":"

我們把第一個整數存入 eax，這裡很明顯是一個 switch 的跳轉表：0x402470 + 8*rax

","text":"我們把第一個整數存入 eax，這裡很明顯是一個 switch 的跳轉表：0x402470 + 8*rax"},{"id":"b72","type":"paragraph","html":"

eax 和 rax 實際上是同一個東西，前者是這個暫存器的前 32 位，後者是這個暫存器的完整 64 位，這是歷史遺留產物，實際上，還有 ax, ah, al，為了向後相容而保留。

","text":"eax 和 rax 實際上是同一個東西，前者是這個暫存器的前 32 位，後者是這個暫存器的完整 64 位，這是歷史遺留產物，實際上，還有 ax, ah, al，為了向後相容而保留。"},{"id":"b73","type":"paragraph","html":"

我們來讀取 10 個，x/10x 0x402470，得到：

","text":"我們來讀取 10 個，x/10x 0x402470，得到："},{"id":"b74","type":"paragraph","html":"

1
2
3

0x402470:       0x00400f7c      0x00000000      0x00400fb9      0x00000000
0x402480:       0x00400f83      0x00000000      0x00400f8a      0x00000000
0x402490:       0x00400f91      0x00000000

","text":"1230x402470: 0x00400f7c 0x00000000 0x00400fb9 0x000000000x402480: 0x00400f83 0x00000000 0x00400f8a 0x000000000x402490: 0x00400f91 0x00000000"},{"id":"b75","type":"paragraph","html":"

這是 switch 語句的跳轉表，與匯編代碼中對應。

","text":"這是 switch 語句的跳轉表，與匯編代碼中對應。"},{"id":"b76","type":"paragraph","html":"

我們隨便選一個就能得到正確答案，如，0 對應 0x00400f7c

","text":"我們隨便選一個就能得到正確答案，如，0 對應 0x00400f7c"},{"id":"b77","type":"paragraph","html":"

0x0000000000400f7c <+57>:    mov    $0xcf,%eax
0x0000000000400f81 <+62>:    jmp    0x400fbe <phase_3+123>
...
0x0000000000400fbe <+123>:   cmp    0xc(%rsp),%eax
0x0000000000400fc2 <+127>:   je     0x400fc9 <phase_3+134>
0x0000000000400fc4 <+129>:   callq  0x40143a <explode_bomb>

","text":"1234560x0000000000400f7c <+57>: mov $0xcf,%eax0x0000000000400f81 <+62>: jmp 0x400fbe ...0x0000000000400fbe <+123>: cmp 0xc(%rsp),%eax0x0000000000400fc2 <+127>: je 0x400fc9 0x0000000000400fc4 <+129>: callq 0x40143a "},{"id":"b78","type":"paragraph","html":"

第二個數和 eax 比較，相等就拆除成功

","text":"第二個數和 eax 比較，相等就拆除成功"},{"id":"b79","type":"paragraph","html":"

我們得到第二個數 0xcf = 207

","text":"我們得到第二個數 0xcf = 207"},{"id":"b80","type":"paragraph","html":"

於是，答案是 0 207

","text":"於是，答案是 0 207"},{"id":"b81","type":"paragraph","html":"

實際上，答案並不唯一，觀察代碼可以知道，每一個 switch 分支中，都對應了一個第二個整數的正確答案。

","text":"實際上，答案並不唯一，觀察代碼可以知道，每一個 switch 分支中，都對應了一個第二個整數的正確答案。"},{"id":"b82","type":"heading","html":"

Phase 4

","text":"Phase 4"},{"id":"b83","type":"paragraph","html":"

反編譯：

","text":"反編譯："},{"id":"b84","type":"paragraph","html":"$1f","text":"$20"},{"id":"b85","type":"paragraph","html":"

我們還是看到 sscanf

","text":"我們還是看到 sscanf"},{"id":"b86","type":"paragraph","html":"

讀一下 0x4025cf，得到 %d %d，看起來又是讀兩個數字，分別存入 rdx, rcx

","text":"讀一下 0x4025cf，得到 %d %d，看起來又是讀兩個數字，分別存入 rdx, rcx"},{"id":"b87","type":"paragraph","html":"

接著往下讀，jbe 0x40103a，要求 rdx <= 14

","text":"接著往下讀，jbe 0x40103a，要求 rdx <= 14"},{"id":"b88","type":"paragraph","html":"

1
2
3

0x000000000040103a <+46>:    mov    $0xe,%edx
0x000000000040103f <+51>:    mov    $0x0,%esi
0x0000000000401044 <+56>:    mov    0x8(%rsp),%edi

","text":"1230x000000000040103a <+46>: mov $0xe,%edx0x000000000040103f <+51>: mov $0x0,%esi0x0000000000401044 <+56>: mov 0x8(%rsp),%edi"},{"id":"b89","type":"paragraph","html":"

明顯在傳參，調用了 func4

","text":"明顯在傳參，調用了 func4"},{"id":"b90","type":"paragraph","html":"

我們先不急著看 func4，接著往下讀

","text":"我們先不急著看 func4，接著往下讀"},{"id":"b91","type":"paragraph","html":"

0x000000000040104d <+65>:    test   %eax,%eax
0x000000000040104f <+67>:    jne    0x401058 <phase_4+76>
...
0x0000000000401058 <+76>:    callq  0x40143a <explode_bomb>

","text":"12340x000000000040104d <+65>: test %eax,%eax0x000000000040104f <+67>: jne 0x401058 ...0x0000000000401058 <+76>: callq 0x40143a "},{"id":"b92","type":"paragraph","html":"

回顧一下暫存器知識，eax 在這裡是函數的返回值，這裡要求返回值等於 0

","text":"回顧一下暫存器知識，eax 在這裡是函數的返回值，這裡要求返回值等於 0"},{"id":"b93","type":"paragraph","html":"

1
2

0x0000000000401051 <+69>:    cmpl   $0x0,0xc(%rsp)
0x0000000000401056 <+74>:    je     0x40105d <phase_4+81>

","text":"120x0000000000401051 <+69>: cmpl $0x0,0xc(%rsp)0x0000000000401056 <+74>: je 0x40105d "},{"id":"b94","type":"paragraph","html":"

這裡要求讀取到的第二個數是 0，算是得到了半個答案

","text":"這裡要求讀取到的第二個數是 0，算是得到了半個答案"},{"id":"b95","type":"paragraph","html":"

接下來我們看 func4

","text":"接下來我們看 func4"},{"id":"b96","type":"paragraph","html":"$21","text":"$22"},{"id":"b97","type":"paragraph","html":"

這個代碼裡面包含遞迴，我們可以手動把這段代碼翻譯到 C 語言：

","text":"這個代碼裡面包含遞迴，我們可以手動把這段代碼翻譯到 C 語言："},{"id":"b98","type":"paragraph","html":"


int func4(int edi, int esi, int edx){
    int mid = l + ((r-l)>>1);
    if(mid <= a){
        if(mid==a){
            return 0;
        }
        l = mid + 1;
        return 2*func4(a, l, r) + 1;
    }else{
        r = mid - 1;
        return 2*func4(a, l, r);
    }
}

","text":"1234567891011121314int func4(int edi, int esi, int edx){ int mid = l + ((r-l)>>1); if(mid <= a){ if(mid==a){ return 0; } l = mid + 1; return 2*func4(a, l, r) + 1; }else{ r = mid - 1; return 2*func4(a, l, r); }}"},{"id":"b99","type":"paragraph","html":"

