StackOverflow2013

Note that there are some explanatory texts on larger screens.

plurals

PO
text
Body
copied!<p>Here is a C equivalent of phase2:</p> <pre><code>int t[6]; read_six_numbers (t); if ((t[0] != 0) || (t[1] != 1)) { explode_bomb(); } for (int i = 2; i < 6; i++) { if (t[i] != t[i - 2] + t[i - 1]) { explode_bomb(); } } </code></pre> <p>So the password is 0, 1, 1, 2, 3, 5.</p> <p>How did I do this ? By gradually replacing the assembly with C.</p> <p>You'll note that the stack pointer (rsp) never changes. You can see the stack as an array t of 32 bits numbers. That is each time you move by 4 bytes you move to the next element. i.e. 0(%rsp), 4(%rsp), ... are equivalent to t[0], t[1], ...</p> <p>I'll show you a possible gradual transformation of the bit you have trouble with:</p> <pre><code> lea 0x8(%rsp),%rbx lea 0x18(%rsp),%rbp <phase_2+42>: mov -0x8(%rbx),%eax add -0x4(%rbx),%eax cmp %eax,(%rbx) je <phase_2+57> callq explode_bomb <phase_2+57>: add $0x4,%rbx cmp %rbp,%rbx jne phase_2+42 ------------------------------------------------------ rbx = rsp + 8; rbp = rsp + 24; <phase_2+42>: eax = [rbx - 8]; eax += [rbx - 4]; if (eax == [rbx]) goto <phase_2+57>; explode_bomb(); <phase_2+57>: rbx += 4; if (rbx != rbp) goto phase_2+42; ------------------------------------------------------ rbx = rsp + 8; rbp = rsp + 24; do { eax = [rbx - 8] + [rbx - 4]; if (eax != [rbx]) { explode_bomb(); } rbx += 4; } while (rbx != rbp); ------------------------------------------------------ rbx = 8; do { eax = [rsp + rbx - 8] + [rsp + rbx - 4]; if (eax != [rsp + rbx]) { explode_bomb(); } rbx += 4; } while (rbx < 24); ------------------------------------------------------ i = 2; do { eax = t[i - 2] + t[i - 1]; if (eax != t[i]) { explode_bomb(); } i += 1; } while (i < 6); ------------------------------------------------------ for (int i = 2; i < 6; i++) { if (t[i] != t[i - 2] + t[i - 1]) { explode_bomb(); } } </code></pre> <p>If you take the time to understand these transformations you'll be able to transform and understand any piece of assembly.</p>

Querying!

Guidance

An individual column

Larger individual text columns get their own page to allow for proper reading.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload