二进制炸弹实验室阶段 6.


0x000000000040106b <+0>:     push   %r12
0x000000000040106d <+2>:     push   %rbp
0x000000000040106e <+3>:     push   %rbx
0x000000000040106f <+4>:     sub    $0x50,%rsp
0x0000000000401073 <+8>:     lea    0x30(%rsp),%rsi
0x0000000000401078 <+13>:    callq  0x40159a <read_six_numbers>
0x000000000040107d <+18>:    mov    $0x0,%ebp
0x0000000000401082 <+23>:    lea    0x30(%rsp),%r12
0x0000000000401087 <+28>:    mov    (%r12,%rbp,4),%eax
0x000000000040108b <+32>:    sub    $0x1,%eax
0x000000000040108e <+35>:    cmp    $0x5,%eax 
0x0000000000401091 <+38>:    jbe    0x401098 <phase_6+45>
0x0000000000401093 <+40>:    callq  0x401564 <explode_bomb>
0x0000000000401098 <+45>:    lea    0x1(%rbp),%ebx
0x000000000040109b <+48>:    cmp    $0x5,%rbp
0x000000000040109f <+52>:    je     0x4010c2 <phase_6+87>
0x00000000004010a1 <+54>:    movslq %ebx,%rdx
0x00000000004010a4 <+57>:    mov    (%r12,%rbp,4),%eax
0x00000000004010a8 <+61>:    cmp    0x30(%rsp,%rdx,4),%eax
0x00000000004010ac <+65>:    jne    0x4010b3 <phase_6+72>
0x00000000004010ae <+67>:    callq  0x401564 <explode_bomb>
0x00000000004010b3 <+72>:    add    $0x1,%ebx
0x00000000004010b6 <+75>:    cmp    $0x5,%ebx
0x00000000004010b9 <+78>:    jle    0x4010a1 <phase_6+54>
0x00000000004010bb <+80>:    add    $0x1,%rbp
0x00000000004010bf <+84>:    nop
0x00000000004010c0 <+85>:    jmp    0x401087 <phase_6+28>
0x00000000004010c2 <+87>:    lea    0x30(%rsp),%rdx
0x00000000004010c7 <+92>:    lea    0x48(%rsp),%rcx
0x00000000004010cc <+97>:    mov    $0x7,%eax
0x00000000004010d1 <+102>:   sub    (%rdx),%eax
0x00000000004010d3 <+104>:   mov    %eax,(%rdx)
0x00000000004010d5 <+106>:   add    $0x4,%rdx
0x00000000004010d9 <+110>:   cmp    %rcx,%rdx
0x00000000004010dc <+113>:   jne    0x4010cc <phase_6+97>
0x00000000004010de <+115>:   mov    $0x1,%edx
0x00000000004010e3 <+120>:   mov    $0x603970,%esi
0x00000000004010e8 <+125>:   mov    $0x0,%ecx
0x00000000004010ed <+130>:   jmp    0x4010f6 <phase_6+139>
0x00000000004010ef <+132>:   mov    0x8(%rsi),%rsi
0x00000000004010f3 <+136>:   add    $0x1,%edx
0x00000000004010f6 <+139>:   movslq %ecx,%rax
0x00000000004010f9 <+142>:   cmp    0x30(%rsp,%rax,4),%edx
0x00000000004010fd <+146>:   jl     0x4010ef <phase_6+132>
0x00000000004010ff <+148>:   mov    %rsi,(%rsp,%rax,8)
0x0000000000401103 <+152>:   add    $0x1,%ecx
0x0000000000401106 <+155>:   cmp    $0x5,%ecx
0x0000000000401109 <+158>:   jg     0x401117 <phase_6+172>
0x000000000040110b <+160>:   mov    $0x1,%edx
0x0000000000401110 <+165>:   mov    $0x603970,%esi
0x0000000000401115 <+170>:   jmp    0x4010f6 <phase_6+139>
0x0000000000401117 <+172>:   mov    (%rsp),%rcx 
0x000000000040111b <+176>:   mov    0x8(%rsp),%rax
0x0000000000401120 <+181>:   mov    %rax,0x8(%rcx)
0x0000000000401124 <+185>:   mov    0x10(%rsp),%rdx
0x0000000000401129 <+190>:   mov    %rdx,0x8(%rax)
0x000000000040112d <+194>:   mov    0x18(%rsp),%rax
0x0000000000401132 <+199>:   mov    %rax,0x8(%rdx)
0x0000000000401136 <+203>:   mov    0x20(%rsp),%rdx
0x000000000040113b <+208>:   mov    %rdx,0x8(%rax)
0x000000000040113f <+212>:   mov    0x28(%rsp),%rax
0x0000000000401144 <+217>:   mov    %rax,0x8(%rdx)
0x0000000000401148 <+221>:   movq   $0x0,0x8(%rax)
0x0000000000401150 <+229>:   mov    %rcx,%rbx
0x0000000000401153 <+232>:   mov    $0x0,%ebp 
0x0000000000401158 <+237>:   mov    0x8(%rbx),%rdx
0x000000000040115c <+241>:   mov    (%rbx),%eax
0x000000000040115e <+243>:   cmp    (%rdx),%eax
0x0000000000401160 <+245>:   jge    0x401167 <phase_6+252>
0x0000000000401162 <+247>:   callq  0x401564 <explode_bomb>
0x0000000000401167 <+252>:   mov    0x8(%rbx),%rbx
0x000000000040116b <+256>:   add    $0x1,%ebp
0x000000000040116e <+259>:   cmp    $0x5,%ebp
0x0000000000401171 <+262>:   jne    0x401158 <phase_6+237>
0x0000000000401173 <+264>:   add    $0x50,%rsp
0x0000000000401177 <+268>:   pop    %rbx
0x0000000000401178 <+269>:   pop    %rbp
0x0000000000401179 <+270>:   pop    %r12
0x000000000040117b <+272>:   retq

