前言#

邪恶的邪恶博士在我们的班级机器上放置了大量的“二进制炸弹”。二进制炸弹是由一系列阶段组成的程序。每个阶段都要求你在 stdin 上键入一个特定的字符串。如果你输入了正确的字符串，那么这个阶段就被拆除，炸弹进入下一个阶段。否则炸弹会爆炸，并打印出 “BOOM!!!”，然后终止。当每一个阶段都被拆除时，炸弹才算拆除。

有太多炸弹要我们处理，所以我们给每个学生一个炸弹来拆除。这是你的任务，你别无选择，只能接受，就是在截止时间前拆除你的炸弹。祝你好运，欢迎加入拆弹小组！

开始#

NOTE
本 WriteUp 所有操作均在 Linux sakimidare-arch 7.0.2-arch1-1-lily #1 SMP PREEMPT_DYNAMIC Thu, 30 Apr 2026 05:29:46 +0000 x86_64 GNU/Linux 上进行。

我拿到了一个 bomb.tar，目录结构如下：

1
.
2
├── bomb
3
├── bomb.c
4
└── README
5

6
1 directory, 3 files

我们的目标是尽可能多地拆除炸弹（获取正确的拆弹密钥）。

首先来看 bomb.c:

1
/***************************************************************************
2
 * Dr. Evil's Insidious Bomb, Version 1.1
3
 * Copyright 2011, Dr. Evil Incorporated. All rights reserved.
4
 *
5
 * LICENSE:
6
 *
7
 * Dr. Evil Incorporated (the PERPETRATOR) hereby grants you (the
8
 * VICTIM) explicit permission to use this bomb (the BOMB).  This is a
9
 * time limited license, which expires on the death of the VICTIM.
10
 * The PERPETRATOR takes no responsibility for damage, frustration,
11
 * insanity, bug-eyes, carpal-tunnel syndrome, loss of sleep, or other
12
 * harm to the VICTIM.  Unless the PERPETRATOR wants to take credit,
13
 * that is.  The VICTIM may not distribute this bomb source code to
14
 * any enemies of the PERPETRATOR.  No VICTIM may debug,
15
 * reverse-engineer, run "strings" on, decompile, decrypt, or use any
16
 * other technique to gain knowledge of and defuse the BOMB.  BOMB
17
 * proof clothing may not be worn when handling this program.  The
18
 * PERPETRATOR will not apologize for the PERPETRATOR's poor sense of
19
 * humor.  This license is null and void where the BOMB is prohibited
20
 * by law.
21
 ***************************************************************************/
22

23
#include <stdio.h>
24
#include <stdlib.h>
25
#include "support.h"
26
#include "phases.h"
27

28
/*
29
 * Note to self: Remember to erase this file so my victims will have no
30
 * idea what is going on, and so they will all blow up in a
31
 * spectaculary fiendish explosion. -- Dr. Evil
32
 */
33

34
FILE *infile;
35

36
int main(int argc, char *argv[])
37
{
38
    char *input;
39

40
    /* Note to self: remember to port this bomb to Windows and put a
41
     * fantastic GUI on it. */
42

43
    /* When run with no arguments, the bomb reads its input lines
44
     * from standard input. */
45
    if (argc == 1) {
46
  infile = stdin;
47
    }
48

49
    /* When run with one argument <file>, the bomb reads from <file>
50
     * until EOF, and then switches to standard input. Thus, as you
51
     * defuse each phase, you can add its defusing string to <file> and
52
     * avoid having to retype it. */
53
    else if (argc == 2) {
54
  if (!(infile = fopen(argv[1], "r"))) {
55
      printf("%s: Error: Couldn't open %s\n", argv[0], argv[1]);
56
      exit(8);
57
  }
58
    }
59

60
    /* You can't call the bomb with more than 1 command line argument. */
61
    else {
62
  printf("Usage: %s [<input_file>]\n", argv[0]);
63
  exit(8);
64
    }
65

66
    /* Do all sorts of secret stuff that makes the bomb harder to defuse. */
67
    initialize_bomb();
68

69
    printf("Welcome to my fiendish little bomb. You have 6 phases with\n");
70
    printf("which to blow yourself up. Have a nice day!\n");
71

72
    /* Hmm...  Six phases must be more secure than one phase! */
73
    input = read_line();             /* Get input                   */
74
    phase_1(input);                  /* Run the phase               */
75
    phase_defused();                 /* Drat!  They figured it out!
76
              * Let me know how they did it. */
77
    printf("Phase 1 defused. How about the next one?\n");
78

79
    /* The second phase is harder.  No one will ever figure out
80
     * how to defuse this... */
81
    input = read_line();
82
    phase_2(input);
83
    phase_defused();
84
    printf("That's number 2.  Keep going!\n");
85

86
    /* I guess this is too easy so far.  Some more complex code will
87
     * confuse people. */
88
    input = read_line();
89
    phase_3(input);
90
    phase_defused();
91
    printf("Halfway there!\n");
92

93
    /* Oh yeah?  Well, how good is your math?  Try on this saucy problem! */
94
    input = read_line();
95
    phase_4(input);
96
    phase_defused();
97
    printf("So you got that one.  Try this one.\n");
98

99
    /* Round and 'round in memory we go, where we stop, the bomb blows! */
100
    input = read_line();
101
    phase_5(input);
102
    phase_defused();
103
    printf("Good work!  On to the next...\n");
104

105
    /* This phase will never be used, since no one will get past the
106
     * earlier ones.  But just in case, make this one extra hard. */
107
    input = read_line();
108
    phase_6(input);
109
    phase_defused();
110

111
    /* Wow, they got it!  But isn't something... missing?  Perhaps
112
     * something they overlooked?  Mua ha ha ha ha! */
113

114
    return 0;
115
}

support.h 和 phases.h 并没有提供，源码中的 initialize_bomb(), read_line(), phase_x(), phase_defused() 未提供定义。这就需要我们用反汇编推出这几个函数内部的逻辑并猜出密钥。

推测原型:

1
void initialize_bomb();
2
char* read_line();
3
void phase_x(char*);
4
void phase_defused();

反汇编#

首先用 readelf 看一眼这个 ELF 文件的布局：

1
readelf -a bomb
2
ELF 头：
3
  Magic：  7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00
4
  类别:                              ELF64
5
  数据:                              2 补码，小端序 (little endian)
6
  Version:                           1 (current)
7
  OS/ABI:                            UNIX - System V
8
  ABI 版本:                          0
9
  类型:                              EXEC (可执行文件)
10
  系统架构:                          Advanced Micro Devices X86-64
11
  版本:                              0x1
12
  入口点地址：              0x400c90
13
  程序头起点：              64 (bytes into file)
14
  Start of section headers:          18616 (bytes into file)
15
  标志：             0x0
16
  Size of this header:               64 (bytes)
17
  Size of program headers:           56 (bytes)
18
  Number of program headers:         9
19
  Size of section headers:           64 (bytes)
20
  Number of section headers:         36
21
  Section header string table index: 33
22