這是二分尋找，我們很容易得到答案 a=7，於是返回 0

","text":"這是二分尋找，我們很容易得到答案 a=7，於是返回 0"},{"id":"b100","type":"paragraph","html":"

得到最終的答案 7 0

","text":"得到最終的答案 7 0"},{"id":"b101","type":"paragraph","html":"

0x0000000000400fd2 <+4>:     mov    %edx,%eax
0x0000000000400fd4 <+6>:     sub    %esi,%eax
0x0000000000400fd6 <+8>:     mov    %eax,%ecx
0x0000000000400fd8 <+10>:    shr    $0x1f,%ecx
0x0000000000400fdb <+13>:    add    %ecx,%eax
0x0000000000400fdd <+15>:    sar    %eax
0x0000000000400fdf <+17>:    lea    (%rax,%rsi,1),%ecx

","text":"12345670x0000000000400fd2 <+4>: mov %edx,%eax0x0000000000400fd4 <+6>: sub %esi,%eax0x0000000000400fd6 <+8>: mov %eax,%ecx0x0000000000400fd8 <+10>: shr $0x1f,%ecx0x0000000000400fdb <+13>: add %ecx,%eax0x0000000000400fdd <+15>: sar %eax0x0000000000400fdf <+17>: lea (%rax,%rsi,1),%ecx"},{"id":"b102","type":"paragraph","html":"

這一段代碼就是在計算 mid，非常好理解，但是有個問題：shr $0x1f,%ecx 是在做什麼？

","text":"這一段代碼就是在計算 mid，非常好理解，但是有個問題：shr $0x1f,%ecx 是在做什麼？"},{"id":"b103","type":"heading","html":"

偏置

","text":"偏置"},{"id":"b104","type":"paragraph","html":"

整數除法要求向零捨入。對於正數，向下捨入；對於負數，向上捨入。除以2的冪可以用右移操作替代。

","text":"整數除法要求向零捨入。對於正數，向下捨入；對於負數，向上捨入。除以2的冪可以用右移操作替代。"},{"id":"b105","type":"paragraph","html":"

但是，對於補碼右移，很可能出現捨入錯誤。

","text":"但是，對於補碼右移，很可能出現捨入錯誤。"},{"id":"b106","type":"paragraph","html":"

我們進行右移的時候，其實是捨去了最低位，是一種向下取整

","text":"我們進行右移的時候，其實是捨去了最低位，是一種向下取整"},{"id":"b107","type":"paragraph","html":"

當我們執行右移 x >> k 時：高位部分的權重全部除以了 $2^k$，變成了整數結果。低位部分（餘數）直接被丟棄了。

","text":"當我們執行右移 x >> k 時：高位部分的權重全部除以了 $2^k$，變成了整數結果。低位部分（餘數）直接被丟棄了。"},{"id":"b108","type":"paragraph","html":"

對於負數而言，這一操作進行了向下取整，但我們要求對負數進行向上取整。

","text":"對於負數而言，這一操作進行了向下取整，但我們要求對負數進行向上取整。"},{"id":"b109","type":"paragraph","html":"

因此，我們需要引入偏置。

","text":"因此，我們需要引入偏置。"},{"id":"b110","type":"paragraph","html":"

於是 (x+(1<<k)-1)>>k 得到 $\\lceil x/2^k \\rceil$

","text":"於是 (x+(1<>k 得到 $\\lceil x/2^k \\rceil$"},{"id":"b111","type":"paragraph","html":"

也就是下面這兩行的含義

","text":"也就是下面這兩行的含義"},{"id":"b112","type":"paragraph","html":"

1
2

0x0000000000400fd8 <+10>:    shr    $0x1f,%ecx
0x0000000000400fdb <+13>:    add    %ecx,%eax

","text":"120x0000000000400fd8 <+10>: shr $0x1f,%ecx0x0000000000400fdb <+13>: add %ecx,%eax"},{"id":"b113","type":"heading","html":"

Phase 5

","text":"Phase 5"},{"id":"b114","type":"paragraph","html":"

我們先disas看代碼

","text":"我們先disas看代碼"},{"id":"b115","type":"paragraph","html":"$23","text":"$24"},{"id":"b116","type":"paragraph","html":"

很快識別出來，這一段代碼中有兩個記憶體地址：0x4024b0 0x40245e

","text":"很快識別出來，這一段代碼中有兩個記憶體地址：0x4024b0 0x40245e"},{"id":"b117","type":"paragraph","html":"

讀一下：

","text":"讀一下："},{"id":"b118","type":"paragraph","html":"

1
2

0x4024b0 <array.3449>:  \"maduiersnfotvbylSo you think you can stop the bomb with ctrl-c, do you?\"
0x40245e:       \"flyers\"

","text":"120x4024b0 : \"maduiersnfotvbylSo you think you can stop the bomb with ctrl-c, do you?\"0x40245e: \"flyers\""},{"id":"b119","type":"paragraph","html":"

第一個 array.3449 是一個字串，我們就記為 a[]

","text":"第一個 array.3449 是一個字串，我們就記為 a[]"},{"id":"b120","type":"paragraph","html":"

上面的代碼可以分個段

","text":"上面的代碼可以分個段"},{"id":"b121","type":"paragraph","html":"

0x0000000000401062 <+0>:     push   %rbx
0x0000000000401063 <+1>:     sub    $0x20,%rsp
0x0000000000401067 <+5>:     mov    %rdi,%rbx
0x000000000040106a <+8>:     mov    %fs:0x28,%rax
0x0000000000401073 <+17>:    mov    %rax,0x18(%rsp)
0x0000000000401078 <+22>:    xor    %eax,%eax
0x000000000040107a <+24>:    callq  0x40131b <string_length>
0x000000000040107f <+29>:    cmp    $0x6,%eax
0x0000000000401082 <+32>:    je     0x4010d2 <phase_5+112>
0x0000000000401084 <+34>:    callq  0x40143a <explode_bomb>
0x0000000000401089 <+39>:    jmp    0x4010d2 <phase_5+112>

","text":"12345678910110x0000000000401062 <+0>: push %rbx0x0000000000401063 <+1>: sub $0x20,%rsp0x0000000000401067 <+5>: mov %rdi,%rbx0x000000000040106a <+8>: mov %fs:0x28,%rax0x0000000000401073 <+17>: mov %rax,0x18(%rsp)0x0000000000401078 <+22>: xor %eax,%eax0x000000000040107a <+24>: callq 0x40131b 0x000000000040107f <+29>: cmp $0x6,%eax0x0000000000401082 <+32>: je 0x4010d2 0x0000000000401084 <+34>: callq 0x40143a 0x0000000000401089 <+39>: jmp 0x4010d2 "},{"id":"b122","type":"paragraph","html":"

這裡是前面初始化的部分，我們可以看到預留了棧空間，應該是讀取了一個字串，長度為 6，存在棧上。

","text":"這裡是前面初始化的部分，我們可以看到預留了棧空間，應該是讀取了一個字串，長度為 6，存在棧上。"},{"id":"b123","type":"paragraph","html":"

0x00000000004010d2 <+112>:   mov    $0x0,%eax
0x00000000004010d7 <+117>:   jmp    0x40108b <phase_5+41>
...
0x000000000040108b <+41>:    movzbl (%rbx,%rax,1),%ecx
0x000000000040108f <+45>:    mov    %cl,(%rsp)
0x0000000000401092 <+48>:    mov    (%rsp),%rdx
0x0000000000401096 <+52>:    and    $0xf,%edx
0x0000000000401099 <+55>:    movzbl 0x4024b0(%rdx),%edx
0x00000000004010a0 <+62>:    mov    %dl,0x10(%rsp,%rax,1)
0x00000000004010a4 <+66>:    add    $0x1,%rax
0x00000000004010a8 <+70>:    cmp    $0x6,%rax
0x00000000004010ac <+74>:    jne    0x40108b <phase_5+41>