我对这段代码的了解是:1.输入应该是六个数字,并且它们应该不同。2.数字范围为1到6。

节点是:

0x603970 <node1> 0x000000f6
0x603978 <node1+8> 0x603960
0x603960 <node2> 0x00000304
0x693968 <node2+8> 0x603950
0x603950 <node3> 0x000000b7
0x603958 <node3+8> 0x603940
0x603940 <node4> 0x000000eb
0x603948 <node4+8> 0x603930
0x603930 <node5> 0x0000021f
0x603938 <node5+8> 0x603920
0x603920 <node6> 0x00000150
0x603928 <node6+8> 0x000000

因此,node1 到 node6 的值为 f6, 304, b7, eb, 21f, 150。我知道 b7 <150><21f>

我在互联网上尝试了许多解决方案。一些解决方案说我应该像这样反向排序:pos(1( (表示 5( : 4(5 是 '4 1 6 5 2 3' 中的第 4 个数字(位置(2( (表示 4( : 1位置(3( : 6位置(4( : 5位置(5( : 2位置(6( : 3所以我尝试了 4 1 6 5 2 3,但它也不起作用。

其实我试过了(3 6 1 2 5 4)(4 1 6 5 2 3)(3 4 1 6 5 2)(2 5 6 1 4 3)(4 3 6 1 2 5)(1 6 5 2 3 4)(6 1 2 5 4 3)(2 3 4 1 6 5)(3 2 5 6 1 4)(4 1 6 5 2 3)(5 6 1 4 3 2(

但在这些试验中没有答案。你能给我一些帮助吗?我不明白发生了什么..

在 <+97> 和 <+102> 上,请注意代码将 %eax 设置为 7 并减去 (%rdx(。换句话说,您必须将 6 个值中的每一个放入函数 f(x( = 7-x 中。

最新更新