西北工業(yè)大學(xué)_計(jì)算機(jī)系統(tǒng)基礎(chǔ)_實(shí)驗(yàn)報(bào)告_第2次

1、計(jì)算機(jī)系統(tǒng)根底實(shí)驗(yàn)課第二次實(shí)驗(yàn)報(bào)告對(duì)二進(jìn)制炸彈求解過程的詳細(xì)描述首先使用objdump命令對(duì)bomb程序進(jìn)行反匯編,并將匯編代碼輸出到asm.txt中.,ajfewi-vwmAh.ibwwfh%rvatibrHu4A“EwUlv:-*riilm*5?E噫-IH4mMwll*l*Pw*i|l!*trIwM|i|wM7W:*!fH三三三三三三曾等官言4411lHh.FPF-r-rFt.-MMpiMIM-MP-wn.AM柝,5I：,FiftHtK呼MVHUwta)fii.LiMH*IuMAM.)HU1+*-y?W噸1*F4hHYW4K工匕*1：卜Jf!7*“嘰上10ta3-LirLc4*-ua_BM

2、b-ZiHavatawE=,階段一、字符串比擬翻開asm.txt文件,搜索到phase_1函數(shù),可以看到以下代碼.08048b33:8048b33:83ec14sub$0x14,%esp8048b36:687ca00408push$0x804a07c8048b3b:ff74241cpushl0x1c(%esp)8048b3f:e83e050000call80490828048b44:83c410add$0x10,%esp8048b47:85c0test%eax,%eax8048b49:7405je8048b508048b4b:e829060000call80491798048b50:83c40

3、cadd$0xc,%esp8048b53:c3ret可以看出,用戶輸入字串指針保存在0x1c(%esp),然后調(diào)用,待返回后,測(cè)試返回值,假設(shè)equal那么進(jìn)入下一phase,否那么,從可知該函數(shù)用于比擬兩函數(shù)的值,因此需要兩個(gè)字串作為輸入,上面代碼中,pushl0x1c(%esp)用于傳遞用戶字串指針,那么push$0x804a07c自然是傳遞比擬字串的指針了.翻開gdb,x/s0x80497c0,可以直接查看到該指針指向的子符串：時(shí)rtsatlnTjlmt/iowTzuri/tovtH5f&a-nrr.-ii-p.irj*f-mkihMl埴ml!fd:-!Iei.3vahr-k-iik.i

4、Qr.il-uIC3mJ*EvFIrir*npHIIw.曜LhrtiliaHllritv；射1LI/麗b.JUFkLKg-,HPI.EIt11FfwFFrrw-!*Ea3b-.batvIt.El*w*dH.；4-IrvII所以第一個(gè)炸彈的拆彈指令為:I.11441IIH-l-fcrHFb*4rvfWfrff*|3&*MM4MI,ViMMlbMIA*hHIH1919ElMli也r*nb4iii%,!iiftw,lAdhir好e上HptiHf.cikirrLIwmhjrdu*fumIturnedthemoonintosomethingIcallaDeathStar.階段二、循環(huán)在asm.txt文件

5、中可以找到phase_2函數(shù)代碼如下:08048b54:8048b54:56push%esi8048b55:53push%ebx8048b56:83ec2csub$0x2c,%esp8048b59:65a114000000mov%gs:0x14,%eax8048b5f:89442424mov%eax,0x24(%esp)8048b63:31c0xor%eax,%eax8048b65:8d44240clea0xc(%esp),%eax8048b69:50push%eax8048b6a:ff74243cpushl0x3c(%esp)8048b6e:e82b060000call804919e8048

6、b73:83c410add$0x10,%esp8048b76:837c240401cmpl$0x1,0x4(%esp)8048b7b:7405je8048b828048b7d:e8f7050000call80491798048b82:8d5c2404lea0x4(%esp),%ebx8048b86:8d742418lea0x18(%esp),%esi8048b8a:8b03mov(%ebx),%eax8048b8c:01c0add%eax,%eax8048b8e:394304cmp%eax,0x4(%ebx)8048b91:7405je8048b988048b93:e8e1050000call

