本文主要是介绍HNU-计算机系统-实验3-BombLab，希望对大家解决编程问题提供一定的参考价值，需要的开发者们随着小编来一起学习吧！
写在前面
首先要感谢A橙_大佬，在之前的实验以及学习中，许多地方参考与学习了大佬的思路。
本次实验也是听取了A橙_大佬的建议，先自己做一遍，再看答案，有了更进一步的深入理解。
最后在验收的时候，发现验收助教居然还是A橙_大佬。哈哈，他真的好温柔，还送我一本专业课书。
视频讲解
有关这个实验的讲解我录制了一个视频上传了B站，链接如下，感觉报告没有看懂的同学可以看一下这个视频，特别是对于汇编代码有进一步的讲解，可能会更容易理解一些。
HNU-CS炸弹实验……蹦蹦炸弹！_哔哩哔哩_bilibili
问题呈现
WARNING
本次实验是根据每个同学的学号来生成的，所以无法抄袭，只能借鉴思路，每个同学的问题从答案到过程都有许多不同，唯一相同的只能说是每题的考点。
本次实验收到的是一个文件包，打开之后是这样的几个文件。
几个文件如下
1、bomb是可执行文件，无法打开
2、bomb.c文件
/**************************************************************************** Dr. Evil's Insidious Bomb, Version 1.1* Copyright 2011, Dr. Evil Incorporated. All rights reserved.** LICENSE:** Dr. Evil Incorporated (the PERPETRATOR) hereby grants you (the* VICTIM) explicit permission to use this bomb (the BOMB). This is a* time limited license, which expires on the death of the VICTIM.* The PERPETRATOR takes no responsibility for damage, frustration,* insanity, bug-eyes, carpal-tunnel syndrome, loss of sleep, or other* harm to the VICTIM. Unless the PERPETRATOR wants to take credit,* that is. The VICTIM may not distribute this bomb source code to* any enemies of the PERPETRATOR. No VICTIM may debug,* reverse-engineer, run "strings" on, decompile, decrypt, or use any* other technique to gain knowledge of and defuse the BOMB. BOMB* proof clothing may not be worn when handling this program. The* PERPETRATOR will not apologize for the PERPETRATOR's poor sense of* humor. This license is null and void where the BOMB is prohibited* by law.***************************************************************************/#include <stdio.h>
#include <stdlib.h>
#include "support.h"
#include "phases.h"/* * Note to self: Remember to erase this file so my victims will have no* idea what is going on, and so they will all blow up in a* spectaculary fiendish explosion. -- Dr. Evil */FILE *infile;int main(int argc, char *argv[])
{char *input;/* Note to self: remember to port this bomb to Windows and put a * fantastic GUI on it. *//* When run with no arguments, the bomb reads its input lines * from standard input. */if (argc == 1) { infile = stdin;} /* When run with one argument <file>, the bomb reads from <file> * until EOF, and then switches to standard input. Thus, as you * defuse each phase, you can add its defusing string to <file> and* avoid having to retype it. */else if (argc == 2) {if (!(infile = fopen(argv[1], "r"))) {printf("%s: Error: Couldn't open %s\n", argv[0], argv[1]);exit(8);}}/* You can't call the bomb with more than 1 command line argument. */else {printf("Usage: %s [<input_file>]\n", argv[0]);exit(8);}/* Do all sorts of secret stuff that makes the bomb harder to defuse. */initialize_bomb();printf("Welcome to my fiendish little bomb. You have 6 phases with\n");printf("which to blow yourself up. Have a nice day!\n");/* Hmm... Six phases must be more secure than one phase! */input = read_line(); /* Get input */phase_1(input); /* Run the phase */phase_defused(); /* Drat! They figured it out!* Let me know how they did it. */printf("Phase 1 defused. How about the next one?\n");/* The second phase is harder. No one will ever figure out* how to defuse this... */input = read_line();phase_2(input);phase_defused();printf("That's number 2. Keep going!\n");/* I guess this is too easy so far. Some more complex code will* confuse people. */input = read_line();phase_3(input);phase_defused();printf("Halfway there!\n");/* Oh yeah? Well, how good is your math? Try on this saucy problem! */input = read_line();phase_4(input);phase_defused();printf("So you got that one. Try this one.\n");/* Round and 'round in memory we go, where we stop, the bomb blows! */input = read_line();phase_5(input);phase_defused();printf("Good work! On to the next...\n");/* This phase will never be used, since no one will get past the* earlier ones. But just in case, make this one extra hard. */input = read_line();phase_6(input);phase_defused();/* Wow, they got it! But isn't something... missing? Perhaps* something they overlooked? Mua ha ha ha ha! */return 0;
}
3、README文件
This is bomb 177.It belongs to 20210801XXXX (esnl@hnu.edu.cn)说明这是属于谁的炸弹问题。（为了隐私，我把自己学号后四位抹去了）
（其实作为助教在检查开始应该先看这个的，因为有冒用他人答案的现象，但这次助教好像没看）
对bomb进行反汇编（使用objdump -d bomb >m.txt）
得到bomb.asm，这是汇编代码文件，如下
（注意：这个汇编代码文件很长，建议不要轻易打开看，会很卡顿）
bomb: file format elf32-i386Disassembly of section .init:08048724 <_init>:8048724: 53 push %ebx8048725: 83 ec 08 sub $0x8,%esp8048728: e8 33 02 00 00 call 8048960 <__x86.get_pc_thunk.bx>804872d: 81 c3 c7 38 00 00 add $0x38c7,%ebx8048733: 8b 83 fc ff ff ff mov -0x4(%ebx),%eax8048739: 85 c0 test %eax,%eax804873b: 74 05 je 8048742 <_init+0x1e>804873d: e8 ee 00 00 00 call 8048830 <__gmon_start__@plt>8048742: e8 89 02 00 00 call 80489d0 <frame_dummy>8048747: e8 54 19 00 00 call 804a0a0 <__do_global_ctors_aux>804874c: 83 c4 08 add $0x8,%esp804874f: 5b pop %ebx8048750: c3 retDisassembly of section .plt:08048760 <read@plt-0x10>:8048760: ff 35 f8 bf 04 08 pushl 0x804bff88048766: ff 25 fc bf 04 08 jmp *0x804bffc804876c: 00 00 add %al,(%eax)...08048770 <read@plt>:8048770: ff 25 00 c0 04 08 jmp *0x804c0008048776: 68 00 00 00 00 push $0x0804877b: e9 e0 ff ff ff jmp 8048760 <_init+0x3c>08048780 <fflush@plt>:8048780: ff 25 04 c0 04 08 jmp *0x804c0048048786: 68 08 00 00 00 push $0x8804878b: e9 d0 ff ff ff jmp 8048760 <_init+0x3c>08048790 <fgets@plt>:8048790: ff 25 08 c0 04 08 jmp *0x804c0088048796: 68 10 00 00 00 push $0x10804879b: e9 c0 ff ff ff jmp 8048760 <_init+0x3c>080487a0 <signal@plt>:80487a0: ff 25 0c c0 04 08 jmp *0x804c00c80487a6: 68 18 00 00 00 push $0x1880487ab: e9 b0 ff ff ff jmp 8048760 <_init+0x3c>080487b0 <sleep@plt>:80487b0: ff 25 10 c0 04 08 jmp *0x804c01080487b6: 68 20 00 00 00 push $0x2080487bb: e9 a0 ff ff ff jmp 8048760 <_init+0x3c>080487c0 <alarm@plt>:80487c0: ff 25 14 c0 04 08 jmp *0x804c01480487c6: 68 28 00 00 00 push $0x2880487cb: e9 90 ff ff ff jmp 8048760 <_init+0x3c>080487d0 <__stack_chk_fail@plt>:80487d0: ff 25 18 c0 04 08 jmp *0x804c01880487d6: 68 30 00 00 00 push $0x3080487db: e9 80 ff ff ff jmp 8048760 <_init+0x3c>080487e0 <strcpy@plt>:80487e0: ff 25 1c c0 04 08 jmp *0x804c01c80487e6: 68 38 00 00 00 push $0x3880487eb: e9 70 ff ff ff jmp 8048760 <_init+0x3c>080487f0 <getenv@plt>:80487f0: ff 25 20 c0 04 08 jmp *0x804c02080487f6: 68 40 00 00 00 push $0x4080487fb: e9 60 ff ff ff jmp 8048760 <_init+0x3c>08048800 <puts@plt>:8048800: ff 25 24 c0 04 08 jmp *0x804c0248048806: 68 48 00 00 00 push $0x48804880b: e9 50 ff ff ff jmp 8048760 <_init+0x3c>08048810 <__memmove_chk@plt>:8048810: ff 25 28 c0 04 08 jmp *0x804c0288048816: 68 50 00 00 00 push $0x50804881b: e9 