Skip to content

Instantly share code, notes, and snippets.

@haohanyang
Last active November 24, 2020 14:42
Show Gist options
  • Save haohanyang/b31c11bcbb058dfa2aad487b017e5d18 to your computer and use it in GitHub Desktop.
Save haohanyang/b31c11bcbb058dfa2aad487b017e5d18 to your computer and use it in GitHub Desktop.
Bomblab solution record

Bomblab Bombs

phase_1

; Dump of assembler code for function phase_1:
0x0000000000001439 <+0>:     sub    $0x8,%rsp
0x000000000000143d <+4>:     lea    0x1d0c(%rip),%rsi        ; 0x3150
0x0000000000001444 <+11>:    callq  0x1909 <strings_not_equal>
0x0000000000001449 <+16>:    test   %eax,%eax
0x000000000000144b <+18>:    jne    0x1452 <phase_1+25>
0x000000000000144d <+20>:    add    $0x8,%rsp
0x0000000000001451 <+24>:    retq   
0x0000000000001452 <+25>:    callq  0x1ba3 <explode_bomb>
0x0000000000001457 <+30>:    jmp    0x144d <phase_1+20>
; End of assembler dump.

Solution

We have to stand with our North Korean allies.

phase_2

; Dump of assembler code for function phase_2:
0x0000000000001459 <+0>:     push   %rbp
0x000000000000145a <+1>:     push   %rbx
0x000000000000145b <+2>:     sub    $0x28,%rsp
0x000000000000145f <+6>:     mov    %fs:0x28,%rax
0x0000000000001468 <+15>:    mov    %rax,0x18(%rsp)
0x000000000000146d <+20>:    xor    %eax,%eax
0x000000000000146f <+22>:    mov    %rsp,%rsi
0x0000000000001472 <+25>:    callq  0x1bdf <read_six_numbers>
0x0000000000001477 <+30>:    cmpl   $0x0,(%rsp)
0x000000000000147b <+34>:    jne    0x1484 <phase_2+43>
0x000000000000147d <+36>:    cmpl   $0x1,0x4(%rsp)
0x0000000000001482 <+41>:    je     0x1489 <phase_2+48>
0x0000000000001484 <+43>:    callq  0x1ba3 <explode_bomb>
0x0000000000001489 <+48>:    mov    %rsp,%rbx
0x000000000000148c <+51>:    lea    0x10(%rsp),%rbp
0x0000000000001491 <+56>:    jmp    0x149c <phase_2+67>
0x0000000000001493 <+58>:    add    $0x4,%rbx
0x0000000000001497 <+62>:    cmp    %rbp,%rbx
0x000000000000149a <+65>:    je     0x14ad <phase_2+84>
0x000000000000149c <+67>:    mov    0x4(%rbx),%eax
0x000000000000149f <+70>:    add    (%rbx),%eax
0x00000000000014a1 <+72>:    cmp    %eax,0x8(%rbx)
0x00000000000014a4 <+75>:    je     0x1493 <phase_2+58>
0x00000000000014a6 <+77>:    callq  0x1ba3 <explode_bomb>
0x00000000000014ab <+82>:    jmp    0x1493 <phase_2+58>
0x00000000000014ad <+84>:    mov    0x18(%rsp),%rax
0x00000000000014b2 <+89>:    sub    %fs:0x28,%rax
0x00000000000014bb <+98>:    jne    0x14c4 <phase_2+107>
0x00000000000014bd <+100>:   add    $0x28,%rsp
0x00000000000014c1 <+104>:   pop    %rbx
0x00000000000014c2 <+105>:   pop    %rbp
0x00000000000014c3 <+106>:   retq   
0x00000000000014c4 <+107>:   callq  0x10a0 <__stack_chk_fail@plt>
; End of assembler dump.

