boomlab

◎ checksec bomb                                                                □ 计算机组成/bomb209 ℂ v14.2.0-gcc 22:04
[*] '/mnt/c/Users/24062/Documents/计算机组成/bomb209/bomb'
    Arch:       amd64-64-little
    RELRO:      Partial RELRO
    Stack:      Canary found
    NX:         NX enabled
    PIE:        No PIE (0x400000)
    FORTIFY:    Enabled
    SHSTK:      Enabled
    IBT:        Enabled
    Stripped:   No
    Debuginfo:  Yes

int main(int argc,char **argv)

{
  undefined8 uVar1;
  
  if (argc == 1) {
    infile = stdin;
  }
  else {
    if (argc != 2) {
      __printf_chk(1,"Usage: %s [<input_file>]\n",*argv);
                    /* WARNING: Subroutine does not return */
      exit(8);
    }
    infile = (FILE *)fopen(argv[1],"r");
    if ((FILE *)infile == (FILE *)0x0) {
      __printf_chk(1,"%s: Error: Couldn\'t open %s\n",*argv,argv[1]);
                    /* WARNING: Subroutine does not return */
      exit(8);
    }
  }
}

  initialize_bomb(); //关键函数1：initialize_bomb()
  puts("Welcome to my fiendish little bomb. You have 6 phases with");
  puts("which to blow yourself up. Have a nice day!");
  uVar1 = read_line(); //关键函数2：read_line()
  phase_1(uVar1); //关键函数3：phase_1()
  phase_defused(); //关键函数4：phase_defused()
  puts("Phase 1 defused. How about the next one?");
  uVar1 = read_line();
  phase_2(uVar1); //关键函数5：phase_2()
  phase_defused();
  puts("That\'s number 2.  Keep going!");
  uVar1 = read_line();
  phase_3(uVar1); //关键函数6：phase_3()
  phase_defused();
  puts("Halfway there!");
  uVar1 = read_line();
  phase_4(uVar1); //关键函数7：phase_4()
  phase_defused();
  puts("So you got that one.  Try this one.");
  uVar1 = read_line();
  phase_5(uVar1); //关键函数8：phase_5()
  phase_defused();
  puts("Good work!  On to the next...");
  uVar1 = read_line();
  phase_6(uVar1); //关键函数9：phase_6()
  phase_defused();
  return 0;

void phase_1(undefined8 param_1)

{
  int iVar1;
  
  iVar1 = strings_not_equal(param_1,"I am not part of the problem. I am a Republican.");
  if (iVar1 == 0) {
    return;
  }
                    /* WARNING: Subroutine does not return */
  explode_bomb();
}

undefined8 strings_not_equal(char *param_1,long param_2)

{
  int iVar1;
  int iVar2;
  undefined8 uVar3;
  long lVar4;
  char cVar5;
  
  iVar1 = string_length();
  iVar2 = string_length(param_2); //这两句是存储字符串长度的，第一句应该是隐式继承吧，结合main函数的调用，大致能猜测是程序读取的我们答案，第二个才是存储的正确答案
  uVar3 = 1; //这里是记录状态的，初始是1，默认不相等
  if (iVar1 == iVar2) { //第一部分：进行长度校验
    cVar5 = *param_1;
    if (cVar5 == '\0') { //这是校验是否是空字符串，如果过了第一部分的话，就证明读取的两个参数都是空字符串相等，自然会让uVar3更新成0
      uVar3 = 0;
    }
    else {//下面才是正常处理的流程（排除了长度不同以及都是空字符串的情况
      lVar4 = 0;//定位符吧，从第1个字母开始（注：索引都是从0开始的
      do {
        if (*(char *)(param_2 + lVar4) != cVar5) {
          return 1;
        }
        lVar4 = lVar4 + 1;
        cVar5 = param_1[lVar4];
      } while (cVar5 != '\0'); //进行循环逐字符对比，全部字符相同的话才能让uVar3更新成0，否则都是1
      uVar3 = 0;
    }
  }
  return uVar3;
}

文件中的每行包含拆除对应炸弹阶段的字符串，程序将依次检查每一阶段拆除字符串的正确性来决定炸弹拆除成败。该文本文件必须采用Unix格式（换行字符不同于Windows格式），并且注意最后一个字符串后也要进行换行（即所有字符串必须以换行结尾）。