23
节头：
24
  [号] 名称              类型             地址              偏移量
25
       大小              全体大小          旗标   链接   信息   对齐
26
  [ 0]                   NULL             0000000000000000  00000000
27
       0000000000000000  0000000000000000           0     0     0
28
  [ 1] .interp           PROGBITS         0000000000400238  00000238
29
       000000000000001c  0000000000000000   A       0     0     1
30
  [ 2] .note.ABI-tag     NOTE             0000000000400254  00000254
31
       0000000000000020  0000000000000000   A       0     0     4
32
  [ 3] .note.gnu.bu[...] NOTE             0000000000400274  00000274
33
       0000000000000024  0000000000000000   A       0     0     4
34
  [ 4] .gnu.hash         GNU_HASH         0000000000400298  00000298
35
       0000000000000030  0000000000000000   A       5     0     8
36
  [ 5] .dynsym           DYNSYM           00000000004002c8  000002c8
37
       0000000000000300  0000000000000018   A       6     1     8
38
  [ 6] .dynstr           STRTAB           00000000004005c8  000005c8
39
       000000000000016d  0000000000000000   A       0     0     1
40
  [ 7] .gnu.version      VERSYM           0000000000400736  00000736
41
       0000000000000040  0000000000000002   A       5     0     2
42
  [ 8] .gnu.version_r    VERNEED          0000000000400778  00000778
43
       0000000000000060  0000000000000000   A       6     1     8
44
  [ 9] .rela.dyn         RELA             00000000004007d8  000007d8
45
       0000000000000060  0000000000000018   A       5     0     8
46
  [10] .rela.plt         RELA             0000000000400838  00000838
47
       0000000000000288  0000000000000018   A       5    12     8
48
  [11] .init             PROGBITS         0000000000400ac0  00000ac0
49
       000000000000000e  0000000000000000  AX       0     0     4
50
  [12] .plt              PROGBITS         0000000000400ad0  00000ad0
51
       00000000000001c0  0000000000000010  AX       0     0     16
52
  [13] .text             PROGBITS         0000000000400c90  00000c90
53
       0000000000001614  0000000000000000  AX       0     0     16
54
  [14] .fini             PROGBITS         00000000004022a4  000022a4
55
       0000000000000009  0000000000000000  AX       0     0     4
56
  [15] .rodata           PROGBITS         00000000004022b0  000022b0
57
       00000000000004e5  0000000000000000   A       0     0     16
58
  [16] .eh_frame_hdr     PROGBITS         0000000000402798  00002798
59
       0000000000000104  0000000000000000   A       0     0     4
60
  [17] .eh_frame         PROGBITS         00000000004028a0  000028a0
61
       0000000000000454  0000000000000000   A       0     0     8
62
  [18] .init_array       INIT_ARRAY       0000000000602df8  00002df8
63
       0000000000000008  0000000000000000  WA       0     0     8
64
  [19] .fini_array       FINI_ARRAY       0000000000602e00  00002e00
65
       0000000000000008  0000000000000000  WA       0     0     8
66
  [20] .jcr              PROGBITS         0000000000602e08  00002e08
67
       0000000000000008  0000000000000000  WA       0     0     8
68
  [21] .dynamic          DYNAMIC          0000000000602e10  00002e10
69
       00000000000001d0  0000000000000010  WA       6     0     8
70
  [22] .got              PROGBITS         0000000000602fe0  00002fe0
71
       0000000000000008  0000000000000008  WA       0     0     8
72
  [23] .got.plt          PROGBITS         0000000000602fe8  00002fe8
73
       00000000000000f0  0000000000000008  WA       0     0     8
74
  [24] .data             PROGBITS         00000000006030e0  000030e0
75
       0000000000000660  0000000000000000  WA       0     0     32
76
  [25] .bss              NOBITS           0000000000603740  00003740
77
       00000000000006d0  0000000000000000  WA       0     0     32
78
  [26] .comment          PROGBITS         0000000000000000  00003740
79
       0000000000000053  0000000000000001  MS       0     0     1
80
  [27] .debug_aranges    PROGBITS         0000000000000000  00003793
81
       0000000000000030  0000000000000000           0     0     1
82
  [28] .debug_info       PROGBITS         0000000000000000  000037c3
83
       00000000000007a3  0000000000000000           0     0     1
84
  [29] .debug_abbrev     PROGBITS         0000000000000000  00003f66
85
       000000000000021f  0000000000000000           0     0     1
86
  [30] .debug_line       PROGBITS         0000000000000000  00004185
87
       0000000000000161  0000000000000000           0     0     1
88
  [31] .debug_str        PROGBITS         0000000000000000  000042e6
89
       00000000000002f3  0000000000000001  MS       0     0     1
90
  [32] .debug_loc        PROGBITS         0000000000000000  000045d9
91
       0000000000000188  0000000000000000           0     0     1
92
  [33] .shstrtab         STRTAB           0000000000000000  00004761
93
       0000000000000153  0000000000000000           0     0     1
94
  [34] .symtab           SYMTAB           0000000000000000  000051b8
95
       0000000000000eb8  0000000000000018          35    57     8
96
  [35] .strtab           STRTAB           0000000000000000  00006070
97
       00000000000006b6  0000000000000000           0     0     1
98
Key to Flags:
99
  W (write), A (alloc), X (execute), M (merge), S (strings), I (info),
100
  L (link order), O (extra OS processing required), G (group), T (TLS),
101
  C (compressed), x (unknown), o (OS specific), E (exclude),
102
  D (mbind), l (large), p (processor specific)
103

104
There are no section groups in this file.

对我们有用的部分是 .text 和 .rodata 段。前者保存机器码，后者保存用到的常量（包括字符串）。

`initialize_bomb()`#

1
objdump -d bomb -disassemble=initialize_bomb

1
objdump -d bomb --disassemble=initialize_bomb
2

3
bomb：     文件格式 elf64-x86-64
4

5

6
Disassembly of section .init:
7

8
Disassembly of section .plt:
9

10
Disassembly of section .text:
11

12
00000000004013a2 <initialize_bomb>:
13
  4013a2:       48 83 ec 08             sub    $0x8,%rsp
14
  4013a6:       be a0 12 40 00          mov    $0x4012a0,%esi
15
  4013ab:       bf 02 00 00 00          mov    $0x2,%edi
16
  4013b0:       e8 db f7 ff ff          call   400b90 <signal@plt>
17
  4013b5:       48 83 c4 08             add    $0x8,%rsp
18
  4013b9:       c3                      ret
19

20
Disassembly of section .fini:

%edi %esi 按照惯例来讲应该是函数的两个参数。%rsp 是栈指针，指向当前栈顶。上述汇编从栈中弹出一个四字（不用 popq 大概是为了不污染 %rax），并赋了两个魔数给两个寄存器，并调用了 400b90 这个地方的函数 <signal@plt> 。我们继续去反编译 signal。

1
0000000000400b90 <signal@plt>:
2
  400b90:       ff 25 c2 24 20 00       jmp    *0x2024c2(%rip)        # 603058 <signal@GLIBC_2.2.5>
3
  400b96:       68 0b 00 00 00          push   $0xb
4
  400b9b:       e9 30 ff ff ff          jmp    400ad0 <.plt>

1
0000000000400ad0 <.plt>:
2
  400ad0:       ff 35 1a 25 20 00       push   0x20251a(%rip)        # 602ff0 <_GLOBAL_OFFSET_TABLE_+0x8>
3
  400ad6:       ff 25 1c 25 20 00       jmp    *0x20251c(%rip)        # 602ff8 <_GLOBAL_OFFSET_TABLE_+0x10>
4
  400adc:       0f 1f 40 00             nopl   0x0(%rax)

坏事了，这个函数并不在我们的二进制文件里，而是动态链接到了 glibc 里面的 signal 函数。

查阅相关资料，发现 signal 函数原型如下：

1
#include <signal.h>
2

3
typedef void (*sighandler_t)(int);
4

5
sighandler_t signal(int signum, sighandler_t handler);

代入%edi，%esi，发现调用的函数是：

1
sighandler_t signal(0x2, 0x4012a0);

通过查表：

1
$ man signal
2

3
SIGNAL(7)                                                         Linux Programmer's Manual                                                        SIGNAL(7)
4

5
NAME
6
     signal - 有效信号的清单
7

8
描述 (DESCRIPTION)
9
     下面 列出 Linux 支持的 信号. 某些 信号 依赖于 体系结构(architecture).
10

11
     首先, POSIX.1 描述了 下列 信号.
12

13
     信号         值      动作   说明
14
     ─────────────────────────────────────────────────────────────────────
15
     SIGHUP        1       A     在控制终端上是挂起信号, 或者控制进程结束
16
     SIGINT        2       A     从键盘输入的中断
17
     SIGQUIT       3       C     从键盘输入的退出
18
     SIGILL        4       C     无效硬件指令
19
     SIGABRT       6       C     非正常终止, 可能来自 abort(3)
20
     SIGFPE        8       C     浮点运算例外
21
     SIGKILL       9      AEF    杀死进程信号
22
     SIGSEGV      11       C     无效的内存引用
23
     SIGPIPE      13       A     管道中止: 写入无人读取的管道
24
     SIGALRM      14       A     来自 alarm(2) 的超时信号
25
     SIGTERM      15       A     终止信号
26
     SIGUSR1   30,10,16    A     用户定义的信号 1
27
     SIGUSR2   31,12,17    A     用户定义的信号 2
28
     SIGCHLD   20,17,18    B     子进程结束或停止
29
     SIGCONT   19,18,25          继续停止的进程
30
     SIGSTOP   17,19,23   DEF    停止进程
31
     SIGTSTP   18,20,24    D     终端上发出的停止信号
32
     SIGTTIN   21,21,26    D     后台进程试图从控制终端(tty)输入
33
     SIGTTOU   22,22,27    D     后台进程试图在控制终端(tty)输出
34
...

发现 0x2 对应 SIGINT。

SIGFPE 是键盘上按下 Ctrl+C时 Linux 向程序发送的信号。上面的函数捕获了这个信号并注册了一个函数，地址在0x4012a0。通过

1
typedef void (*sighandler_t)(int);

我们还能知道函数钩子的原型是 void foo(int);。

接下来反汇编 0x4012a0 处的函数：

1
$ objdump -d --start-address=0x4012a0 --stop-address=0x4013a0 bomb
2

3
bomb：     文件格式 elf64-x86-64
4

5

6
Disassembly of section .text:
7

8
00000000004012a0 <sig_handler>:
9
  4012a0:       48 83 ec 08             sub    $0x8,%rsp
10
  4012a4:       bf c0 24 40 00          mov    $0x4024c0,%edi
11
  4012a9:       e8 62 f8 ff ff          call   400b10 <puts@plt>
12
  4012ae:       bf 03 00 00 00          mov    $0x3,%edi
13
  4012b3:       e8 98 f9 ff ff          call   400c50 <sleep@plt>
14
  4012b8:       be 82 25 40 00          mov    $0x402582,%esi
15
  4012bd:       bf 01 00 00 00          mov    $0x1,%edi
16
  4012c2:       b8 00 00 00 00          mov    $0x0,%eax
17
  4012c7:       e8 34 f9 ff ff          call   400c00 <__printf_chk@plt>
18
  4012cc:       48 8b 3d 6d 24 20 00    mov    0x20246d(%rip),%rdi        # 603740 <stdout@GLIBC_2.2.5>
19
  4012d3:       e8 08 f9 ff ff          call   400be0 <fflush@plt>
20
  4012d8:       bf 01 00 00 00          mov    $0x1,%edi
21
  4012dd:       e8 6e f9 ff ff          call   400c50 <sleep@plt>
22
  4012e2:       bf 8a 25 40 00          mov    $0x40258a,%edi
23
  4012e7:       e8 24 f8 ff ff          call   400b10 <puts@plt>
24
  4012ec:       bf 10 00 00 00          mov    $0x10,%edi
25
  4012f1:       e8 2a f9 ff ff          call   400c20 <exit@plt>

这个函数大量调用了 puts() sleep() fflush() exit() 等函数，猜测与炸弹密钥无关。但为了保险，我们先看看 puts() 都输出了什么东西。

查看 0x4024c0 0x400b10对应的汇编：

1
$ objdump -s -j .rodata bomb | grep -A 5 "4024c0"
2
 4024c0 536f2079 6f752074 68696e6b 20796f75  So you think you
3
 4024d0 2063616e 2073746f 70207468 6520626f   can stop the bo
4
 4024e0 6d622077 69746820 6374726c 2d632c20  mb with ctrl-c,
5
 4024f0 646f2079 6f753f00 43757273 65732c20  do you?.Curses,
6
 402500 796f7527 76652066 6f756e64 20746865  you've found the
7
 402510 20736563 72657420 70686173 65210000   secret phase!..

好吧确实没啥关系……不管了我们接着看下一个函数。

`phase_1()`#

1
$ objdump -d bomb --disassemble=phase_1
2

3
bomb：     文件格式 elf64-x86-64
4

5

6
Disassembly of section .init:
7

8
Disassembly of section .plt:
9

10
Disassembly of section .text:
11

12
0000000000400ee0 <phase_1>:
13
  400ee0:       48 83 ec 08             sub    $0x8,%rsp
14
  400ee4:       be 00 24 40 00          mov    $0x402400,%esi
15
  400ee9:       e8 4a 04 00 00          call   401338 <strings_not_equal>
16
  400eee:       85 c0                   test   %eax,%eax
17
  400ef0:       74 05                   je     400ef7 <phase_1+0x17>
18
  400ef2:       e8 43 05 00 00          call   40143a <explode_bomb>
19
  400ef7:       48 83 c4 08             add    $0x8,%rsp
20
  400efb:       c3                      ret
21

22
Disassembly of section .fini:

查看 0x402400 处的汇编：

1
$ objdump -s -j .rodata bomb | grep -A 10 "402400"
2
 402400 426f7264 65722072 656c6174 696f6e73  Border relations
3
 402410 20776974 68204361 6e616461 20686176   with Canada hav
4
 402420 65206e65 76657220 6265656e 20626574  e never been bet
5
 402430 7465722e 00000000 576f7721 20596f75  ter.....Wow! You
6
 402440 27766520 64656675 73656420 74686520  've defused the
7
 402450 73656372 65742073 74616765 2100666c  secret stage!.fl
8
 402460 79657273 00000000 00000000 00000000  yers............
9
 402470 7c0f4000 00000000 b90f4000 00000000  |.@.......@.....
10
 402480 830f4000 00000000 8a0f4000 00000000  ..@.......@.....
11
 402490 910f4000 00000000 980f4000 00000000  ..@.......@.....
12
 4024a0 9f0f4000 00000000 a60f4000 00000000  ..@.......@.....

注意这一行：

1
 402430 7465722e 00000000 576f7721 20596f75  ter.....Wow! You

00标志着 C 风格字符串的结尾。也就是说，这个字符串的内容是:

1
Border relations with Canada have never been better.

查看 401338 的汇编：

1
objdump -d bomb --start-address=0x401338 --stop-address=0x401400
2

3
bomb：     文件格式 elf64-x86-64
4

5

6
Disassembly of section .text:
7

8
0000000000401338 <strings_not_equal>:
9
  401338:       41 54                   push   %r12
10
  40133a:       55                      push   %rbp
11
  40133b:       53                      push   %rbx
12
  40133c:       48 89 fb                mov    %rdi,%rbx
13
  40133f:       48 89 f5                mov    %rsi,%rbp
14
  401342:       e8 d4 ff ff ff          call   40131b <string_length>
15
  401347:       41 89 c4                mov    %eax,%r12d
16
  40134a:       48 89 ef                mov    %rbp,%rdi
17
  40134d:       e8 c9 ff ff ff          call   40131b <string_length>
18
  401352:       ba 01 00 00 00          mov    $0x1,%edx
19
  401357:       41 39 c4                cmp    %eax,%r12d
20
  40135a:       75 3f                   jne    40139b <strings_not_equal+0x63>
21
  40135c:       0f b6 03                movzbl (%rbx),%eax
22
  40135f:       84 c0                   test   %al,%al
23
  401361:       74 25                   je     401388 <strings_not_equal+0x50>
24
  401363:       3a 45 00                cmp    0x0(%rbp),%al
25
  401366:       74 0a                   je     401372 <strings_not_equal+0x3a>
26
  401368:       eb 25                   jmp    40138f <strings_not_equal+0x57>
27
  40136a:       3a 45 00                cmp    0x0(%rbp),%al
28
  40136d:       0f 1f 00                nopl   (%rax)
29
  401370:       75 24                   jne    401396 <strings_not_equal+0x5e>
30
  401372:       48 83 c3 01             add    $0x1,%rbx
31
  401376:       48 83 c5 01             add    $0x1,%rbp
32
  40137a:       0f b6 03                movzbl (%rbx),%eax
33
  40137d:       84 c0                   test   %al,%al
34
  40137f:       75 e9                   jne    40136a <strings_not_equal+0x32>
35
  401381:       ba 00 00 00 00          mov    $0x0,%edx
36
  401386:       eb 13                   jmp    40139b <strings_not_equal+0x63>
37
  401388:       ba 00 00 00 00          mov    $0x0,%edx
38
  40138d:       eb 0c                   jmp    40139b <strings_not_equal+0x63>
39
  40138f:       ba 01 00 00 00          mov    $0x1,%edx
40
  401394:       eb 05                   jmp    40139b <strings_not_equal+0x63>
41
  401396:       ba 01 00 00 00          mov    $0x1,%edx
42
  40139b:       89 d0                   mov    %edx,%eax
43
  40139d:       5b                      pop    %rbx
44
  40139e:       5d                      pop    %rbp
45
  40139f:       41 5c                   pop    %r12
46
  4013a1:       c3                      ret

……

怎么这么长呀！

猜测一手，上面那个函数的意思是把输入进去的内容和先前看到的字符串做比对，如果相同表明拆弹成功。到底是不是这样呢？

1
$ ./bomb
2
Welcome to my fiendish little bomb. You have 6 phases with
3
which to blow yourself up. Have a nice day!
4
Border relations with Canada have never been better.
5
Phase 1 defused. How about the next one?

嘿嘿，拆弹成功！

`phase_2()`#

1
objdump -d bomb --disassemble=phase_2
2

3
bomb：     文件格式 elf64-x86-64
4

5

6
Disassembly of section .init:
7

8
Disassembly of section .plt:
9

10
Disassembly of section .text:
11

12
0000000000400efc <phase_2>:
13
  400efc:       55                      push   %rbp
14
  400efd:       53                      push   %rbx
15
  400efe:       48 83 ec 28             sub    $0x28,%rsp
16
  400f02:       48 89 e6                mov    %rsp,%rsi
17
  400f05:       e8 52 05 00 00          call   40145c <read_six_numbers>
18
  400f0a:       83 3c 24 01             cmpl   $0x1,(%rsp)
19
  400f0e:       74 20                   je     400f30 <phase_2+0x34>
20
  400f10:       e8 25 05 00 00          call   40143a <explode_bomb>
21
  400f15:       eb 19                   jmp    400f30 <phase_2+0x34>
22
  400f17:       8b 43 fc                mov    -0x4(%rbx),%eax
23
  400f1a:       01 c0                   add    %eax,%eax
24
  400f1c:       39 03                   cmp    %eax,(%rbx)
25
  400f1e:       74 05                   je     400f25 <phase_2+0x29>
26
  400f20:       e8 15 05 00 00          call   40143a <explode_bomb>
27
  400f25:       48 83 c3 04             add    $0x4,%rbx
28
  400f29:       48 39 eb                cmp    %rbp,%rbx
29
  400f2c:       75 e9                   jne    400f17 <phase_2+0x1b>
30
  400f2e:       eb 0c                   jmp    400f3c <phase_2+0x40>
31
  400f30:       48 8d 5c 24 04          lea    0x4(%rsp),%rbx
32
  400f35:       48 8d 6c 24 18          lea    0x18(%rsp),%rbp
33
  400f3a:       eb db                   jmp    400f17 <phase_2+0x1b>
34
  400f3c:       48 83 c4 28             add    $0x28,%rsp
35
  400f40:       5b                      pop    %rbx
36
  400f41:       5d                      pop    %rbp
37
  400f42:       c3                      ret
38

39
Disassembly of section .fini:

这个函数开始出现了比较多的跳转指令，猜测由 if 和 while 编译而来。

`<read_six_numbers>`#

先去看看 40145c 的 read_six_numbers 函数吧，看看读入的六个数字存到哪里去。

1
objdump -d bomb --start-address=0x40145c --stop-address=0x40155c
2

3
bomb：     文件格式 elf64-x86-64
4

5

6
Disassembly of section .text:
7

8
000000000040145c <read_six_numbers>:
9
  40145c:       48 83 ec 18             sub    $0x18,%rsp
10
  401460:       48 89 f2                mov    %rsi,%rdx
11
  401463:       48 8d 4e 04             lea    0x4(%rsi),%rcx
12
  401467:       48 8d 46 14             lea    0x14(%rsi),%rax
13
  40146b:       48 89 44 24 08          mov    %rax,0x8(%rsp)
14
  401470:       48 8d 46 10             lea    0x10(%rsi),%rax
15
  401474:       48 89 04 24             mov    %rax,(%rsp)
16
  401478:       4c 8d 4e 0c             lea    0xc(%rsi),%r9
17
  40147c:       4c 8d 46 08             lea    0x8(%rsi),%r8
18
  401480:       be c3 25 40 00          mov    $0x4025c3,%esi
19
  401485:       b8 00 00 00 00          mov    $0x0,%eax
20
  40148a:       e8 61 f7 ff ff          call   400bf0 <__isoc99_sscanf@plt>
21
  40148f:       83 f8 05                cmp    $0x5,%eax
22
  401492:       7f 05                   jg     401499 <read_six_numbers+0x3d>
23
  401494:       e8 a1 ff ff ff          call   40143a <explode_bomb>
24
  401499:       48 83 c4 18             add    $0x18,%rsp
25
  40149d:       c3                      ret

我不行了这都啥啊！

看一眼 sscanf() 的原型：

1
int sscanf(const char *str, const char *format, ...);

发现不同于直接从 stdin 读取的 scanf, 他接收 n+2 = 8 个参数。

已知 x86-64 汇编中函数传参的顺序是 %rdi %rsi %rdx %rcx %r8 %r9，而我们读入六个数字需要传给 sscanf() 8个参数。还余下两个怎么办？经过查找资料发现会从栈里从顶到底挨个读取数据。

第二个参数是%rsi。盲猜一手 0x4025c3 那边存的应该是类似 %d %d %d %d %d %d 的东西。

1
 4025c0 702e0025 64202564 20256420 25642025  p..%d %d %d %d %
2
 4025d0 64202564 00457272 6f723a20 5072656d  d %d.Error: Prem

那问题来了，%rdi 在哪？

既然是我输入的字符串，我有理由猜测输入的字符串原封不动地躺在 %edi 里边 ~~大概吧（）~~

NOTE
这个地方是我蒙的不小心蒙对了（）

注意到有几行汇编非常有意思：

1
  400efe:       48 83 ec 28             sub    $0x28,%rsp
2
  400f02:       48 89 e6                mov    %rsp,%rsi
3
  400f05:       e8 52 05 00 00          call   40145c <read_six_numbers>
4
  ...
5
  40145c:       48 83 ec 18             sub    $0x18,%rsp

400efe 行：开辟 0x28 字节大小空间；
400f02 行：给当前栈指针做个备份，赋给 %rsi；
40145c 行：开辟 0x18 字节大小空间。

1
  401460:       48 89 f2                mov    %rsi,%rdx
2
  401463:       48 8d 4e 04             lea    0x4(%rsi),%rcx
3
  401478:       4c 8d 4e 0c             lea    0xc(%rsi),%r9
4
  40147c:       4c 8d 46 08             lea    0x8(%rsi),%r8
5
  401480:       be c3 25 40 00          mov    $0x4025c3,%esi

这几行涉及内存地址的计算。可以看到，所有参数对应的内存偏移量都是以 %rsi（也就是刚刚备份过的 %rsp）为基准的。sscanf 写入的所有数据都保存在 phase_2 的栈帧中。

1
  401467:       48 8d 46 14             lea    0x14(%rsi),%rax
2
  40146b:       48 89 44 24 08          mov    %rax,0x8(%rsp)
3
  401470:       48 8d 46 10             lea    0x10(%rsi),%rax
4
  401474:       48 89 04 24             mov    %rax,(%rsp)

这几行不同于上文的lea 0x...(%rsi) %寄存器 是因为给参数使用的寄存器用完了，不得不从栈里读数据。这里的栈指针为分配好 0x18 字节之后的指针，确保不会覆盖之前读取好的数据。

于是我们就有了下面一张表：

（对不起我用 AI 整理了一下实在不好意思...）

次序	参数意义	存放位置	具体数据	汇编证据
1	输入字符串	`%rdi`	`(%rdi)`	(外部传入，直接透传)
2	格式化字符串	`%rsi`	`0x4025c3`	`mov $0x4025c3, %esi`
3	数字 1 的地址	`%rdx`	`(%rsi)`	`mov %rsi, %rdx`
4	数字 2 的地址	`%rcx`	`0x4(%rsi)`	`lea 0x4(%rsi), %rcx`
5	数字 3 的地址	`%r8`	`0x8(%rsi)`	`lea 0x8(%rsi), %r8`
6	数字 4 的地址	`%r9`	`0xc(%rsi)`	`lea 0xc(%rsi), %r9`
7	数字 5 的地址	`(%rsp)`	`0x10(%rsi)`	`lea 0x10(%rsi),%rax` `mov %rax, (%rsp)`
8	数字 6 的地址	`0x8(%rsp)`	`0x14(%rsi)`	`lea 0x14(%rsi),%rax` `mov %rax, 0x8(%rsp)`

注意到了 401492 的比较跳转指令正好跳过了401494 的爆炸函数，所以我们要想办法满足 jg 的条件。

1
  40148a:       e8 61 f7 ff ff          call   400bf0 <__isoc99_sscanf@plt>
2
  40148f:       83 f8 05                cmp    $0x5,%eax
3
  401492:       7f 05                   jg     401499 <read_six_numbers+0x3d>

我们来查阅 sscanf 的返回值：

1
RETURN VALUE
2
  On success, these functions return the number of input items
3
  successfully matched and assigned; this can be fewer than provided
4
  for, or even zero, in the event of an early matching failure.
5

6
  The value EOF is returned if the end of input is reached before
7
  either the first successful conversion or a matching failure
8
  occurs.

发现返回值（也就是 %eax 里的值）是解析出的输入个数。之后 40148f 行将返回值与 5 进行比较，如果返回值大于 5，就跳过炸弹。

这个操作等效于以下 C 代码：

1
if(sscanf("%d %d %d %d %d %d", &a1, &a2, &a3, &a4, &a5, &a6) <= 5) {
2
    explode_bomb();
3
}

于是我们顺利分析了 read_six_numbers 的行为。

循环与跳转#

调用完 read_six_numbers 函数后，紧接着 phase_2 做了以下行为：

1
  400f0a:       83 3c 24 01             cmpl   $0x1,(%rsp)
2
  400f0e:       74 20                   je     400f30 <phase_2+0x34>
3
  400f10:       e8 25 05 00 00          call   40143a <explode_bomb>
4
  400f15:       eb 19                   jmp    400f30 <phase_2+0x34>
5
  400f17:       8b 43 fc                mov    -0x4(%rbx),%eax
6
  400f1a:       01 c0                   add    %eax,%eax
7
  400f1c:       39 03                   cmp    %eax,(%rbx)
8
  400f1e:       74 05                   je     400f25 <phase_2+0x29>
9
  400f20:       e8 15 05 00 00          call   40143a <explode_bomb>
10
  400f25:       48 83 c3 04             add    $0x4,%rbx
11
  400f29:       48 39 eb                cmp    %rbp,%rbx
12
  400f2c:       75 e9                   jne    400f17 <phase_2+0x1b>
13
  400f2e:       eb 0c                   jmp    400f3c <phase_2+0x40>
14
  400f30:       48 8d 5c 24 04          lea    0x4(%rsp),%rbx
15
  400f35:       48 8d 6c 24 18          lea    0x18(%rsp),%rbp
16
  400f3a:       eb db                   jmp    400f17 <phase_2+0x1b>
17
  400f3c:       48 83 c4 28             add    $0x28,%rsp
18
  400f40:       5b                      pop    %rbx
19
  400f41:       5d                      pop    %rbp
20
  400f42:       c3                      ret

1
  400f0a:       83 3c 24 01             cmpl   $0x1,(%rsp)
2
  400f0e:       74 20                   je     400f30 <phase_2+0x34>
3
  400f10:       e8 25 05 00 00          call   40143a <explode_bomb>
4
  400f15:       eb 19                   jmp    400f30 <phase_2+0x34>

如果 (%rsp) 不是 1，直接引爆炸弹。之后跳转到 400f30 段落。

1
  400f30:       48 8d 5c 24 04          lea    0x4(%rsp),%rbx
2
  400f35:       48 8d 6c 24 18          lea    0x18(%rsp),%rbp
3
  400f3a:       eb db                   jmp    400f17 <phase_2+0x1b>

这时候遇到了 0x...(%rsp)！时刻记住上面推导出来的那张表，注意所有的%rsi均需换成%rsp，因为栈帧已还原。

上述汇编做了个什么事呢？首先 %rbx 被赋予了 %rsp + 0x4。也就是第二个数字的地址。然后，%rbp 被赋予了 %rsp + 0x18，查表发现，刚好是最后一个数字之后的地址。随后跳转到 400f17 开始执行指令。

1
  400f17:       8b 43 fc                mov    -0x4(%rbx),%eax
2
  400f1a:       01 c0                   add    %eax,%eax
3
  400f1c:       39 03                   cmp    %eax,(%rbx)
4
  400f1e:       74 05                   je     400f25 <phase_2+0x29>
5
  400f20:       e8 15 05 00 00          call   40143a <explode_bomb>
6
  400f25:       48 83 c3 04             add    $0x4,%rbx
7
  400f29:       48 39 eb                cmp    %rbp,%rbx
8
  400f2c:       75 e9                   jne    400f17 <phase_2+0x1b>

400f17: %eax 赋值为 %rbx的 前一个数字；
f00f1a: 将%eax 翻倍；
400f1c: 比较翻倍后的前一个数字与当前数字；
400f1e: 如果相等，跳过炸弹，否则引爆炸弹；
400f25: %rbx 增加 0x4，指向后一个数字；
400f29: 检查 %rbx 是否与 %rbp 相等（指针是否指向了末尾）；
400f2c: 如果没有指向末尾，重复执行上述操作。

这不就是经典的for循环吗！

1
 for(long *p = &a2; p < &a6 + 1; p++) {
2
    if(*(p - 1) * 2 != *p) explode_bomb();
3
 }

显然可以看出，phase_2 是一个检查输入 是否为等比数列 的函数，初值为 1，公比是 2，项数为6！

1
$ ./bomb
2
Welcome to my fiendish little bomb. You have 6 phases with
3
which to blow yourself up. Have a nice day!
4
Border relations with Canada have never been better.
5
Phase 1 defused. How about the next one?
6
1 2 4 8 16 32
7
That's number 2.  Keep going!

`phase_3()`#

1
objdump -d bomb --disassemble=phase_3
2

3
bomb：     文件格式 elf64-x86-64
4

5

6
Disassembly of section .init:
7

8
Disassembly of section .plt:
9

10
Disassembly of section .text:
11

12
0000000000400f43 <phase_3>:
13
  400f43:       48 83 ec 18             sub    $0x18,%rsp
14
  400f47:       48 8d 4c 24 0c          lea    0xc(%rsp),%rcx
15
  400f4c:       48 8d 54 24 08          lea    0x8(%rsp),%rdx
16
  400f51:       be cf 25 40 00          mov    $0x4025cf,%esi
17
  400f56:       b8 00 00 00 00          mov    $0x0,%eax
18
  400f5b:       e8 90 fc ff ff          call   400bf0 <__isoc99_sscanf@plt>
19
  400f60:       83 f8 01                cmp    $0x1,%eax
20
  400f63:       7f 05                   jg     400f6a <phase_3+0x27>
21
  400f65:       e8 d0 04 00 00          call   40143a <explode_bomb>
22
  400f6a:       83 7c 24 08 07          cmpl   $0x7,0x8(%rsp)
23
  400f6f:       77 3c                   ja     400fad <phase_3+0x6a>
24
  400f71:       8b 44 24 08             mov    0x8(%rsp),%eax
25
  400f75:       ff 24 c5 70 24 40 00    jmp    *0x402470(,%rax,8)
26
  400f7c:       b8 cf 00 00 00          mov    $0xcf,%eax
27
  400f81:       eb 3b                   jmp    400fbe <phase_3+0x7b>
28
  400f83:       b8 c3 02 00 00          mov    $0x2c3,%eax
29
  400f88:       eb 34                   jmp    400fbe <phase_3+0x7b>
30
  400f8a:       b8 00 01 00 00          mov    $0x100,%eax
31
  400f8f:       eb 2d                   jmp    400fbe <phase_3+0x7b>
32
  400f91:       b8 85 01 00 00          mov    $0x185,%eax
33
  400f96:       eb 26                   jmp    400fbe <phase_3+0x7b>
34
  400f98:       b8 ce 00 00 00          mov    $0xce,%eax
35
  400f9d:       eb 1f                   jmp    400fbe <phase_3+0x7b>
36
  400f9f:       b8 aa 02 00 00          mov    $0x2aa,%eax
37
  400fa4:       eb 18                   jmp    400fbe <phase_3+0x7b>
38
  400fa6:       b8 47 01 00 00          mov    $0x147,%eax
39
  400fab:       eb 11                   jmp    400fbe <phase_3+0x7b>
40
  400fad:       e8 88 04 00 00          call   40143a <explode_bomb>
41
  400fb2:       b8 00 00 00 00          mov    $0x0,%eax
42
  400fb7:       eb 05                   jmp    400fbe <phase_3+0x7b>
43
  400fb9:       b8 37 01 00 00          mov    $0x137,%eax
44
  400fbe:       3b 44 24 0c             cmp    0xc(%rsp),%eax
45
  400fc2:       74 05                   je     400fc9 <phase_3+0x86>
46
  400fc4:       e8 71 04 00 00          call   40143a <explode_bomb>
47
  400fc9:       48 83 c4 18             add    $0x18,%rsp
48
  400fcd:       c3                      ret