40 ff ff ff jmp 8048760 <_init+0x3c>08048820 <__memcpy_chk@plt>:8048820: ff 25 2c c0 04 08 jmp *0x804c02c8048826: 68 58 00 00 00 push $0x58804882b: e9 30 ff ff ff jmp 8048760 <_init+0x3c>08048830 <__gmon_start__@plt>:8048830: ff 25 30 c0 04 08 jmp *0x804c0308048836: 68 60 00 00 00 push $0x60804883b: e9 20 ff ff ff jmp 8048760 <_init+0x3c>08048840 <exit@plt>:8048840: ff 25 34 c0 04 08 jmp *0x804c0348048846: 68 68 00 00 00 push $0x68804884b: e9 10 ff ff ff jmp 8048760 <_init+0x3c>08048850 <__libc_start_main@plt>:8048850: ff 25 38 c0 04 08 jmp *0x804c0388048856: 68 70 00 00 00 push $0x70804885b: e9 00 ff ff ff jmp 8048760 <_init+0x3c>08048860 <write@plt>:8048860: ff 25 3c c0 04 08 jmp *0x804c03c8048866: 68 78 00 00 00 push $0x78804886b: e9 f0 fe ff ff jmp 8048760 <_init+0x3c>08048870 <__isoc99_sscanf@plt>:8048870: ff 25 40 c0 04 08 jmp *0x804c0408048876: 68 80 00 00 00 push $0x80804887b: e9 e0 fe ff ff jmp 8048760 <_init+0x3c>08048880 <fopen@plt>:8048880: ff 25 44 c0 04 08 jmp *0x804c0448048886: 68 88 00 00 00 push $0x88804888b: e9 d0 fe ff ff jmp 8048760 <_init+0x3c>08048890 <__errno_location@plt>:8048890: ff 25 48 c0 04 08 jmp *0x804c0488048896: 68 90 00 00 00 push $0x90804889b: e9 c0 fe ff ff jmp 8048760 <_init+0x3c>080488a0 <__printf_chk@plt>:80488a0: ff 25 4c c0 04 08 jmp *0x804c04c80488a6: 68 98 00 00 00 push $0x9880488ab: e9 b0 fe ff ff jmp 8048760 <_init+0x3c>080488b0 <socket@plt>:80488b0: ff 25 50 c0 04 08 jmp *0x804c05080488b6: 68 a0 00 00 00 push $0xa080488bb: e9 a0 fe ff ff jmp 8048760 <_init+0x3c>080488c0 <__fprintf_chk@plt>:80488c0: ff 25 54 c0 04 08 jmp *0x804c05480488c6: 68 a8 00 00 00 push $0xa880488cb: e9 90 fe ff ff jmp 8048760 <_init+0x3c>080488d0 <gethostbyname@plt>:80488d0: ff 25 58 c0 04 08 jmp *0x804c05880488d6: 68 b0 00 00 00 push $0xb080488db: e9 80 fe ff ff jmp 8048760 <_init+0x3c>080488e0 <strtol@plt>:80488e0: ff 25 5c c0 04 08 jmp *0x804c05c80488e6: 68 b8 00 00 00 push $0xb880488eb: e9 70 fe ff ff jmp 8048760 <_init+0x3c>080488f0 <connect@plt>:80488f0: ff 25 60 c0 04 08 jmp *0x804c06080488f6: 68 c0 00 00 00 push $0xc080488fb: e9 60 fe ff ff jmp 8048760 <_init+0x3c>08048900 <close@plt>:8048900: ff 25 64 c0 04 08 jmp *0x804c0648048906: 68 c8 00 00 00 push $0xc8804890b: e9 50 fe ff ff jmp 8048760 <_init+0x3c>08048910 <__ctype_b_loc@plt>:8048910: ff 25 68 c0 04 08 jmp *0x804c0688048916: 68 d0 00 00 00 push $0xd0804891b: e9 40 fe ff ff jmp 8048760 <_init+0x3c>08048920 <__sprintf_chk@plt>:8048920: ff 25 6c c0 04 08 jmp *0x804c06c8048926: 68 d8 00 00 00 push $0xd8804892b: e9 30 fe ff ff jmp 8048760 <_init+0x3c>Disassembly of section .text:08048930 <_start>:8048930: 31 ed xor %ebp,%ebp8048932: 5e pop %esi8048933: 89 e1 mov %esp,%ecx8048935: 83 e4 f0 and $0xfffffff0,%esp8048938: 50 push %eax8048939: 54 push %esp804893a: 52 push %edx804893b: 68 90 a0 04 08 push $0x804a0908048940: 68 20 a0 04 08 push $0x804a0208048945: 51 push %ecx8048946: 56 push %esi8048947: 68 f4 89 04 08 push $0x80489f4804894c: e8 ff fe ff ff call 8048850 <__libc_start_main@plt>8048951: f4 hlt8048952: 90 nop8048953: 90 nop8048954: 90 nop8048955: 90 nop8048956: 90 nop8048957: 90 nop8048958: 90 nop8048959: 90 nop804895a: 90 nop804895b: 90 nop804895c: 90 nop804895d: 90 nop804895e: 90 nop804895f: 90 nop08048960 <__x86.get_pc_thunk.bx>:8048960: 8b 1c 24 mov (%esp),%ebx8048963: c3 ret8048964: 90 nop8048965: 90 nop8048966: 90 nop8048967: 90 nop8048968: 90 nop8048969: 90 nop804896a: 90 nop804896b: 90 nop804896c: 90 nop804896d: 90 nop804896e: 90 nop804896f: 90 nop08048970 <__do_global_dtors_aux>:8048970: 55 push %ebp8048971: 89 e5 mov %esp,%ebp8048973: 53 push %ebx8048974: 83 ec 04 sub $0x4,%esp8048977: 80 3d c4 c3 04 08 00 cmpb $0x0,0x804c3c4804897e: 75 3f jne 80489bf <__do_global_dtors_aux+0x4f>8048980: a1 c8 c3 04 08 mov 0x804c3c8,%eax8048985: bb 20 bf 04 08 mov $0x804bf20,%ebx804898a: 81 eb 1c bf 04 08 sub $0x804bf1c,%ebx8048990: c1 fb 02 sar $0x2,%ebx8048993: 83 eb 01 sub $0x1,%ebx8048996: 39 d8 cmp %ebx,%eax8048998: 73 1e jae 80489b8 <__do_global_dtors_aux+0x48>804899a: 8d b6 00 00 00 00 lea 0x0(%esi),%esi80489a0: 83 c0 01 add $0x1,%eax80489a3: a3 c8 c3 04 08 mov %eax,0x804c3c880489a8: ff 14 85 1c bf 04 08 call *0x804bf1c(,%eax,4)80489af: a1 c8 c3 04 08 mov 0x804c3c8,%eax80489b4: 39 d8 cmp %ebx,%eax80489b6: 72 e8 jb 80489a0 <__do_global_dtors_aux+0x30>80489b8: c6 05 c4 c3 04 08 01 movb $0x1,0x804c3c480489bf: 83 c4 04 add $0x4,%esp80489c2: 5b pop %ebx80489c3: 5d pop %ebp80489c4: c3 ret80489c5: 8d 74 26 00 lea 0x0(%esi,%eiz,1),%esi80489c9: 8d bc 27 00 00 00 00 lea 0x0(%edi,%eiz,1),%edi080489d0 <frame_dummy>:80489d0: 55 push %ebp80489d1: 89 e5 mov %esp,%ebp80489d3: 83 ec 18 sub $0x18,%esp80489d6: a1 24 bf 04 08 mov 0x804bf24,%eax80489db: 85 c0 test %eax,%eax80489dd: 74 12 je 80489f1 <frame_dummy+0x21>80489df: b8 00 00 00 00 mov $0x0,%eax80489e4: 85 c0 test %eax,%eax80489e6: 74 09 je 80489f1 <frame_dummy+0x21>80489e8: c7 04 24 24 bf 04 08 movl $0x804bf24,(%esp)80489ef: ff d0 call *%eax80489f1: c9 leave80489f2: c3 ret80489f3: 90 nop080489f4 <main>:80489f4: 55 push %ebp80489f5: 89 e5 mov %esp,%ebp80489f7: 53 push %ebx80489f8: 83 e4 f0 and $0xfffffff0,%esp80489fb: 83 ec 10 sub $0x10,%esp80489fe: 8b 45 08 mov 0x8(%ebp),%eax8048a01: 8b 5d 0c mov 0xc(%ebp),%ebx8048a04: 83 f8 01 cmp $0x1,%eax8048a07: 75 0c jne 8048a15 <main+0x21>8048a09: a1 a4 c3 04 08 mov 0x804c3a4,%eax8048a0e: a3 d0 c3 04 08 mov %eax,0x804c3d08048a13: eb 74 jmp 8048a89 <main+0x95>8048a15: 83 f8 02 cmp $0x2,%eax8048a18: 75 49 jne 8048a63 <main+0x6f>8048a1a: c7 44 24 04 08 a1 04 movl $0x804a108,0x4(%esp)8048a21: 088048a22: 8b 43 04 mov 0x4(%ebx),%eax8048a25: 89 04 24 mov %eax,(%esp)8048a28: e8 53 fe ff ff call 8048880 <fopen@plt>8048a2d: a3 d0 c3 04 08 mov %eax,0x804c3d08048a32: 85 c0 test %eax,%eax8048a34: 75 53 jne 8048a89 <main+0x95>8048a36: 8b 43 04 mov 0x4(%ebx),%eax8048a39: 89 44 24 0c mov %eax,0xc(%esp)8048a3d: 8b 03 mov (%ebx),%eax8048a3f: 89 44 24 08 mov %eax,0x8(%esp)8048a43: c7 44 24 04 0a a1 04 movl $0x804a10a,0x4(%esp)8048a4a: 088048a4b: c7 04 24 01 00 00 00 movl $0x1,(%esp)8048a52: e8 49 fe ff ff call 80488a0 <__printf_chk@plt>8048a57: c7 04 24 08 00 00 00 movl $0x8,(%esp)8048a5e: e8 dd fd ff ff call 8048840 <exit@plt>8048a63: 8b 03 mov (%ebx),%eax8048a65: 89 44 24 08 mov %eax,0x8(%esp)8048a69: c7 44 24 04 27 a1 04 movl $0x804a127,0x4(%esp)8048a70: 088048a71: c7 04 24 01 00 00 00 movl $0x1,(%esp)8048a78: e8 23 fe ff ff call 80488a0 <__printf_chk@plt>8048a7d: c7 04 24 08 00 00 00 movl $0x8,(%esp)8048a84: e8 b7 fd ff ff call 8048840 <exit@plt>8048a89: e8 4d 06 00 00 call 80490db <initialize_bomb>8048a8e: c7 04 24 8c