Solution

0 1 1 2 3 5

phase_3

; Dump of assembler code for function phase_3:
0x00000000000014c9 <+0>:     sub    $0x18,%rsp
0x00000000000014cd <+4>:     mov    %fs:0x28,%rax
0x00000000000014d6 <+13>:    mov    %rax,0x8(%rsp)
0x00000000000014db <+18>:    xor    %eax,%eax
0x00000000000014dd <+20>:    lea    0x4(%rsp),%rcx
0x00000000000014e2 <+25>:    mov    %rsp,%rdx
0x00000000000014e5 <+28>:    lea    0x1f59(%rip),%rsi        ; 0x3445
0x00000000000014ec <+35>:    callq  0x1150 <__isoc99_sscanf@plt>
0x00000000000014f1 <+40>:    cmp    $0x1,%eax
0x00000000000014f4 <+43>:    jle    0x150f <phase_3+70>
0x00000000000014f6 <+45>:    cmpl   $0x7,(%rsp)
0x00000000000014fa <+49>:    ja     0x1560 <phase_3+151>
0x00000000000014fc <+51>:    mov    (%rsp),%eax             
0x00000000000014ff <+54>:    lea    0x1cba(%rip),%rdx        ; 0x31c0
0x0000000000001506 <+61>:    movslq (%rdx,%rax,4),%rax       
0x000000000000150a <+65>:    add    %rdx,%rax               
0x000000000000150d <+68>:    jmpq   *%rax
0x000000000000150f <+70>:    callq  0x1ba3 <explode_bomb>
0x0000000000001514 <+75>:    jmp    0x14f6 <phase_3+45>
0x0000000000001516 <+77>:    mov    $0x1cd,%eax
0x000000000000151b <+82>:    cmp    %eax,0x4(%rsp)
0x000000000000151f <+86>:    jne    0x1573 <phase_3+170>
0x0000000000001521 <+88>:    mov    0x8(%rsp),%rax
0x0000000000001526 <+93>:    sub    %fs:0x28,%rax
0x000000000000152f <+102>:   jne    0x157a <phase_3+177>
0x0000000000001531 <+104>:   add    $0x18,%rsp
0x0000000000001535 <+108>:   retq   
0x0000000000001536 <+109>:   mov    $0xf9,%eax
0x000000000000153b <+114>:   jmp    0x151b <phase_3+82>
0x000000000000153d <+116>:   mov    $0x317,%eax
0x0000000000001542 <+121>:   jmp    0x151b <phase_3+82>
0x0000000000001544 <+123>:   mov    $0x388,%eax
0x0000000000001549 <+128>:   jmp    0x151b <phase_3+82>
0x000000000000154b <+130>:   mov    $0x78,%eax
0x0000000000001550 <+135>:   jmp    0x151b <phase_3+82>
0x0000000000001552 <+137>:   mov    $0xab,%eax
0x0000000000001557 <+142>:   jmp    0x151b <phase_3+82>
0x0000000000001559 <+144>:   mov    $0x374,%eax
0x000000000000155e <+149>:   jmp    0x151b <phase_3+82>
0x0000000000001560 <+151>:   callq  0x1ba3 <explode_bomb>
0x0000000000001565 <+156>:   mov    $0x0,%eax
0x000000000000156a <+161>:   jmp    0x151b <phase_3+82>
0x000000000000156c <+163>:   mov    $0x26e,%eax
0x0000000000001571 <+168>:   jmp    0x151b <phase_3+82>
0x0000000000001573 <+170>:   callq  0x1ba3 <explode_bomb>
0x0000000000001578 <+175>:   jmp    0x1521 <phase_3+88>
0x000000000000157a <+177>:   callq  0x10a0 <__stack_chk_fail@plt>
; End of assembler dump.