","text":"1234567891011120x00000000004010d2 <+112>: mov $0x0,%eax0x00000000004010d7 <+117>: jmp 0x40108b ...0x000000000040108b <+41>: movzbl (%rbx,%rax,1),%ecx0x000000000040108f <+45>: mov %cl,(%rsp)0x0000000000401092 <+48>: mov (%rsp),%rdx0x0000000000401096 <+52>: and $0xf,%edx0x0000000000401099 <+55>: movzbl 0x4024b0(%rdx),%edx0x00000000004010a0 <+62>: mov %dl,0x10(%rsp,%rax,1)0x00000000004010a4 <+66>: add $0x1,%rax0x00000000004010a8 <+70>: cmp $0x6,%rax0x00000000004010ac <+74>: jne 0x40108b "},{"id":"b124","type":"paragraph","html":"

以上是一個 for 循環，循環 6 次，取 edx 的後四位，這是一個 0~15 的數，記為 i，於是把 a[i] 加入棧中對應位置

","text":"以上是一個 for 循環，循環 6 次，取 edx 的後四位，這是一個 0~15 的數，記為 i，於是把 a[i] 加入棧中對應位置"},{"id":"b125","type":"paragraph","html":"$25","text":"12345678910111213141516170x00000000004010ae <+76>: movb $0x0,0x16(%rsp)0x00000000004010b3 <+81>: mov $0x40245e,%esi0x00000000004010b8 <+86>: lea 0x10(%rsp),%rdi0x00000000004010bd <+91>: callq 0x401338 0x00000000004010c2 <+96>: test %eax,%eax0x00000000004010c4 <+98>: je 0x4010d9 0x00000000004010c6 <+100>: callq 0x40143a 0x00000000004010cb <+105>: nopl 0x0(%rax,%rax,1)0x00000000004010d0 <+110>: jmp 0x4010d9 ...0x00000000004010d9 <+119>: mov 0x18(%rsp),%rax0x00000000004010de <+124>: xor %fs:0x28,%rax0x00000000004010e7 <+133>: je 0x4010ee 0x00000000004010e9 <+135>: callq 0x400b30 <__stack_chk_fail@plt>0x00000000004010ee <+140>: add $0x20,%rsp0x00000000004010f2 <+144>: pop %rbx0x00000000004010f3 <+145>: retq"},{"id":"b126","type":"paragraph","html":"

這裡有價值的片段只有

","text":"這裡有價值的片段只有"},{"id":"b127","type":"paragraph","html":"

0x00000000004010ae <+76>:    movb   $0x0,0x16(%rsp)
0x00000000004010b3 <+81>:    mov    $0x40245e,%esi
0x00000000004010b8 <+86>:    lea    0x10(%rsp),%rdi
0x00000000004010bd <+91>:    callq  0x401338 <strings_not_equal>
0x00000000004010c2 <+96>:    test   %eax,%eax
0x00000000004010c4 <+98>:    je     0x4010d9 <phase_5+119>
0x00000000004010c6 <+100>:   callq  0x40143a <explode_bomb>
0x00000000004010cb <+105>:   nopl   0x0(%rax,%rax,1)
0x00000000004010d0 <+110>:   jmp    0x4010d9 <phase_5+119>

","text":"1234567890x00000000004010ae <+76>: movb $0x0,0x16(%rsp)0x00000000004010b3 <+81>: mov $0x40245e,%esi0x00000000004010b8 <+86>: lea 0x10(%rsp),%rdi0x00000000004010bd <+91>: callq 0x401338 0x00000000004010c2 <+96>: test %eax,%eax0x00000000004010c4 <+98>: je 0x4010d9 0x00000000004010c6 <+100>: callq 0x40143a 0x00000000004010cb <+105>: nopl 0x0(%rax,%rax,1)0x00000000004010d0 <+110>: jmp 0x4010d9 "},{"id":"b128","type":"paragraph","html":"

這是比較字串。

","text":"這是比較字串。"},{"id":"b129","type":"paragraph","html":"

我們不難發現，這道題的邏輯是查表映射：程序會把輸入字元對 16 取模得到的數值作為索引，去尋找那個長字串（maduiers…）中的字元。為了讓最終取出來的字元拼成 flyers，我們需要反向尋找 flyers 中每個字母在表中對應的下標位置，然後構造一個輸入字串，使其每一位的 ASCII 碼模 16 後正好等於這些下標。

","text":"我們不難發現，這道題的邏輯是查表映射：程序會把輸入字元對 16 取模得到的數值作為索引，去尋找那個長字串（maduiers…）中的字元。為了讓最終取出來的字元拼成 flyers，我們需要反向尋找 flyers 中每個字母在表中對應的下標位置，然後構造一個輸入字串，使其每一位的 ASCII 碼模 16 後正好等於這些下標。"},{"id":"b130","type":"paragraph","html":"

這個過程可以總結為： Input Char -> ASCII Hex -> AND 0xF (取後4位) -> Table Index -> Lookup Table Char -> Target “flyers”

","text":"這個過程可以總結為： Input Char -> ASCII Hex -> AND 0xF (取後4位) -> Table Index -> Lookup Table Char -> Target “flyers”"},{"id":"b131","type":"paragraph","html":"

於是我們可以得到答案 ionefg 或者 IONEFG

","text":"於是我們可以得到答案 ionefg 或者 IONEFG"},{"id":"b132","type":"paragraph","html":"

其實還可以有一些其他答案，留給讀者去發現

","text":"其實還可以有一些其他答案，留給讀者去發現"},{"id":"b133","type":"heading","html":"

Phase 6

","text":"Phase 6"},{"id":"b134","type":"paragraph","html":"

先看代碼

","text":"先看代碼"},{"id":"b135","type":"paragraph","html":"$26","text":"$27"},{"id":"b136","type":"paragraph","html":"

分開來看：

","text":"分開來看："},{"id":"b137","type":"paragraph","html":"

0x00000000004010f4 <+0>:     push   %r14
0x00000000004010f6 <+2>:     push   %r13
0x00000000004010f8 <+4>:     push   %r12
0x00000000004010fa <+6>:     push   %rbp
0x00000000004010fb <+7>:     push   %rbx
0x00000000004010fc <+8>:     sub    $0x50,%rsp
0x0000000000401100 <+12>:    mov    %rsp,%r13
0x0000000000401103 <+15>:    mov    %rsp,%rsi

","text":"123456780x00000000004010f4 <+0>: push %r140x00000000004010f6 <+2>: push %r130x00000000004010f8 <+4>: push %r120x00000000004010fa <+6>: push %rbp0x00000000004010fb <+7>: push %rbx0x00000000004010fc <+8>: sub $0x50,%rsp0x0000000000401100 <+12>: mov %rsp,%r130x0000000000401103 <+15>: mov %rsp,%rsi"},{"id":"b138","type":"paragraph","html":"

這一段是設置棧幀

","text":"這一段是設置棧幀"},{"id":"b139","type":"paragraph","html":"

0x0000000000401106 <+18>:    callq  0x40145c <read_six_numbers>

","text":"10x0000000000401106 <+18>: callq 0x40145c "},{"id":"b140","type":"paragraph","html":"

