Skip to content

Instantly share code, notes, and snippets.

View Cee's full-sized avatar
πŸŽ€
ハネだ (<ゝω·)β˜†

Tianyu Wang Cee

πŸŽ€
ハネだ (<ゝω·)β˜†
View GitHub Profile
@Cee
Cee / phase_5.asm
Created July 26, 2014 07:51
phase_5
0x0000000000401002 <+0>: sub $0x18,%rsp
0x0000000000401006 <+4>: lea 0x8(%rsp),%rcx
0x000000000040100b <+9>: lea 0xc(%rsp),%rdx
0x0000000000401010 <+14>: mov $0x401ebe,%esi
0x0000000000401015 <+19>: mov $0x0,%eax
0x000000000040101a <+24>: callq 0x400ab0 <__isoc99_sscanf@plt>
0x000000000040101f <+29>: cmp $0x1,%eax
0x0000000000401022 <+32>: jg 0x401029 <phase_5+39>
0x0000000000401024 <+34>: callq 0x40163d <explode_bomb>
0x0000000000401029 <+39>: mov 0xc(%rsp),%eax
@Cee
Cee / phase_6.asm
Created July 26, 2014 08:31
phase_6
0x00000000004010d9 <+0>: sub $0x8,%rsp
0x00000000004010dd <+4>: mov $0xa,%edx
0x00000000004010e2 <+9>: mov $0x0,%esi
0x00000000004010e7 <+14>: callq 0x400b80 <strtol@plt>
0x00000000004010ec <+19>: mov %eax,0x20168e(%rip) # 0x602780 <node0>
0x00000000004010f2 <+25>: mov $0x602780,%edi
0x00000000004010f7 <+30>: callq 0x40106f <fun6>
0x00000000004010fc <+35>: mov 0x8(%rax),%rax
0x0000000000401100 <+39>: mov 0x8(%rax),%rax
0x0000000000401104 <+43>: mov 0x8(%rax),%rax
@Cee
Cee / fun6.asm
Created July 26, 2014 13:04
fun6
0x000000000040106f <+0>: mov 0x8(%rdi),%r8
0x0000000000401073 <+4>: movq $0x0,0x8(%rdi)
0x000000000040107b <+12>: mov %rdi,%rax
0x000000000040107e <+15>: mov %rdi,%rcx
0x0000000000401081 <+18>: test %r8,%r8
0x0000000000401084 <+21>: jne 0x4010c6 <fun6+87>
0x0000000000401086 <+23>: mov %rdi,%rax
0x0000000000401089 <+26>: retq
0x000000000040108a <+27>: mov %rdx,%rcx
0x000000000040108d <+30>: mov 0x8(%rcx),%rdx
@Cee
Cee / phase_defused.asm
Created July 29, 2014 17:12
phase_defused
0x0000000000401785 <+0>: sub $0x68,%rsp
0x0000000000401789 <+4>: cmpl $0x6,0x2014f0(%rip) # 0x602c80 <num_input_strings>
0x0000000000401790 <+11>: jne 0x4017f0 <phase_defused+107>
0x0000000000401792 <+13>: lea 0x10(%rsp),%rcx
0x0000000000401797 <+18>: lea 0xc(%rsp),%rdx
0x000000000040179c <+23>: mov $0x401ec4,%esi
0x00000000004017a1 <+28>: mov $0x603030,%edi
0x00000000004017a6 <+33>: mov $0x0,%eax
0x00000000004017ab <+38>: callq 0x400ab0 <__isoc99_sscanf@plt>
0x00000000004017b0 <+43>: cmp $0x2,%eax
@Cee
Cee / secret_phase.asm
Created July 29, 2014 17:15
secret_phase
0x000000000040115a <+0>: push %rbx
0x000000000040115b <+1>: callq 0x40165f <read_line>
0x0000000000401160 <+6>: mov $0xa,%edx
0x0000000000401165 <+11>: mov $0x0,%esi
0x000000000040116a <+16>: mov %rax,%rdi
0x000000000040116d <+19>: callq 0x400b80 <strtol@plt>
0x0000000000401172 <+24>: mov %eax,%ebx
0x0000000000401174 <+26>: lea -0x1(%rbx),%eax
0x0000000000401177 <+29>: cmp $0x3e8,%eax
0x000000000040117c <+34>: jbe 0x401183 <secret_phase+41>
@Cee
Cee / fun7.asm
Created July 29, 2014 17:16
fun7
0x000000000040111c <+0>: sub $0x8,%rsp
0x0000000000401120 <+4>: test %rdi,%rdi
0x0000000000401123 <+7>: je 0x401150 <fun7+52>
0x0000000000401125 <+9>: mov (%rdi),%edx
0x0000000000401127 <+11>: cmp %esi,%edx
0x0000000000401129 <+13>: jle 0x401138 <fun7+28>
0x000000000040112b <+15>: mov 0x8(%rdi),%rdi
0x000000000040112f <+19>: callq 0x40111c <fun7>
0x0000000000401134 <+24>: add %eax,%eax
0x0000000000401136 <+26>: jmp 0x401155 <fun7+57>
@Cee
Cee / Getbuf.c
Created July 30, 2014 16:28
Getbuf
unsigned long long getbuf() {
char buf[36];
volatile char* variable_length;
int i;
unsigned long long val = (unsigned long long)Gets(buf);
variable_length = alloca((val % 40) < 36 ? 36 : val % 40);
for(i = 0; i < 36; i++) {
variable_length[i] = buf[i];
}
return val % 40;
@Cee
Cee / Fizz.c
Created July 31, 2014 07:50
Fizz
void fizz(int arg1, char arg2, long arg3,
char* arg4, short arg5, short arg6, unsigned long long val)
{
entry_check(1); /* Make sure entered this function properly */
if (val == cookie)
{
printf("Fizz!: You called fizz(0x%llx)\n", val);
validate(1);
}
else {
@Cee
Cee / Bang.c
Created July 31, 2014 14:07
Bang
unsigned long long global_value = 0;
void bang(unsigned long long val)
{
entry_check(2); /* Make sure entered this function properly */
if (global_value == cookie)
{
printf("Bang!: You set global_value to 0x%llx\n", global_value);
validate(2);
} else {
printf("Misfire: global_value = 0x%llx\n", global_value);
@Cee
Cee / Bang.d
Created July 31, 2014 14:17
Bang
0000000000401020 <bang>:
401020: 48 83 ec 08 sub $0x8,%rsp
401024: 48 8b 35 dd 12 20 00 mov 0x2012dd(%rip),%rsi # 602308 <global_value>
40102b: 48 3b 35 ee 12 20 00 cmp 0x2012ee(%rip),%rsi # 602320 <cookie>
401032: c7 05 74 12 20 00 02 movl $0x2,0x201274(%rip) # 6022b0 <check_level>
401039: 00 00 00
40103c: 74 13 je 401051 <bang+0x31>
40103e: bf 70 15 40 00 mov $0x401570,%edi
401043: 31 c0 xor %eax,%eax
401045: e8 a6 f7 ff ff callq 4007f0 <printf@plt>