Solution

1 461

phase_4

; Dump of assembler code for function phase_4:
0x00000000000015b1 <+0>:     sub    $0x18,%rsp
0x00000000000015b5 <+4>:     mov    %fs:0x28,%rax
0x00000000000015be <+13>:    mov    %rax,0x8(%rsp)
0x00000000000015c3 <+18>:    xor    %eax,%eax
0x00000000000015c5 <+20>:    lea    0x4(%rsp),%rcx
0x00000000000015ca <+25>:    mov    %rsp,%rdx
0x00000000000015cd <+28>:    lea    0x1e71(%rip),%rsi        ; 0x3445
0x00000000000015d4 <+35>:    callq  0x1150 <__isoc99_sscanf@plt>
0x00000000000015d9 <+40>:    cmp    $0x2,%eax
0x00000000000015dc <+43>:    jne    0x15e4 <phase_4+51>
0x00000000000015de <+45>:    cmpl   $0xe,(%rsp)
0x00000000000015e2 <+49>:    jbe    0x15e9 <phase_4+56>
0x00000000000015e4 <+51>:    callq  0x1ba3 <explode_bomb>
0x00000000000015e9 <+56>:    mov    $0xe,%edx
0x00000000000015ee <+61>:    mov    $0x0,%esi
0x00000000000015f3 <+66>:    mov    (%rsp),%edi
0x00000000000015f6 <+69>:    callq  0x157f <func4>
0x00000000000015fb <+74>:    cmp    $0xa,%eax
0x00000000000015fe <+77>:    jne    0x1607 <phase_4+86>
0x0000000000001600 <+79>:    cmpl   $0xa,0x4(%rsp)
0x0000000000001605 <+84>:    je     0x160c <phase_4+91>
0x0000000000001607 <+86>:    callq  0x1ba3 <explode_bomb>
0x000000000000160c <+91>:    mov    0x8(%rsp),%rax
0x0000000000001611 <+96>:    sub    %fs:0x28,%rax
0x000000000000161a <+105>:   jne    0x1621 <phase_4+112>
0x000000000000161c <+107>:   add    $0x18,%rsp
0x0000000000001620 <+111>:   retq   
0x0000000000001621 <+112>:   callq  0x10a0 <__stack_chk_fail@plt>
; End of assembler dump.
; Dump of assembler code for function func4:
0x000000000000157f <+0>:     push   %rbx
0x0000000000001580 <+1>:     mov    %edx,%eax
0x0000000000001582 <+3>:     sub    %esi,%eax
0x0000000000001584 <+5>:     mov    %eax,%ebx
0x0000000000001586 <+7>:     shr    $0x1f,%ebx
0x0000000000001589 <+10>:    add    %eax,%ebx
0x000000000000158b <+12>:    sar    %ebx
0x000000000000158d <+14>:    add    %esi,%ebx
0x000000000000158f <+16>:    cmp    %edi,%ebx
0x0000000000001591 <+18>:    jg     0x1599 <func4+26>
0x0000000000001593 <+20>:    jl     0x15a5 <func4+38>
0x0000000000001595 <+22>:    mov    %ebx,%eax
0x0000000000001597 <+24>:    pop    %rbx
0x0000000000001598 <+25>:    retq   
0x0000000000001599 <+26>:    lea    -0x1(%rbx),%edx
0x000000000000159c <+29>:    callq  0x157f <func4>
0x00000000000015a1 <+34>:    add    %eax,%ebx
0x00000000000015a3 <+36>:    jmp    0x1595 <func4+22>
0x00000000000015a5 <+38>:    lea    0x1(%rbx),%esi
0x00000000000015a8 <+41>:    callq  0x157f <func4>
0x00000000000015ad <+46>:    add    %eax,%ebx
0x00000000000015af <+48>:    jmp    0x1595 <func4+22>
; End of assembler dump.