◎ echo "I am not part of the problem. I am a Republican." > test.txt   /tmp 56% ↓ 14:20


◎ xxd test.txt                                                         /tmp 54% ↓ 14:25
00000000: 4920 616d 206e 6f74 2070 6172 7420 6f66  I am not part of
00000010: 2074 6865 2070 726f 626c 656d 2e20 4920   the problem. I
00000020: 616d 2061 2052 6570 7562 6c69 6361 6e2e  am a Republican.
00000030: 0a

void phase_2(undefined8 param_1)

{
  int *piVar1;
  long in_FS_OFFSET;
  int local_38 [6]; //申请了一个6元素空间的数组
  long local_20;
  
  piVar1 = local_38;
  local_20 = *(long *)(in_FS_OFFSET + 0x28); //canary金丝雀，pwn里的知识，不用管
  read_six_numbers(param_1,local_38); //关键函数，应该会处理读取的输入，一会儿分析
  if ((local_38[0] != 0) || (local_38[1] != 1)) { //这里规定了，读取的前两个数字必须是0,1;否则Boom
                    /* WARNING: Subroutine does not return */
    explode_bomb();
  }
  // 循环处理剩下的4个数字
  do {
    if (piVar1[2] != piVar1[1] + *piVar1) {
                    /* WARNING: Subroutine does not return */
      explode_bomb();
    }
    piVar1 = piVar1 + 1;
  } while (piVar1 != local_38 + 4); 
  if (local_20 == *(long *)(in_FS_OFFSET + 0x28)) { //栈保护处理，不管
    return;
  }
                    /* WARNING: Subroutine does not return */
  __stack_chk_fail();
}

do {
    if (piVar1[2] != piVar1[1] + *piVar1) {
                    /* WARNING: Subroutine does not return */
      explode_bomb();
    }
    piVar1 = piVar1 + 1;
  } while (piVar1 != local_38 + 4); 

void read_six_numbers(undefined8 param_1, long param_2)
{
    int iVar1;
    
    iVar1 = __isoc99_sscanf(
        param_1,                     // 输入字符串（用户输入的那一行）
        "%d %d %d %d %d %d",         // 格式：读取 6 个整数
        param_2,                     // 第 1 个整数 → &numbers[0]
        param_2 + 4,                 // 第 2 个整数 → &numbers[1]
        param_2 + 8,                 // 第 3 个整数 → &numbers[2]
        param_2 + 0xc,               // 第 4 个整数 → &numbers[3]
        param_2 + 0x10,              // 第 5 个整数 → &numbers[4]
        param_2 + 0x14               // 第 6 个整数 → &numbers[5]
    );
    
    if (5 < iVar1) {   // 实际检查 iVar1 >= 6
        return;        // 成功读到 6 个整数 → 正常返回
    }
    
    explode_bomb();    // 读到的数字少于 6 个 → 炸弹爆炸
}

◎ echo "0 1 1 2 3 5" >> test.txt                                       /tmp 54% ↓ 14:25 

◎ xxd test.txt                                                         /tmp 40% ↓ 14:55
00000000: 4920 616d 206e 6f74 2070 6172 7420 6f66  I am not part of
00000010: 2074 6865 2070 726f 626c 656d 2e20 4920   the problem. I
00000020: 616d 2061 2052 6570 7562 6c69 6361 6e2e  am a Republican.
00000030: 0a30 2031 2031 2032 2033 2035 0a         .0 1 1 2 3 5.

◎ echo "yolo is handsome" | xxd                                        /tmp 40% ↓ 14:55
00000000: 796f 6c6f 2069 7320 6861 6e64 736f 6d65  yolo is handsome
00000010: 0a                                       .


◎ echo -n "yolo is handsome" | xxd                                     /tmp 39% ↓ 14:58
00000000: 796f 6c6f 2069 7320 6861 6e64 736f 6d65  yolo is handsome

void phase_3(undefined8 param_1)

{
  int iVar1;
  long in_FS_OFFSET;
  undefined4 local_18;
  int local_14;
  long local_10;
  
  local_10 = *(long *)(in_FS_OFFSET + 0x28);
  iVar1 = __isoc99_sscanf(param_1,"%d %d",&local_18,&local_14);//这里读取了两个整数，10进制就行
  if (iVar1 < 2) { //必须至少读两个数
                    /* WARNING: Subroutine does not return */
    explode_bomb();
  }
  switch(local_18) {//这里开始进行case选择了，读取的第一个数就是case用的
  case 0:
    iVar1 = 0x21a; //538
    break;
  case 1:
    iVar1 = 0x135; //309
    break;
  case 2:
    iVar1 = 0x1a6; //422
    break;
  case 3:
    iVar1 = 0x238; //568
    break;
  case 4:
    iVar1 = 0xf1; //241
    break;
  case 5:
    iVar1 = 0x39b; //923
    break;
  case 6:
    iVar1 = 0x1b2; //434
    break;
  case 7:
    iVar1 = 0x23e; //574
    break;
  default:
                    /* WARNING: Subroutine does not return */
    explode_bomb(); //如果8个case都没有匹配上，就会触发Boom
  }
  if (local_14 != iVar1) { //这里在校验读取的第二个数字是否和case对应的数字相同，不同就会boom
                    /* WARNING: Subroutine does not return */
    explode_bomb();
  }
  if (local_10 != *(long *)(in_FS_OFFSET + 0x28)) { //栈安全检查，不管
                    /* WARNING: Subroutine does not return */
    __stack_chk_fail();
  }
  return;
}

◎ echo "1 309" >> test.txt                                             /tmp 39% ↓ 14:58


◎ xxd test.txt                                                         /tmp 34% ↓ 15:08
00000000: 4920 616d 206e 6f74 2070 6172 7420 6f66  I am not part of
00000010: 2074 6865 2070 726f 626c 656d 2e20 4920   the problem. I
00000020: 616d 2061 2052 6570 7562 6c69 6361 6e2e  am a Republican.
00000030: 0a30 2031 2031 2032 2033 2035 0a31 2033  .0 1 1 2 3 5.1 3
00000040: 3039 0a                                  09.

void phase_4(undefined8 param_1)

{
  int iVar1;
  long in_FS_OFFSET;
  int local_18;
  int local_14;
  long local_10;
  
  local_10 = *(long *)(in_FS_OFFSET + 0x28);
  iVar1 = __isoc99_sscanf(param_1,"%d %d",&local_14,&local_18); //读取两个整数
  if ((iVar1 != 2) || (2 < local_18 - 2U)) { //进行两次判断，读取整数必须两个，输入的第二个参数必须小于等于2+2=4，否则会boom
                    /* WARNING: Subroutine does not return */
    explode_bomb();
  }
  iVar1 = func4(5,local_18); //关键函数 func4
  if (local_14 != iVar1) { //第一个参数的值必须等于func4算出来的值，否则Boom
                    /* WARNING: Subroutine does not return */
    explode_bomb();
  }
  if (local_10 == *(long *)(in_FS_OFFSET + 0x28)) { //栈检查
    return;
  }
                    /* WARNING: Subroutine does not return */
  __stack_chk_fail();
}

int func4(int param_1,int param_2)

{
  int iVar1;
  int iVar2;
  
  if (0 < param_1) {
    if (param_1 != 1) {
      iVar1 = func4(param_1 + -1); //warning:有没有发现这里仅仅读取了一个参数？
      iVar2 = func4(param_1 + -2,param_2);
      param_2 = iVar2 + iVar1 + param_2;
    }
    return param_2;
  }
  return 0;
}

int func4(int x,int y)

{
  int iVar1;
  int iVar2;
  
  if (0 < x) {
    if (x != 1) {
      iVar1 = func4(x + -1,y);
      iVar2 = func4(x + -2,y);
      y = iVar2 + iVar1 + y;
    }
    return y;
  }
  return 0;
}

int func4(int x, int y) {
    if (x <= 0) return 0;
    if (x == 1) return y;
    return func4(x-1, y) + func4(x-2, y) + y;
}

if ((iVar1 != 2) || (2 < local_18 - 2U))

  0x00000001
- 0x00000002
-------------
  0xFFFFFFFF  (借位溢出)

#include<stdio.h>
int func4(int x, int y) {
    if (x <= 0) return 0;
    if (x == 1) return y;
    return func4(x-1, y) + func4(x-2, y) + y;
}
int main(){
    int x=5, y=3;
    printf("result is %d\n", func4(x, y));
    return 0;
}

void phase_5(long param_1)

{
  int iVar1;
  long lVar2;
  long in_FS_OFFSET;
  char local_17 [6];
  undefined1 local_11;
  long local_10;
  
  local_10 = *(long *)(in_FS_OFFSET + 0x28); //栈检查，忽略
  iVar1 = string_length(); //读取输入的字符串长度，这里应该是省略了参数？
  if (iVar1 != 6) { //key1:输入的字符串长度为6
                    /* WARNING: Subroutine does not return */
    explode_bomb();
  }
  lVar2 = 0; //定义初始状态为0
  do {
    local_17[lVar2] =
         "maduiersnfotvbylSo you think you can stop the bomb with ctrl-c, do you?"
         [*(byte *)(param_1 + lVar2) & 0xf];
    lVar2 = lVar2 + 1; //状态递增
  } while (lVar2 != 6);
  local_11 = 0;
  iVar1 = strings_not_equal(local_17,"bruins");
  if (iVar1 == 0) {
    if (local_10 == *(long *)(in_FS_OFFSET + 0x28)) {
      return;
    }
                    /* WARNING: Subroutine does not return */
    __stack_chk_fail();
  }
                    /* WARNING: Subroutine does not return */
  explode_bomb();
}

  lVar2 = 0; //定义初始状态为0
  do {
    local_17[lVar2] =
         "maduiersnfotvbylSo you think you can stop the bomb with ctrl-c, do you?"
         [*(byte *)(param_1 + lVar2) & 0xf];
    lVar2 = lVar2 + 1; //状态递增
  } while (lVar2 != 6);

yolo@Yolo:~$ python -c "print(ord('y'))"
121

	0111 1001 (121)
	0000 1111 (15)
&____________________
	0000 1001 (9)

yolo@Yolo:~$ python -c "print(ord('y')&15)"
9

索引 0 → 'm'
索引 1 → 'a'
索引 2 → 'd'
索引 3 → 'u'
索引 4 → 'i'
索引 5 → 'e'
索引 6 → 'r'
索引 7 → 's'
索引 8 → 'n'
索引 9 → 'f'
索引 10 → 'o'
索引 11 → 't'
索引 12 → 'v'
索引 13 → 'b'
索引 14 → 'y'
索引 15 → 'l'

iVar1 = strings_not_equal(local_17,"bruins"); 
if (iVar1 == 0) {
    if (local_10 == *(long *)(in_FS_OFFSET + 0x28)) {
      return;
    }
                    /* WARNING: Subroutine does not return */
    __stack_chk_fail();
  }

bruins 在密文表中的索引：
b → 13
r → 6
u → 3
i → 4
n → 8
s → 7

yolo@Yolo:~$ echo -n '`' | xxd -b
00000000: 01100000

yolo@Yolo:~$ python -c "print((ord('\`')+13)&15)"
13

yolo@Yolo:~$ python -c "print(chr(ord('\`')+13))"
m
yolo@Yolo:~$ python -c "print(chr(ord('\`')+6))"
f
yolo@Yolo:~$ python -c "print(chr(ord('\`')+3))"
c
yolo@Yolo:~$ python -c "print(chr(ord('\`')+4))"
d
yolo@Yolo:~$ python -c "print(chr(ord('\`')+8))"
h
yolo@Yolo:~$ python -c "print(chr(ord('\`')+7))"
g

void phase_6(undefined8 param_1)

{
  int iVar1;
  undefined1 *puVar2;
  long lVar3;
  int *piVar4;
  long lVar5;
  long in_FS_OFFSET;
  int local_88 [8];
  int *local_68;
  long local_60;
  long local_58;
  long local_50;
  long local_48;
  long local_40;
  long local_30;
  
  piVar4 = local_88;
  local_30 = *(long *)(in_FS_OFFSET + 0x28); //栈保护，忽略
  read_six_numbers(param_1,local_88); //此函数已经在phase_2中分析过，作用是读取6个数字
  lVar5 = 1; //定义某个状态量为1
  while( true ) {
    if (5 < *piVar4 - 1U) { //这里的*piVar4实质上指向我们输入的6个数，这里也存在一个坑，无符号整数参与运算，要避免下溢，口算了下，只能填写1,2,3,4,5,6(理论上我写6个3也没有非法处理)
                    /* WARNING: Subroutine does not return */
      explode_bomb();
    }
    lVar3 = lVar5; // 1
    if (5 < (int)lVar5) break;
    do {
      if (*piVar4 == local_88[lVar3]) {//禁止重复，上面想偷的懒也被算到了，只能填写{1,2,3,4,5,6}的一个全排列
                    /* WARNING: Subroutine does not return */
        explode_bomb();
      }
      lVar3 = lVar3 + 1;
    } while ((int)lVar3 < 6);
    lVar5 = lVar5 + 1;
    piVar4 = piVar4 + 1;
  }

lVar5 = 0;
  do {
    iVar1 = 1; //初始化索引值
    puVar2 = node1;  //全局链表头，每次从头开始遍历
    if (1 < local_88[lVar5]) { //lVar5初始化到第0位了，而且
      do {
        puVar2 = *(undefined1 **)((long)puVar2 + 8); //让指针puVar2指向下一个指针，可以大致体会到，每一个节点的value和ID区域共8字节，跳过8字节后就到达next指针了，关于这里为啥会有ID区域，我后面会提供汇编看的
        iVar1 = iVar1 + 1; //更新索引值
      } while (iVar1 != local_88[lVar5]);
    }
    (&local_68)[lVar5] = (int *)puVar2; //保存找到的节点地址
    lVar5 = lVar5 + 1;
  } while (lVar5 != 6); //简单来说就是按数字选节点
//下面是按照输入的数字序列将6个节点重新链接
  *(long *)(local_68 + 2) = local_60; 
  *(long *)(local_60 + 8) = local_58;
  *(long *)(local_58 + 8) = local_50;
  *(long *)(local_50 + 8) = local_48;
  *(long *)(local_48 + 8) = local_40;
  *(undefined8 *)(local_40 + 8) = 0;
//[你输入的第1个节点] -> [第2个] -> [第3个] -> [第4个] -> [第5个] -> [第6个] -> NULL

iVar1 = 5;
  do {
    if (**(int **)(local_68 + 2) < *local_68) {//遍历数组中的节点，判断当前节点的值是否大于等于下一个节点的值，如果不是，就会Boom，这也就意味着我们自定义的node链表必须走顺序，从低到高，可以保证下一个节点值大于当前节点，这里还有个关键信息，判断的时候，使用的是int类，读取的是节点的前4字节，这就能解释为啥下面推测node结构体的时候，判断value占据前4字节了
                    /* WARNING: Subroutine does not return */
      explode_bomb();
    }
    local_68 = *(int **)(local_68 + 2);
    iVar1 = iVar1 + -1;
  } while (iVar1 != 0);
  if (local_30 != *(long *)(in_FS_OFFSET + 0x28)) {
                    /* WARNING: Subroutine does not return */
    __stack_chk_fail();
  }
  return;
}

struct Node {
    int value;      // 0~3 字节
    int node_id;         // 4~7 字节（maybe）
    Node* next;     // 8~15 字节
};

◎ python -c "print(0x18a,0x204,0x7e,0x2f0,0x120,0x38)"                                                          ⌂ 23:03
394 516 126 752 288 56

void phase_defused(void)

{
  int iVar1;
  long in_FS_OFFSET;
  undefined1 local_70 [4];
  undefined1 local_6c [4];
  undefined1 local_68 [88];
  long local_10;
  
  local_10 = *(long *)(in_FS_OFFSET + 0x28);
  send_msg(1); //关键函数1
  if (num_input_strings == 6) { //这个变量应该是全局变量，需要找到定义点
    iVar1 = __isoc99_sscanf(0x405910,"%d %d %s",local_70,local_6c,local_68); //看这里的读取，是两个整数加一个字符串
    if (iVar1 == 3) {
      iVar1 = strings_not_equal(local_68,"DrEvil"); //对比第三个字符串是不是DrEvil
      if (iVar1 == 0) { //对比成功，进入隐藏关卡
        puts("Curses, you\'ve found the secret phase!");
        puts("But finding it and solving it are quite different...");
        secret_phase(); //关键函数2
      }
    }
    puts("Congratulations! You\'ve defused the bomb!");
    puts("Your instructor has been notified and will verify your solution.");
  }
  if (local_10 == *(long *)(in_FS_OFFSET + 0x28)) {
    return;
  }
                    /* WARNING: Subroutine does not return */
  __stack_chk_fail();
}