又是经典sscanf。看看格式化字符串：

1
 4025c0 702e0025 64202564 20256420 25642025  p..%d %d %d %d %
2
 4025d0 64202564 00457272 6f723a20 5072656d  d %d.Error: Prem

竟然复用phase_2的字符串！但是起始位置不同。这次的格式化字符串是

1
%d %d

意味着我需要输入俩数字，存到 (%rdx) 和 (%rcx) （也就是 0x8(%rsp), 0xc(%rsp)）。

根据 phase_2 的经验，我们直接来看这段：

1
  400f6a:       83 7c 24 08 07          cmpl   $0x7,0x8(%rsp)
2
  400f6f:       77 3c                   ja     400fad <phase_3+0x6a>
3
  400f71:       8b 44 24 08             mov    0x8(%rsp),%eax
4
  400f75:       ff 24 c5 70 24 40 00    jmp    *0x402470(,%rax,8)
5
  400f7c:       b8 cf 00 00 00          mov    $0xcf,%eax
6
  400f81:       eb 3b                   jmp    400fbe <phase_3+0x7b>
7
  400f83:       b8 c3 02 00 00          mov    $0x2c3,%eax
8
  400f88:       eb 34                   jmp    400fbe <phase_3+0x7b>
9
  400f8a:       b8 00 01 00 00          mov    $0x100,%eax
10
  400f8f:       eb 2d                   jmp    400fbe <phase_3+0x7b>
11
  400f91:       b8 85 01 00 00          mov    $0x185,%eax
12
  400f96:       eb 26                   jmp    400fbe <phase_3+0x7b>
13
  400f98:       b8 ce 00 00 00          mov    $0xce,%eax
14
  400f9d:       eb 1f                   jmp    400fbe <phase_3+0x7b>
15
  400f9f:       b8 aa 02 00 00          mov    $0x2aa,%eax
16
  400fa4:       eb 18                   jmp    400fbe <phase_3+0x7b>
17
  400fa6:       b8 47 01 00 00          mov    $0x147,%eax
18
  400fab:       eb 11                   jmp    400fbe <phase_3+0x7b>
19
  400fad:       e8 88 04 00 00          call   40143a <explode_bomb>
20
  400fb2:       b8 00 00 00 00          mov    $0x0,%eax
21
  400fb7:       eb 05                   jmp    400fbe <phase_3+0x7b>
22
  400fb9:       b8 37 01 00 00          mov    $0x137,%eax
23
  400fbe:       3b 44 24 0c             cmp    0xc(%rsp),%eax
24
  400fc2:       74 05                   je     400fc9 <phase_3+0x86>
25
  400fc4:       e8 71 04 00 00          call   40143a <explode_bomb>
26
  400fc9:       48 83 c4 18             add    $0x18,%rsp
27
  400fcd:       c3                      ret

400f6f 会直接把炸弹搞炸，所以 0x8(%rsp) 不应该大于 0x7。

1
  400f71:       8b 44 24 08             mov    0x8(%rsp),%eax
2
  400f75:       ff 24 c5 70 24 40 00    jmp    *0x402470(,%rax,8)

这是干啥的？

看看 0x402470 附近有啥吧。

怎么反编译出来没这个地址？

1
00000000004022a0 <__libc_csu_fini>:
2
  4022a0:       f3 c3                   repz ret
3
  4022a2:       90                      nop
4
  4022a3:       90                      nop
5

6
Disassembly of section .fini:
7

8
00000000004022a4 <_fini>:
9
  4022a4:       48 83 ec 08             sub    $0x8,%rsp
10
  4022a8:       48 83 c4 08             add    $0x8,%rsp
11
  4022ac:       c3                      ret

？？？？

我没招了。

（激情拷打 Gemini）

你看到的 402470 是跳转表（Jump Table）的基地址。

这正是 C 语言中 switch-case 语句编译后的典型模样。因为 switch 的分支太多，编译器为了效率，不会写一堆 if-else，而是直接在内存里建了一张“地址表”，根据你输入的数字直接查表跳转。

1
$ gdb bomb
2
GNU gdb (GDB) 17.1
3
Copyright (C) 2025 Free Software Foundation, Inc.
4
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
5
This is free software: you are free to change and redistribute it.
6
There is NO WARRANTY, to the extent permitted by law.
7
Type "show copying" and "show warranty" for details.
8
This GDB was configured as "x86_64-pc-linux-gnu".
9
Type "show configuration" for configuration details.
10
For bug reporting instructions, please see:
11
<https://www.gnu.org/software/gdb/bugs/>.
12
Find the GDB manual and other documentation resources online at:
13
    <http://www.gnu.org/software/gdb/documentation/>.
14

15
For help, type "help".
16
Type "apropos word" to search for commands related to "word"...
17
Reading symbols from bomb...
18
(gdb) x/8gx 0x402470
19
0x402470:       0x0000000000400f7c      0x0000000000400fb9
20
0x402480:       0x0000000000400f83      0x0000000000400f8a
21
0x402490:       0x0000000000400f91      0x0000000000400f98
22
0x4024a0:       0x0000000000400f9f      0x0000000000400fa6

NOTE

gdb 显示的地址为大端序，实际上 .rodata 以小端序存放地址。

1
$ objdump -s -j .rodata bomb --start-address=0x402470
2

3
bomb：     文件格式 elf64-x86-64
4

5
Contents of section .rodata:
6
 402470 7c0f4000 00000000 b90f4000 00000000  |.@.......@.....
7
 402480 830f4000 00000000 8a0f4000 00000000  ..@.......@.....
8
 402490 910f4000 00000000 980f4000 00000000  ..@.......@.....
9
 4024a0 9f0f4000 00000000 a60f4000 00000000  ..@.......@.....

行吧，那么得出这么一张表：

`%rax`	地址
0	`0x400f7c`
1	`0x400fb9`
2	`0x400f83`
3	`0x400f8a`
4	`0x400f91`
5	`0x400f98`
6	`0x400f9f`
7	`0x400fa6`

凭直觉，我猜测这可能是个多解问题。假设我们的0x8(%rsp)是0，那么跳转到0x400f7c。那么会依次执行：

1
mov    $0xcf,%eax
2
# jmp    400fbe <phase_3+0x7b>
3
cmp    0xc(%rsp),%eax
4
# je     400fc9 <phase_3+0x86>

如果 je 不满足条件。就会直接触发下一行的炸弹。

0xcf == 0d207。所以第二个数字应该输入 207！

为了验证猜想，我们把所有可能的答案都列出来：

`0x8(%rsp)`	`0xc(%rsp)`
0	207
1	311
2	707
3	256
4	389
5	206
6	682
7	327

1
./bomb
2
Welcome to my fiendish little bomb. You have 6 phases with
3
which to blow yourself up. Have a nice day!
4
Border relations with Canada have never been better.
5
Phase 1 defused. How about the next one?
6
1 2 4 8 16 32
7
That's number 2.  Keep going!
8
0 207
9
Halfway there!