這裡讀了 6 個數字，我們在 Phase 2 已經看到，這六個數字存在從 rsp 開始的一個數組中。

","text":"這裡讀了 6 個數字，我們在 Phase 2 已經看到，這六個數字存在從 rsp 開始的一個數組中。"},{"id":"b141","type":"paragraph","html":"$28","text":"123456789101112131415161718192021220x000000000040110b <+23>: mov %rsp,%r140x000000000040110e <+26>: mov $0x0,%r12d0x0000000000401114 <+32>: mov %r13,%rbp0x0000000000401117 <+35>: mov 0x0(%r13),%eax0x000000000040111b <+39>: sub $0x1,%eax0x000000000040111e <+42>: cmp $0x5,%eax0x0000000000401121 <+45>: jbe 0x401128 0x0000000000401123 <+47>: callq 0x40143a 0x0000000000401128 <+52>: add $0x1,%r12d0x000000000040112c <+56>: cmp $0x6,%r12d0x0000000000401130 <+60>: je 0x401153 0x0000000000401132 <+62>: mov %r12d,%ebx0x0000000000401135 <+65>: movslq %ebx,%rax0x0000000000401138 <+68>: mov (%rsp,%rax,4),%eax0x000000000040113b <+71>: cmp %eax,0x0(%rbp)0x000000000040113e <+74>: jne 0x401145 0x0000000000401140 <+76>: callq 0x40143a 0x0000000000401145 <+81>: add $0x1,%ebx0x0000000000401148 <+84>: cmp $0x5,%ebx0x000000000040114b <+87>: jle 0x401135 0x000000000040114d <+89>: add $0x4,%r130x0000000000401151 <+93>: jmp 0x401114 "},{"id":"b142","type":"paragraph","html":"

此處代碼構建了一個典型的嵌套循環結構：外層循環由 %r12d 計數，內層循環則由 %ebx 控制。

","text":"此處代碼構建了一個典型的嵌套循環結構：外層循環由 %r12d 計數，內層循環則由 %ebx 控制。"},{"id":"b143","type":"paragraph","html":"

0x0000000000401117 <+35>:    mov    0x0(%r13),%eax
0x000000000040111b <+39>:    sub    $0x1,%eax
0x000000000040111e <+42>:    cmp    $0x5,%eax
...
0x000000000040114d <+89>:    add    $0x4,%r13
0x0000000000401151 <+93>:    jmp    0x401114 <phase_6+32>

","text":"1234560x0000000000401117 <+35>: mov 0x0(%r13),%eax0x000000000040111b <+39>: sub $0x1,%eax0x000000000040111e <+42>: cmp $0x5,%eax...0x000000000040114d <+89>: add $0x4,%r130x0000000000401151 <+93>: jmp 0x401114 "},{"id":"b144","type":"paragraph","html":"

首先分析外層循環：它通過 %r13 指針遍歷輸入數組，首要任務是進行邊界檢查，確保讀取到的每一個數字都小於或等於 6。

","text":"首先分析外層循環：它通過 %r13 指針遍歷輸入數組，首要任務是進行邊界檢查，確保讀取到的每一個數字都小於或等於 6。"},{"id":"b145","type":"paragraph","html":"

再來看內層循環：

","text":"再來看內層循環："},{"id":"b146","type":"paragraph","html":"

0x0000000000401132 <+62>:    mov    %r12d,%ebx
0x0000000000401135 <+65>:    movslq %ebx,%rax
0x0000000000401138 <+68>:    mov    (%rsp,%rax,4),%eax
0x000000000040113b <+71>:    cmp    %eax,0x0(%rbp)
0x000000000040113e <+74>:    jne    0x401145 <phase_6+81>
0x0000000000401140 <+76>:    callq  0x40143a <explode_bomb>
0x0000000000401145 <+81>:    add    $0x1,%ebx
0x0000000000401148 <+84>:    cmp    $0x5,%ebx
0x000000000040114b <+87>:    jle    0x401135 <phase_6+65>

","text":"1234567890x0000000000401132 <+62>: mov %r12d,%ebx0x0000000000401135 <+65>: movslq %ebx,%rax0x0000000000401138 <+68>: mov (%rsp,%rax,4),%eax0x000000000040113b <+71>: cmp %eax,0x0(%rbp)0x000000000040113e <+74>: jne 0x401145 0x0000000000401140 <+76>: callq 0x40143a 0x0000000000401145 <+81>: add $0x1,%ebx0x0000000000401148 <+84>: cmp $0x5,%ebx0x000000000040114b <+87>: jle 0x401135 "},{"id":"b147","type":"paragraph","html":"

這裡從當前外層數字開始，判斷數組之後的每一個數位（int 類型，4 位元組，故 (%rsp,%rax,4) 獲得當前數字），判斷這個數字是否和外層數字相同。

","text":"這裡從當前外層數字開始，判斷數組之後的每一個數位（int 類型，4 位元組，故 (%rsp,%rax,4) 獲得當前數字），判斷這個數字是否和外層數字相同。"},{"id":"b148","type":"paragraph","html":"

於是，我們發現，這一層循環判斷輸入的每個數字是否互不相同。

","text":"於是，我們發現，這一層循環判斷輸入的每個數字是否互不相同。"},{"id":"b149","type":"paragraph","html":"

總結一下，這個嵌套循環檢查我們的輸入是否是六個互不相同的小於等於 6 的數字

","text":"總結一下，這個嵌套循環檢查我們的輸入是否是六個互不相同的小於等於 6 的數字"},{"id":"b150","type":"paragraph","html":"

0x0000000000401153 <+95>:    lea    0x18(%rsp),%rsi
0x0000000000401158 <+100>:   mov    %r14,%rax
0x000000000040115b <+103>:   mov    $0x7,%ecx
0x0000000000401160 <+108>:   mov    %ecx,%edx
0x0000000000401162 <+110>:   sub    (%rax),%edx
0x0000000000401164 <+112>:   mov    %edx,(%rax)
0x0000000000401166 <+114>:   add    $0x4,%rax
0x000000000040116a <+118>:   cmp    %rsi,%rax
0x000000000040116d <+121>:   jne    0x401160 <phase_6+108>

","text":"1234567890x0000000000401153 <+95>: lea 0x18(%rsp),%rsi0x0000000000401158 <+100>: mov %r14,%rax0x000000000040115b <+103>: mov $0x7,%ecx0x0000000000401160 <+108>: mov %ecx,%edx0x0000000000401162 <+110>: sub (%rax),%edx0x0000000000401164 <+112>: mov %edx,(%rax)0x0000000000401166 <+114>: add $0x4,%rax0x000000000040116a <+118>: cmp %rsi,%rax0x000000000040116d <+121>: jne 0x401160 "},{"id":"b151","type":"paragraph","html":"

這裡又有一個循環。前文已知，r14 就是 rsp，也就是棧指針。這裡遍歷每一個數 x，重新賦值，x = 7-x

","text":"這裡又有一個循環。前文已知，r14 就是 rsp，也就是棧指針。這裡遍歷每一個數 x，重新賦值，x = 7-x"},{"id":"b152","type":"paragraph","html":"$29","text":"1234567891011121314151617180x000000000040116f <+123>: mov $0x0,%esi0x0000000000401174 <+128>: jmp 0x401197 0x0000000000401176 <+130>: mov 0x8(%rdx),%rdx0x000000000040117a <+134>: add $0x1,%eax0x000000000040117d <+137>: cmp %ecx,%eax0x000000000040117f <+139>: jne 0x401176 0x0000000000401181 <+141>: jmp 0x401188 0x0000000000401183 <+143>: mov $0x6032d0,%edx0x0000000000401188 <+148>: mov %rdx,0x20(%rsp,%rsi,2)0x000000000040118d <+153>: add $0x4,%rsi0x0000000000401191 <+157>: cmp $0x18,%rsi0x0000000000401195 <+161>: je 0x4011ab 0x0000000000401197 <+163>: mov (%rsp,%rsi,1),%ecx0x000000000040119a <+166>: cmp $0x1,%ecx0x000000000040119d <+169>: jle 0x401183 0x000000000040119f <+171>: mov $0x1,%eax0x00000000004011a4 <+176>: mov $0x6032d0,%edx0x00000000004011a9 <+181>: jmp 0x401176 "},{"id":"b153","type":"paragraph","html":"