7、80491798048b98:83c304add$0x4,%ebx8048b9b:39f3cmp%esi,%ebx8048b9d:75ebjne8048b8a8048b9f:8b44241cmov0x1c(%esp),%eax8048ba3:65330514000000xor%gs:0x14,%eax8048baa:7405je8048bb18048bac:e8dffbffffcall80487908048bb1:83c424add$0x24,%esp8048bb4:5bpop%ebx8048bb5:5epop%esi8048bb6:c3ret根據(jù)call804919e可以推測(cè)題目要求是輸入六

8、個(gè)數(shù)字.又根據(jù)cmpl$0x1,0x4(%esp)可以推斷,輸入的第一個(gè)數(shù)字是1;jne8048b8a可以知道程序是一個(gè)循環(huán).add%eax,%eax和cmp%eax,0x4(%ebx)可以明白,每次循環(huán)的答案是上一個(gè)答案的2倍,所以可以推測(cè)答案序列為：12481632測(cè)試發(fā)現(xiàn)結(jié)果正確.0Virtuefrok:rQ4t(hbutuMinrttulii-13/MRefuJbunb4nb-4/rMtubUAtu4-4Vtrtvi/idne/u.buntiEb4/iHftt36DQZgt|ii*frwiciftwflBrcr2修arcfrettachangeriIstrlbwtrit,IhcrE-I

9、sMDuAAAfiTt,toUeutefitpe-KHilLtebj1-bm.占ha.cipLnkgAH-2d*T4tHThisCOB-vasicgrtqinEwe-llntx-snu-Fartnqrcpcrtiif*gtnjtrictiaHSjple-erbe-sm:卜.ynmggrt“ie/-gdb/tiu&/qFtidthsCDSfunlOTfctfdacdWitittORr#50urrg/-5efttaifefgdb/d&CKiwit-att&n/j-.Fxh#lp,琳m.TyiieaapropostosearchfortennandsrelatedtoBB*ari1p.發(fā)0*1/IO

10、*4agrfar$X4fXlrigprerii*:/hwif|ubiitNtliCDmh)nyflefrtshHttlYovh4v兩/withpwhilchit口blGijourselPip.Havenice1da)i!3twrcd工IntoSa5l*r,Pluseie#Ti4fld.Hwabjtthewxt中n*F314壞】phut1snib#r2Meepgotagr階段三、條件/分支Phase_3代碼如下：08048bb7:8048bb7:83ec28sub$0x28,%esp8048bba:65a114000000mov%gs:0x14,%eax8048bc0:89442418mov%e

11、ax,0x18(%esp)8048bc4:31c0xor%eax,%eax8048bc6:8d442414lea0x14(%esp),%eax8048bca:50push%eax8048bcb:8d442413lea0x13(%esp),%eax8048bcf:50push%eax8048bd0:8d442418lea0x18(%esp),%eax8048bd4:50push%eax8048bd5:68daa00408push$0x804a0da8048bda:ff74243cpushl0x3c(%esp)8048bde:e82dfcffffcall80488108048be3:83c420a

12、dd$0x20,%esp8048be6:83f802cmp$0x2,%eax8048be9:7f05jg8048bf08048beb:e889050000call80491798048bf0:837c240407cmpl$0x7,0x4(%esp)8048bf5:0f87fc000000ja8048cf78048bfb:8b442404mov0x4(%esp),%eax8048bff:ff2485eca00408jmp*0x804a0ec(,%eax,4)8048c06:b8710000008048c0b:817c2408e900008048c12:008048c13:0f84e8000000

13、8048c19:e85b0500008048c1e:b8710000008048c23:e9d90000008048c28:b86f0000008048c2d:817c2408b902008048c34:008048c35:0f84c60000008048c3b:e8390500008048c40:b86f0000008048c45:e9b70000008048c4a:b8700000008048c4f:817c24088e01008048c56:008048c57:0f84a40000008048c5d:e8170500008048c62:b8700000008048c67:e9950000

14、008048c6c:b8680000008048c71:817c24088d03008048c78:008048c79:0f84820000008048c7f:e8f50400008048c84:b8680000008048c89:eb768048c8b:b8640000008048c90:817c2408eb00008048c97:008048c98:74678048c9a:e8da0400008048c9f:b8640000008048ca4:eb5b8048ca6:b86a0000008048cab:817c2408b000008048cb2:008048cb3:744c8048cb5:

15、e8bf0400008048cba:b86a0000008048cbf:eb408048cc1:b86d0000008048cc6:817c2408e203008048ccd:008048cce:7431mov$0x71,%eaxcmpl$0xe9,0x8(%esp)je8048d01call8049179mov$0x71,%eaxjmp8048d01mov$0x6f,%eaxcmpl$0x2b9,0x8(%esp)je8048d01call8049179mov$0x6f,%eaxjmp8048d01mov$0x70,%eaxcmpl$0x18e,0x8(%esp)je8048d01call8

16、049179mov$0x70,%eaxjmp8048d01mov$0x68,%eaxcmpl$0x38d,0x8(%esp)je8048d01call8049179mov$0x68,%eaxjmp8048d01mov$0x64,%eaxcmpl$0xeb,0x8(%esp)je8048d01call8049179mov$0x64,%eaxjmp8048d01mov$0x6a,%eaxcmpl$0xb0,0x8(%esp)je8048d01call8049179mov$0x6a,%eaxjmp8048d01mov$0x6d,%eaxcmpl$0x3e2,0x8(%esp)je8048d01804

17、8cd0:e8a4040000call80491798048cd5:b86d000000mov$0x6d,%eax8048cda:eb25jmp8048d018048cdc:b865000000mov$0x65,%eax8048ce1:817c24083d0300cmpl$0x33d,0x8(%esp)8048ce8:008048ce9:7416je8048d018048ceb:e889040000call80491798048cf0:b865000000mov$0x65,%eax8048cf5:eb0ajmp8048d018048cf7:e87d040000call80491798048cf

18、c:b878000000mov$0x78,%eax8048d01:3a442403cmp0x3(%esp),%al8048d05:7405je8048d0c8048d07:e86d040000call80491798048d0c:8b44240cmov0xc(%esp),%eax8048d10:65330514000000xor%gs:0x14,%eax8048d17:7405je8048d1e8048d19:e872faffffcall80487908048d1e:83c41cadd$0x1c,%esp8048d21:c3ret注,國(guó)王Upush$0x804a0da,查看內(nèi)存可以發(fā)現(xiàn)輸入的要

19、求即輸入一個(gè)數(shù)字,一個(gè)字符,再一個(gè)數(shù)字.8048bf0:837c240407cmpl$0x7,0x4(%esp)8048bf5:0f87fc000000ja8048cf78048cf7:e87d040000call8049179movjmp輸入的第一個(gè)數(shù)一定小于78048bfb:8b4424048048bff:ff2485eca004080x4(%esp),%eax*0x804a0ec(,%eax,4)mov$0x71,%eaxcmpl$0xe9,0x8(%esp)即字符q假設(shè)輸入的第一個(gè)數(shù)為0,IP(%eax)=0,所以:(gdb)p/x$2=Ox&e4ficOb8048c06:b87100

20、00008048c0b:817c2408e90000所以第二個(gè)字符ascll碼為0x71,而第三個(gè)數(shù)為0xe9,即233驗(yàn)證結(jié)果滿足要求：rM皿仙1tmVirtueHbh：:cd/hnr,ub的史W4jb433Frgt*皿tuX-Vltuail角g：Fh4E,uMNuH/M*b30adbbMbCflUgjdb(Lftantu7.11-1-flubiwutu1-11.S)7.11.1Ccwriglit(C)Ml*Fr*t誦n.Inc.License81_74：1523Lversloi*3orlaterJ/flpu.CKrgi/ltfivsf.htfll*ThliUfrelaf(Mart:jhcw

21、trtfretcochtre力.rfdttlrlbut#It.ThereUEU麗AM九t*th*extentfrer*ttt*dbylw.Typeihewands-hwwAtT*ntpforTMf心DeWiSCtfirigurfd節(jié)TyperstiwcoiiriflMifsfkwfr曾tgwani.的derdocwnefit-flltenresdurtrs-ofllLfte.htpr/mw.gitu,0rMMfEih4rru*#1tTLmfdBFerhelp.,tjpe-MMpLTy時(shí)Tififo4ifrdlrtiftrchfo*rcdafuimIirtword.Re*dthgfy四&l野rr

22、H&ch4.r-die.的gjrSt*ting時(shí).1rf：Fhf607gstu64/Mrib3b42MeUc*et&ffleMtshllttlfibonlb-寸觸由3$ph4sv$withMilcbte311jfwr*lLFHav*4nicdiyEItdrf*edth*f*ilnt4seflethlnflclleX前bStar,PDJte1de-wIhEthenextne?124tt春32Thit11fliirticr九gviffeglq1HalTzythefel階段四、遞歸調(diào)用和棧phase_4函數(shù)如下：08048d65:8048d65:83ec1csub$0x1c,%esp8048d68:

23、65a114000000mov%gs:0x14,%eax8048d6e:8944240cmov%eax,0xc(%esp)8048d72:31c0xor%eax,%eax8048d74:8d442404lea0x4(%esp),%eax8048d78:50push%eax8048d79:8d44240clea0xc(%esp),%eax8048d7d:50push%eax8048d7e:682ba20408push$0x804a22b8048d83:ff74242cpushl0x2c(%esp)8048d87:e884faffffcall80488108048d8c:83c410add$0x1

24、0,%esp8048d8f:83f802cmp$0x2,%eax8048d92:750cjne8048da08048d94:8b442404mov0x4(%esp),%eax8048d98:83e802sub$0x2,%eax8048d9b:83f802cmp$0x2,%eax8048d9e:7605jbe8048da58048da0:e8d4030000call80491798048da5:83ec08sub$0x8,%esp8048da8:ff74240cpushl0xc(%esp)8048dac:6a07push$0x78048dae:e86fffffffcall8048d228048d

25、b3:83c410add$0x10,%esp8048db6:3b442408cmp0x8(%esp),%eax8048dba:7405je8048dc18048dbc:e8b8030000call80491798048dc1:8b44240cmov0xc(%esp),%eax8048dc5:65330514000000xor%gs:0x14,%eax8048dcc:7405je8048dd38048dce:e8bdf9ffffcall80487908048dd3:83c41cadd$0x1c,%esp8048dd6:c3ret通過查看0x804a22b,可以知道題目要求輸入兩個(gè)整數(shù).(gdb)

26、x/s0x804a22b以既船22b:%d配由push$0x7可以知道,輸入的func4數(shù)的第二個(gè)參數(shù)值等于0x7.再根據(jù)函數(shù)func4可以發(fā)現(xiàn),函數(shù)使用了遞歸調(diào)用.08048d22:8048d22:57push%edi8048d23:56push%esi8048d24:53push%ebx8048d25:8b5c2410mov0x10(%esp),%ebx8048d29:8b7c2414mov0x14(%esp),%edi8048d2d:85dbtest%ebx,%ebx8048d2f:7e2bjle8048d5c8048d31:89f8mov%edi,%eax8048d33:83fb01c

27、mp$0x1,%ebx8048d36:7429jei8048d618048d38:83ec08sub$0x8,%esp8048d3b:57push%edi8048d3c:8d43fflea-0x1(%ebx),%eax8048d3f:50push%eax8048d40:e8ddffffffcall8048d228048d45:83c408add$0x8,%esp8048d48:8d3407lea(%edi,%eax,1),%esi8048d4b:57push%edi8048d4c:83eb02sub$0x2,%ebx8048d4f:53push%ebx8048d50:e8cdffffffcal

28、l8048d228048d55:83c410add$0x10,%esp8048d58:01f0add%esi,%eax8048d5a:eb05jmp8048d618048d5c:b800000000mov$0x0,%eax8048d61:5bpop%ebx8048d62:5epop%esi8048d63:5fpop%edi8048d64:c3ret卜面就來剖析func4,這個(gè)函數(shù)在確定棧之后,首先取出來傳遞給它的參數(shù),依次放在eax,edx,esi.中,從一個(gè)jle可以看出,這個(gè)遞歸函數(shù)跳出的條件根據(jù)func4的第二個(gè)參數(shù)和第二個(gè)參數(shù)進(jìn)過種種運(yùn)算的結(jié)果等于第一個(gè)參數(shù)即可.注意在遞歸過程中第一個(gè)

29、參數(shù)是不變的,最后返回值是經(jīng)過運(yùn)算后的esi加上第一個(gè)參數(shù).sub$0x2,%eax和cmp$0x2,%eax說明輸入的參數(shù)要求小于等于4.那么假設(shè)輸入第二個(gè)參數(shù)的值為4,經(jīng)過函數(shù)func4的計(jì)算,返回值eax可以知道(gdb)ntfb呢48tb3inphase_4()1:再/I5PL2GxS048db:add$Gxlz:/xSesptcjxffffcfBa3: /x$eax-0x04那么輸入第二個(gè)參數(shù)為4返回0x84即十進(jìn)制的132所以第四個(gè)炸彈的答案是1324reglu44-VlriUdlftoiMfMtflbvAtMHlV|f(utMOia：Cfrt#wlnjAt-VlrGNUWb(Ub

30、untu7.Hi-akntiT九分7,11,1Cdpright(O?Q14FEsdffenreFovMvtiM,ncLlcens-eCFLv3mCMU5Lversion3arlater-4http:/;/lLcens/gpl.htrlThistifre*iftwAr:yu廣frtets七h(yuǎn)*tnv1Ty酬-sn*w1FindtheQDBnanu-aland:QtberdaczunenttonresQurcesoniltneat:http:/.gwhofq$工e/$db/idauHtintatlewi/*,FarlwrlpptpehelpBType口口T3s.edrchforcor

31、andsrelatedto百隔id.口*di%口91y哂中ItfraR加辦r5t4rttng伊廣制,內(nèi)：/hf/ttw*Wlcom-tomyftrndishlittlebanb.qiili.VtiptiAiseswithwlil.chtoblowjpourselfup.Haveaniced-BfIturmdth#nchonintolOHethlngI“11oDthltrn幢金g1defu工國(guó)Uhonabcutth酬曲14|15MThJit1g料Xr工顰1修1.Q44MM4y(IhprelS374SayougotthatMe*frythis,qrc.階段五、指針Phase_5函數(shù)如下：08048

32、dd7:8048dd7:53push%ebx8048dd8:83ec24sub$0x24,%esp8048ddb:8b5c242cmov0x2c(%esp),%ebx8048ddf:65a114000000mov%gs:0x14,%eax8048de5:89442418mov%eax,0x18(%esp)8048de9:31c0xor%eax,%eax8048deb:53push%ebx8048dec:e872020000call80490638048df1:83c410add$0x10,%esp8048df4:83f806cmp$0x6,%eax8048df7:7405je8048dfe80

33、48df9:e87b030000call80491798048dfe:b800000000mov$0x0,%eax8048e03:0fb61403movzbl(%ebx,%eax,1),%edx8048e07:83e20fand$0xf,%edx8048e0a:0fb6920ca10408movzbl0x804a10c(%edx),%edx8048e11:88540405mov%dl,0x5(%esp,%eax,1)8048e15:83c001add$0x1,%eax8048e18:83f806cmp$0x6,%eax8048e1b:75e6jne8048e038048e1d:c644240b

34、00movb$0x0,0xb(%esp)8048e22:83ec08sub$0x8,%esp8048e25:68e3a00408push$0x804a0e38048e2a:8d442411lea0x11(%esp),%eax8048e2e:50push%eax8048e2f:e84e020000call80490828048e34:83c410add$0x10,%esp8048e37:85c0test%eax,%eax8048e39:7405je8048e408048e3b:e839030000call80491798048e40:8b44240cmov0xc(%esp),%eax8048e4

35、4:65330514000000xor%gs:0x14,%eax8048e4b:7405je8048e528048e4d:e83ef9ffffcall80487908048e52:83c418add$0x18,%esp8048e55:5bpop%ebx8048e56:c3ret注后到call8049063所以輸入應(yīng)該是一個(gè)字符串,cmp$0x6,%eax說明輸入字符串的長(zhǎng)度應(yīng)該是6.and$0xf,%edx說明在循環(huán)中,取輸入串的每個(gè)字符的ascii碼轉(zhuǎn)換成二進(jìn)制的低四位,拓展成32位整數(shù)后作為偏移量在模式串中取對(duì)應(yīng)位置的字符.根據(jù)movzbl0x804a10c(%edx),%edx,那么0x

36、804a10c放置的應(yīng)該是用來替換的字符串.l(qdb)/isxBa4alfliI工曰Gwdui-：5nfDtMbMl0civquthinkvcmj匚用nEto,thgb-OHmb匚tl仁.dmvour所以替換串應(yīng)該是maduiersnfotvbyl是目標(biāo)字符串.所以目標(biāo)字符串是“push$0x804a0e3那么0x804a0e3中應(yīng)該flames(qdb)Is&x804a0e3所以順序應(yīng)該是9/15/1/0/5/7,轉(zhuǎn)換為二進(jìn)制再查ascii碼可以推出一組解為ioapeg.(gdb)rStartinigprogram:/hopw/ubuntu64/bonbSO/bcmbWelcometomy

37、fiendishlittleYouhave5phasesuithwhichtoblowyourselfup.aniceday!1turnedthe悌onInto噂thin51callaDeathst*r+Phas.e1dtfusfd.mowaboutthnext&nr7124Gl632Thatsnumber2,Keepgoing!&q2ntherel1324勺口yougatthatoneTrythisone-1口mpegG&odworli,08048e57:檢驗(yàn)發(fā)現(xiàn)結(jié)果正確.階段六、鏈表/指針/結(jié)構(gòu)Phase6內(nèi)容如下：8048e57:56push%esi8048e58:53push%ebx8

38、048e59:83ec4csub$0x4c,%esp8048e5c:65a114000000mov%gs:0x14,%eax8048e62:89442444mov%eax,0x44(%esp)8048e66:31c0xor%eax,%eax8048e68:8d442414lea0x14(%esp),%eax8048e6c:50push%eax8048e6d:ff74245cpushl0x5c(%esp)8048e71:e828030000call804919e8048e76:83c410add$0x10,%esp8048e79:be00000000mov$0x0,%esi8048e7e:8b4

39、4b40cmov0xc(%esp,%esi,4),%eax8048e82:83e801sub$0x1,%eax8048e85:83f805cmp$0x5,%eax8048e88:7605jbe8048e8f8048e8a:e8ea020000call80491798048e8f:83c601add$0x1,%esi8048e92:83fe06cmp$0x6,%esi8048e95:7433je8048eca8048e97:89f3mov%esi,%ebx8048e99:8b449c0cmov0xc(%esp,%ebx,4),%eax8048e9d:3944b408cmp%eax,0x8(%es

40、p,%esi,4)8048ea1:7505jne8048ea88048ea3:e8d1020000call80491798048ea8:83c301add$0x1,%ebx8048eab:83fb05cmp$0x5,%ebx8048eae:7ee9jle8048e998048eb0:ebccjmp8048e7e8048eb2:8b5208mov0x8(%edx),%edx8048eb5:83c001add$0x1,%eax8048eb8:39c8cmp%ecx,%eax8048eba:75f6jne8048eb28048ebc:8954b424mov%edx,0x24(%esp,%esi,4)

41、8048ec0:83c301add$0x1,%ebx8048ec3:83fb06cmp$0x6,%ebx8048ec6:7507jne8048ecf8048ec8:eb1cjmp8048ee68048eca:bb00000000mov$0x0,%ebx8048ecf:89demov%ebx,%esi8048ed1:8b4c9c0cmov0xc(%esp,%ebx,4),%ecx8048ed5:b801000000mov$0x1,%eax8048eda:ba3cc10408mov$0x804c13c,%edx8048edf:83f901cmp$0x1,%ecx8048ee2:7fcejg8048eb28048ee4:ebd6jmp8048ebc8048ee6:8b5c2424mov0x24(%esp),%ebx8048eea:8d4