`phase_4()`#

1
$ objdump -d bomb --disassemble=phase_4
2

3
bomb：     文件格式 elf64-x86-64
4

5

6
Disassembly of section .init:
7

8
Disassembly of section .plt:
9

10
Disassembly of section .text:
11

12
000000000040100c <phase_4>:
13
  40100c:       48 83 ec 18             sub    $0x18,%rsp
14
  401010:       48 8d 4c 24 0c          lea    0xc(%rsp),%rcx
15
  401015:       48 8d 54 24 08          lea    0x8(%rsp),%rdx
16
  40101a:       be cf 25 40 00          mov    $0x4025cf,%esi
17
  40101f:       b8 00 00 00 00          mov    $0x0,%eax
18
  401024:       e8 c7 fb ff ff          call   400bf0 <__isoc99_sscanf@plt>
19
  401029:       83 f8 02                cmp    $0x2,%eax
20
  40102c:       75 07                   jne    401035 <phase_4+0x29>
21
  40102e:       83 7c 24 08 0e          cmpl   $0xe,0x8(%rsp)
22
  401033:       76 05                   jbe    40103a <phase_4+0x2e>
23
  401035:       e8 00 04 00 00          call   40143a <explode_bomb>
24
  40103a:       ba 0e 00 00 00          mov    $0xe,%edx
25
  40103f:       be 00 00 00 00          mov    $0x0,%esi
26
  401044:       8b 7c 24 08             mov    0x8(%rsp),%edi
27
  401048:       e8 81 ff ff ff          call   400fce <func4>
28
  40104d:       85 c0                   test   %eax,%eax
29
  40104f:       75 07                   jne    401058 <phase_4+0x4c>
30
  401051:       83 7c 24 0c 00          cmpl   $0x0,0xc(%rsp)
31
  401056:       74 05                   je     40105d <phase_4+0x51>
32
  401058:       e8 dd 03 00 00          call   40143a <explode_bomb>
33
  40105d:       48 83 c4 18             add    $0x18,%rsp
34
  401061:       c3                      ret

经典 sscanf。这次的格式化字符串是 0x4025cf。还是 phase_3 的格式，意味着输入俩整数进去，保存到 0x8(%rsp)和 0xc(%rsp)。

此时我们的研究重心到了：

1
  40102e:       83 7c 24 08 0e          cmpl   $0xe,0x8(%rsp)
2
  401033:       76 05                   jbe    40103a <phase_4+0x2e>
3
  401035:       e8 00 04 00 00          call   40143a <explode_bomb>
4
  40103a:       ba 0e 00 00 00          mov    $0xe,%edx
5
  40103f:       be 00 00 00 00          mov    $0x0,%esi
6
  401044:       8b 7c 24 08             mov    0x8(%rsp),%edi
7
  401048:       e8 81 ff ff ff          call   400fce <func4>
8
  40104d:       85 c0                   test   %eax,%eax
9
  40104f:       75 07                   jne    401058 <phase_4+0x4c>
10
  401051:       83 7c 24 0c 00          cmpl   $0x0,0xc(%rsp)
11
  401056:       74 05                   je     40105d <phase_4+0x51>
12
  401058:       e8 dd 03 00 00          call   40143a <explode_bomb>
13
  40105d:       48 83 c4 18             add    $0x18,%rsp

jbe需满足 0xe < 0x8(%rsp)。即第一个数需要大于 14。

又已知函数传参的顺序是%edi, %esi, %edx。在上面的汇编中，分别被赋值成 0x8(%esp), $0, $14。查看 func4 的汇编：

1
objdump -d bomb --disassemble=func4
2

3
bomb：     文件格式 elf64-x86-64
4

5

6
Disassembly of section .init:
7

8
Disassembly of section .plt:
9

10
Disassembly of section .text:
11

12
0000000000400fce <func4>:
13
  400fce:       48 83 ec 08             sub    $0x8,%rsp
14
  400fd2:       89 d0                   mov    %edx,%eax
15
  400fd4:       29 f0                   sub    %esi,%eax
16
  400fd6:       89 c1                   mov    %eax,%ecx
17
  400fd8:       c1 e9 1f                shr    $0x1f,%ecx
18
  400fdb:       01 c8                   add    %ecx,%eax
19
  400fdd:       d1 f8                   sar    $1,%eax
20
  400fdf:       8d 0c 30                lea    (%rax,%rsi,1),%ecx
21
  400fe2:       39 f9                   cmp    %edi,%ecx
22
  400fe4:       7e 0c                   jle    400ff2 <func4+0x24>
23
  400fe6:       8d 51 ff                lea    -0x1(%rcx),%edx
24
  400fe9:       e8 e0 ff ff ff          call   400fce <func4>
25
  400fee:       01 c0                   add    %eax,%eax
26
  400ff0:       eb 15                   jmp    401007 <func4+0x39>
27
  400ff2:       b8 00 00 00 00          mov    $0x0,%eax
28
  400ff7:       39 f9                   cmp    %edi,%ecx
29
  400ff9:       7d 0c                   jge    401007 <func4+0x39>
30
  400ffb:       8d 71 01                lea    0x1(%rcx),%esi
31
  400ffe:       e8 cb ff ff ff          call   400fce <func4>
32
  401003:       8d 44 00 01             lea    0x1(%rax,%rax,1),%eax
33
  401007:       48 83 c4 08             add    $0x8,%rsp
34
  40100b:       c3                      ret

哦我的上帝这是什么诡异的递归……

（拿出草稿纸）

1
  400fd2:       89 d0                   mov    %edx,%eax
2
  400fd4:       29 f0                   sub    %esi,%eax
3
  400fd6:       89 c1                   mov    %eax,%ecx
4
  400fd8:       c1 e9 1f                shr    $0x1f,%ecx
5
  400fdb:       01 c8                   add    %ecx,%eax
6
  400fdd:       d1 f8                   sar    $1,%eax
7
  400fdf:       8d 0c 30                lea    (%rax,%rsi,1),%ecx

询问 Gemini 之后发现这部分实现了一个取平均数的操作。~~（原谅我）~~

shr $0x1f,%ecx 这条指令极其炫技。想想0x1f是什么？31 对吧。对一个有符号双字右移 31 位得到了什么？符号位！所以这条指令取了%ecx (也就是%eax的备份) 的符号位。

add %ecx,%eax 更神奇。我们不妨分情况讨论：

%eax 是正数：符号位为 0, 直接右移。
%eax 是负奇数：加一再右移（结果无区别）；
%eax 是负偶数：加一再右移（结果 + 1）。

发现了吗？这一部分实现了 C 标准的向 0 取整，确保右移和数学除法没有区别。

执行完之后 %rax 里面是差值的一半，而 %ecx 里面正好就是平均数（low + (low + high) >> 1）。

之后的条件跳转就不细说了，整体逻辑可以简化为下面的函数：

1
int func4(int target, int low, int high) {
2
    int mid = low + (high - low) / 2;
3
    if (mid > target) {
4
        return 2 * func4(target, low, mid - 1);
5
    } else if (mid < target) {
6
        return 2 * func4(target, mid + 1, high) + 1;
7
    } else {
8
        return 0;
9
    }
10
}

剩下下面几行：

1
  40104d:       85 c0                   test   %eax,%eax
2
  40104f:       75 07                   jne    401058 <phase_4+0x4c>
3
  401051:       83 7c 24 0c 00          cmpl   $0x0,0xc(%rsp)
4
  401056:       74 05                   je     40105d <phase_4+0x51>
5
  401058:       e8 dd 03 00 00          call   40143a <explode_bomb>
6
  40105d:       48 83 c4 18             add    $0x18,%rsp
7
  401061:       c3                      ret

显然，如果返回值不是 0，就会跳转到爆炸函数。0xc(%rsp) 如果不等于 0，也会触发爆炸。

那么显然，我们的0x8(%esp)应该被赋值成 7, 0xc(%esp) 应该被赋值成 0。

1
./bomb
2
Welcome to my fiendish little bomb. You have 6 phases with
3
which to blow yourself up. Have a nice day!
4
Border relations with Canada have never been better.
5
Phase 1 defused. How about the next one?
6
1 2 4 8 16 32
7
That's number 2.  Keep going!
8
0 207
9
Halfway there!
10
7 0
11
So you got that one.  Try this one.