a1 04 08 movl $0x804a18c,(%esp)8048a95: e8 66 fd ff ff call 8048800 <puts@plt>8048a9a: c7 04 24 c8 a1 04 08 movl $0x804a1c8,(%esp)8048aa1: e8 5a fd ff ff call 8048800 <puts@plt>8048aa6: e8 f2 06 00 00 call 804919d <read_line>8048aab: 89 04 24 mov %eax,(%esp)8048aae: e8 ad 00 00 00 call 8048b60 <phase_1>8048ab3: e8 43 08 00 00 call 80492fb <phase_defused>8048ab8: c7 04 24 f4 a1 04 08 movl $0x804a1f4,(%esp)8048abf: e8 3c fd ff ff call 8048800 <puts@plt>8048ac4: e8 d4 06 00 00 call 804919d <read_line>8048ac9: 89 04 24 mov %eax,(%esp)8048acc: e8 b3 00 00 00 call 8048b84 <phase_2>8048ad1: e8 25 08 00 00 call 80492fb <phase_defused>8048ad6: c7 04 24 41 a1 04 08 movl $0x804a141,(%esp)8048add: e8 1e fd ff ff call 8048800 <puts@plt>8048ae2: e8 b6 06 00 00 call 804919d <read_line>8048ae7: 89 04 24 mov %eax,(%esp)8048aea: e8 e5 00 00 00 call 8048bd4 <phase_3>8048aef: e8 07 08 00 00 call 80492fb <phase_defused>8048af4: c7 04 24 5f a1 04 08 movl $0x804a15f,(%esp)8048afb: e8 00 fd ff ff call 8048800 <puts@plt>8048b00: e8 98 06 00 00 call 804919d <read_line>8048b05: 89 04 24 mov %eax,(%esp)8048b08: e8 7d 02 00 00 call 8048d8a <phase_4>8048b0d: e8 e9 07 00 00 call 80492fb <phase_defused>8048b12: c7 04 24 20 a2 04 08 movl $0x804a220,(%esp)8048b19: e8 e2 fc ff ff call 8048800 <puts@plt>8048b1e: e8 7a 06 00 00 call 804919d <read_line>8048b23: 89 04 24 mov %eax,(%esp)8048b26: e8 c1 02 00 00 call 8048dec <phase_5>8048b2b: e8 cb 07 00 00 call 80492fb <phase_defused>8048b30: c7 04 24 6e a1 04 08 movl $0x804a16e,(%esp)8048b37: e8 c4 fc ff ff call 8048800 <puts@plt>8048b3c: e8 5c 06 00 00 call 804919d <read_line>8048b41: 89 04 24 mov %eax,(%esp)8048b44: e8 ec 02 00 00 call 8048e35 <phase_6>8048b49: e8 ad 07 00 00 call 80492fb <phase_defused>8048b4e: b8 00 00 00 00 mov $0x0,%eax8048b53: 8b 5d fc mov -0x4(%ebp),%ebx8048b56: c9 leave8048b57: c3 ret8048b58: 90 nop8048b59: 90 nop8048b5a: 90 nop8048b5b: 90 nop8048b5c: 90 nop8048b5d: 90 nop8048b5e: 90 nop8048b5f: 90 nop08048b60 <phase_1>:8048b60: 83 ec 1c sub $0x1c,%esp8048b63: c7 44 24 04 44 a2 04 movl $0x804a244,0x4(%esp)8048b6a: 088048b6b: 8b 44 24 20 mov 0x20(%esp),%eax8048b6f: 89 04 24 mov %eax,(%esp)8048b72: e8 ed 04 00 00 call 8049064 <strings_not_equal> #比较两个字符串是否相等8048b77: 85 c0 test %eax,%eax8048b79: 74 05 je 8048b80 <phase_1+0x20> #函数返回0，即字符串相等，就通过8048b7b: e8 f6 05 00 00 call 8049176 <explode_bomb>8048b80: 83 c4 1c add $0x1c,%esp8048b83: c3 ret08048b84 <phase_2>:8048b84: 56 push %esi8048b85: 53 push %ebx8048b86: 83 ec 34 sub $0x34,%esp8048b89: 8d 44 24 18 lea 0x18(%esp),%eax8048b8d: 89 44 24 04 mov %eax,0x4(%esp)8048b91: 8b 44 24 40 mov 0x40(%esp),%eax8048b95: 89 04 24 mov %eax,(%esp)8048b98: e8 0e 07 00 00 call 80492ab <read_six_numbers>8048b9d: 83 7c 24 18 00 cmpl $0x0,0x18(%esp) #m[0]=08048ba2: 75 07 jne 8048bab <phase_2+0x27>8048ba4: 83 7c 24 1c 01 cmpl $0x1,0x1c(%esp) #m[1]=18048ba9: 74 05 je 8048bb0 <phase_2+0x2c>8048bab: e8 c6 05 00 00 call 8049176 <explode_bomb>8048bb0: 8d 5c 24 20 lea 0x20(%esp),%ebx8048bb4: 8d 74 24 30 lea 0x30(%esp),%esi #%esi存放m[5]地址（遍历完成终点）8048bb8: 8b 43 f8 mov -0x8(%ebx),%eax8048bbb: 03 43 fc add -0x4(%ebx),%eax #temp=m[i]+m[i-1]8048bbe: 39 03 cmp %eax,(%ebx)8048bc0: 74 05 je 8048bc7 <phase_2+0x43> #判断m[i]=m[i-1]+m[i-2]是否成立8048bc2: e8 af 05 00 00 call 8049176 <explode_bomb>8048bc7: 83 c3 04 add $0x4,%ebx #%ebx表示当前访问的地址（循环控制变量）8048bca: 39 f3 cmp %esi,%ebx8048bcc: 75 ea jne 8048bb8 <phase_2+0x34>8048bce: 83 c4 34 add $0x34,%esp8048bd1: 5b pop %ebx8048bd2: 5e pop %esi8048bd3: c3 ret08048bd4 <phase_3>:8048bd4: 83 ec 3c sub $0x3c,%esp8048bd7: 8d 44 24 28 lea 0x28(%esp),%eax #第3个参数位置8048bdb: 89 44 24 10 mov %eax,0x10(%esp)8048bdf: 8d 44 24 2f lea 0x2f(%esp),%eax #第2个参数位置8048be3: 89 44 24 0c mov %eax,0xc(%esp)8048be7: 8d 44 24 24 lea 0x24(%esp),%eax #第1个参数位置8048beb: 89 44 24 08 mov %eax,0x8(%esp)8048bef: c7 44 24 04 9e a2 04 movl $0x804a29e,0x4(%esp) #"%d %c %d"读取数据的格式8048bf6: 088048bf7: 8b 44 24 40 mov 0x40(%esp),%eax #读入数据存放的地址8048bfb: 89 04 24 mov %eax,(%esp)8048bfe: e8 6d fc ff ff call 8048870 <__isoc99_sscanf@plt>8048c03: 83 f8 02 cmp $0x2,%eax #要求读入数据个数>28048c06: 7f 05 jg 8048c0d <phase_3+0x39>8048c08: e8 69 05 00 00 call 8049176 <explode_bomb>8048c0d: 83 7c 24 24 07 cmpl $0x7,0x24(%esp) #跳转决定值0<=n<=7,共8个可能值8048c12: 0f 87 fc 00 00 00 ja 8048d14 <phase_3+0x140>8048c18: 8b 44 24 24 mov 0x24(%esp),%eax8048c1c: ff 24 85 c0 a2 04 08 jmp *0x804a2c0(,%eax,4) #跳转表，在跳转表中找到目标地址并跳转8048c23: b8 64 00 00 00 mov $0x64,%eax #n=08048c28: 81 7c 24 28 80 00 00 cmpl $0x80,0x28(%esp)8048c2f: 008048c30: 0f 84 e8 00 00 00 je 8048d1e <phase_3+0x14a> #比较数字值是否正确8048c36: e8 3b 05 00 00 call 8049176 <explode_bomb>8048c3b: b8 64 00 00 00 mov $0x64,%eax #将正确字符值存入%eax，等待比较8048c40: e9 d9 00 00 00 jmp 8048d1e <phase_3+0x14a>8048c45: b8 6f 00 00 00 mov $0x6f,%eax #n=18048c4a: 81 7c 24 28 35 01 00 cmpl $0x135,0x28(%esp)8048c51: 008048c52: 0f 84 c6 00 00 00 je 8048d1e <phase_3+0x14a>8048c58: e8 19 05 00 00 call 8049176 <explode_bomb>8048c5d: b8 6f 00 00 00 mov $0x6f,%eax8048c62: e9 b7 00 00 00 jmp 8048d1e <phase_3+0x14a>8048c67: b8 67 00 00 00 mov $0x67,%eax #n=28048c6c: 81 7c 24 28 48 03 00 cmpl $0x348,0x28(%esp)8048c73: 008048c74: 0f 84 a4 00 00 00 je 8048d1e <phase_3+0x14a>8048c7a: e8 f7 04 00 00 call 8049176 <explode_bomb>8048c7f: b8 67 00 00 00 mov $0x67,%eax8048c84: e9 95 00 00 00 jmp 8048d1e <phase_3+0x14a>8048c89: b8 6b 00 00 00 mov $0x6b,%eax #n=38048c8e: 81 7c 24 28 6d 01 00 cmpl $0x16d,0x28(%esp)8048c95: 008048c96: 0f 84 82 00 00 00 je 8048d1e <phase_3+0x14a>8048c9c: e8 d5 04 00 00 call 8049176 <explode_bomb>8048ca1: b8 6b 00 00 00 mov $0x6b,%eax8048ca6: eb 76 jmp 8048d1e <phase_3+0x14a>8048ca8: b8 75 00 00 00 mov $0x75,%eax #n=48048cad: 81 7c 24 28 d7 01 00 cmpl $0x1d7,0x28(%esp)8048cb4: 008048cb5: 74 67 je 8048d1e <phase_3+0x14a>8048cb7: e8 ba 04 00 00 call 8049176 <explode_bomb>8048cbc: b8 75 00 00 00 mov $0x75,%eax8048cc1: eb 5b jmp 8048d1e <phase_3+0x14a>8048cc3: b8 72 00 00 00 mov $0x72,%eax #n=58048cc8: 81 7c 24 28 1b 03 00 cmpl $0x31b,0x28(%esp)8048ccf: 008048cd0: 74 4c je 8048d1e <phase_3+0x14a>8048cd2: e8 9f 04 00 00 call 8049176 <explode_bomb>8048cd7: b8 72 00 00 00 mov $0x72,%eax8048cdc: eb 40 jmp 8048d1e <phase_3+0x14a>8048cde: b8 6e 00 00 00 mov $0x6e,%eax #n=68048ce3: 81 7c 24 28 04 02 00 cmpl $0x204,0x28(%esp)8048cea: 008048ceb: 74 31 je 8048d1e <phase_3+0x14a>8048ced: e8 84 04 00 00 call 8049176 <explode_bomb>8048cf2: b8 6e 00 00 00 mov $0x6e,%eax8048cf7: eb 25 jmp 8048d1e <phase_3+0x14a>8048cf9: b8 6f 00 00 00 mov $0x6f,%eax #n=78048cfe: 81 7c 24 28 b0 00 00 cmpl $0xb0,0x28(%esp)8048d05: 008048d06: 74 16 je 8048d1e <phase_3+0x14a>8048d08: e8 69 04 00 00 call 8049176 <explode_bomb>8048d0d: b8 6f 00 00 00 mov $0x6f,%eax8048d12: eb 0a jmp 8048d1e <phase_3+0x14a>8048d14: e8 5d 04 00 00 call 8049176 <explode_bomb>8048d19: b8 6a 00 00 00 mov $0x6a,%eax8048d1e: 3a 44 24 2f cmp 0x2f(%esp),%al #比较字符值是否正确8048d22: 74 05 je 8048d29 <phase_3+0x155>8048d24: e8 4d 04 00 00 call 8049176 <explode_bomb>8048d29: 83 c4 3c add $0x3c,%esp8048d2c: c3 ret08048d2d <func4>:8048d2d: 83 ec 1c sub $0x1c,%esp8048d30: 89 5c 24 10 mov %ebx,0x10(%esp)8048d34: 89 74 24 14 mov %esi,0x14(%esp)8048d38: 89 7c 24 18 mov %edi,0x18(%esp)8048d3c: 8b 74 24 20 mov 0x20(%esp),%esi #%esi为n8048d40: 8b 5c 24 24 mov 0x24(%esp),%ebx #%ebx为x8048d44: 85 f6 test %esi,%esi #n=0,到达最底层，返回08048d46: 7e 2b jle 8048d73 <func4+0x46>8048d48: 83 fe 01 cmp $0x1,%esi8048d4b: 74 2b je 8048d78 <func4+0x4b> #若n=1，返回%ebx8048d4d: 89 5c 24 04 mov %ebx,0x4(%esp)8048d51: 8d 46 ff lea -0x1(%esi),%eax8048d54: 89 04 24 mov %eax,(%esp)8048d57: e8 d1 ff ff ff call 8048d2d <func4> #func4(n-1,x)8048d5c: 8d 3c 18 lea (%eax,%ebx,1),%edi #%edi=func4(n-1,x)+x8048d5f: 89 5c 24 04 mov %ebx,0x4(%esp)8048d63: 83 ee 02 sub $0x2,%esi8048d66: 89 34 24 mov %esi,(%esp)8048d69: e8 bf ff ff ff call 8048d2d <func4> #func4(n-2,x)8048d6e: 8d 1c 07 lea (%edi,%eax,1),%ebx #%ebx=func4(n-1,x)+func4(n-2,x)+x8048d71: eb 05 jmp 8048d78 <func4+0x4b>8048d73: bb 00 00 00 00 mov $0x0,%ebx8048d78: 89 d8 mov %ebx,%eax8048d7a: 8b 5c 24 10 mov 0x10(%esp),%ebx8048d7e: 8b 74 24 14 mov 0x14(%esp),%esi8048d82: 8b 7c 24 18 mov 0x18(%esp),%edi8048d86: 83 c4 1c add $0x1c,%esp #return %ebx8048d89: c3 ret08048d8a <phase_4>:8048d8a: 83 ec 2c sub $0x2c,%esp8048d8d: 8d 44 24 18 lea 0x18(%esp),%eax8048d91: 89 44 24 0c mov %eax,0xc(%esp)8048d95: 8d 44 24 1c lea 0x1c(%esp),%eax8048d99: 89 44 24 08 mov %eax,0x8(%esp)8048d9d: c7 44 24 04 83 a4 04 movl $0x804a483,0x4(%esp) #输入格式"%d %d"8048da4: 088048da5: 8b 44 24 30 mov 0x30(%esp),%eax8048da9: 89 04 24 mov %eax,(%esp)8048dac: e8 bf fa ff ff call 8048870 <__isoc99_sscanf@plt> #scanf(check，x)8048db1: 83 f8 02 cmp $0x2,%eax #输入的是两个数8048db4: 75 0e jne 8048dc4 <phase_4+0x3a>8048db6: 8b 44 24 18 mov 0x18(%esp),%eax8048dba: 83 f8 01 cmp $0x1,%eax8048dbd: 7e 05 jle 8048dc4 <phase_4+0x3a>8048dbf: 83 f8 04 cmp $0x4,%eax #1<x<=4,x=2,3,48048dc2: 7e 05 jle 8048dc9 <phase_4+0x3f>8048dc4: e8 ad 03 00 00 call 8049176 <explode_bomb>8048dc9: 8b 44 24 18 mov 0x18(%esp),%eax8048dcd: 89 44 24 04 mov %eax,0x4(%esp)8048dd1: c7 04 24 09 00 00 00 movl $0x9,(%esp)8048dd8: e8 50 ff ff ff call 8048d2d <func4> #func4(n=9,x)8048ddd: 3b 44 24 1c cmp 0x1c(%esp),%eax #投机取巧的方法,可以直接看答案8048de1: 74 05 je 8048de8 <phase_4+0x5e>8048de3: e8 8e 03 00 00 call 8049176 <explode_bomb>8048de8: 83 c4 2c add $0x2c,%esp8048deb: c3 ret08048dec <phase_5>:8048dec: 53 push %ebx8048ded: 83 ec 18 sub $0x18,%esp8048df0: 8b 5c 24 20 mov 0x20(%esp),%ebx8048df4: 89 1c 24 mov %ebx,(%esp)8048df7: e8 4f 02 00 00 call 804904b <string_length>8048dfc: 83 f8 06 cmp $0x6,%eax #字符6位8048dff: 74 05 je 8048e06 <phase_5+0x1a>8048e01: e8 70 03 00 00 call 8049176 <explode_bomb>8048e06: ba 00 00 00 00 mov $0x0,%edx8048e0b: b8 00 00 00 00 mov $0x0,%eax #%eax为计数器，表示处理的位数i8048e10: 0f be 0c 03 movsbl (%ebx,%eax,1),%ecx #loop开始8048e14: 83 e1 0f and $0xf,%ecx8048e17: 03 14 8d e0 a2 04 08 add 0x804a2e0(,%ecx,4),%edx8048e1e: 83 c0 01 add $0x1,%eax #循环控制变量i++8048e21: 83 f8 06 cmp $0x6,%eax8048e24: 75 ea jne 8048e10 <phase_5+0x24> #loop结尾，查看循环控制变量是否到达8048e26: 83 fa 38 cmp $0x38,%edx8048e29: 74 05 je 8048e30 <phase_5+0x44> #与给定值相比较8048e2b: e8 46 03 00 00 call 8049176 <explode_bomb>8048e30: 83 c4 18 add $0x18,%esp8048e33: 5b pop %ebx8048e34: c3 ret08048e35 <phase_6>:8048e35: 56 push %esi8048e36: 53 push %ebx8048e37: 83 ec 44 sub $0x44,%esp8048e3a: 8d 44 24 10 lea 0x10(%esp),%eax8048e3e: 89 44 24 04 mov %eax,0x4(%esp)8048e42: 8b 44 24 50 mov 0x50(%esp),%eax8048e46: 89 04 24 mov %eax,(%esp)8048e49: e8 5d 04 00 00 call 80492ab <read_six_numbers>8048e4e: be 00 00 00 00 mov $0x0,%esi #initial esi=08048e53: 8b 44 b4 10 mov 0x10(%esp,%esi,4),%eax #loop 外层(控制变量esi)8048e57: 83 e8 01 sub $0x1,%eax8048e5a: 83 f8 05 cmp $0x5,%eax8048e5d: 76 05 jbe 8048e64 <phase_6+0x2f> #eax<=6正常(控制变量ebx)8048e5f: e8 12 03 00 00 call 8049176 <explode_bomb>8048e64: 83 c6 01 add $0x1,%esi #esi++8048e67: 83 fe 06 cmp $0x6,%esi8048e6a: 74 33 je 8048e9f <phase_6+0x6a> #esi=6，跳出循环8048e6c: 89 f3 mov %esi,%ebx #esi！=68048e6e: 8b 44 9c 10 mov 0x10(%esp,%ebx,4),%eax #loop 内层8048e72: 39 44 b4 0c cmp %eax,0xc(%esp,%esi,4)8048e76: 75 05 jne 8048e7d <phase_6+0x48> #8048e78: e8 f9 02 00 00 call 8049176 <explode_bomb>8048e7d: 83 c3 01 add $0x1,%ebx #ebx++8048e80: 83 fb 05 cmp $0x5,%ebx8048e83: 7e e9 jle 8048e6e <phase_6+0x39> #loop 内层 ebx：esi..58048e85: eb cc jmp 8048e53 <phase_6+0x1e> #loop 外层 esi：0..58048e87: 8b 52 08 mov 0x8(%edx),%edx #ecx>1：通过循环得到编号对应的数据地址8048e8a: 83 c0 01 add $0x1,%eax8048e8d: 39 c8 cmp %ecx,%eax #loop28048e8f: 75 f6 jne 8048e87 <phase_6+0x52>8048e91: 89 54 b4 28 mov %edx,0x28(%esp,%esi,4) #将编号对应的数据地址放入数组中8048e95: 83 c3 01 add $0x1,%ebx #ebx++8048e98: 83 fb 06 cmp $0x6,%ebx8048e9b: 75 07 jne 8048ea4 <phase_6+0x6f> #ebx！=6，重复循环8048e9d: eb 1c jmp 8048ebb <phase_6+0x86> #ebx=6跳出8048e9f: bb 00 00 00 00 mov $0x0,%ebx #第二阶段开始：esi=6跳出循环后8048ea4: 89 de mov %ebx,%esi8048ea6: 8b 4c 9c 10 mov 0x10(%esp,%ebx,4),%ecx8048eaa: b8 01 00 00 00 mov $0x1,%eax8048eaf: ba 3c c1 04 08 mov $0x804c13c,%edx #给定数据首地址放入%edx8048eb4: 83 f9 01 cmp $0x1,%ecx8048eb7: 7f ce jg 8048e87 <phase_6+0x52> #ecx>18048eb9: eb d6 jmp 8048e91 <phase_6+0x5c> #ecx=1,没必要进入loop28048ebb: 8b 5c 24 28 mov 0x28(%esp),%ebx #第三阶段开始：ebx=6跳出循环后8048ebf: 8b 44 24 2c mov 0x2c(%esp),%eax8048ec3: 89 43 08 mov %eax,0x8(%ebx) #*b[0]->next=*b[1]8048ec6: 8b 54 24 30 mov 0x30(%esp),%edx8048eca: 89 50 08 mov %edx,0x8(%eax) #*b[1]->next=*b[2]8048ecd: 8b 44 24 34 mov 0x34(%esp),%eax8048ed1: 89 42 08 mov %eax,0x8(%edx) #*b[2]->next=*b[3]8048ed4: 8b 54 24 38 mov 0x38(%esp),%edx8048ed8: 89 50 08 mov %edx,0x8(%eax) #*b[3]->next=*b[4]8048edb: 8b 44 24 3c mov 0x3c(%esp),%eax8048edf: 89 42 08 mov %eax,0x8(%edx) #*b[4]->next=*b[5]8048ee2: c7 40 08 00 00 00 00 movl $0x0,0x8(%eax)8048ee9: be 05 00 00 00 mov $0x5,%esi #loop（循环控制变量为%esi）8048eee: 8b 43 08 mov 0x8(%ebx),%eax8048ef1: 8b 10 mov (%eax),%edx8048ef3: 39 13 cmp %edx,(%ebx)8048ef5: 7e 05 jle 8048efc <phase_6+0xc7> #要求(0x8(%ebx))<(%ebx)，即递增8048ef7: e8 7a 02 00 00 call 8049176 <explode_bomb>8048efc: 8b 5b 08 mov 0x8(%ebx),%ebx8048eff: 83 ee 01 sub $0x1,%esi8048f02: 75 ea jne 8048eee <phase_6+0xb9>8048f04: 83 c4 44 add $0x44,%esp8048f07: 5b pop %ebx8048f08: 5e pop %esi8048f09: c3 ret08048f0a <fun7>:8048f0a: 53 push %ebx8048f0b: 83 ec 18 sub $0x18,%esp8048f0e: 8b 54 24 20 mov 0x20(%esp),%edx #读取参数1放入%edx(x)8048f12: 8b 4c 24 24 mov 0x24(%esp),%ecx #读取参数2放入%ecx(input)8048f16: 85 d2 test %edx,%edx8048f18: 74 37 je 8048f51 <fun7+0x47> #x为0，返回-18048f1a: 8b 1a mov (%edx),%ebx8048f1c: 39 cb cmp %ecx,%ebx #比较input和*x8048f1e: 7e 13 jle 8048f33 <fun7+0x29>8048f20: 89 4c 24 04 mov %ecx,0x4(%esp) #*x>input 参数2：input8048f24: 8b 42 04 mov 0x4(%edx),%eax8048f27: 89 04 24 mov %eax,(%esp) #参数1：(x+4)8048f2a: e8 db ff ff ff call 8048f0a <fun7>8048f2f: 01 c0 add %eax,%eax8048f31: eb 23 jmp 8048f56 <fun7+0x4c> #返回(2fun7())8048f33: b8 00 00 00 00 mov $0x0,%eax #*x<=input8048f38: 39 cb cmp %ecx,%ebx8048f3a: 74 1a je 8048f56 <fun7+0x4c> #*x=input，返回08048f3c: 89 4c 24 04 mov %ecx,0x4(%esp) #参数2：input8048f40: 8b 42 08 mov 0x8(%edx),%eax8048f43: 89 04 24 mov %eax,(%esp) #参数1：(x+8)8048f46: e8 bf ff ff ff call 8048f0a <fun7> #调用fun7()8048f4b: 8d 44 00 01 lea 0x1(%eax,%eax,1),%eax8048f4f: eb 05 jmp 8048f56 <fun7+0x4c> #返回(2fun7()+1)8048f51: b8 ff ff ff ff mov $0xffffffff,%eax8048f56: 83 c4 18 add $0x18,%esp8048f59: 5b pop %ebx8048f5a: c3 ret08048f5b <secret_phase>:8048f5b: 53 push %ebx8048f5c: 83 ec 18 sub $0x18,%esp8048f5f: e8 39 02 00 00 call 804919d <read_line>8048f64: c7 44 24 08 0a 00 00 movl $0xa,0x8(%esp) #参数38048f6b: 008048f6c: c7 44 24 04 00 00 00 movl $0x0,0x4(%esp) #参数28048f73: 008048f74: 89 04 24 mov %eax,(%esp) #参数1：read_line的返回值8048f77: e8 64 f9 ff ff call 80488e0 <strtol@plt>8048f7c: 89 c3 mov %eax,%ebx8048f7e: 8d 40 ff lea -0x1(%eax),%eax8048f81: 3d e8 03 00 00 cmp $0x3e8,%eax #0x3e8=10008048f86: 76 05 jbe 8048f8d <secret_phase+0x32> #strtol返回值<10008048f88: e8 e9 01 00 00 call 8049176 <explode_bomb>8048f8d: 89 5c 24 04 mov %ebx,0x4(%esp) #参数2：strtol的返回值(即为输入值input)8048f91: c7 04 24 88 c0 04 08 movl $0x804c088,(%esp) #*0x804c088="0x24"即36 参数18048f98: e8 6d ff ff ff call 8048f0a <fun7>8048f9d: 85 c0 test %eax,%eax8048f9f: 74 05 je 8048fa6 <secret_phase+0x4b> #fun7返回值得是08048fa1: e8 d0 01 00 00 call 8049176 <explode_bomb>8048fa6: c7 04 24 78 a2 04 08 movl $0x804a278,(%esp) #输出隐藏关通过8048fad: e8 4e f8 ff ff call 8048800 <puts@plt>8048fb2: e8 44 03 00 00 call 80492fb <phase_defused>8048fb7: 83 c4 18 add $0x18,%esp8048fba: 5b pop %ebx8048fbb: c3 ret8048fbc: 90 nop8048fbd: 90 nop8048fbe: 90 nop8048fbf: 90 nop08048fc0 <sig_handler>:8048fc0: 83 ec 1c sub $0x1c,%esp8048fc3: c7 04 24 20 a3 04 08 movl $0x804a320,(%esp)8048fca: e8 31 f8 ff ff call 8048800 <puts@plt>8048fcf: c7 04 24 03 00 00 00 movl $0x3,(%esp)8048fd6: e8 d5 f7 ff ff call 80487b0 <sleep@plt>8048fdb: c7 44 24 04 e2 a3 04 movl $0x804a3e2,0x4(%esp)8048fe2: 088048fe3: c7 04 24 01 00 00 00 movl $0x1,(%esp)8048fea: e8 b1 f8 ff ff call 80488a0 <__printf_chk@plt>8048fef: a1 c0 c3 04 08 mov 0x804c3c0,%eax8048ff4: 89 04 24 mov %eax,(%esp)8048ff7: e8 84 f7 ff ff call 8048780 <fflush@plt>8048ffc: c7 04 24 01 00 00 00 movl $0x1,(%esp)8049003: e8 a8 f7 ff ff call 80487b0 <sleep@plt>8049008: c7 04 24 ea a3 04 08 movl $0x804a3ea,(%esp)804900f: e8 ec f7 ff ff call 8048800 <puts@plt>8049014: c7 04 24 10 00 00 00 movl $0x10,(%esp)804901b: e8 20 f8 ff ff call 8048840 <exit@plt>08049020 <invalid_phase>:8049020: 83 ec 1c sub $0x1c,%esp8049023: 8b 44 24 20 mov 0x20(%esp),%eax8049027: 89 44 24 08 mov %eax,0x8(%esp)804902b: c7 44 24 04 f2 a3 04 movl $0x804a3f2,0x4(%esp)8049032: 088049033: c7 04 24 01 00 00 00 movl $0x1,(%esp)804903a: e8 61 f8 ff ff call 80488a0 <__printf_chk@plt>804903f: c7 04 24 08 00 00 00 movl $0x8,(%esp)8049046: e8 f5 f7 ff ff call 8048840 <exit@plt>0804904b <string_length>:804904b: 8b 54 24 04 mov 0x4(%esp),%edx804904f: b8 00 00 00 00 mov $0x0,%eax8049054: 80 3a 00 cmpb $0x0,(%edx)8049057: 74 09 je 8049062 <string_length+0x17>8049059: 83 c0 01 add $0x1,%eax804905c: 80 3c 02 00 cmpb $0x0,(%edx,%eax,1)8049060: 75 f7 jne 8049059 <string_length+0xe>8049062: f3 c3 repz ret08049064 <strings_not_equal>:8049064: 83 ec 10 sub $0x10,%esp8049067: 89 5c 24 04 mov %ebx,0x4(%esp)804906b: 89 74 24 08 mov %esi,0x8(%esp)804906f: 89 7c 24 0c mov %edi,0xc(%esp)8049073: 8b 5c 24 14 mov 0x14(%esp),%ebx8049077: 8b 74 24 18 mov 0x18(%esp),%esi804907b: 89 1c 24 mov %ebx,(%esp)804907e: e8 c8 ff ff ff call 804904b <string_length>8049083: 89 c7 mov %eax,%edi8049085: 89 34 24 mov %esi,(%esp)8049088: e8 be ff ff ff call 804904b <string_length>804908d: ba 01 00 00 00 mov $0x1,%edx8049092: 39 c7 cmp %eax,%edi8049094: 75 33 jne 80490c9 <strings_not_equal+0x65>8049096: 0f b6 03 movzbl (%ebx),%eax8049099: b2 00 mov $0x0,%dl804909b: 84 c0 test %al,%al804909d: 74 2a je 80490c9 <strings_not_equal+0x65>804909f: b2 01 mov $0x1,%dl80490a1: 3a 06 cmp (%esi),%al80490a3: 75 24 jne 80490c9 <strings_not_equal+0x65>80490a5: b8 00 00 00 00 mov $0x0,%eax80490aa: eb 08 jmp 80490b4 <strings_not_equal+0x50>80490ac: 83 c0 01 add $0x1,%eax80490af: 3a 14 06 cmp (%esi,%eax,1),%dl80490b2: 75 10 jne 80490c4 <strings_not_equal+0x60>80490b4: 0f b6 54 03 01 movzbl 0x1(%ebx,%eax,1),%edx80490b9: 84 d2 test %dl,%dl80490bb: 75 ef jne 80490ac <strings_not_equal+0x48>80490bd: ba 00 00 00 00 mov $0x0,%edx80490c2: eb 05 jmp 80490c9 <strings_not_equal+0x65>80490c4: ba 01 00 00 00 mov $0x1,%edx80490c9: 89 d0 mov %edx,%eax80490cb: 8b 5c 24 04 mov 0x4(%esp),%ebx80490cf: 8b 74 24 08 mov 0x8(%esp),%esi80490d3: 8b 7c 24 0c mov 0xc(%esp),%edi80490d7: 83 c4 10 add $0x10,%esp80490da: c3 ret080490db <initialize_bomb>:80490db: 83 ec 1c sub $0x1c,%esp80490de: c7 44 24 04 c0 8f 04 movl $0x8048fc0,0x4(%esp)80490e5: 0880490e6: c7 04 24 02 00 00 00 movl $0x2,(%esp)80490ed: e8 ae f6 ff ff call 80487a0 <signal@plt>80490f2: 83 c4 1c add $0x1c,%esp80490f5: c3 ret080490f6 <initialize_bomb_solve>:80490f6: f3 c3 repz ret080490f8 <blank_line>:80490f8: 56 push %esi80490f9: 53 push %ebx80490fa: 83 ec 04 sub $0x4,%esp80490fd: 8b 74 24 10 mov 0x10(%esp),%esi8049101: eb 14 jmp 8049117 <blank_line+0x1f>8049103: e8 08 f8 ff ff call 8048910 <__ctype_b_loc@plt>8049108: 83 c6 01 add $0x1,%esi804910b: 0f be db movsbl %bl,%ebx804910e: 8b 00 mov (%eax),%eax8049110: f6 44 58 01 20 testb $0x20,0x1(%eax,%ebx,2)8049115: 74 0e je 8049125 <blank_line+0x2d>8049117: 0f b6 1e movzbl (%esi),%ebx804911a: 84 db test %bl,%bl804911c: 75 e5 jne 8049103 <blank_line+0xb>804911e: b8 01 00 00 00 mov $0x1,%eax8049123: eb 05 jmp 804912a <blank_line+0x32>8049125: b8 00 00 00 00 mov $0x0,%eax804912a: 83 c4 04 add $0x4,%esp804912d: 5b pop %ebx804912e: 5e pop %esi804912f: c3 ret08049130 <skip>:8049130: 53 push %ebx8049131: 83 ec 18 sub $0x18,%esp8049134: a1 d0 c3 04 08 mov 0x804c3d0,%eax8049139: 89 44 24 08 mov %eax,0x8(%esp)804913d: c7 44 24 