二进制炸弹实验 BinaryBombs( 七 ) _生活百科

phase_6密码如下：2 6 4 3 1 5破解过程：

设置断点，运行，反汇编
解读汇编代码知：

读6个数
二重循环，判断是否每个数大于6，判断是否和其他数相等。即，输入的应该为1~6的排列
将每个数i转化为$j = 7 – i$
取出链表的第j个元素的值，放入栈中
遍历一遍放入栈的6个链表元素，判断是否为降序

链表的发现：

4016be: ba d0 52 40 00 mov $0x4052d0,%edx // 链表头4016c9: 48 89 d9 mov %rbx,%rcx4016db: 48 89 51 08 mov %rdx,0x8(%rcx) //next指针发现是链式结构，设置断点，打印出：

文章插图
发现nodej也是在提示
第一个为链表值，第二个为链表游标，第三个为next指针

那么，将链表值按降序排序，得到游标为5 1 3 4 6 2
再，由 $j = 7 – i$, 得到答案 2 6 4 3 1 5

汇编代码：

点击查看代码0000000000401610 <phase_6>: 401610: 55 push %rbp 401611: 48 89 e5 mov %rsp,%rbp 401614: 41 55 push %r13 401616: 41 54 push %r12 401618: 53 push %rbx 401619: 48 83 ec 58 sub $0x58,%rsp 40161d: 48 8d 75 c0 lea -0x40(%rbp),%rsi 401621: e8 3c 03 00 00 callq 401962 <read_six_numbers> 401626: 41 bc 00 00 00 00 mov $0x0,%r12d // %r12d = 0 40162c: eb 29 jmp 401657 <phase_6+0x47> 40162e: e8 0d 03 00 00 callq 401940 <explode_bomb> 401633: eb 37 jmp 40166c <phase_6+0x5c> 401635: e8 06 03 00 00 callq 401940 <explode_bomb> 40163a: 83 c3 01 add $0x1,%ebx===============================================================------------------------------------------------------------ 40163d: 83 fb 05 cmp $0x5,%ebx // if(%ebx > 5) 401640: 7f 12 jg 401654 <phase_6+0x44> 401642: 49 63 c4 movslq %r12d,%rax // %rax = %r12d 401645: 48 63 d3 movslq %ebx,%rdx // %rdx = %ebx 401648: 8b 7c 95 c0 mov -0x40(%rbp,%rdx,4),%edi 40164c: 39 7c 85 c0 cmp %edi,-0x40(%rbp,%rax,4) 401650: 75 e8 jne 40163a <phase_6+0x2a>----------------------------------------------------------- 401652: eb e1 jmp 401635 <phase_6+0x25> 401654: 45 89 ec mov %r13d,%r12d 401657: 41 83 fc 05 cmp $0x5,%r12d // cmp %r12d 5 40165b: 7f 19 jg 401676 <phase_6+0x66> // > 40165d: 49 63 c4 movslq %r12d,%rax // %rax = %r12d 401660: 8b 44 85 c0 mov -0x40(%rbp,%rax,4),%eax 401664: 83 e8 01 sub $0x1,%eax // %rax -= 1 401667: 83 f8 05 cmp $0x5,%eax // if rax > 5 40166a: 77 c2 ja 40162e <phase_6+0x1e> 40166c: 45 8d 6c 24 01 lea 0x1(%r12),%r13d// %r13d=(%r12d+1) 401671: 44 89 eb mov %r13d,%ebx // %ebx = %r13d 401674: eb c7 jmp 40163d <phase_6+0x2d>================================================================ 401676: b8 00 00 00 00 mov $0x0,%eax // %eax = 0 40167b: eb 13 jmp 401690 <phase_6+0x80>// j = 7 - i========================================================== 40167d: 48 63 c8 movslq %eax,%rcx 401680: ba 07 00 00 00 mov $0x7,%edx 401685: 2b 54 8d c0 sub -0x40(%rbp,%rcx,4),%edx 从第一个数开始 401689: 89 54 8d c0 mov %edx,-0x40(%rbp,%rcx,4) 40168d: 83 c0 01 add $0x1,%eax 401690: 83 f8 05 cmp $0x5,%eax 401693: 7e e8 jle 40167d <phase_6+0x6d>========================================================== 401695: be 00 00 00 00 mov $0x0,%esi 40169a: eb 18 jmp 4016b4 <phase_6+0xa4> 40169c: 48 8b 52 08 mov 0x8(%rdx),%rdx 4016a0: 83 c0 01 add $0x1,%eax//二重循环，寻找第j个链表元素============================================================== 4016a3: 48 63 ce movslq %esi,%rcx 4016a6: 39 44 8d c0 cmp %eax,-0x40(%rbp,%rcx,4) 4016aa: 7f f0 jg 40169c <phase_6+0x8c> 4016ac: 48 89 54 cd 90 mov %rdx,-0x70(%rbp,%rcx,8) 4016b1: 83 c6 01 add $0x1,%esi 4016b4: 83 fe 05 cmp $0x5,%esi 4016b7: 7f 0c jg 4016c5 <phase_6+0xb5> 4016b9: b8 01 00 00 00 mov $0x1,%eax 4016be: ba d0 52 40 00 mov $0x4052d0,%edx // 链表头 4016c3: eb de jmp 4016a3 <phase_6+0x93> 4016c5: 48 8b 5d 90 mov -0x70(%rbp) 4016c9: 48 89 d9 mov %rbx,%rcx //%rcx = %rbx 4016cc: b8 01 00 00 00 mov $0x1,%eax // eax = 1 4016d1: eb 12 jmp 4016e5 <phase_6+0xd5> 4016d3: 48 63 d0 movslq %eax,%rdx // rdx = eax 4016d6: 48 8b 54 d5 90 mov -0x70(%rbp,%rdx,8),%rdx 4016db: 48 89 51 08 mov %rdx,0x8(%rcx) 4016df: 83 c0 01 add $0x1,%eax 4016e2: 48 89 d1 mov %rdx,%rcx // rcx = rdx 4016e5: 83 f8 05 cmp $0x5,%eax // while 循环 4016e8: 7e e9 jle 4016d3 <phase_6+0xc3>========================================================= 4016ea: 48 c7 41 08 00 00 00 movq $0x0,0x8(%rcx) 4016f1: 00 4016f2: 41 bc 00 00 00 00 mov $0x0,%r12d 4016f8: eb 08 jmp 401702 <phase_6+0xf2> 4016fa: 48 8b 5b 08 mov 0x8(%rbx),%rbx 4016fe: 41 83 c4 01 add $0x1,%r12d 401702: 41 83 fc 04 cmp $0x4,%r12d 401706: 7f 11 jg 401719 <phase_6+0x109> 401708: 48 8b 43 08 mov 0x8(%rbx),%rax 40170c: 8b 00 mov (%rax),%eax 40170e: 39 03 cmp %eax,(%rbx) 401710: 7d e8 jge 4016fa <phase_6+0xea>// 这里是一重循环，判断是否前个元素大于等于后一个元素，即降序// 否则爆炸 401712: e8 29 02 00 00 callq 401940 <explode_bomb> 401717: eb e1 jmp 4016fa <phase_6+0xea> 401719: 48 83 c4 58 add $0x58,%rsp 40171d: 5b pop %rbx 40171e: 41 5c pop %r12 401720: 41 5d pop %r13 401722: 5d pop %rbp 401723: c3 retq