前言
下载地址:http://csapp.cs.cmu.edu/3e/labs.html
其中包含11个Lab,覆盖整个的CSAPP的各个章节,包括:Data、Bomb、Buffer、Cache、Malloc等。
具体的实验方式各式各样,例如DataLab,就是通过位运算实现各个函数。这样可以更好的理解计算机的补码相关信息。
又例如BombLab,就是通过gdb来查看汇编信息,通关来提高大家对汇编的了解。
也还有类似BufferLab,让你输入相关的数据,通过溢出来攻击程序。
关于BombLab
准备
下载地址:http://csapp.cs.cmu.edu/3e/bomb.tar
文件:bomb、bomb.c、README
工具:gdb、https://github.com/longld/peda
常用命令:disassemble、break、x、n、s
phase_1
=> 0x0000000000400ee0 <phase_1+0>: sub rsp,0x8
0x0000000000400ee4 <phase_1+4>: mov esi,0x402400
0x0000000000400ee9 <phase_1+9>: call 0x401338 <strings_not_equal>
0x0000000000400eee <phase_1+14>: test eax,eax
0x0000000000400ef0 <phase_1+16>: je 0x400ef7 <phase_1+23>
0x0000000000400ef2 <phase_1+18>: call 0x40143a <explode_bomb>
0x0000000000400ef7 <phase_1+23>: add rsp,0x8
0x0000000000400efb <phase_1+27>: ret
phase_2
0x0000000000400efd <phase_2+1>: push rbx
0x0000000000400efe <phase_2+2>: sub rsp,0x28
0x0000000000400f02 <phase_2+6>: mov rsi,rsp
0x0000000000400f05 <phase_2+9>: call 0x40145c <read_six_numbers>
0x0000000000400f0a <phase_2+14>: cmp DWORD PTR [rsp],0x1
0x0000000000400f0e <phase_2+18>: je 0x400f30 <phase_2+52>
0x0000000000400f10 <phase_2+20>: call 0x40143a <explode_bomb>
0x0000000000400f15 <phase_2+25>: jmp 0x400f30 <phase_2+52>
0x0000000000400f17 <phase_2+27>: mov eax,DWORD PTR [rbx-0x4]
0x0000000000400f1a <phase_2+30>: add eax,eax
0x0000000000400f1c <phase_2+32>: cmp DWORD PTR [rbx],eax
0x0000000000400f1e <phase_2+34>: je 0x400f25 <phase_2+41>
0x0000000000400f20 <phase_2+36>: call 0x40143a <explode_bomb>
0x0000000000400f25 <phase_2+41>: add rbx,0x4
0x0000000000400f29 <phase_2+45>: cmp rbx,rbp
0x0000000000400f2c <phase_2+48>: jne 0x400f17 <phase_2+27>
0x0000000000400f2e <phase_2+50>: jmp 0x400f3c <phase_2+64>
0x0000000000400f30 <phase_2+52>: lea rbx,[rsp+0x4]
0x0000000000400f35 <phase_2+57>: lea rbp,[rsp+0x18]
0x0000000000400f3a <phase_2+62>: jmp 0x400f17 <phase_2+27>
0x0000000000400f3c <phase_2+64>: add rsp,0x28
0x0000000000400f40 <phase_2+68>: pop rbx
0x0000000000400f41 <phase_2+69>: pop rbp
0x0000000000400f42 <phase_2+70>: ret
phase_3
0x0000000000400f43 <phase_3+0>: sub rsp,0x18
0x0000000000400f47 <phase_3+4>: lea rcx,[rsp+0xc]
0x0000000000400f4c <phase_3+9>: lea rdx,[rsp+0x8]
0x0000000000400f51 <phase_3+14>: mov esi,0x4025cf
0x0000000000400f56 <phase_3+19>: mov eax,0x0
0x0000000000400f5b <phase_3+24>: call 0x400bf0 <__isoc99_sscanf@plt>
0x0000000000400f60 <phase_3+29>: cmp eax,0x1
0x0000000000400f63 <phase_3+32>: jg 0x400f6a <phase_3+39>
0x0000000000400f65 <phase_3+34>: call 0x40143a <explode_bomb>
0x0000000000400f6a <phase_3+39>: cmp DWORD PTR [rsp+0x8],0x7
