Ok thanks, Do you have suggestions of commands to take note of the contents of the register? Currently i'm using the x /s <register> command.
Main Topics
Browse All Topics
Loading Advertisement...
Question
Binary Bomb Phase 2
Hello, I am needing help with the Binary Bomb Assignment. I have completed phase one by using the x /s command. I am now stuck on phase 2.
From what I understand, the the function call read_six_numbers will take in my entered string (six numbers with spaces) and scanf will extract that string into an array of integers.
If the string I have entered is equal to six, it will jump back to phase_2, correct?
Once in phase_2, it will check using a loop to see if my int[x] = the correct int, and that is being checked at 8048f81: 39 c3 cmp %eax,%ebx, correct?
Now my question is, how am I able to find what numbers it's checking for?
Any help would be appreciated, thanks in advance!
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Subscribe now for full access to Experts Exchange and get
Instant Access to this Solution
- Plus...
- 30 Day FREE access, no risk, no obligation
- Collaborate with the world's top tech experts
- Unlimited access to our exclusive solution database
- Never be left without tech help again
Trusted by hundreds of thousands everyday for fast, accurate and reliable tech support.
- "The time we save is the biggest benefit of Experts Exchange to Warner Bros. What could take multiple guys 2 hours or more each to find is accessed in around 15 minutes on Experts Exchange." Mike Kapnisakis, Warner Bros.
- "Our team likes having a resource that is more secure than just using Google and most experts using this service really know their stuff. It's nice to look here first versus using Google." Dayna Sellner, Lockheed Martin
- "Anytime that I've been stumped with a problem, 9 out of 10 times Experts Exchange has either the accepted solution or an open discussion of the potential solution to the problem." Kenny Red, eBay Inc.
See what Experts Exchange can do for you.
Got a question?
We've got the answer.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
Need individual assistance?
Our experts are ready to help.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Want to learn from the best?
Read articles from industry experts.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Working on a long term project?
Store your work and research.
Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
What Makes Experts Exchange Unique?
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.
Trusted by the world's most respected brands.
Faithfully serving IT professionals since 1996.
Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Free Tech Articles
-
WARNING: 5 Reasons why you should NEVER fix a computer for free.
It is in our nature to love the puzzle. We are obsessed. The lot of us. We love puzzles. We love the challenge. We thrive on finding the answer. We hate disarray. It bothers us deep in our soul. W...
-
SCCM OSD Basic troubleshooting
SCCM 2007 OSD is a fantastic way to deploy operating systems, however, like most things SCCM issues can sometimes be difficult to resolve due to the sheer volume of logs to sift through and the dispe...
-
Migrate Small Business Server 2003 to Exchange 2010 and Windows 2008 R2
This guide is intended to provide step by step instructions on how to migrate from Small Business Server 2003 to Windows 2008 R2 with Exchange 2010. For this migration to work you will need the fo...
-
Create a Win7 Gadget
This article shows you how to create a simple "Gadget" -- a sort of mini-application supported by Windows 7 and Vista. Gadgets can be dropped anywhere on the desktop to provide instant information, ...
-
Outlook continually prompting for username and password
There have been a lot of questions recently regarding Outlook prompting for a username and password whilst using Exchange 2007. There are a few reasons why this would happen and I will try to cover t...
-
Backup Exchange 2010 Information Store using Windows Backup
There seems to be quite a lot of confusion around the ability to backup Exchange 2010 using the built in Windows Backup feature. This stems from the omission of this feature prior to Exchange 2007 s...
Cloud Class Webinars
- Avoiding Bugs in Microsoft Access
Alison Balter takes and in-depth look at avoiding bugs in Access. In this webinar you will learn about using the immediate window to debug your applications, invoking the debugger, using breakpoints to troubleshoot, stepping through code, setting the next statement to execute, ...
- Top 10 Best New Features in Visio 2010
Scott Helmers gives live demonstrations of the top 10 new features in Visio 2010. This webinar will teach you how to create compelling diagrams by adding shapes to the page with a single click, linking the shapes in a diagram to data in Excel (or SQL Server, or SharePoint), ...