C interpretation of func4

int func4(int key,int low,int high) {

	int length = high - low; // eax
	unsigned sign = length >> 31;  // ebx 

	sign = ((sign + length) >> 1) + low;  // ebx

	if(sign > key) {

		sign += func4(key, low, sign - 1); 

		return sign;

	} else if(sign < key) {
		
		sign += func4(key, sign + 1, high);
		return sign;
	}
	return sign;

}

Solution

3 10

phase_5

; Dump of assembler code for function phase_5:
0x0000000000001626 <+0>:     sub    $0x18,%rsp
0x000000000000162a <+4>:     mov    %fs:0x28,%rax
0x0000000000001633 <+13>:    mov    %rax,0x8(%rsp)
0x0000000000001638 <+18>:    xor    %eax,%eax
0x000000000000163a <+20>:    lea    0x4(%rsp),%rcx
0x000000000000163f <+25>:    mov    %rsp,%rdx
0x0000000000001642 <+28>:    lea    0x1dfc(%rip),%rsi        ; 0x3445
0x0000000000001649 <+35>:    callq  0x1150 <__isoc99_sscanf@plt>
0x000000000000164e <+40>:    cmp    $0x1,%eax
0x0000000000001651 <+43>:    jle    0x16ad <phase_5+135>
0x0000000000001653 <+45>:    mov    (%rsp),%eax
0x0000000000001656 <+48>:    and    $0xf,%eax
0x0000000000001659 <+51>:    mov    %eax,(%rsp)
0x000000000000165c <+54>:    cmp    $0xf,%eax
0x000000000000165f <+57>:    je     0x1693 <phase_5+109>
0x0000000000001661 <+59>:    mov    $0x0,%ecx
0x0000000000001666 <+64>:    mov    $0x0,%edx
0x000000000000166b <+69>:    lea    0x1b6e(%rip),%rsi        ; 0x31e0 <array.0>
0x0000000000001672 <+76>:    add    $0x1,%edx
0x0000000000001675 <+79>:    cltq   
0x0000000000001677 <+81>:    mov    (%rsi,%rax,4),%eax
0x000000000000167a <+84>:    add    %eax,%ecx
0x000000000000167c <+86>:    cmp    $0xf,%eax
0x000000000000167f <+89>:    jne    0x1672 <phase_5+76>
0x0000000000001681 <+91>:    movl   $0xf,(%rsp)
0x0000000000001688 <+98>:    cmp    $0xf,%edx
0x000000000000168b <+101>:   jne    0x1693 <phase_5+109>
0x000000000000168d <+103>:   cmp    %ecx,0x4(%rsp)
0x0000000000001691 <+107>:   je     0x1698 <phase_5+114>
0x0000000000001693 <+109>:   callq  0x1ba3 <explode_bomb>
0x0000000000001698 <+114>:   mov    0x8(%rsp),%rax
0x000000000000169d <+119>:   sub    %fs:0x28,%rax
0x00000000000016a6 <+128>:   jne    0x16b4 <phase_5+142>
0x00000000000016a8 <+130>:   add    $0x18,%rsp
0x00000000000016ac <+134>:   retq   
0x00000000000016ad <+135>:   callq  0x1ba3 <explode_bomb>
0x00000000000016b2 <+140>:   jmp    0x1653 <phase_5+45>
0x00000000000016b4 <+142>:   callq  0x10a0 <__stack_chk_fail@plt>
; End of assembler dump.

Searching the appropriate (%rbp) or first element of array input

(gdb) x/d (0x31e0+4*0)
0x31e0 <array.0>:       10
(gdb) x/d (0x31e0+4*0)
0x31e0 <array.0>:       10
(gdb) x/d (0x31e0+4*1)
0x31e4 <array.0+4>:     2
(gdb) x/d (0x31e0+4*2)
0x31e8 <array.0+8>:     14
(gdb) x/d (0x31e0+4*3)
0x31ec <array.0+12>:    7
(gdb) x/d (0x31e0+4*4)
0x31f0 <array.0+16>:    8
(gdb) x/d (0x31e0+4*5)
0x31f4 <array.0+20>:    12
(gdb) x/d (0x31e0+4*6)
0x31f8 <array.0+24>:    15
(gdb) x/d (0x31e0+4*7)
0x31fc <array.0+28>:    11
(gdb) x/d (0x31e0+4*8)
0x3200 <array.0+32>:    0
(gdb) x/d (0x31e0+4*9)
0x3204 <array.0+36>:    4
(gdb) x/d (0x31e0+4*10)
0x3208 <array.0+40>:    1
(gdb) x/d (0x31e0+4*11)
0x320c <array.0+44>:    13
(gdb) x/d (0x31e0+4*12)
0x3210 <array.0+48>:    3
(gdb) x/d (0x31e0+4*13)
0x3214 <array.0+52>:    9
(gdb) x/d (0x31e0+4*14)
0x3218 <array.0+56>:    6
(gdb) x/d (0x31e0+4*15)
0x321c <array.0+60>:    5
#include <stdio.h>

