The Bomb Lab teaches students principles of, machine-level programs, as well as general debugger and reverse, A "binary bomb" is a Linux executable C program that consists of six, "phases." We can see one line above that $esi is also involved. On the bright side, at least now we know that our string should come out of the loop as giants. Changing the second input does not affect the ecx. Welcome to my fiendish little bomb. Learn more about bidirectional Unicode characters, #######################################################, # Copyright (c) 2002-2013, R. Bryant and D. O'Hallaron, This directory contains the files that you will use to build and run, the CS:APP Bomb Lab. This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. Give 0 to ebp-8, which is used as loop condition. The smart way of solving this phase is by actually figuring out the cypher. At the . You have 6 phases with which to blow yourself up. Could this mean alternative endings? The user input is then, 4 5 1 6 2 3. f = 9. initialize_bomb Lo and behold, when we dump the contents of the memory address we get "%d", which tells us that the . From this, we can guess that to pass phase_1, we need to enter the correct string. The address and stuff will vary, but . It is called recursively and in the end you need it to spit out the number 11. phase_1() - I'm first going to start stepping through the program starting at main. Next there is pattern that must be applied to the first 6 numbers. This continuous through all the user inputed indices and finally places the value zero in the last remaining empty element in the array. Based on the first user inputed number, you enter into that indexed element of the array, which then gives you the index of the next element in the array, etc. In addition, most, phase variants are parameterized by randomly chosen constants that are, assigned when a particular bomb is constructed. In this repository I will take down my process of solving the bomb lab of CS:APP. This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository. This part is really long. Okay, we know it works. Are you sure you want to create this branch? rev2023.4.21.43403. If not null terminated then preserve the originally passed pointer argument by copying it to %rdx. Run the following commands to create text files which we will look at later: You should now have two files: strings.txt and assembly.txt. At any point in time, the, tab-delimited file (./bomblab/scores.txt) contains the most recent, scores for each student. If you type the correct string, then. (Add 16 each time) ecx is compared to rsp, which is 15, so we need ecx to equal to 15. First thing I did was to search the binary using strings to see if there was anything interesting that pops out. Find centralized, trusted content and collaborate around the technologies you use most. A clear, concise, correct answer will earn full credit. A binary bomb is a program that consists of a sequence of six phases. phase_3 If the two string are of the same length, then it looks to see that the first inputed character is a non-zero (anything but a zero). Custom, notifying bombs are constrained to run on a specific set of Linux, hosts determined by the instructor. main Readme (27 points) 2 points for explosion suppression, 5 points for each level question. A binary bomb is a program that consists of a sequence of phases. Please feel free to fork or star this repo if you find it helpful!***. Students download their bombs, and display the scoreboard by pointing a browser at a simple HTTP, server called the "request server." What was the actual cockpit layout and crew of the Mi-24A? phase_2 What differentiates living as mere roommates from living in a marriage-like relationship? without any ill effects. I will omit this part here, you can refer to this document. Learn more. phase_3 Many Git commands accept both tag and branch names, so creating this branch may cause unexpected behavior. You signed in with another tab or window. If nothing happens, download Xcode and try again. Halfway there! You will get full credit for defusing phase 1 with less than 20 explosions. What does the power set mean in the construction of Von Neumann universe? any particular student, is quiet, and hence can run on any host. There are many things going on with shuffling of variables between registers, some bit shifting, and either a subtraction or an addition being applied to some of the hard coded constants. You don't need root access. Bomb Lab: Phase 5. Are you sure you want to create this branch? As the students work on their bombs, each, explosion and defusion is streamed back to the server, where the, current results for each bomb are displayed on a Web "scoreboard.". phase_4 You have 