先讀取輸入的元素 x，如果小於等於 1，把 edx 賦值為 0x6032d0，然後把 x 放在一個臨時數組中，然後繼續到下一個元素，直到遍歷完整個數組 (0x18 = 24 = 4*6)

","text":"先讀取輸入的元素 x，如果小於等於 1，把 edx 賦值為 0x6032d0，然後把 x 放在一個臨時數組中，然後繼續到下一個元素，直到遍歷完整個數組 (0x18 = 24 = 4*6)"},{"id":"b154","type":"paragraph","html":"

如果元素 x 大於 1，把 eax 賦值為 1，edx 賦值為 0x6032d0，之後執行 x-1 次 mov 0x8(%rdx),%rdx 操作

","text":"如果元素 x 大於 1，把 eax 賦值為 1，edx 賦值為 0x6032d0，之後執行 x-1 次 mov 0x8(%rdx),%rdx 操作"},{"id":"b155","type":"paragraph","html":"

這裡疑似是鍊表，出現了記憶體地址 0x6032d0，我們來看看：

","text":"這裡疑似是鍊表，出現了記憶體地址 0x6032d0，我們來看看："},{"id":"b156","type":"paragraph","html":"

(gdb) x/12xg 0x6032d0
0x6032d0 <node1>:       0x000000010000014c      0x00000000006032e0
0x6032e0 <node2>:       0x00000002000000a8      0x00000000006032f0
0x6032f0 <node3>:       0x000000030000039c      0x0000000000603300
0x603300 <node4>:       0x00000004000002b3      0x0000000000603310
0x603310 <node5>:       0x00000005000001dd      0x0000000000603320
0x603320 <node6>:       0x00000006000001bb      0x0000000000000000

","text":"1234567(gdb) x/12xg 0x6032d00x6032d0 : 0x000000010000014c 0x00000000006032e00x6032e0 : 0x00000002000000a8 0x00000000006032f00x6032f0 : 0x000000030000039c 0x00000000006033000x603300 : 0x00000004000002b3 0x00000000006033100x603310 : 0x00000005000001dd 0x00000000006033200x603320 : 0x00000006000001bb 0x0000000000000000"},{"id":"b157","type":"paragraph","html":"

這裡注意，在 64 位系統中，指針占用 8 位元組（即 64 位）。

","text":"這裡注意，在 64 位系統中，指針占用 8 位元組（即 64 位）。"},{"id":"b158","type":"paragraph","html":"

顯然是鍊表，0x8(%rdx) 代表 next 指針

","text":"顯然是鍊表，0x8(%rdx) 代表 next 指針"},{"id":"b159","type":"paragraph","html":"

故上述操作得到一個數組，設輸入數組的第 i 個數為 x，數組中第 i 個數對應鍊表中第 x 個數的地址。

","text":"故上述操作得到一個數組，設輸入數組的第 i 個數為 x，數組中第 i 個數對應鍊表中第 x 個數的地址。"},{"id":"b160","type":"paragraph","html":"

1
2
3

0x00000000004011ab <+183>:   mov    0x20(%rsp),%rbx
0x00000000004011b0 <+188>:   lea    0x28(%rsp),%rax
0x00000000004011b5 <+193>:   lea    0x50(%rsp),%rsi

","text":"1230x00000000004011ab <+183>: mov 0x20(%rsp),%rbx0x00000000004011b0 <+188>: lea 0x28(%rsp),%rax0x00000000004011b5 <+193>: lea 0x50(%rsp),%rsi"},{"id":"b161","type":"paragraph","html":"

這裡是一些初始化。rsi 是邊界指針，標記循環的終止。0x20 到 0x50 正好 6*8=48

","text":"這裡是一些初始化。rsi 是邊界指針，標記循環的終止。0x20 到 0x50 正好 6*8=48"},{"id":"b162","type":"paragraph","html":"

0x00000000004011ba <+198>:   mov    %rbx,%rcx
0x00000000004011bd <+201>:   mov    (%rax),%rdx
0x00000000004011c0 <+204>:   mov    %rdx,0x8(%rcx)
0x00000000004011c4 <+208>:   add    $0x8,%rax
0x00000000004011c8 <+212>:   cmp    %rsi,%rax
0x00000000004011cb <+215>:   je     0x4011d2 <phase_6+222>
0x00000000004011cd <+217>:   mov    %rdx,%rcx
0x00000000004011d0 <+220>:   jmp    0x4011bd <phase_6+201>

","text":"123456780x00000000004011ba <+198>: mov %rbx,%rcx0x00000000004011bd <+201>: mov (%rax),%rdx0x00000000004011c0 <+204>: mov %rdx,0x8(%rcx)0x00000000004011c4 <+208>: add $0x8,%rax0x00000000004011c8 <+212>: cmp %rsi,%rax0x00000000004011cb <+215>: je 0x4011d2 0x00000000004011cd <+217>: mov %rdx,%rcx0x00000000004011d0 <+220>: jmp 0x4011bd "},{"id":"b163","type":"paragraph","html":"

這裡遍歷了我們剛才得到的鍊表地址數組。寫成 C 語言或許更好理解。

","text":"這裡遍歷了我們剛才得到的鍊表地址數組。寫成 C 語言或許更好理解。"},{"id":"b164","type":"paragraph","html":"

Node *current = node_ptrs[0]; 
int i = 1; 

while (i < 6) {
    Node *next_node = node_ptrs[i]; 
    current->next = next_node;      
    current = next_node;            
    i++;                            
}

","text":"123456789Node *current = node_ptrs[0]; int i = 1; while (i < 6) { Node *next_node = node_ptrs[i]; current->next = next_node; current = next_node; i++; }"},{"id":"b165","type":"paragraph","html":"

這一個循環對於鍊表結構進行了修改。

","text":"這一個循環對於鍊表結構進行了修改。"},{"id":"b166","type":"paragraph","html":"

0x00000000004011d2 <+222>:   movq   $0x0,0x8(%rdx)

","text":"10x00000000004011d2 <+222>: movq $0x0,0x8(%rdx)"},{"id":"b167","type":"paragraph","html":"

這句話則把最後一個節點的 next 賦值為 NULL，確保鍊表結構

","text":"這句話則把最後一個節點的 next 賦值為 NULL，確保鍊表結構"},{"id":"b168","type":"paragraph","html":"

接下來又有一個循環：

","text":"接下來又有一個循環："},{"id":"b169","type":"paragraph","html":"

0x00000000004011da <+230>:   mov    $0x5,%ebp
0x00000000004011df <+235>:   mov    0x8(%rbx),%rax
0x00000000004011e3 <+239>:   mov    (%rax),%eax
0x00000000004011e5 <+241>:   cmp    %eax,(%rbx)
0x00000000004011e7 <+243>:   jge    0x4011ee <phase_6+250>
0x00000000004011e9 <+245>:   callq  0x40143a <explode_bomb>
0x00000000004011ee <+250>:   mov    0x8(%rbx),%rbx
0x00000000004011f2 <+254>:   sub    $0x1,%ebp
0x00000000004011f5 <+257>:   jne    0x4011df <phase_6+235>

","text":"1234567890x00000000004011da <+230>: mov $0x5,%ebp0x00000000004011df <+235>: mov 0x8(%rbx),%rax0x00000000004011e3 <+239>: mov (%rax),%eax0x00000000004011e5 <+241>: cmp %eax,(%rbx)0x00000000004011e7 <+243>: jge 0x4011ee 0x00000000004011e9 <+245>: callq 0x40143a 0x00000000004011ee <+250>: mov 0x8(%rbx),%rbx0x00000000004011f2 <+254>: sub $0x1,%ebp0x00000000004011f5 <+257>: jne 0x4011df "},{"id":"b170","type":"paragraph","html":"

遍歷鍊表，確保鍊表倒序排列。

","text":"遍歷鍊表，確保鍊表倒序排列。"},{"id":"b171","type":"paragraph","html":"

看到這裡，我們就可以得到答案了：

","text":"看到這裡，我們就可以得到答案了："},{"id":"b172","type":"paragraph","html":"

(gdb) x/12xg 0x6032d0
0x6032d0 <node1>:       0x000000010000014c      0x00000000006032e0
0x6032e0 <node2>:       0x00000002000000a8      0x00000000006032f0
0x6032f0 <node3>:       0x000000030000039c      0x0000000000603300
0x603300 <node4>:       0x00000004000002b3      0x0000000000603310
0x603310 <node5>:       0x00000005000001dd      0x0000000000603320
0x603320 <node6>:       0x00000006000001bb      0x0000000000000000

找到鍊表值的倒序索引即可，注意值是 int 類型，只取後四位。於是可以得到 3 4 5 6 1 2

","text":"找到鍊表值的倒序索引即可，注意值是 int 類型，只取後四位。於是可以得到 3 4 5 6 1 2"},{"id":"b174","type":"paragraph","html":"

但我們還要注意，輸入進行過 7-x 操作（見上文），所以我們調整答案 4 3 2 1 6 5

","text":"但我們還要注意，輸入進行過 7-x 操作（見上文），所以我們調整答案 4 3 2 1 6 5"},{"id":"b175","type":"paragraph","html":"

最後一個 Phase 有點複雜，巧妙融合了嵌套循環校驗、數組映射變換以及鍊表重組等多種技術。

","text":"最後一個 Phase 有點複雜，巧妙融合了嵌套循環校驗、數組映射變換以及鍊表重組等多種技術。"},{"id":"b176","type":"heading","html":"

隱藏關

","text":"隱藏關"},{"id":"b177","type":"paragraph","html":"


input = read_line();             
phase_1(input);                  
phase_defused();                 

printf(\"Phase 1 defused. How about the next one?\\n\");



input = read_line();
phase_2(input);
phase_defused();
printf(\"That's number 2.  Keep going!\\n\");



input = read_line();
phase_3(input);
phase_defused();
printf(\"Halfway there!\\n\");


input = read_line();
phase_4(input);
phase_defused();
printf(\"So you got that one.  Try this one.\\n\");


input = read_line();
phase_5(input);
phase_defused();
printf(\"Good work!  On to the next...\\n\");



input = read_line();
phase_6(input);
phase_defused();

","text":"1234567891011121314151617181920212223242526272829303132333435363738input = read_line(); phase_1(input); phase_defused(); printf(\"Phase 1 defused. How about the next one?\\n\");input = read_line();phase_2(input);phase_defused();printf(\"That's number 2. Keep going!\\n\");input = read_line();phase_3(input);phase_defused();printf(\"Halfway there!\\n\");input = read_line();phase_4(input);phase_defused();printf(\"So you got that one. Try this one.\\n\");input = read_line();phase_5(input);phase_defused();printf(\"Good work! On to the next...\\n\");input = read_line();phase_6(input);phase_defused();"},{"id":"b178","type":"paragraph","html":"

bomb 代碼中，每一個 phase 後都運行 phase_defused。我們來看看：

","text":"bomb 代碼中，每一個 phase 後都運行 phase_defused。我們來看看："},{"id":"b179","type":"paragraph","html":"$2a","text":"$2b"},{"id":"b180","type":"paragraph","html":"

0x00000000004015d8 <+20>:    cmpl   $0x6,0x202181(%rip)        # 0x603760 <num_input_strings>

","text":"10x00000000004015d8 <+20>: cmpl $0x6,0x202181(%rip) # 0x603760 "},{"id":"b181","type":"paragraph","html":"

這裡要求六關全部通過之後才能進入 secret_phase

","text":"這裡要求六關全部通過之後才能進入 secret_phase"},{"id":"b182","type":"paragraph","html":"

我們可以設置條件斷點：b phase_defused if num_input_strings == 6

","text":"我們可以設置條件斷點：b phase_defused if num_input_strings == 6"},{"id":"b183","type":"paragraph","html":"

注意到：

","text":"注意到："},{"id":"b184","type":"paragraph","html":"

0x0000000000401630 <+108>:   callq  0x401242 <secret_phase>

","text":"10x0000000000401630 <+108>: callq 0x401242 "},{"id":"b185","type":"paragraph","html":"

這裡有非常多的記憶體地址，其中：

","text":"這裡有非常多的記憶體地址，其中："},{"id":"b186","type":"paragraph","html":"

(gdb) x/s 0x402619
0x402619:       \"%d %d %s\"
(gdb) x/s 0x603870
0x603870 <input_strings+240>:   \"7 0\"
(gdb) x/s 0x402622
0x402622:       \"DrEvil\"

","text":"123456(gdb) x/s 0x4026190x402619: \"%d %d %s\"(gdb) x/s 0x6038700x603870 : \"7 0\"(gdb) x/s 0x4026220x402622: \"DrEvil\""},{"id":"b187","type":"paragraph","html":"

判斷 Phase 4 輸入之後是否有一個字串 DrEvil，如果有，進入隱藏關！

","text":"判斷 Phase 4 輸入之後是否有一個字串 DrEvil，如果有，進入隱藏關！"},{"id":"b188","type":"paragraph","html":"

再來看看隱藏關的代碼：

","text":"再來看看隱藏關的代碼："},{"id":"b189","type":"paragraph","html":"$2c","text":"$2d"},{"id":"b190","type":"paragraph","html":"

看到 strtol，知道這裡讀入了一個整數

","text":"看到 strtol，知道這裡讀入了一個整數"},{"id":"b191","type":"paragraph","html":"

0x000000000040125a <+24>:    mov    %rax,%rbx
0x000000000040125d <+27>:    lea    -0x1(%rax),%eax
0x0000000000401260 <+30>:    cmp    $0x3e8,%eax
0x0000000000401265 <+35>:    jbe    0x40126c <secret_phase+42>
0x0000000000401267 <+37>:    callq  0x40143a <explode_bomb>

","text":"123450x000000000040125a <+24>: mov %rax,%rbx0x000000000040125d <+27>: lea -0x1(%rax),%eax0x0000000000401260 <+30>: cmp $0x3e8,%eax0x0000000000401265 <+35>: jbe 0x40126c 0x0000000000401267 <+37>: callq 0x40143a "},{"id":"b192","type":"paragraph","html":"

要求讀取的整數小於等於 1001。注意 jbe 是無符號數的跳轉檢查，所以這裡其實也隱性限制了下限。所以嚴格的輸入限制是 [1, 1001] 之間的整數。

","text":"要求讀取的整數小於等於 1001。注意 jbe 是無符號數的跳轉檢查，所以這裡其實也隱性限制了下限。所以嚴格的輸入限制是 [1, 1001] 之間的整數。"},{"id":"b193","type":"paragraph","html":"