/*
Get value from (%rsi,%rax,4) for given %rax

from the command :
	mov    (%rsi,%rax,4),%eax
*/

int getMemory[16] = {10, 2, 14, 7, 8, 12, 15, 11, 0, 4, 1, 13, 3, 9, 6, 5};

int main(int argc, char const *argv[])
{

	int ecx;
	int edx;

	for (int arr0 = 0; arr0 < 0xf; ++arr0)
	{
		int i = arr0;
		ecx = 0;
		edx = 0;
		
		do {
			edx += 1;
			i = getMemory[i];
			ecx += i;

		} while(i != 0xf);

		/* match the solution */

		if (edx == 0xf)
		{
			printf("ecx=%d, edx=%d,arr0=%d\n",ecx,edx,arr0);
		}

	}

	return 0;

}

Output

ecx=115, edx=15,arr0=5

Solution

5 115

phase_6

; Dump of assembler code for function phase_6:
0x00000000000016b9 <+0>:     push   %r14
0x00000000000016bb <+2>:     push   %r13
0x00000000000016bd <+4>:     push   %r12
0x00000000000016bf <+6>:     push   %rbp
0x00000000000016c0 <+7>:     push   %rbx
0x00000000000016c1 <+8>:     sub    $0x60,%rsp
0x00000000000016c5 <+12>:    mov    %fs:0x28,%rax
0x00000000000016ce <+21>:    mov    %rax,0x58(%rsp)
0x00000000000016d3 <+26>:    xor    %eax,%eax
0x00000000000016d5 <+28>:    mov    %rsp,%r13
0x00000000000016d8 <+31>:    mov    %r13,%rsi
0x00000000000016db <+34>:    callq  0x1bdf <read_six_numbers>
0x00000000000016e0 <+39>:    mov    $0x1,%r14d
0x00000000000016e6 <+45>:    mov    %rsp,%r12
0x00000000000016e9 <+48>:    jmp    0x1713 <phase_6+90>
0x00000000000016eb <+50>:    callq  0x1ba3 <explode_bomb>
0x00000000000016f0 <+55>:    jmp    0x1722 <phase_6+105>
0x00000000000016f2 <+57>:    add    $0x1,%rbx
0x00000000000016f6 <+61>:    cmp    $0x5,%ebx
0x00000000000016f9 <+64>:    jg     0x170b <phase_6+82>
0x00000000000016fb <+66>:    mov    (%r12,%rbx,4),%eax
0x00000000000016ff <+70>:    cmp    %eax,0x0(%rbp)
0x0000000000001702 <+73>:    jne    0x16f2 <phase_6+57>
0x0000000000001704 <+75>:    callq  0x1ba3 <explode_bomb>
0x0000000000001709 <+80>:    jmp    0x16f2 <phase_6+57>
0x000000000000170b <+82>:    add    $0x1,%r14
0x000000000000170f <+86>:    add    $0x4,%r13
0x0000000000001713 <+90>:    mov    %r13,%rbp
0x0000000000001716 <+93>:    mov    0x0(%r13),%eax
0x000000000000171a <+97>:    sub    $0x1,%eax
0x000000000000171d <+100>:   cmp    $0x5,%eax
0x0000000000001720 <+103>:   ja     0x16eb <phase_6+50>
0x0000000000001722 <+105>:   cmp    $0x5,%r14d
0x0000000000001726 <+109>:   jg     0x172d <phase_6+116>
0x0000000000001728 <+111>:   mov    %r14,%rbx
0x000000000000172b <+114>:   jmp    0x16fb <phase_6+66>
0x000000000000172d <+116>:   mov    $0x0,%esi
0x0000000000001732 <+121>:   mov    (%rsp,%rsi,4),%ecx
0x0000000000001735 <+124>:   mov    $0x1,%eax
0x000000000000173a <+129>:   lea    0x3bef(%rip),%rdx        ; 0x5330 <node1>
0x0000000000001741 <+136>:   cmp    $0x1,%ecx
0x0000000000001744 <+139>:   jle    0x1751 <phase_6+152>
0x0000000000001746 <+141>:   mov    0x8(%rdx),%rdx
0x000000000000174a <+145>:   add    $0x1,%eax
0x000000000000174d <+148>:   cmp    %ecx,%eax
0x000000000000174f <+150>:   jne    0x1746 <phase_6+141>
0x0000000000001751 <+152>:   mov    %rdx,0x20(%rsp,%rsi,8)
0x0000000000001756 <+157>:   add    $0x1,%rsi
0x000000000000175a <+161>:   cmp    $0x6,%rsi
0x000000000000175e <+165>:   jne    0x1732 <phase_6+121>