6 phases with which to blow yourself up. This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository. You can start and stop the autograding service as often as. So you think you can stop the bomb with ctrl-c, do you? Asking for help, clarification, or responding to other answers. If that function fails, it calls explode_bomb to the left. Is there a weapon that has the heavy property and the finesse property (or could this be obtained)? Many Git commands accept both tag and branch names, so creating this branch may cause unexpected behavior. You signed in with another tab or window. As we can see, it is fairly obvious that there is a loop somewhere in this function (by following the arrows). Ok, lets get right to it and dig into the code: So, what have we got here? (sorted smallest to largest gives you the answer), See also: getSubSequenceCount Interview Question. I have given a detailed explanation for phase_5 here: https://techiekarthik.hashnode.dev/cmu-bomblab-walkthrough?t=1676391915473#heading-phase-5. Thus on the 14th iteration if I needed a 6, I would need to be in the 14th index of the array on the 13th iteration, then on index 2 of the 12th iteration. initialize_bomb_solve Here is the assembly code: The list of numbers I've inputed is this: So far from my understanding, two conditions need to be met: compare %ecx is 115 line 103 Each element in the array has an empty element directly adjacent to it. It is passed the inputed user phrase and the pass-phrase and then checks that the two strings are the same length. Hello world. Use Git or checkout with SVN using the web URL. strings_not_equal Pretty confident its looking for 3 inputs this time. I found the memory position for the beginning of phase_1 and placed a break point there. On line <phase_4+16>, the <phase_4> function is pushing a fixed value stored at memory address 0x8049808 onto the stack right before a call to scanf is made. Load the binary, perform analysis, seek to Phase 6, and have a look at your task. which to blow yourself up. By clicking Post Your Answer, you agree to our terms of service, privacy policy and cookie policy. Servers run quietly, so they. These lines indicate that if the first argument equal the last one(right before this line), then we get 0. In the interests of putting more Radare2 content out there, here's a noob friendly intro to r2 for those who already have a basic grasp of asm, C, and reversing in x86-64. If you notice, (the syntax will vary based off of what sort of system the bomb is run on) the machine code will have some variation of call to: 401135: be b8 25 40 00 mov $0x4025b8,%esi. The main daemon is the. METU Ceng'e selamlar :)This is the first part of the Attack Lab. Next, as we scan through each operation, we see that a register is being . I will likely take another shot at figureing out exactly how to come up with the solution by following the implemented logic but I eventually brute forced it, which took a whole 30 seconds to figure out. Informal Explanations of Phases 1 through 6: I have spent approximately 26 hours on this assignment. Can you help me please? offer the lab. Help/Collaboration: I recieved no outside help with this bomb, other than. DrEvil. Contribute to CurryTang/bomb_lab_solution development by creating an account on GitHub. In this version of the lab, you build your own quiet bombs manually, and then hand them out to the students. int numArray[15] = {10, 2, 14, 7, 8, 12, 15, 11, 0, 4, 1, 13, 3, 9, 6}; int readOK; /** number of elements successfully read **/. Each phase expects the student to enter a particular string, on stdin. phase_4 0x00401100 4989e5 mov r13, rsp. Each bomb phase tests a different aspect of machine language programs: Phase 1: string comparison. In order to determine the comparisons used, it will be useful to look up or know Jumps Based on Signed Comparisons. You've defused the bomb! I'm getting a feeling that the author wants you to really have to work to get through some of these functions. 1) We have to find that number 'q' which will cause 12 (twelve) iterations. You signed in with another tab or window. While layout asm is helpful, also helpful to view the complete disassembled binary. I dereference the string pointed to by %rdi using x/s $rdi and see that the string pointed to is 'blah'. f7 ff ff callq 400bf0 <__isoc99_sscanf@plt>, : e8 a1 ff ff ff callq 40143a , fc ff ff callq 400bf0 <__isoc99_sscanf@plt>, : e8 c7 fb ff ff callq 400bf0 <__isoc99_sscanf@plt>, fa ff ff callq 400b30 <__stack_chk_fail@plt>. because it is too easy for the students to cheat. Let's have a look at the phase_4 function. Such bombs are called "notifying bombs. From phase_4, we call the four arguments of func4 to be a, b(known, 0), c(known, 