0x0000000000400f6f <phase_3+44>: ja 0x400fad <phase_3+106>
0x0000000000400f71 <phase_3+46>: mov eax,DWORD PTR [rsp+0x8]
0x0000000000400f75 <phase_3+50>: jmp QWORD PTR [rax*8+0x402470]
0x0000000000400f7c <phase_3+57>: mov eax,0xcf
0x0000000000400f81 <phase_3+62>: jmp 0x400fbe <phase_3+123>
0x0000000000400f83 <phase_3+64>: mov eax,0x2c3
0x0000000000400f88 <phase_3+69>: jmp 0x400fbe <phase_3+123>
0x0000000000400f8a <phase_3+71>: mov eax,0x100
0x0000000000400f8f <phase_3+76>: jmp 0x400fbe <phase_3+123>
0x0000000000400f91 <phase_3+78>: mov eax,0x185
0x0000000000400f96 <phase_3+83>: jmp 0x400fbe <phase_3+123>
0x0000000000400f98 <phase_3+85>: mov eax,0xce
0x0000000000400f9d <phase_3+90>: jmp 0x400fbe <phase_3+123>
0x0000000000400f9f <phase_3+92>: mov eax,0x2aa
0x0000000000400fa4 <phase_3+97>: jmp 0x400fbe <phase_3+123>
0x0000000000400fa6 <phase_3+99>: mov eax,0x147
0x0000000000400fab <phase_3+104>: jmp 0x400fbe <phase_3+123>
0x0000000000400fad <phase_3+106>: call 0x40143a <explode_bomb>
0x0000000000400fb2 <phase_3+111>: mov eax,0x0
0x0000000000400fb7 <phase_3+116>: jmp 0x400fbe <phase_3+123>
0x0000000000400fb9 <phase_3+118>: mov eax,0x137
0x0000000000400fbe <phase_3+123>: cmp eax,DWORD PTR [rsp+0xc]
0x0000000000400fc2 <phase_3+127>: je 0x400fc9 <phase_3+134>
0x0000000000400fc4 <phase_3+129>: call 0x40143a <explode_bomb>
0x0000000000400fc9 <phase_3+134>: add rsp,0x18
0x0000000000400fcd <phase_3+138>: ret
phase_4
0x0000000000400fce <func4+0>: sub rsp,0x8
0x0000000000400fd2 <func4+4>: mov eax,edx
0x0000000000400fd4 <func4+6>: sub eax,esi
0x0000000000400fd6 <func4+8>: mov ecx,eax
0x0000000000400fd8 <func4+10>: shr ecx,0x1f
0x0000000000400fdb <func4+13>: add eax,ecx
0x0000000000400fdd <func4+15>: sar eax,1
0x0000000000400fdf <func4+17>: lea ecx,[rax+rsi*1]
0x0000000000400fe2 <func4+20>: cmp ecx,edi
0x0000000000400fe4 <func4+22>: jle 0x400ff2 <func4+36>
0x0000000000400fe6 <func4+24>: lea edx,[rcx-0x1]
0x0000000000400fe9 <func4+27>: call 0x400fce <func4>
0x0000000000400fee <func4+32>: add eax,eax
0x0000000000400ff0 <func4+34>: jmp 0x401007 <func4+57>
0x0000000000400ff2 <func4+36>: mov eax,0x0
0x0000000000400ff7 <func4+41>: cmp ecx,edi
0x0000000000400ff9 <func4+43>: jge 0x401007 <func4+57>
0x0000000000400ffb <func4+45>: lea esi,[rcx+0x1]
0x0000000000400ffe <func4+48>: call 0x400fce <func4>
0x0000000000401003 <func4+53>: lea eax,[rax+rax*1+0x1]
0x0000000000401007 <func4+57>: add rsp,0x8
0x000000000040100b <func4+61>: ret
0x000000000040100c <phase_4+0>: sub rsp,0x18
0x0000000000401010 <phase_4+4>: lea rcx,[rsp+0xc]
0x0000000000401015 <phase_4+9>: lea rdx,[rsp+0x8]
0x000000000040101a <phase_4+14>: mov esi,0x4025cf
0x000000000040101f <phase_4+19>: mov eax,0x0
0x0000000000401024 <phase_4+24>: call 0x400bf0 <__isoc99_sscanf@plt>
0x0000000000401029 <phase_4+29>: cmp eax,0x2
0x000000000040102c <phase_4+32>: jne 0x401035 <phase_4+41>
0x000000000040102e <phase_4+34>: cmp DWORD PTR [rsp+0x8],0xe
0x0000000000401033 <phase_4+39>: jbe 0x40103a <phase_4+46>
0x0000000000401035 <phase_4+41>: call 0x40143a <explode_bomb>
0x000000000040103a <phase_4+46>: mov edx,0xe
0x000000000040103f <phase_4+51>: mov esi,0x0
0x0000000000401044 <phase_4+56>: mov edi,DWORD PTR [rsp+0x8]
0x0000000000401048 <phase_4+60>: call 0x400fce <func4>
0x000000000040104d <phase_4+65>: test eax,eax
0x000000000040104f <phase_4+67>: jne 0x401058 <phase_4+76>
0x0000000000401051 <phase_4+69>: cmp DWORD PTR [rsp+0xc],0x0
0x0000000000401056 <phase_4+74>: je 0x40105d <phase_4+81>
0x0000000000401058 <phase_4+76>: call 0x40143a <explode_bomb>
0x000000000040105d <phase_4+81>: add rsp,0x18
0x0000000000401061 <phase_4+85>: ret
phase_5
0x0000000000401062 <phase_5+0>: push rbx
0x0000000000401063 <phase_5+1>: sub rsp,0x20
0x0000000000401067 <phase_5+5>: mov rbx,rdi
0x000000000040106a <phase_5+8>: mov rax,QWORD PTR fs:0x28
0x0000000000401073 <phase_5+17>: mov QWORD PTR [rsp+0x18],rax
0x0000000000401078 <phase_5+22>: xor eax,eax
0x000000000040107a <phase_5+24>: call 0x40131b <string_length>
0x000000000040107f <phase_5+29>: cmp eax,0x6
0x0000000000401082 <phase_5+32>: je 0x4010d2 <phase_5+112>
0x0000000000401084 <phase_5+34>: call 0x40143a <explode_bomb>
0x0000000000401089 <phase_5+39>: jmp 0x4010d2 <phase_5+112>
0x000000000040108b <phase_5+41>: movzx ecx,BYTE PTR [rbx+rax*1]
0x000000000040108f <phase_5+45>: mov BYTE PTR [rsp],cl
0x0000000000401092 <phase_5+48>: mov rdx,QWORD PTR [rsp]
0x0000000000401096 <phase_5+52>: and edx,0xf
0x0000000000401099 <phase_5+55>: movzx edx,BYTE PTR [rdx+0x4024b0]
0x00000000004010a0 <phase_5+62>: mov BYTE PTR [rsp+rax*1+0x10],dl
0x00000000004010a4 <phase_5+66>: add rax,0x1
0x00000000004010a8 <phase_5+70>: cmp rax,0x6
0x00000000004010ac <phase_5+74>: jne 0x40108b <phase_5+41>
0x00000000004010ae <phase_5+76>: mov BYTE PTR [rsp+0x16],0x0
0x00000000004010b3 <phase_5+81>: mov esi,0x40245e
0x00000000004010b8 <phase_5+86>: lea rdi,[rsp+0x10]
0x00000000004010bd <phase_5+91>: call 0x401338 <strings_not_equal>
0x00000000004010c2 <phase_5+96>: test eax,eax
0x00000000004010c4 <phase_5+98>: je 0x4010d9 <phase_5+119>
0x00000000004010c6 <phase_5+100>: call 0x40143a <explode_bomb>
0x00000000004010cb <phase_5+105>: nop DWORD PTR [rax+rax*1+0x0]
0x00000000004010d0 <phase_5+110>: jmp 0x4010d9 <phase_5+119>
0x00000000004010d2 <phase_5+112>: mov eax,0x0
0x00000000004010d7 <phase_5+117>: jmp 0x40108b <phase_5+41>
0x00000000004010d9 <phase_5+119>: mov rax,QWORD PTR [rsp+0x18]
0x00000000004010de <phase_5+124>: xor rax,QWORD PTR fs:0x28
0x00000000004010e7 <phase_5+133>: je 0x4010ee <phase_5+140>
0x00000000004010e9 <phase_5+135>: call 0x400b30 <__stack_chk_fail@plt>
0x00000000004010ee <phase_5+140>: add rsp,0x20
0x00000000004010f2 <phase_5+144>: pop rbx
0x00000000004010f3 <phase_5+145>: ret
phase_6
0x00000000004010f4 <phase_6+0>: push r14
0x00000000004010f6 <phase_6+2>: push r13
0x00000000004010f8 <phase_6+4>: push r12
0x00000000004010fa <phase_6+6>: push rbp
0x00000000004010fb <phase_6+7>: push rbx
0x00000000004010fc <phase_6+8>: sub rsp,0x50
0x0000000000401100 <phase_6+12>: mov r13,rsp
0x0000000000401103 <phase_6+15>: mov rsi,rsp
0x0000000000401106 <phase_6+18>: call 0x40145c <read_six_numbers>
0x000000000040110b <phase_6+23>: mov r14,rsp
0x000000000040110e <phase_6+26>: mov r12d,0x0
0x0000000000401114 <phase_6+32>: mov rbp,r13
0x0000000000401117 <phase_6+35>: mov eax,DWORD PTR [r13+0x0]
0x000000000040111b <phase_6+39>: sub eax,0x1
0x000000000040111e <phase_6+42>: cmp eax,0x5
0x0000000000401121 <phase_6+45>: jbe 0x401128 <phase_6+52>
0x0000000000401123 <phase_6+47>: call 0x40143a <explode_bomb>
0x0000000000401128 <phase_6+52>: add r12d,0x1
0x000000000040112c <phase_6+56>: cmp r12d,0x6
0x0000000000401130 <phase_6+60>: je 0x401153 <phase_6+95>
0x0000000000401132 <phase_6+62>: mov ebx,r12d
0x0000000000401135 <phase_6+65>: movsxd rax,ebx
0x0000000000401138 <phase_6+68>: mov eax,DWORD PTR [rsp+rax*4]
0x000000000040113b <phase_6+71>: cmp DWORD PTR [rbp+0x0],eax
0x000000000040113e <phase_6+74>: jne 0x401145 <phase_6+81>
0x0000000000401140 <phase_6+76>: call 0x40143a <explode_bomb>
0x0000000000401145 <phase_6+81>: add ebx,0x1
0x0000000000401148 <phase_6+84>: cmp ebx,0x5
0x000000000040114b <phase_6+87>: jle 0x401135 <phase_6+65>
0x000000000040114d <phase_6+89>: add r13,0x4
0x0000000000401151 <phase_6+93>: jmp 0x401114 <phase_6+32>
0x0000000000401153 <phase_6+95>: lea rsi,[rsp+0x18]
0x0000000000401158 <phase_6+100>: mov rax,r14
0x000000000040115b <phase_6+103>: mov ecx,0x7
0x0000000000401160 <phase_6+108>: mov edx,ecx
0x0000000000401162 <phase_6+110>: sub edx,DWORD PTR [rax]
0x0000000000401164 <phase_6+112>: mov DWORD PTR [rax],edx
0x0000000000401166 <phase_6+114>: add rax,0x4
0x000000000040116a <phase_6+118>: cmp rax,rsi
0x000000000040116d <phase_6+121>: jne 0x401160 <phase_6+108>
0x000000000040116f <phase_6+123>: mov esi,0x0
0x0000000000401174 <phase_6+128>: jmp 0x401197 <phase_6+163>
0x0000000000401176 <phase_6+130>: mov rdx,QWORD PTR [rdx+0x8]
0x000000000040117a <phase_6+134>: add eax,0x1
0x000000000040117d <phase_6+137>: cmp eax,ecx
0x000000000040117f <phase_6+139>: jne 0x401176 <phase_6+130>
0x0000000000401181 <phase_6+141>: jmp 0x401188 <phase_6+148>
0x0000000000401183 <phase_6+143>: mov edx,0x6032d0
0x0000000000401188 <phase_6+148>: mov QWORD PTR [rsp+rsi*2+0x20],rdx
0x000000000040118d <phase_6+153>: add rsi,0x4
0x0000000000401191 <phase_6+157>: cmp rsi,0x18
0x0000000000401195 <phase_6+161>: je 0x4011ab <phase_6+183>
0x0000000000401197 <phase_6+163>: mov ecx,DWORD PTR [rsp+rsi*1]
0x000000000040119a <phase_6+166>: cmp ecx,0x1
0x000000000040119d <phase_6+169>: jle 0x401183 <phase_6+143>
0x000000000040119f <phase_6+171>: mov eax,0x1
0x00000000004011a4 <phase_6+176>: mov edx,0x6032d0
0x00000000004011a9 <phase_6+181>: jmp 0x401176 <phase_6+130>
0x00000000004011ab <phase_6+183>: mov rbx,QWORD PTR [rsp+0x20]
0x00000000004011b0 <phase_6+188>: lea rax,[rsp+0x28]
0x00000000004011b5 <phase_6+193>: lea rsi,[rsp+0x50]
0x00000000004011ba <phase_6+198>: mov rcx,rbx
0x00000000004011bd <phase_6+201>: mov rdx,QWORD PTR [rax]
0x00000000004011c0 <phase_6+204>: mov QWORD PTR [rcx+0x8],rdx
0x00000000004011c4 <phase_6+208>: add rax,0x8
0x00000000004011c8 <phase_6+212>: cmp rax,rsi
0x00000000004011cb <phase_6+215>: je 0x4011d2 <phase_6+222>
0x00000000004011cd <phase_6+217>: mov rcx,rdx
0x00000000004011d0 <phase_6+220>: jmp 0x4011bd <phase_6+201>
0x00000000004011d2 <phase_6+222>: mov QWORD PTR [rdx+0x8],0x0
0x00000000004011da <phase_6+230>: mov ebp,0x5
0x00000000004011df <phase_6+235>: mov rax,QWORD PTR [rbx+0x8]
0x00000000004011e3 <phase_6+239>: mov eax,DWORD PTR [rax]
0x00000000004011e5 <phase_6+241>: cmp DWORD PTR [rbx],eax
0x00000000004011e7 <phase_6+243>: jge 0x4011ee <phase_6+250>
0x00000000004011e9 <phase_6+245>: call 0x40143a <explode_bomb>
0x00000000004011ee <phase_6+250>: mov rbx,QWORD PTR [rbx+0x8]
0x00000000004011f2 <phase_6+254>: sub ebp,0x1
0x00000000004011f5 <phase_6+257>: jne 0x4011df <phase_6+235>
0x00000000004011f7 <phase_6+259>: add rsp,0x50
0x00000000004011fb <phase_6+263>: pop rbx
0x00000000004011fc <phase_6+264>: pop rbp
0x00000000004011fd <phase_6+265>: pop r12
0x00000000004011ff <phase_6+267>: pop r13
0x0000000000401201 <phase_6+269>: pop r14
答案
Border relations with Canada have never been better.
1 2 4 8 16 32
1 311
7 0
ionefg
4 3 2 1 6 5