0x0000000000001760 <+167>:   mov    0x20(%rsp),%rbx
0x0000000000001765 <+172>:   mov    0x28(%rsp),%rax
0x000000000000176a <+177>:   mov    %rax,0x8(%rbx)
0x000000000000176e <+181>:   mov    0x30(%rsp),%rdx
0x0000000000001773 <+186>:   mov    %rdx,0x8(%rax)
0x0000000000001777 <+190>:   mov    0x38(%rsp),%rax
0x000000000000177c <+195>:   mov    %rax,0x8(%rdx)
0x0000000000001780 <+199>:   mov    0x40(%rsp),%rdx
0x0000000000001785 <+204>:   mov    %rdx,0x8(%rax)
0x0000000000001789 <+208>:   mov    0x48(%rsp),%rax
0x000000000000178e <+213>:   mov    %rax,0x8(%rdx)
0x0000000000001792 <+217>:   movq   $0x0,0x8(%rax)
0x000000000000179a <+225>:   mov    $0x5,%ebp
0x000000000000179f <+230>:   jmp    0x17aa <phase_6+241>
0x00000000000017a1 <+232>:   mov    0x8(%rbx),%rbx
0x00000000000017a5 <+236>:   sub    $0x1,%ebp
0x00000000000017a8 <+239>:   je     0x17bb <phase_6+258>
0x00000000000017aa <+241>:   mov    0x8(%rbx),%rax
0x00000000000017ae <+245>:   mov    (%rax),%eax
0x00000000000017b0 <+247>:   cmp    %eax,(%rbx)
0x00000000000017b2 <+249>:   jge    0x17a1 <phase_6+232>
0x00000000000017b4 <+251>:   callq  0x1ba3 <explode_bomb>
0x00000000000017b9 <+256>:   jmp    0x17a1 <phase_6+232>
0x00000000000017bb <+258>:   mov    0x58(%rsp),%rax
0x00000000000017c0 <+263>:   sub    %fs:0x28,%rax
0x00000000000017c9 <+272>:   jne    0x17d8 <phase_6+287>
0x00000000000017cb <+274>:   add    $0x60,%rsp
0x00000000000017cf <+278>:   pop    %rbx
0x00000000000017d0 <+279>:   pop    %rbp
0x00000000000017d1 <+280>:   pop    %r12
0x00000000000017d3 <+282>:   pop    %r13
0x00000000000017d5 <+284>:   pop    %r14
0x00000000000017d7 <+286>:   retq   
0x00000000000017d8 <+287>:   callq  0x10a0 <__stack_chk_fail@plt>
; End of assembler dump.
; Dump of assembler code for function read_six_numbers:
0x0000000000001bdf <+0>:     sub    $0x8,%rsp
0x0000000000001be3 <+4>:     mov    %rsi,%rdx
0x0000000000001be6 <+7>:     lea    0x4(%rsi),%rcx
0x0000000000001bea <+11>:    lea    0x14(%rsi),%rax
0x0000000000001bee <+15>:    push   %rax
0x0000000000001bef <+16>:    lea    0x10(%rsi),%rax
0x0000000000001bf3 <+20>:    push   %rax
0x0000000000001bf4 <+21>:    lea    0xc(%rsi),%r9
0x0000000000001bf8 <+25>:    lea    0x8(%rsi),%r8
0x0000000000001bfc <+29>:    lea    0x1836(%rip),%rsi        ; 0x3439
0x0000000000001c03 <+36>:    mov    $0x0,%eax
0x0000000000001c08 <+41>:    callq  0x1150 <__isoc99_sscanf@plt>
0x0000000000001c0d <+46>:    add    $0x10,%rsp
0x0000000000001c11 <+50>:    cmp    $0x5,%eax
0x0000000000001c14 <+53>:    jle    0x1c1b <read_six_numbers+60>
0x0000000000001c16 <+55>:    add    $0x8,%rsp
0x0000000000001c1a <+59>:    retq   
0x0000000000001c1b <+60>:    callq  0x1ba3 <explode_bomb>
; End of assembler dump.
(gdb) x/d 0x5330
0x5330 <node1>: 587
(gdb) x/d 0x5330 + 16 * 1
0x5340 <node2>: 685
(gdb) x/d 0x5330 + 16 * 2
0x5350 <node3>: 937
(gdb) x/d 0x5330 + 16 * 3
0x5360 <node4>: 252
(gdb) x/d 0x5330 + 16 * 4
0x5370 <node5>: 544
(gdb) x/d 0x5330 + 16 * 5
0x5380 <host_table>:    13471
(gdb) x/d 0x5330 + 16 * 4 + 8
0x5378 <node5+8>:       21008
(gdb) x/d 21008
0x5210 <node6>: 103

The linked list is

587 -> 685 -> 937 -> 252 -> 544 -> 103

Solution

3 2 1 5 4 6

secret_phase

; Dump of assembler code for function secret_phase:
0x000000000000181a <+0>:     push   %rbx
0x000000000000181b <+1>:     callq  0x1c20 <read_line>
0x0000000000001820 <+6>:     mov    %rax,%rdi
0x0000000000001823 <+9>:     mov    $0xa,%edx
0x0000000000001828 <+14>:    mov    $0x0,%esi
0x000000000000182d <+19>:    callq  0x1130 <strtol@plt>
0x0000000000001832 <+24>:    mov    %rax,%rbx
0x0000000000001835 <+27>:    lea    -0x1(%rax),%eax
0x0000000000001838 <+30>:    cmp    $0x3e8,%eax
0x000000000000183d <+35>:    ja     0x1865 <secret_phase+75>
0x000000000000183f <+37>:    mov    %ebx,%esi
0x0000000000001841 <+39>:    lea    0x3a08(%rip),%rdi        ; 0x5250 <n1>
0x0000000000001848 <+46>:    callq  0x17dd <fun7>
0x000000000000184d <+51>:    cmp    $0x4,%eax
0x0000000000001850 <+54>:    jne    0x186c <secret_phase+82>
0x0000000000001852 <+56>:    lea    0x1927(%rip),%rdi        ; 0x3180
0x0000000000001859 <+63>:    callq  0x1070 <puts@plt>
0x000000000000185e <+68>:    callq  0x1d57 <phase_defused>
0x0000000000001863 <+73>:    pop    %rbx
0x0000000000001864 <+74>:    retq   
0x0000000000001865 <+75>:    callq  0x1ba3 <explode_bomb>
0x000000000000186a <+80>:    jmp    0x183f <secret_phase+37>
0x000000000000186c <+82>:    callq  0x1ba3 <explode_bomb>
0x0000000000001871 <+87>:    jmp    0x1852 <secret_phase+56>
; End of assembler dump.

Secret phase is not finished because I am too busy

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment