二进制炸弹实验 BinaryBombs( 三 ) _生活百科

phase_3密码如下：1 -1199破解过程：

文章插图

设置断点，运行，反汇编。
发现线索： 401475:be 1f 33 40 00 mov $0x40331f,%esi 。
打印0x40331f处的字符串，得到：
文章插图
结合后边的40147f:e88cfcff ff callq 401110 <__isoc99_sscanf@plt>可知，本题答案为两个整型变量

401489: 8b 45 fc mov -0x4(%rbp),%eax40148c: 83 f8 07 cmp $0x7,%eax40148f: 77 7b ja 40150c <phase_3+0xa7>第一个输入的数不能大于7结合后面的可猜测，是一个根据第一个输入的数的switch语句

那就输入 1 2 进行调试测试
观察到

4014cf: 39 45 f8 cmp %eax,-0x8(%rbp)4014d2: 74 05 je 4014d9 <phase_3+0x74>4014d4: e8 67 04 00 00 callq 401940 <explode_bomb>4014d9: c9 leaveq是函数不爆炸的出口
在这里设置断点，打印出%eax，得到-1199 。

文章插图

得到答案，1 -1199 。答案不唯一。

汇编代码：

点击查看代码0000000000401465 <phase_3>: 401465: 55 push %rbp 401466: 48 89 e5 mov %rsp,%rbp 401469: 48 83 ec 10 sub $0x10,%rsp 40146d: 48 8d 4d f8 lea -0x8(%rbp),%rcx 401471: 48 8d 55 fc lea -0x4(%rbp),%rdx 401475: be 1f 33 40 00 mov $0x40331f,%esi 40147a: b8 00 00 00 00 mov $0x0,%eax 40147f: e8 8c fc ff ff callq 401110 <__isoc99_sscanf@plt> 401484: 83 f8 01 cmp $0x1,%eax 401487: 7e 11 jle 40149a <phase_3+0x35> 401489: 8b 45 fc mov -0x4(%rbp),%eax 40148c: 83 f8 07 cmp $0x7,%eax 40148f: 77 7b ja 40150c <phase_3+0xa7> 401491: 89 c0 mov %eax,%eax 401493: ff 24 c5 c0 31 40 00 jmpq *0x4031c0(,%rax,8) 40149a: e8 a1 04 00 00 callq 401940 <explode_bomb> 40149f: eb e8 jmp 401489 <phase_3+0x24> 4014a1: b8 00 00 00 00 mov $0x0,%eax 4014a6: 2d 7b 02 00 00 sub $0x27b,%eax 4014ab: 05 2c 01 00 00 add $0x12c,%eax 4014b0: 2d 60 03 00 00 sub $0x360,%eax 4014b5: 05 60 03 00 00 add $0x360,%eax 4014ba: 2d 60 03 00 00 sub $0x360,%eax 4014bf: 05 60 03 00 00 add $0x360,%eax 4014c4: 2d 60 03 00 00 sub $0x360,%eax 4014c9: 83 7d fc 05 cmpl $0x5,-0x4(%rbp) 4014cd: 7f 05 jg 4014d4 <phase_3+0x6f> 4014cf: 39 45 f8 cmp %eax,-0x8(%rbp) 4014d2: 74 05 je 4014d9 <phase_3+0x74> 4014d4: e8 67 04 00 00 callq 401940 <explode_bomb> 4014d9: c9 leaveq 4014da: c3 retq 4014db: b8 95 02 00 00 mov $0x295,%eax 4014e0: eb c4 jmp 4014a6 <phase_3+0x41> 4014e2: b8 00 00 00 00 mov $0x0,%eax 4014e7: eb c2 jmp 4014ab <phase_3+0x46> 4014e9: b8 00 00 00 00 mov $0x0,%eax 4014ee: eb c0 jmp 4014b0 <phase_3+0x4b> 4014f0: b8 00 00 00 00 mov $0x0,%eax 4014f5: eb be jmp 4014b5 <phase_3+0x50> 4014f7: b8 00 00 00 00 mov $0x0,%eax 4014fc: eb bc jmp 4014ba <phase_3+0x55> 4014fe: b8 00 00 00 00 mov $0x0,%eax 401503: eb ba jmp 4014bf <phase_3+0x5a> 401505: b8 00 00 00 00 mov $0x0,%eax 40150a: eb b8 jmp 4014c4 <phase_3+0x5f> 40150c: e8 2f 04 00 00 callq 401940 <explode_bomb> 401511: b8 00 00 00 00 mov $0x0,%eax 401516: eb b1 jmp 4014c9 <phase_3+0x64>