1
2
3

0x000000000040126c <+42>:    mov    %ebx,%esi
0x000000000040126e <+44>:    mov    $0x6030f0,%edi
0x0000000000401273 <+49>:    callq  0x401204 <fun7>

","text":"1230x000000000040126c <+42>: mov %ebx,%esi0x000000000040126e <+44>: mov $0x6030f0,%edi0x0000000000401273 <+49>: callq 0x401204 "},{"id":"b194","type":"paragraph","html":"

傳參，進入 fun7

","text":"傳參，進入 fun7"},{"id":"b195","type":"paragraph","html":"

0x0000000000401278 <+54>:    cmp    $0x2,%eax
0x000000000040127b <+57>:    je     0x401282 <secret_phase+64>
0x000000000040127d <+59>:    callq  0x40143a <explode_bomb>
0x0000000000401282 <+64>:    mov    $0x402438,%edi

","text":"12340x0000000000401278 <+54>: cmp $0x2,%eax0x000000000040127b <+57>: je 0x401282 0x000000000040127d <+59>: callq 0x40143a 0x0000000000401282 <+64>: mov $0x402438,%edi"},{"id":"b196","type":"paragraph","html":"

這裡要求 fun7 的返回值等於 2

","text":"這裡要求 fun7 的返回值等於 2"},{"id":"b197","type":"paragraph","html":"

接下來我們看看 fun7，手動分個段

","text":"接下來我們看看 fun7，手動分個段"},{"id":"b198","type":"paragraph","html":"$2e","text":"123456789101112131415161718192021222324252627Dump of assembler code for function fun7: 0x0000000000401204 <+0>: sub $0x8,%rsp 0x0000000000401208 <+4>: test %rdi,%rdi 0x000000000040120b <+7>: je 0x401238 0x000000000040120d <+9>: mov (%rdi),%edx 0x000000000040120f <+11>: cmp %esi,%edx 0x0000000000401211 <+13>: jle 0x401220 0x0000000000401213 <+15>: mov 0x8(%rdi),%rdi 0x0000000000401217 <+19>: callq 0x401204 0x000000000040121c <+24>: add %eax,%eax 0x000000000040121e <+26>: jmp 0x40123d 0x0000000000401220 <+28>: mov $0x0,%eax 0x0000000000401225 <+33>: cmp %esi,%edx 0x0000000000401227 <+35>: je 0x40123d 0x0000000000401229 <+37>: mov 0x10(%rdi),%rdi 0x000000000040122d <+41>: callq 0x401204 0x0000000000401232 <+46>: lea 0x1(%rax,%rax,1),%eax 0x0000000000401236 <+50>: jmp 0x40123d 0x0000000000401238 <+52>: mov $0xffffffff,%eax 0x000000000040123d <+57>: add $0x8,%rsp 0x0000000000401241 <+61>: retq End of assembler dump."},{"id":"b199","type":"paragraph","html":"

遍歷當前 rdi 之後的兩個指針，遞迴，有點像二叉樹。我們來看看初始參數：

","text":"遍歷當前 rdi 之後的兩個指針，遞迴，有點像二叉樹。我們來看看初始參數："},{"id":"b200","type":"paragraph","html":"$2f","text":"$30"},{"id":"b201","type":"paragraph","html":"

確實是一顆二叉樹！（這裡的 60 是我試出來的）

","text":"確實是一顆二叉樹！（這裡的 60 是我試出來的）"},{"id":"b202","type":"paragraph","html":"

fun7 傳入的參數為 rdi 和 esi

","text":"fun7 傳入的參數為 rdi 和 esi"},{"id":"b203","type":"paragraph","html":"

0x0000000000401208 <+4>:     test   %rdi,%rdi
0x000000000040120b <+7>:     je     0x401238 <fun7+52>
...
0x0000000000401238 <+52>:    mov    $0xffffffff,%eax
0x000000000040123d <+57>:    add    $0x8,%rsp
0x0000000000401241 <+61>:    retq

","text":"1234560x0000000000401208 <+4>: test %rdi,%rdi0x000000000040120b <+7>: je 0x401238 ...0x0000000000401238 <+52>: mov $0xffffffff,%eax0x000000000040123d <+57>: add $0x8,%rsp0x0000000000401241 <+61>: retq"},{"id":"b204","type":"paragraph","html":"

如果遍歷到葉子結點，直接返回 0xffffffff。

","text":"如果遍歷到葉子結點，直接返回 0xffffffff。"},{"id":"b205","type":"paragraph","html":"

1
2
3

0x000000000040120d <+9>:     mov    (%rdi),%edx
0x000000000040120f <+11>:    cmp    %esi,%edx
0x0000000000401211 <+13>:    jle    0x401220 <fun7+28>

","text":"1230x000000000040120d <+9>: mov (%rdi),%edx0x000000000040120f <+11>: cmp %esi,%edx0x0000000000401211 <+13>: jle 0x401220 "},{"id":"b206","type":"paragraph","html":"

查看當前節點的值，如果值大於 esi：

","text":"查看當前節點的值，如果值大於 esi："},{"id":"b207","type":"paragraph","html":"

0x0000000000401213 <+15>:    mov    0x8(%rdi),%rdi
0x0000000000401217 <+19>:    callq  0x401204 <fun7>
0x000000000040121c <+24>:    add    %eax,%eax
0x000000000040121e <+26>:    jmp    0x40123d <fun7+57>
...
0x000000000040123d <+57>:    add    $0x8,%rsp
0x0000000000401241 <+61>:    retq

","text":"12345670x0000000000401213 <+15>: mov 0x8(%rdi),%rdi0x0000000000401217 <+19>: callq 0x401204 0x000000000040121c <+24>: add %eax,%eax0x000000000040121e <+26>: jmp 0x40123d ...0x000000000040123d <+57>: add $0x8,%rsp0x0000000000401241 <+61>: retq"},{"id":"b208","type":"paragraph","html":"

訪問左子節點，返回值乘以二

","text":"訪問左子節點，返回值乘以二"},{"id":"b209","type":"paragraph","html":"

如果當前節點的值和 rsi 相等：

","text":"如果當前節點的值和 rsi 相等："},{"id":"b210","type":"paragraph","html":"

0x0000000000401220 <+28>:    mov    $0x0,%eax
0x0000000000401225 <+33>:    cmp    %esi,%edx
0x0000000000401227 <+35>:    je     0x40123d <fun7+57>
...
0x000000000040123d <+57>:    add    $0x8,%rsp
0x0000000000401241 <+61>:    retq

","text":"1234560x0000000000401220 <+28>: mov $0x0,%eax0x0000000000401225 <+33>: cmp %esi,%edx0x0000000000401227 <+35>: je 0x40123d ...0x000000000040123d <+57>: add $0x8,%rsp0x0000000000401241 <+61>: retq"},{"id":"b211","type":"paragraph","html":"

直接返回

","text":"直接返回"},{"id":"b212","type":"paragraph","html":"

否則，訪問右子節點：

","text":"否則，訪問右子節點："},{"id":"b213","type":"paragraph","html":"

0x0000000000401229 <+37>:    mov    0x10(%rdi),%rdi
0x000000000040122d <+41>:    callq  0x401204 <fun7>
0x0000000000401232 <+46>:    lea    0x1(%rax,%rax,1),%eax
0x0000000000401236 <+50>:    jmp    0x40123d <fun7+57>
...
0x000000000040123d <+57>:    add    $0x8,%rsp
0x0000000000401241 <+61>:    retq

