0

The following is the assembly dump of a binary bomb from bomb lab Basically, you have to come up with a 6 number sequence to defuse the bomb, however, I am having trouble finding the first number and understanding the pattern.

I added some quick comments to the right to help EDIT: It seems like rbx is increased by 0x4 every time, 5 times, from my understanding that should mean that rbx is initialized at 0

 400f0c:       41 54                   push   %r12
  400f0e:       55                      push   %rbp
  400f0f:       53                      push   %rbx
  400f10:       48 83 ec 20             sub    $0x20,%rsp
  400f14:       48 89 e6                mov    %rsp,%rsi
  400f17:       e8 ac 06 00 00          callq  4015c8 <read_six_numbers>        reads numbers as "%d %d %d %d %d %d"
  400f1c:       8b 44 24 04             mov    0x4(%rsp),%eax                   move first number to eax
  400f20:       39 04 24                cmp    %eax,(%rsp)                      compare eax to rsp
  400f23:       74 06                   je     400f2b <phase_2+0x1f>            explode if equal
  400f25:       3b 44 24 08             cmp    0x8(%rsp),%eax                   compare second number to eax
  400f29:       75 26                   jne    400f51 <phase_2+0x45>            Jump to f51 step 1 if they're not equal
  400f2b:       e8 62 06 00 00          callq  401592 <explode_bomb>            not good
  400f30:       eb 1f                   jmp    400f51 <phase_2+0x45>
  400f32:       48 89 e8                mov    %rbp,%rax                        f32 step 4
  400f35:       48 29 d8                sub    %rbx,%rax                        subtract rbx from rax (addresses)
  400f38:       8b 00                   mov    (%rax),%eax                      put rax into eax
  400f3a:       41 39 04 1c             cmp    %eax,(%r12,%rbx,1)               compare eax to array r12[rbx] (is 1 just a multiplier?)
  400f3e:       74 05                   je     400f45 <phase_2+0x39>            jump if equal
  400f40:       e8 4d 06 00 00          callq  401592 <explode_bomb>            not good
  400f45:       48 83 c3 04             add    $0x4,%rbx                        add 4 to rbx step 5
  400f49:       48 83 fb 14             cmp    $0x14,%rbx                       check if rbx==14, if equal phase is defused, last number is 14
  400f4d:       75 e3                   jne    400f32 <phase_2+0x26>            go back to f32 loop until end
  400f4f:       eb 11                   jmp    400f62 <phase_2+0x56>
  400f51:       bb 00 00 00 00          mov    $0x0,%ebx                        ebx=0           f51 step 2
  400f56:       4c 8d 64 24 04          lea    0x4(%rsp),%r12                   move first number address to r12
  400f5b:       48 8d 6c 24 10          lea    0x10(%rsp),%rbp                  move rsp+0x10 to rbp
  400f60:       eb d0                   jmp    400f32 <phase_2+0x26>            jump to f32 step 3
  400f62:       48 83 c4 20             add    $0x20,%rsp
  400f66:       5b                      pop    %rbx
  400f67:       5d                      pop    %rbp
  400f68:       41 5c                   pop    %r12
  400f6a:       c3         

         retq

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.