- IT Consultant Business Secrets Revealed
Michael Munger, Experts Exchange tech pro and IT consultant, pulls back the curtain on his very successful businesses and answers question on every IT consultant and business owner should know about. He shares secrets on what he did to solve the 5 most common problems in IT, ...
- Disaster Recovery and Business Continuity
Quest CTO, Mike Billon, gives an overview of the steps involved in building a dunamic disaster recovery plan. Through case studies and an examination of software/hardware tooles for monitoring and testing, you'll gain a better understandin of where you are, where you want ...
- Organize Your Visio Diagrams with Containers and Lists
Scott Helmers uses cross functional flowcharts, wireframe diagrams, data graphic legends and seating charts to teach you: how to ustilize all three new structured diagram components in Visio 2010, the best practices for organizeing shapes in previous version of Visio, how to organize ...
- How to Us Objects, Properties, Events and Methods in Microsoft Access
Alison Dalter gives an in-depbth look at objects, properties, events and methods in Microsoft Access. In this webinar you will learn about using the object browser, referring to objects, working with properties and methods, working with object variables, understanding the ...
Join the Community
Give a Little. Get a Lot.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
Answers
Ok, from what it looks like the line
8048f78: 03 7e f4 add -0xc(%esi),%edi |
is pushing the stack down 3 to make room for edi,
and then 8048f7b: 83 c3 04 add $0x4,%ebx |
will add the literal value 4 to ebx,
So I get that this is a loop that will be executed while i (%eax) is less than 6 (%ebx).
This loop will increment the value to check by four every time, and continue to push the stack lower for more room. so %ebx must be the value that holds the correct number, and int is stored in the register %esi, right?
The loop will increment my value by 4 every time, but how do I come up with the original value? I would assume eax...
>> Ok thanks, Do you have suggestions of commands to take note of the contents of the register? Currently i'm using the x /s <register> command.
x/s shows the string at a given memory address.
If you want to see the contents of a register, you can use 'p/x name_of_the_register' (or any other format instead of x, depending on what the register contains).
>> Ok, from what it looks like the line
>> 8048f78: 03 7e f4 add -0xc(%esi),%edi |
>> is pushing the stack down 3 to make room for edi,
Not really. That instruction simply gets the contents of a memory location, and adds it to %edi. The memory location in question is (%esi - 0xc).
>> So I get that this is a loop that will be executed while i (%eax) is less than 6 (%ebx).
Does %ebx contain 6 ? Look closer. Where is %ebx set before the loop body ? What is it set to ? How is it modified inside the loop body ? What's the condition for the loop to continue ?
Look at the entire function. First figure out where on the stack your 6 integers can be found (after the call to read_six_numbers). Also find out what the rest of the stack contains. Once you have that, you can start advancing one instruction at a time. Take careful note of how the registers change while you work through the code.
Thanks again, okay so I know that phase three needs three parameters, '%d, %a, %d'. That would be a decimal, ascii, decimal. I think this is a switch statement, and the statement parameters are between 3 and 7. So when I enter three, I think I go down to this line,
8048e60: 81 7d f8 14 02 00 00 cmpl $0x214,-0x8(%ebp)
8048e67: 0f 84 c5 00 00 00 je 8048f32 <phase_3+0x121>
But I can't figure out how to make this jump.
Any Suggestions? Or where to look for my ascii character?
You've been great so far, Thanks! You have no idea how much you've helped me out. I was SO frustrated.
>> '%d, %a, %d'. That would be a decimal, ascii, decimal.
%a in C99 is for a floating point value, not an ascii value. But it could be that the compiler that your runtime library interprets it differently. Check your system documentation to be sure. From the code, it seems that you're right, but that would be a non-C99 implementation.
I assume that that was the format string you found at memory location 0x8049a7d ?
>> I think this is a switch statement, and the statement parameters are between 3 and 7.
It gets a value, and depending on that value, it jumps to a different location. So, yes, that looks like a switch ;)
I'm not sure why you say it has to be at least 3 though ... The only limitation on the first value entered by the user is this one :
8048e49: 83 7d fc 07 cmpl $0x7,-0x4(%ebp)
Maybe you confused with this one ?