`phase_5()`#

1
$ objdump -d bomb --disassemble=phase_5
2

3
bomb：     文件格式 elf64-x86-64
4

5

6
Disassembly of section .init:
7

8
Disassembly of section .plt:
9

10
Disassembly of section .text:
11

12
0000000000401062 <phase_5>:
13
  401062:       53                      push   %rbx
14
  401063:       48 83 ec 20             sub    $0x20,%rsp
15
  401067:       48 89 fb                mov    %rdi,%rbx
16
  40106a:       64 48 8b 04 25 28 00    mov    %fs:0x28,%rax
17
  401071:       00 00
18
  401073:       48 89 44 24 18          mov    %rax,0x18(%rsp)
19
  401078:       31 c0                   xor    %eax,%eax
20
  40107a:       e8 9c 02 00 00          call   40131b <string_length>
21
  40107f:       83 f8 06                cmp    $0x6,%eax
22
  401082:       74 4e                   je     4010d2 <phase_5+0x70>
23
  401084:       e8 b1 03 00 00          call   40143a <explode_bomb>
24
  401089:       eb 47                   jmp    4010d2 <phase_5+0x70>
25
  40108b:       0f b6 0c 03             movzbl (%rbx,%rax,1),%ecx
26
  40108f:       88 0c 24                mov    %cl,(%rsp)
27
  401092:       48 8b 14 24             mov    (%rsp),%rdx
28
  401096:       83 e2 0f                and    $0xf,%edx
29
  401099:       0f b6 92 b0 24 40 00    movzbl 0x4024b0(%rdx),%edx
30
  4010a0:       88 54 04 10             mov    %dl,0x10(%rsp,%rax,1)
31
  4010a4:       48 83 c0 01             add    $0x1,%rax
32
  4010a8:       48 83 f8 06             cmp    $0x6,%rax
33
  4010ac:       75 dd                   jne    40108b <phase_5+0x29>
34
  4010ae:       c6 44 24 16 00          movb   $0x0,0x16(%rsp)
35
  4010b3:       be 5e 24 40 00          mov    $0x40245e,%esi
36
  4010b8:       48 8d 7c 24 10          lea    0x10(%rsp),%rdi
37
  4010bd:       e8 76 02 00 00          call   401338 <strings_not_equal>
38
  4010c2:       85 c0                   test   %eax,%eax
39
  4010c4:       74 13                   je     4010d9 <phase_5+0x77>
40
  4010c6:       e8 6f 03 00 00          call   40143a <explode_bomb>
41
  4010cb:       0f 1f 44 00 00          nopl   0x0(%rax,%rax,1)
42
  4010d0:       eb 07                   jmp    4010d9 <phase_5+0x77>
43
  4010d2:       b8 00 00 00 00          mov    $0x0,%eax
44
  4010d7:       eb b2                   jmp    40108b <phase_5+0x29>
45
  4010d9:       48 8b 44 24 18          mov    0x18(%rsp),%rax
46
  4010de:       64 48 33 04 25 28 00    xor    %fs:0x28,%rax
47
  4010e5:       00 00
48
  4010e7:       74 05                   je     4010ee <phase_5+0x8c>
49
  4010e9:       e8 42 fa ff ff          call   400b30 <__stack_chk_fail@plt>
50
  4010ee:       48 83 c4 20             add    $0x20,%rsp
51
  4010f2:       5b                      pop    %rbx
52
  4010f3:       c3                      ret

注意到有一行代码是

1
  40106a:       64 48 8b 04 25 28 00    mov    %fs:0x28,%rax

这是个啥（）

这个寻址方式我从来没见过，让我搜一手：

在 Stack OverFlow 上的帖子 Why does this memory address %fs:0x28 ( fs[0x28] ) have a random value? 中，有一位答主解释了这行代码的作用：

Both the FS and GS registers can be used as base-pointer addresses in order to access special operating system data-structures. So what you’re seeing is a value loaded at an offset from the value held in the FS register, and not bit manipulation of the contents of the FS register.

Specifically what’s taking place, is that FS:0x28 on Linux is storing a special sentinel stack-guard value, and the code is performing a stack-guard check. For instance, if you look further in your code, you’ll see that the value at FS:0x28 is stored on the stack, and then the contents of the stack are recalled and an XOR is performed with the original value at FS:0x28. If the two values are equal, which means that the zero-bit has been set because XOR’ing two of the same values results in a zero-value, then we jump to the test routine, otherwise we jump to a special function that indicates that the stack was somehow corrupted, and the sentinel value stored on the stack was changed.

If using GCC, this can be disabled with:
1
-fno-stack-protector

中文翻译如下：

FS 和 GS 寄存器都可以作为基址指针（Base-pointer addresses），用于访问操作系统特殊的内部数据结构。因此，你所看到的实际上是从 FS 寄存器保存的基地址加上一个偏移量后加载的数据，而不是对 FS 寄存器本身的内容进行位运算。

具体来说，在 Linux 系统上，FS:0x28 的位置存储了一个特殊的哨兵值，称为栈保护值（Stack-guard value / Canary），这段代码正在进行栈保护检查。例如，如果你查看代码的后续部分，会发现程序先将 FS:0x28 处的值存入栈中；函数结束前，再将栈中的值取出，与 FS:0x28 原有的值进行 XOR（异或）运算。

如果两个值相等（这意味着异或运算的结果为 0，从而设置了零标志位 ZF），程序就会跳转到正常的测试或后续流程；否则，程序会跳转到一个特殊的函数，表明栈已经被破坏（缓冲区溢出），即存储在栈上的那个哨兵值被篡改了。

如果你使用 GCC 编译器，可以通过以下参数禁用此功能：
1
-fno-stack-protector

观察后续代码，确实有将 %fs:0x28 与 %rax 异或运算的逻辑，如下：

1
  4010de:       64 48 33 04 25 28 00    xor    %fs:0x28,%rax
2
  4010e5:       00 00
3
  4010e7:       74 05                   je     4010ee <phase_5+0x8c>
4
  4010e9:       e8 42 fa ff ff          call   400b30 <__stack_chk_fail@plt>

我们继续往下看，看到下面这一段：

1
  401073:       48 89 44 24 18          mov    %rax,0x18(%rsp)
2
  401078:       31 c0                   xor    %eax,%eax
3
  40107a:       e8 9c 02 00 00          call   40131b <string_length>
4
  40107f:       83 f8 06                cmp    $0x6,%eax
5
  401082:       74 4e                   je     4010d2 <phase_5+0x70>
6
  401084:       e8 b1 03 00 00          call   40143a <explode_bomb>

前两行表示把之前存的那个 Canary 值压到栈里，并且把 %eax 清空。这也好理解，毕竟做校验嘛，不能到处留这个值。下面一行又出现了 string_length。直觉告诉我们，%rdi 里面存的准是输入字符串，而且长度必须为 6，否则爆炸。

那问题来了，这个字符串长度包不包含 \0？phase_1 蒙对了这个函数，但这里可不能蒙了，我们必须使用 gdb 来调试一手：

1
$ gdb bomb
2
Reading symbols from bomb...
3
(gdb) b *0x40107a             # 在 call 40131b <string_length> 处打断点
4
Breakpoint 1 at 0x40107a
5
(gdb) r                       # 运行程序
6
Starting program: /home/sakimidare/bomb/bomb
7
Welcome to my fiendish little bomb. You have 6 phases with
8
which to blow yourself up. Have a nice day!
9
Border relations with Canada have never been better.
10
Phase 1 defused. How about the next one?
11
1 2 4 8 16 32
12
That's number 2.  Keep going!
13
0 207
14
Halfway there!
15
7 0
16
So you got that one.  Try this one.
17
123456                        # 输入一个 123456 看看效果
18

19
Breakpoint 1, 0x000000000040107a in phase_5 ()
20
(gdb) ni                      # 运行下一条指令 （即执行完整个 call）
21
0x000000000040107f in phase_5 ()
22
(gdb) i r eax                 # 立即查看寄存器 %eax 的值
23
eax            0x6                 6
24
(gdb)

我们得出结论：string_length 函数返回的长度不包含 \0。也就是说，我们应该输入一个长度为 6 的字符串。

1
  401089:       eb 47                   jmp    4010d2 <phase_5+0x70>
2
  ...
3
  4010d2:       b8 00 00 00 00          mov    $0x0,%eax
4
  4010d7:       eb b2                   jmp    40108b <phase_5+0x29>

1
  40108b:       0f b6 0c 03             movzbl (%rbx,%rax,1),%ecx
2
  40108f:       88 0c 24                mov    %cl,(%rsp)
3
  401092:       48 8b 14 24             mov    (%rsp),%rdx
4
  401096:       83 e2 0f                and    $0xf,%edx
5
  401099:       0f b6 92 b0 24 40 00    movzbl 0x4024b0(%rdx),%edx
6
  4010a0:       88 54 04 10             mov    %dl,0x10(%rsp,%rax,1)
7
  4010a4:       48 83 c0 01             add    $0x1,%rax
8
  4010a8:       48 83 f8 06             cmp    $0x6,%rax
9
  4010ac:       75 dd                   jne    40108b <phase_5+0x29>

前言#

开始#

反汇编#

initialize_bomb()#

phase_1()#

phase_2()#

<read_six_numbers>#

循环与跳转#

phase_3()#

phase_4()#

phase_5()#

`initialize_bomb()`#

`phase_1()`#

`phase_2()`#

`<read_six_numbers>`#

`phase_3()`#

`phase_4()`#

`phase_5()`#