14), d(known, 0). I then restart the program and see if that got me through phase 1. Each line is annotated. ", - Report Daemon (bomblab-reportd.pl). We get the following part, We see a critical keyword Border, right? Enter a random string and then we stop at the phase 1 position, then we try printing out the information around 0x402400. It appears that there may be a secret stage. Connect and share knowledge within a single location that is structured and easy to search. On a roll! . There are a ton of dead ends that you can follow in this code that all land on detonation. Phase 3: conditionals/switches. This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository. A tag already exists with the provided branch name. Well I believe this function also acts as the gateway to the secret phase. First, the numbers must be positive. Option 1: The simplest approach for offering the offline Bomb Lab is. Cannot retrieve contributors at this time. This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository. Each phase has a password/key that is solved through the hints found within the assembly code. Then you set a breakpoint at 4010b3 and find the target string to be "flyers". Congratulations! In order to solve the cypher, take a look at %esi and youll find an array of characters stored there, where each character has an index. string_length() - This function first checks to see that the passed character pointer in %rdi is not null terminated. Phase 1: There are two main ways of getting the answer. As a next step, lets input the test string abcdef and take a look at what the loop does to it. To review, open the file in an editor that reveals hidden Unicode characters. The student then saves the tar file to disk. First, setup your bomb directory. Specifically: I think the second number should be. What are the advantages of running a power tool on 240 V vs 120 V? Defusing the binary bomb. phase_5 After solving stage 1 you likely get the string 'Phase 1 defused. Then you get the answer to be the pair(7, 0). Phase 2: loops. Add abcdef as your Phase 5 solution in answers.txt, load the binary in r2's Debug mode, run analysis, then dcu sym.phase_5. A loop is occurring. At each iteration, we check to see that the current value is double the previous value. Nothing special other than the first number acting like a selector of jump paths to a linked second number. And when we execute it, it expects to receive certain inputs, otherwise it 'blows' up. changeme.edu If the event was a defusion, the message also, contains the "defusing string" that the student typed to defuse the, Report Daemon: The report daemon periodically scans the scoreboard log, and updates the Web scoreboard. we use, and get the following file (not the full code), We enter gdb, set a breakpoint at the phase 1. The following lines are annotated. We can find the latter numbers from the loop structure. gdb ./bomb -q -x ~/gdbCfg. Wow! I tried many methods of solution on internet. Going through func4, we get the value of d at 400ff7 and 400fe2 to be (14 + 0) >> 1 = 7. The first number we can try to be 6 and the second must be 682. If not then the detonation flag that was initialized to 1 is not set to low and will eventually trigger the detonate function. A tag already exists with the provided branch name. First, to figure out that the program wants a string as an input. Learn more about bidirectional Unicode characters. From this, we can see that the input format of read_six_numbers should be 6 space-separated integers. Is there any extra credit for solving the secret phase. If so, put zero in %eax and return. Remember this structure from Phase 2? What were the poems other than those by Donne in the Melford Hall manuscript? Then enter this command. Let's enter the string blah as our input to phase_1 . Each binary bomb is a program, running a sequence of phases. lesson and forces them to learn to use a debugger. Option 2. Considering this line of code. srveaw is pretty far off from abcdef. Score!!! node6 Each bomb phase tests a different aspect of machine language programs: Phase 4: recursive calls and the stack discipline, Phases get progressively harder. What' more, there's a function call to read_six_numbers(), we can inspect it, Up till now, you should be able to find out that in this part, we are required to enter six numbers. is "defused." Each, variable is preceded by a descriptive comment. I also found strings that look like they could be related to attribution: GET /%s/submitr.pl/?userid=%s&lab=%s&result=%s&submit=submit HTTP/1.0
Walter E Bennett Chicago Silk,
Kimberly Kravitz Parents,
Medicare Vaccine Administration Codes 2022,
Krunker Unblocked At School Server,
Harry And Voldemort Are Friends Fanfiction,
Articles B