    iVar1 = __isoc99_sscanf(0x405910,"%d %d %s",local_70,local_6c,local_68);
    if (iVar1 == 3) {
      iVar1 = strings_not_equal(local_68,"DrEvil");
      if (iVar1 == 0) {
        puts("Curses, you\'ve found the secret phase!");
        puts("But finding it and solving it are quite different...");
        secret_phase();
      }

  iVar1 = num_input_strings; //保存当前num_input_strings到iVar1中，初始0
  lVar2 = (long)num_input_strings; //转换64位索引，用于指针运算
  sVar3 = strlen(input_strings + lVar2 * 0x50); //确认存储在缓冲区的内容长度
  if ((int)sVar3 < 0x4f) { //长度必须小于79b,所以最多78个非空字符,留一个存储\0
    input_strings[(long)((int)sVar3 + -1) + (long)iVar1 * 0x50] = 0; //将元素中最后一个字节，通常来说应该是换行符'\n'，替换成'\0'
    num_input_strings = iVar1 + 1; //将索引值更新
    return input_strings + lVar2 * 0x50; //返回fix后的内容
  }

>>> hex(0x405820 + 80*0)
'0x405820'
>>> hex(0x405820 + 80*1)
'0x405870'
>>> hex(0x405820 + 80*2)
'0x4058c0'
>>> hex(0x405820 + 80*3)
'0x405910'

void secret_phase(void)

{
  int iVar1;
  char *__nptr;
  ulong uVar2;
  
  __nptr = (char *)read_line();//等待我在终端中输入一行字符串
  uVar2 = strtol(__nptr,(char **)0x0,10); //将字符串转换成长整数存入uVar2
  if (1000 < (int)uVar2 - 1U) { //长整数的值范围[1,1001]
                    /* WARNING: Subroutine does not return */
    explode_bomb();
  }
  iVar1 = fun7(n1,uVar2 & 0xffffffff); //关键函数fun7,应该会返回一个数字
  if (iVar1 == 2) { //上面返回的数字如果是2，我就真的通关了
    puts("Wow! You\'ve defused the secret stage!");
    phase_defused();
    return;
  }
                    /* WARNING: Subroutine does not return */
  explode_bomb();
}

int fun7(int *param_1,int param_2)

{
  int iVar1;
  
  if (param_1 != (int *)0x0) { //空节点就Boom
    if (param_2 < *param_1) { //输入值<节点值
      iVar1 = fun7(*(undefined8 *)(param_1 + 2)); //param_1是int4字节，+2会偏移8字节，恰好指向左子节点指针，也就是说当我们输入小于当前节点，就会递归调用左子节点，并且返回值乘2
      iVar1 = iVar1 * 2;
    }
    else { //输入值>=节点值
      iVar1 = 0; //假设iVar1=0，输入值==节点值就不会进入下面的if了
      if (*param_1 != param_2) { //排除不等的情况，输入值>节点值
        iVar1 = fun7(*(undefined8 *)(param_1 + 4)); //右偏移，并且返回值乘2+1
        iVar1 = iVar1 * 2 + 1;
      }
    }
    return iVar1;
  }
  return -1;
}

B24041429@ICS:~/bombk$ cat B24041429.txt 
I am not part of the problem. I am a Republican.
0 1 1 2 3 5
1 309
36 3 DrEvil
mfcdhg
6 3 5 1 2 4
22
B24041429@ICS:~/bombk$ ./bomb B24041429.txt 
Welcome to my fiendish little bomb. You have 6 phases with
which to blow yourself up. Have a nice day!
Phase 1 defused. How about the next one?
That's number 2.  Keep going!
Halfway there!
So you got that one.  Try this one.
Good work!  On to the next...
Curses, you've found the secret phase!
But finding it and solving it are quite different...
Wow! You've defused the secret stage!
Congratulations! You've defused the bomb!
Your instructor has been notified and will verify your solution.