8048e3f: 83 f8 02 cmp $0x2,%eax
8048e42: 7f 05 jg 8048e49 <phase_3+0x38>
which checks the return value of sscanf.
>> So when I enter three, I think I go down to this line,
The jump is performed by this piece of code :
8048e56: 8b 45 fc mov -0x4(%ebp),%eax
8048e59: ff 24 85 a0 9a 04 08 jmp *0x8049aa0(,%eax,4)
So, when the first value entered by the user is 3, the code jumps to the address present at (0x8049aa0 + 4 * 3) which is 0x8049aac.
Note that 0x8049aa0 is the base address of an array of memory addresses. One of the values is picked from this array depending on the value entered by the user. Which address, you'll have to find out by looking at the contents of memory location 0x8049aac.
>> But I can't figure out how to make this jump.
Remember that -0x8(%ebp) contains the third value entered by the user.
3 Ways to Join
Business Accounts
- Perfect for organizations
- Multiple users
- Save over 36%
- Create a Business Account
Answer for Membership
- Earn free access
- Showcase your knowledge
- No credit card required
- Sign Up to Answer
Loading Advertisement...
by: Infinity08Posted on 2009-02-01 at 01:54:43ID: 23520745
>> From what I understand, the the function call read_six_numbers will take in my entered string (six numbers with spaces) and scanf will extract that string into an array of integers.
Correct. It will place those 6 integer values on the stack at the address that was passed to read_six_numbers as second parameter.
>> If the string I have entered is equal to six, it will jump back to phase_2, correct?
If the string you entered contains at least 6 integer values, then the code flow will return to phase_2 (right after the read_six_numbers function call) :
>> 8049403: 83 f8 05 cmp $0x5,%eax
sscanf returns the number of correctly read integer values, and if that amount is greater than 5, we leave the read_six_numbers function. If not, the bomb explodes.
>> Once in phase_2, it will check using a loop to see if my int[x] = the correct int
That's right.
>> and that is being checked at 8048f81: 39 c3 cmp %eax,%ebx, correct?
No, that's the loop condition :
>> 8048f81: 39 c3 cmp %eax,%ebx
>> 8048f83: 75 e5 jne 8048f6a <phase_2+0x29>
as long as eax is not equal to ebx, the loop will continue.
The check happens after the loop has finished :
>> 8048f85: 85 ff test %edi,%edi
>> 8048f87: 75 05 jne 8048f8e <phase_2+0x4d>
>> 8048f89: e8 f0 03 00 00 call 804937e <explode_bomb>
You have to make sure that that jump is made, otherwise the bomb will explode.
Note that there's also a possibility for the bomb to explode inside the loop body. You have to avoid that too, obviously.
>> Now my question is, how am I able to find what numbers it's checking for?
You have to look at what the loop is doing exactly. It's taking some input (including the six numbers you entered), and performs some calculations on it.
Here's the complete loop :
8048f62: bf 00 00 00 00 mov $0x0,%edi \ initialization
8048f67: 8d 5d e8 lea -0x18(%ebp),%ebx /
8048f6a: 89 de mov %ebx,%esi \
8048f6c: 8b 43 f4 mov -0xc(%ebx),%eax |
8048f6f: 3b 03 cmp (%ebx),%eax |
8048f71: 74 05 je 8048f78 <phase_2+0x37> | loop body
8048f73: e8 06 04 00 00 call 804937e <explode_bomb> |
8048f78: 03 7e f4 add -0xc(%esi),%edi |
8048f7b: 83 c3 04 add $0x4,%ebx |
8048f7e: 8d 45 f4 lea -0xc(%ebp),%eax /
8048f81: 39 c3 cmp %eax,%ebx \ loop condition
8048f83: 75 e5 jne 8048f6a <phase_2+0x29> /
Concentrate on what it's doing by following the logic. Take note of the contents of every register while you follow through one instruction at a time. You'll soon notice a pattern, and that should make things clearer ;)
I'll be here if you have further questions. Give it a try, and see whether you can figure it out :)