","text":"12345670x0000000000401229 <+37>: mov 0x10(%rdi),%rdi0x000000000040122d <+41>: callq 0x401204 0x0000000000401232 <+46>: lea 0x1(%rax,%rax,1),%eax0x0000000000401236 <+50>: jmp 0x40123d ...0x000000000040123d <+57>: add $0x8,%rsp0x0000000000401241 <+61>: retq"},{"id":"b214","type":"paragraph","html":"

返回值乘以二再加一

","text":"返回值乘以二再加一"},{"id":"b215","type":"paragraph","html":"

我們可以用 C 語言翻譯上述代碼：

","text":"我們可以用 C 語言翻譯上述代碼："},{"id":"b216","type":"paragraph","html":"

long fun7(struct Node *node, int target_val) {
    
    if (node == NULL) {
        return -1; 
    }

    int current_val = node->value; 

    
    
    if (current_val > target_val) {
        
        
        return 2 * fun7(node->left, target_val);
    }
    
    
    
    if (current_val == target_val) {
        return 0; 
    }

    
    
    
    
    return 2 * fun7(node->right, target_val) + 1;
}

","text":"12345678910111213141516171819202122232425262728long fun7(struct Node *node, int target_val) { if (node == NULL) { return -1; } int current_val = node->value; if (current_val > target_val) { return 2 * fun7(node->left, target_val); } if (current_val == target_val) { return 0; } return 2 * fun7(node->right, target_val) + 1;}"},{"id":"b217","type":"paragraph","html":"

我們再來看看二叉樹的結構，根據：

","text":"我們再來看看二叉樹的結構，根據："},{"id":"b218","type":"paragraph","html":"$31","text":"$32"},{"id":"b219","type":"paragraph","html":"

graph TD
    N1((36)) --> N21((8))
    N1 --> N22((50))

    N21 --> N31((6))
    N21 --> N32((22))

    N22 --> N33((45))
    N22 --> N34((107))

    N31 --> N41((1))
    N31 --> N42((7))

    N32 --> N43((20))
    N32 --> N44((35))

    N33 --> N45((40))
    N33 --> N46((47))

    N34 --> N47((99))
    N34 --> N48((1001))

","text":"123456789101112131415161718192021graph TD N1((36)) --> N21((8)) N1 --> N22((50)) N21 --> N31((6)) N21 --> N32((22)) N22 --> N33((45)) N22 --> N34((107)) N31 --> N41((1)) N31 --> N42((7)) N32 --> N43((20)) N32 --> N44((35)) N33 --> N45((40)) N33 --> N46((47)) N34 --> N47((99)) N34 --> N48((1001))"},{"id":"b220","type":"paragraph","html":"

要求最終輸出為 2，2 = 1*2

","text":"要求最終輸出為 2，2 = 1*2"},{"id":"b221","type":"paragraph","html":"

先向左，再向右，然後找到了答案。

","text":"先向左，再向右，然後找到了答案。"},{"id":"b222","type":"paragraph","html":"

於是，我們得到答案 22

","text":"於是，我們得到答案 22"},{"id":"b223","type":"heading","html":"

總結

","text":"總結"},{"id":"b224","type":"paragraph","html":"

於是，最終答案是：

","text":"於是，最終答案是："},{"id":"b225","type":"paragraph","html":"

Border relations with Canada have never been better.
1 2 4 8 16 32
0 207
7 0 DrEvil
ionefg
4 3 2 1 6 5
22

","text":"1234567Border relations with Canada have never been better.1 2 4 8 16 320 2077 0 DrEvilionefg4 3 2 1 6 522"},{"id":"b226","type":"paragraph","html":"

最後讓 AI 生成一段小結

","text":"最後讓 AI 生成一段小結"},{"id":"b227","type":"paragraph","html":"

CSAPP Bomb Lab 是一個非常經典的實驗，它不僅是一次對匯編語言 (x86-64) 的深度練習，更是一場邏輯推理的解謎遊戲。

","text":"CSAPP Bomb Lab 是一個非常經典的實驗，它不僅是一次對匯編語言 (x86-64) 的深度練習，更是一場邏輯推理的解謎遊戲。"},{"id":"b228","type":"paragraph","html":"

回顧整個拆彈過程，我們經歷了從簡單到複雜的演進：

","text":"回顧整個拆彈過程，我們經歷了從簡單到複雜的演進："},{"id":"b229","type":"list","html":"

基礎控制流：從 Phase 1 的字串比較，到 Phase 2 的循環與棧上數組操作。
高級控制流：Phase 3 展示了 switch 語句如何通過跳轉表實現，Phase 4 則通過遞迴讓我們深入理解了棧幀的生長與銷毀以及二分尋找算法。
數據操縱：Phase 5 的位運算與字元數組索引映射，考察了對指針和記憶體定址的敏感度。
數據結構：Phase 6 的鍊表重排以及隱藏關卡的二叉搜索樹（BST），讓我們看到了高級數據結構在匯編層面的具體形態（指針即地址）。

","text":"基礎控制流：從 Phase 1 的字串比較，到 Phase 2 的循環與棧上數組操作。高級控制流：Phase 3 展示了 switch 語句如何通過跳轉表實現，Phase 4 則通過遞迴讓我們深入理解了棧幀的生長與銷毀以及二分尋找算法。數據操縱：Phase 5 的位運算與字元數組索引映射，考察了對指針和記憶體定址的敏感度。數據結構：Phase 6 的鍊表重排以及隱藏關卡的二叉搜索樹（BST），讓我們看到了高級數據結構在匯編層面的具體形態（指針即地址）。"},{"id":"b230","type":"paragraph","html":"

在這個過程中，gdb 是最強大的武器。熟練掌握斷點設置、暫存器查看 (i r) 和記憶體檢查 (x/) 是通關的關鍵。同時，我們也深刻體會到了編譯器最佳化的“智慧”（如利用 lea 進行算術運算、利用無符號數比較合併上下界檢查）和 C 語言與機器碼之間的映射關係。

","text":"在這個過程中，gdb 是最強大的武器。熟練掌握斷點設置、暫存器查看 (i r) 和記憶體檢查 (x/) 是通關的關鍵。同時，我們也深刻體會到了編譯器最佳化的“智慧”（如利用 lea 進行算術運算、利用無符號數比較合併上下界檢查）和 C 語言與機器碼之間的映射關係。"},{"id":"b231","type":"paragraph","html":"

當看到終端最終列印出 “Congratulations! You’ve defused the bomb!” 時，所有的查表、計算和堆棧分析都是值得的。希望這篇解析能對你理解計算機底層系統有所幫助。 Happy Hacking!

","text":"當看到終端最終列印出 “Congratulations! You’ve defused the bomb!” 時，所有的查表、計算和堆棧分析都是值得的。希望這篇解析能對你理解計算機底層系統有所幫助。 Happy Hacking!"}],"source":"$0:f:0:1:0:props:children:props:children:1:props:children:props:children:props:children:0:props:sources:336","originalUrl":"https://blog.aeilot.top/2025/12/21/csapp-lab2/","excerpt":"做完了 CSAPP Bomb Lab，寫一篇解析。題目要求運行一個二進制文件 bomb，它包括六個”階段(phase)”，每個階段要求學生通過 stdin 輸入一個特定的字串。如果輸入了預期的字串，那麼該階段被”拆除”，進入下一個階段，直到所有炸彈被成功”拆除”。否則，炸彈就會”爆炸”，列印出”BOOM!!!” 環境這個系統是在 x86_64 Linux 上運行的，而筆者的環境是 ARM 架構"},"shouldTranslate":true}],"$L33"]}]