04 50 00 00 movl $0x50,0x4(%esp)8049144: 008049145: a1 cc c3 04 08 mov 0x804c3cc,%eax804914a: 8d 04 80 lea (%eax,%eax,4),%eax804914d: c1 e0 04 shl $0x4,%eax8049150: 05 e0 c3 04 08 add $0x804c3e0,%eax8049155: 89 04 24 mov %eax,(%esp)8049158: e8 33 f6 ff ff call 8048790 <fgets@plt>804915d: 89 c3 mov %eax,%ebx804915f: 85 c0 test %eax,%eax8049161: 74 0c je 804916f <skip+0x3f>8049163: 89 04 24 mov %eax,(%esp)8049166: e8 8d ff ff ff call 80490f8 <blank_line>804916b: 85 c0 test %eax,%eax804916d: 75 c5 jne 8049134 <skip+0x4>804916f: 89 d8 mov %ebx,%eax8049171: 83 c4 18 add $0x18,%esp8049174: 5b pop %ebx8049175: c3 ret08049176 <explode_bomb>:8049176: 83 ec 1c sub $0x1c,%esp8049179: c7 04 24 03 a4 04 08 movl $0x804a403,(%esp)8049180: e8 7b f6 ff ff call 8048800 <puts@plt>8049185: c7 04 24 0c a4 04 08 movl $0x804a40c,(%esp)804918c: e8 6f f6 ff ff call 8048800 <puts@plt>8049191: c7 04 24 08 00 00 00 movl $0x8,(%esp)8049198: e8 a3 f6 ff ff call 8048840 <exit@plt>0804919d <read_line>:804919d: 83 ec 2c sub $0x2c,%esp80491a0: 89 5c 24 20 mov %ebx,0x20(%esp)80491a4: 89 74 24 24 mov %esi,0x24(%esp)80491a8: 89 7c 24 28 mov %edi,0x28(%esp)80491ac: e8 7f ff ff ff call 8049130 <skip>80491b1: 85 c0 test %eax,%eax80491b3: 75 6c jne 8049221 <read_line+0x84>80491b5: a1 a4 c3 04 08 mov 0x804c3a4,%eax80491ba: 39 05 d0 c3 04 08 cmp %eax,0x804c3d080491c0: 75 18 jne 80491da <read_line+0x3d>80491c2: c7 04 24 23 a4 04 08 movl $0x804a423,(%esp)80491c9: e8 32 f6 ff ff call 8048800 <puts@plt>80491ce: c7 04 24 08 00 00 00 movl $0x8,(%esp)80491d5: e8 66 f6 ff ff call 8048840 <exit@plt>80491da: c7 04 24 41 a4 04 08 movl $0x804a441,(%esp)80491e1: e8 0a f6 ff ff call 80487f0 <getenv@plt>80491e6: 85 c0 test %eax,%eax80491e8: 74 0c je 80491f6 <read_line+0x59>80491ea: c7 04 24 00 00 00 00 movl $0x0,(%esp)80491f1: e8 4a f6 ff ff call 8048840 <exit@plt>80491f6: a1 a4 c3 04 08 mov 0x804c3a4,%eax80491fb: a3 d0 c3 04 08 mov %eax,0x804c3d08049200: e8 2b ff ff ff call 8049130 <skip>8049205: 85 c0 test %eax,%eax8049207: 75 18 jne 8049221 <read_line+0x84>8049209: c7 04 24 23 a4 04 08 movl $0x804a423,(%esp)8049210: e8 eb f5 ff ff call 8048800 <puts@plt>8049215: c7 04 24 00 00 00 00 movl $0x0,(%esp)804921c: e8 1f f6 ff ff call 8048840 <exit@plt>8049221: 8b 15 cc c3 04 08 mov 0x804c3cc,%edx8049227: 8d 1c 92 lea (%edx,%edx,4),%ebx804922a: c1 e3 04 shl $0x4,%ebx804922d: 81 c3 e0 c3 04 08 add $0x804c3e0,%ebx8049233: 89 df mov %ebx,%edi8049235: b8 00 00 00 00 mov $0x0,%eax804923a: b9 ff ff ff ff mov $0xffffffff,%ecx804923f: f2 ae repnz scas %es:(%edi),%al8049241: f7 d1 not %ecx8049243: 83 e9 01 sub $0x1,%ecx8049246: 83 f9 4e cmp $0x4e,%ecx8049249: 7e 37 jle 8049282 <read_line+0xe5>804924b: c7 04 24 4c a4 04 08 movl $0x804a44c,(%esp)8049252: e8 a9 f5 ff ff call 8048800 <puts@plt>8049257: a1 cc c3 04 08 mov 0x804c3cc,%eax804925c: 8d 50 01 lea 0x1(%eax),%edx804925f: 89 15 cc c3 04 08 mov %edx,0x804c3cc8049265: 6b c0 50 imul $0x50,%eax,%eax8049268: 05 e0 c3 04 08 add $0x804c3e0,%eax804926d: ba 67 a4 04 08 mov $0x804a467,%edx8049272: b9 04 00 00 00 mov $0x4,%ecx8049277: 89 c7 mov %eax,%edi8049279: 89 d6 mov %edx,%esi804927b: f3 a5 rep movsl %ds:(%esi),%es:(%edi)804927d: e8 f4 fe ff ff call 8049176 <explode_bomb>8049282: 8d 04 92 lea (%edx,%edx,4),%eax8049285: c1 e0 04 shl $0x4,%eax8049288: c6 84 01 df c3 04 08 movb $0x0,0x804c3df(%ecx,%eax,1)804928f: 008049290: 83 c2 01 add $0x1,%edx8049293: 89 15 cc c3 04 08 mov %edx,0x804c3cc8049299: 89 d8 mov %ebx,%eax804929b: 8b 5c 24 20 mov 0x20(%esp),%ebx804929f: 8b 74 24 24 mov 0x24(%esp),%esi80492a3: 8b 7c 24 28 mov 0x28(%esp),%edi80492a7: 83 c4 2c add $0x2c,%esp80492aa: c3 ret080492ab <read_six_numbers>:80492ab: 83 ec 2c sub $0x2c,%esp80492ae: 8b 44 24 34 mov 0x34(%esp),%eax80492b2: 8d 50 14 lea 0x14(%eax),%edx80492b5: 89 54 24 1c mov %edx,0x1c(%esp)80492b9: 8d 50 10 lea 0x10(%eax),%edx80492bc: 89 54 24 18 mov %edx,0x18(%esp)80492c0: 8d 50 0c lea 0xc(%eax),%edx80492c3: 89 54 24 14 mov %edx,0x14(%esp)80492c7: 8d 50 08 lea 0x8(%eax),%edx80492ca: 89 54 24 10 mov %edx,0x10(%esp)80492ce: 8d 50 04 lea 0x4(%eax),%edx80492d1: 89 54 24 0c mov %edx,0xc(%esp)80492d5: 89 44 24 08 mov %eax,0x8(%esp)80492d9: c7 44 24 04 77 a4 04 movl $0x804a477,0x4(%esp)80492e0: 0880492e1: 8b 44 24 30 mov 0x30(%esp),%eax80492e5: 89 04 24 mov %eax,(%esp)80492e8: e8 83 f5 ff ff call 8048870 <__isoc99_sscanf@plt>80492ed: 83 f8 05 cmp $0x5,%eax80492f0: 7f 05 jg 80492f7 <read_six_numbers+0x4c>80492f2: e8 7f fe ff ff call 8049176 <explode_bomb>80492f7: 83 c4 2c add $0x2c,%esp80492fa: c3 ret080492fb <phase_defused>:80492fb: 81 ec 8c 00 00 00 sub $0x8c,%esp8049301: 65 a1 14 00 00 00 mov %gs:0x14,%eax8049307: 89 44 24 7c mov %eax,0x7c(%esp)804930b: 31 c0 xor %eax,%eax804930d: 83 3d cc c3 04 08 06 cmpl $0x6,0x804c3cc8049314: 75 72 jne 8049388 <phase_defused+0x8d> #若前6关都通过则进入，否则自动跳出8049316: 8d 44 24 2c lea 0x2c(%esp),%eax804931a: 89 44 24 10 mov %eax,0x10(%esp)804931e: 8d 44 24 28 lea 0x28(%esp),%eax8049322: 89 44 24 0c mov %eax,0xc(%esp)8049326: 8d 44 24 24 lea 0x24(%esp),%eax804932a: 89 44 24 08 mov %eax,0x8(%esp)804932e: c7 44 24 04 89 a4 04 movl $0x804a489,0x4(%esp) #"%d %d %s"，即两个数字后还要输入字符串8049335: 088049336: c7 04 24 d0 c4 04 08 movl $0x804c4d0,(%esp)804933d: e8 2e f5 ff ff call 8048870 <__isoc99_sscanf@plt> #第四关中同样出现了此段调用8049342: 83 f8 03 cmp $0x3,%eax8049345: 75 35 jne 804937c <phase_defused+0x81> #若第四关中输入个数不是3个，不触发8049347: c7 44 24 04 92 a4 04 movl $0x804a492,0x4(%esp) #第二个参数"DrEvil"804934e: 08804934f: 8d 44 24 2c lea 0x2c(%esp),%eax #第一个参数8049353: 89 04 24 mov %eax,(%esp)8049356: e8 09 fd ff ff call 8049064 <strings_not_equal> #比较密码是否相等（重点关注）804935b: 85 c0 test %eax,%eax804935d: 75 1d jne 804937c <phase_defused+0x81> #若第四关中输入的密码错误，不触发804935f: c7 04 24 58 a3 04 08 movl $0x804a358,(%esp)8049366: e8 95 f4 ff ff call 8048800 <puts@plt>804936b: c7 04 24 80 a3 04 08 movl $0x804a380,(%esp)8049372: e8 89 f4 ff ff call 8048800 <puts@plt> #这一段是输出"找到隐藏关"的记录8049377: e8 df fb ff ff call 8048f5b <secret_phase> #进入隐藏关804937c: c7 04 24 b8 a3 04 08 movl $0x804a3b8,(%esp) #输出通过（未触发隐藏关）8049383: e8 78 f4 ff ff call 8048800 <puts@plt>8049388: 8b 44 24 7c mov 0x7c(%esp),%eax804938c: 65 33 05 14 00 00 00 xor %gs:0x14,%eax8049393: 74 05 je 804939a <phase_defused+0x9f>8049395: e8 36 f4 ff ff call 80487d0 <__stack_chk_fail@plt>804939a: 81 c4 8c 00 00 00 add $0x8c,%esp80493a0: c3 ret80493a1: 90 nop80493a2: 90 nop80493a3: 90 nop80493a4: 90 nop80493a5: 90 nop80493a6: 90 nop80493a7: 90 nop80493a8: 90 nop80493a9: 90 nop80493aa: 90 nop80493ab: 90 nop80493ac: 90 nop80493ad: 90 nop80493ae: 90 nop80493af: 90 nop080493b0 <rio_readlineb>:80493b0: 55 push %ebp80493b1: 57 push %edi80493b2: 56 push %esi80493b3: 53 push %ebx80493b4: 83 ec 3c sub $0x3c,%esp80493b7: 89 c3 mov %eax,%ebx80493b9: 83 f9 01 cmp $0x1,%ecx80493bc: 0f 86 bb 00 00 00 jbe 804947d <rio_readlineb+0xcd>80493c2: 89 4c 24 1c mov %ecx,0x1c(%esp)80493c6: 89 54 24 18 mov %edx,0x18(%esp)80493ca: bd 01 00 00 00 mov $0x1,%ebp80493cf: 8d 78 0c lea 0xc(%eax),%edi80493d2: eb 3c jmp 8049410 <rio_readlineb+0x60>80493d4: c7 44 24 08 00 20 00 movl $0x2000,0x8(%esp)80493db: 0080493dc: 89 7c 24 04 mov %edi,0x4(%esp)80493e0: 8b 03 mov (%ebx),%eax80493e2: 89 04 24 mov %eax,(%esp)80493e5: e8 86 f3 ff ff call 8048770 <read@plt>80493ea: 89 43 04 mov %eax,0x4(%ebx)80493ed: 85 c0 test %eax,%eax80493ef: 79 14 jns 8049405 <rio_readlineb+0x55>80493f1: e8 9a f4 ff ff call 8048890 <__errno_location@plt>80493f6: 83 38 04 cmpl $0x4,(%eax)80493f9: 74 15 je 8049410 <rio_readlineb+0x60>80493fb: 90 nop80493fc: 8d 74 26 00 lea 0x0(%esi,%eiz,1),%esi8049400: e9 a0 00 00 00 jmp 80494a5 <rio_readlineb+0xf5>8049405: 85 c0 test %eax,%eax8049407: 0f 84 9f 00 00 00 je 80494ac <rio_readlineb+0xfc>804940d: 89 7b 08 mov %edi,0x8(%ebx)8049410: 8b 73 04 mov 0x4(%ebx),%esi8049413: 85 f6 test %esi,%esi8049415: 7e bd jle 80493d4 <rio_readlineb+0x24>8049417: 85 f6 test %esi,%esi8049419: 0f 85 96 00 00 00 jne 80494b5 <rio_readlineb+0x105>804941f: c7 44 24 0c 01 00 00 movl $0x1,0xc(%esp)8049426: 008049427: 89 74 24 08 mov %esi,0x8(%esp)804942b: 8b 43 08 mov 0x8(%ebx),%eax804942e: 89 44 24 04 mov %eax,0x4(%esp)8049432: 8d 44 24 2f lea 0x2f(%esp),%eax8049436: 89 04 24 mov %eax,(%esp)8049439: e8 e2 f3 ff ff call 8048820 <__memcpy_chk@plt>804943e: 01 73 08 add %esi,0x8(%ebx)8049441: 29 73 04 sub %esi,0x4(%ebx)8049444: 83 fe 01 cmp $0x1,%esi8049447: 75 18 jne 8049461 <rio_readlineb+0xb1>8049449: 0f b6 44 24 2f movzbl 0x2f(%esp),%eax804944e: 8b 54 24 18 mov 0x18(%esp),%edx8049452: 88 02 mov %al,(%edx)8049454: 83 c2 01 add $0x1,%edx8049457: 89 54 24 18 mov %edx,0x18(%esp)804945b: 3c 0a cmp $0xa,%al804945d: 75 13 jne 8049472 <rio_readlineb+0xc2>804945f: eb 25 jmp 8049486 <rio_readlineb+0xd6>8049461: 89 e8 mov %ebp,%eax8049463: 85 f6 test %esi,%esi8049465: 75 28 jne 804948f <rio_readlineb+0xdf>8049467: 83 f8 01 cmp $0x1,%eax804946a: 75 1a jne 8049486 <rio_readlineb+0xd6>804946c: 8d 74 26 00 lea 0x0(%esi,%eiz,1),%esi8049470: eb 24 jmp 8049496 <rio_readlineb+0xe6>8049472: 83 c5 01 add $0x1,%ebp8049475: 3b 6c 24 1c cmp 0x1c(%esp),%ebp8049479: 75 95 jne 8049410 <rio_readlineb+0x60>804947b: eb 09 jmp 8049486 <rio_readlineb+0xd6>804947d: 89 54 24 18 mov %edx,0x18(%esp)8049481: bd 01 00 00 00 mov $0x1,%ebp8049486: 8b 44 24 18 mov 0x18(%esp),%eax804948a: c6 00 00 movb $0x0,(%eax)804948d: eb 0c jmp 804949b <rio_readlineb+0xeb>804948f: bd ff ff ff ff mov $0xffffffff,%ebp8049494: eb 05 jmp 804949b <rio_readlineb+0xeb>8049496: bd 00 00 00 00 mov $0x0,%ebp804949b: 89 e8 mov %ebp,%eax804949d: 83 c4 3c add $0x3c,%esp80494a0: 5b pop %ebx80494a1: 5e pop %esi80494a2: 5f pop %edi80494a3: 5d pop %ebp80494a4: c3 ret80494a5: be ff ff ff ff mov $0xffffffff,%esi80494aa: eb 05 jmp 80494b1 <rio_readlineb+0x101>80494ac: be 00 00 00 00 mov $0x0,%esi80494b1: 89 e8 mov %ebp,%eax80494b3: eb ae jmp 8049463 <rio_readlineb+0xb3>80494b5: 8b 43 08 mov 0x8(%ebx),%eax80494b8: 0f b6 00 movzbl (%eax),%eax80494bb: 88 44 24 2f mov %al,0x2f(%esp)80494bf: 83 43 08 01 addl $0x1,0x8(%ebx)80494c3: 83 6b 04 01 subl $0x1,0x4(%ebx)80494c7: eb 80 jmp 8049449 <rio_readlineb+0x99>080494c9 <sigalrm_handler>:80494c9: 83 ec 1c sub $0x1c,%esp80494cc: c7 44 24 0c 00 00 00 movl $0x0,0xc(%esp)80494d3: 0080494d4: c7 44 24 08 b0 a4 04 movl $0x804a4b0,0x8(%esp)80494db: 0880494dc: c7 44 24 04 01 00 00 movl $0x1,0x4(%esp)80494e3: 0080494e4: a1 a0 c3 04 08 mov 0x804c3a0,%eax80494e9: 89 04 24 mov %eax,(%esp)80494ec: e8 cf f3 ff ff call 80488c0 <__fprintf_chk@plt>80494f1: c7 04 24 01 00 00 00 movl $0x1,(%esp)80494f8: e8 43 f3 ff ff call 8048840 <exit@plt>080494fd <submitr>:80494fd: 55 push %ebp80494fe: 57 push %edi80494ff: 56 push %esi8049500: 53 push %ebx8049501: 81 ec 7c a0 00 00 sub $0xa07c,%esp8049507: 8b 9c 24 90 a0 00 00 mov 0xa090(%esp),%ebx804950e: 8b 84 24 98 a0 00 00 mov 0xa098(%esp),%eax8049515: 89 44 24 30 mov %eax,0x30(%esp)8049519: 8b 94 24 9c a0 00 00 mov 0xa09c(%esp),%edx8049520: 89 54 24 34 mov %edx,0x34(%esp)8049524: 8b 8c 24 a0 a0 00 00 mov 0xa0a0(%esp),%ecx804952b: 89 4c 24 38 mov %ecx,0x38(%esp)804952f: 8b ac 24 a4 a0 00 00 mov 0xa0a4(%esp),%ebp8049536: 8b 84 24 a8 a0 00 00 mov 0xa0a8(%esp),%eax804953d: 89 44 24 28 mov %eax,0x28(%esp)8049541: 65 8b 15 14 00 00 00 mov %gs:0x14,%edx8049548: 89 94 24 6c a0 00 00 mov %edx,0xa06c(%esp)804954f: 31 d2 xor %edx,%edx8049551: c7 44 24 44 00 00 00 movl $0x0,0x44(%esp)8049558: 008049559: c7 44 24 08 00 00 00 movl $0x0,0x8(%esp)8049560: 008049561: c7 44 24 04 01 00 00 movl $0x1,0x4(%esp)8049568: 008049569: c7 04 24 02 00 00 00 movl $0x2,(%esp)8049570: e8 3b f3 ff ff call 80488b0 <socket@plt>8049575: 89 44 24 2c mov %eax,0x2c(%esp)8049579: 85 c0 test %eax,%eax804957b: 79 52 jns 80495cf <submitr+0xd2>804957d: 8b 4c 24 28 mov 0x28(%esp),%ecx8049581: c7 01 45 72 72 6f movl $0x6f727245,(%ecx)8049587: c7 41 04 72 3a 20 43 movl $0x43203a72,0x4(%ecx)804958e: c7 41 08 6c 69 65 6e movl $0x6e65696c,0x8(%ecx)8049595: c7 41 0c 74 20 75 6e movl $0x6e752074,0xc(%ecx)804959c: c7 41 10 61 62 6c 65 movl $0x656c6261,0x10(%ecx)80495a3: c7 41 14 20 74 6f 20 movl $0x206f7420,0x14(%ecx)80495aa: c7 41 18 63 72 65 61 movl $0x61657263,0x18(%ecx)80495b1: c7 41 1c 74 65 20 73 movl $0x73206574,0x1c(%ecx)80495b8: c7 41 20 6f 63 6b 65 movl $0x656b636f,0x20(%ecx)80495bf: 66 c7 41 24 74 00 movw $0x74,0x24(%ecx)80495c5: b8 ff ff ff ff mov $0xffffffff,%eax80495ca: e9 e8 06 00 00 jmp 8049cb7 <submitr+0x7ba>80495cf: 89 1c 24 mov %ebx,(%esp)80495d2: e8 f9 f2 ff ff call 80488d0 <gethostbyname@plt>80495d7: 85 c0 test %eax,%eax80495d9: 75 70 jne 804964b <submitr+0x14e>80495db: 8b 44 24 28 mov 0x28(%esp),%eax80495df: c7 00 45 72 72 6f movl $0x6f727245,(%eax)80495e5: c7 40 04 72 3a 20 44 movl $0x44203a72,0x4(%eax)80495ec: c7 40 08 4e 53 20 69 movl $0x6920534e,0x8(%eax)80495f3: c7 40 0c 73 20 75 6e movl $0x6e752073,0xc(%eax)80495fa: c7 40 10 61 62 6c 65 movl $0x656c6261,0x10(%eax)8049601: c7 40 14 20 74 6f 20 movl $0x206f7420,0x14(%eax)8049608: c7 40 18 72 65 73 6f movl $0x6f736572,0x18(%eax)804960f: c7 40 1c 6c 76 65 20 movl $0x2065766c,0x1c(%eax)8049616: c7 40 20 73 65 72 76 movl $0x76726573,0x20(%eax)804961d: c7 40 24 65 72 20 61 movl $0x61207265,0x24(%eax)8049624: c7 40 28 64 64 72 65 movl $0x65726464,0x28(%eax)804962b: 66 c7 40 2c 73 73 movw $0x7373,0x2c(%eax)8049631: c6 40 2e 00 movb $0x0,0x2e(%eax)8049635: 8b 44 24 2c mov 0x2c(%esp),%eax8049639: 89 04 24 mov %eax,(%esp)804963c: e8 bf f2 ff ff call 8048900 <close@plt>8049641: b8 ff ff ff ff mov $0xffffffff,%eax8049646: e9 6c 06 00 00 jmp 8049cb7 <submitr+0x7ba>804964b: 8d 9c 24 54 a0 00 00 lea 0xa054(%esp),%ebx8049652: c7 84 24 54 a0 00 00 movl $0x0,0xa054(%esp)8049659: 00 00 00 00804965d: c7 84 24 58 a0 00 00 movl $0x0,0xa058(%esp)8049664: 00 00 00 008049668: c7 84 24 5c a0 00 00 movl $0x0,0xa05c(%esp)804966f: 00 00 00 008049673: c7 84 24 60 a0 00 00 movl $0x0,0xa060(%esp)804967a: 00 00 00 00804967e: 66 c7 84 24 54 a0 00 movw $0x2,0xa054(%esp)8049685: 00 02 008049688: c7 44 24 0c 0c 00 00 movl $0xc,0xc(%esp)804968f: 008049690: 8b 50 0c mov 0xc(%eax),%edx8049693: 89 54 24 08 mov %edx,0x8(%esp)8049697: 8b 40 10 mov 0x10(%eax),%eax804969a: 8b 00 mov (%eax),%eax804969c: 89 44 24 04 mov %eax,0x4(%esp)80496a0: 8d 84 24 58 a0 00 00 lea 0xa058(%esp),%eax80496a7: 89 04 24 mov %eax,(%esp)80496aa: e8 61 f1 ff ff call 8048810 <__memmove_chk@plt>80496af: 0f b7 84 24 94 a0 00 movzwl 0xa094(%esp),%eax80496b6: 0080496b7: 66 c1 c8 08 ror $0x8,%ax80496bb: 66 89 84 24 56 a0 00 mov %ax,0xa056(%esp)80496c2: 0080496c3: c7 44 24 08 10 00 00 movl $0x10,0x8(%esp)80496ca: 0080496cb: 89 5c 24 04 mov %ebx,0x4(%esp)80496cf: 8b 44 24 2c mov 0x2c(%esp),%eax80496d3: 89 04 24 mov %eax,(%esp)80496d6: e8 15 f2 ff ff call 80488f0 <connect@plt>80496db: 85 c0 test %eax,%eax80496dd: 79 62 jns 8049741 <submitr+0x244>80496df: 8b 54 24 28 mov 0x28(%esp),%edx80496e3: c7 02 45 72 72 6f movl $0x6f727245,(%edx)80496e9: c7 42 04 72 3a 20 55 movl $0x55203a72,0x4(%edx)80496f0: c7 42 08 6e 61 62 6c movl $0x6c62616e,0x8(%edx)80496f7: c7 42 0c 65 20 74 6f movl $0x6f742065,0xc(%edx)80496fe: c7 42 10 20 63 6f 6e movl $0x6e6f6320,0x10(%edx)8049705: c7 42 14 6e 65 63 74 movl $0x7463656e,0x14(%edx)804970c: c7 42 18 20 74 6f 20 movl $0x206f7420,0x18(%edx)8049713: c7 42 1c 74 68 65 20 movl $0x20656874,0x1c(%edx)804971a: c7 42 20 73 65 72 76 movl $0x76726573,0x20(%edx)8049721: 66 c7 42 24 65 72 movw $0x7265,0x24(%edx)8049727: c6 42 26 00 movb $0x0,0x26(%edx)804972b: 8b 44 24 2c mov 0x2c(%esp),%eax804972f: 89 04 24 mov %eax,(%esp)8049732: e8 c9 f1 ff ff call 8048900 <close@plt>8049737: b8 ff ff ff ff mov $0xffffffff,%eax804973c: e9 76 05 00 00 jmp 8049cb7 <submitr+0x7ba>8049741: ba ff ff ff ff mov $0xffffffff,%edx8049746: 89 ef mov %ebp,%edi8049748: b8 00 00 00 00 mov $0x0,%eax804974d: 89 d1 mov %edx,%ecx804974f: f2 ae repnz scas %es:(%edi),%al8049751: 89 cb mov %ecx,%ebx8049753: f7 d3 not %ebx8049755: 8b 7c 24 30 mov 0x30(%esp),%edi8049759: 89 d1 mov %edx,%ecx804975b: f2 ae repnz scas %es:(%edi),%al804975d: 89 4c 24 3c mov %ecx,0x3c(%esp)8049761: 8b 7c 24 34 mov 0x34(%esp),%edi8049765: 89 d1 mov %edx,%ecx8049767: f2 ae repnz scas %es:(%edi),%al8049769: 89 ce mov %ecx,%esi804976b: f7 d6 not %esi804976d: 8b 7c 24 38 mov 0x38(%esp),%edi8049771: 89 d1 mov %edx,%ecx8049773: f2 ae repnz scas %es:(%edi),%al8049775: 2b 74 24 3c sub 0x3c(%esp),%esi8049779: 29 ce sub %ecx,%esi804977b: 8d 44 5b fd lea -0x3(%ebx,%ebx,2),%eax804977f: 8d 44 06 7b lea 0x7b(%esi,%eax,1),%eax8049783: 3d 00 20 00 00 cmp $0x2000,%eax8049788: 76 7b jbe 8049805 <submitr+0x308>804978a: 8b 44 24 28 mov 0x28(%esp),%eax804978e: c7 00 45 72 72 6f movl $0x6f727245,(%eax)8049794: c7 40 04 72 3a 20 52 movl $0x52203a72,0x4(%eax)804979b: c7 40 08 65 73 75 6c movl $0x6c757365,0x8(%eax)80497a2: c7 40 0c 74 20 73 74 movl $0x74732074,0xc(%eax)80497a9: c7 40 10 72 69 6e 67 movl $0x676e6972,0x10(%eax)80497b0: c7 40 14 20 74 6f 6f movl $0x6f6f7420,0x14(%eax)80497b7: c7 40 18 20 6c 61 72 movl $0x72616c20,0x18(%eax)80497be: c7 40 1c 67 65 2e 20 movl $0x202e6567,0x1c(%eax)80497c5: c7 40 20 49 6e 63 72 movl $0x72636e49,0x20(%eax)80497cc: c7 40 24 65 61 73 65 movl $0x65736165,0x24(%eax)80497d3: c7 40 28 20 53 55 42 movl $0x42555320,0x28(%eax)80497da: c7 40 2c 4d 49 54 52 movl $0x5254494d,0x2c(%eax)80497e1: c7 40 30 5f 4d 41 58 movl $0x58414d5f,0x30(%eax)80497e8: c7 40 34 42 55 46 00 movl $0x465542,0x34(%eax)80497ef: 8b 44 24 2c mov 0x2c(%esp),%eax80497f3: 89 04 24 mov %eax,(%esp)80497f6: e8 05 f1 ff ff call 8048900 <close@plt>80497fb: b8 ff ff ff ff mov $0xffffffff,%eax8049800: e9 b2 04 00 00 jmp 8049cb7 <submitr+0x7ba>8049805: 8d 94 24 54 40 00 00 lea 0x4054(%esp),%edx804980c: b9 00 08 00 00 mov $0x800,%ecx8049811: b8 00 00 00 00 mov $0x0,%eax8049816: 89 d7 mov %edx,%edi8049818: f3 ab rep stos %eax,%es:(%edi)804981a: 89 ef mov %ebp,%edi804981c: b9 ff ff ff ff mov $0xffffffff,%ecx8049821: f2 ae repnz scas %es:(%edi),%al8049823: f7 d1 not %ecx8049825: 89 ce mov %ecx,%esi8049827: 83 ee 01 sub $0x1,%esi804982a: 0f 84 99 04 00 00 je 8049cc9 <submitr+0x7cc>8049830: 89 d3 mov %edx,%ebx8049832: 0f b6 45 00 movzbl 0x0(%ebp),%eax8049836: 3c 2a cmp $0x2a,%al8049838: 74 24 je 804985e <submitr+0x361>804983a: 3c 2d cmp $0x2d,%al804983c: 74 20 je 804985e <submitr+0x361>804983e: 3c 2e cmp $0x2e,%al8049840: 74 1c je 804985e <submitr+0x361>8049842: 3c 5f cmp $0x5f,%al8049844: 74 18 je 804985e <submitr+0x361>8049846: 8d 50 d0 lea -0x30(%eax),%edx8049849: 80 fa 09 cmp $0x9,%dl804984c: 76 10 jbe 804985e <submitr+0x361>804984e: 8d 50 bf lea -0x41(%eax),%edx8049851: 80 fa 19 cmp $0x19,%dl8049854: 76 08 jbe 804985e <submitr+0x361>8049856: 8d 50 9f lea -0x61(%eax),%edx8049859: 80 fa 19 cmp $0x19,%dl804985c: 77 07 ja 8049865 <submitr+0x368>804985e: 88 03 mov %al,(%ebx)8049860: 83 c3 01 add $0x1,%ebx8049863: eb 69 jmp 80498ce <submitr+0x3d1>8049865: 3c 20 cmp $0x20,%al8049867: 75 08 jne 8049871 <submitr+0x374>8049869: c6 03 2b movb $0x2b,(%ebx)804986c: 83 c3 01 add $0x1,%ebx804986f: eb 5d jmp 80498ce <submitr+0x3d1>8049871: 8d 50 e0 lea -0x20(%eax),%edx8049874: 80 fa 5f cmp $0x5f,%dl8049877: 76 04 jbe 804987d <submitr+0x380>8049879: 3c 09 cmp $0x9,%al804987b: 75 62 jne 80498df <submitr+0x3e2>804987d: 0f b6 c0 movzbl %al,%eax8049880: 89 44 24 10 mov %eax,0x10(%esp)8049884: c7 44 24 0c bc a5 04 movl $0x804a5bc,0xc(%esp)804988b: 08804988c: c7 44 24 08 08 00 00 movl $0x8,0x8(%esp)8049893: 008049894: c7 44 24 04 01 00 00 movl $0x1,0x4(%esp)804989b: 00804989c: 8d 94 24 64 a0 00 00 lea 0xa064(%esp),%edx80498a3: 89 14 24 mov %edx,(%esp)80498a6: e8 75 f0 ff ff call 8048920 <__sprintf_chk@plt>80498ab: 0f b6 84 24 64 a0 00 movzbl 0xa064(%esp),%eax80498b2: 0080498b3: 88 03 mov %al,(%ebx)80498b5: 0f b6 84 24 65 a0 00 movzbl 0xa065(%esp),%eax80498bc: 0080498bd: 88 43 01 mov %al,0x1(%ebx)80498c0: 0f b6 84 24 66 a0 00 movzbl 0xa066(%esp),%eax80498c7: 0080498c8: 88 43 02 mov %al,0x2(%ebx)80498cb: 83 c3 03 add $0x3,%ebx80498ce: 83 c5 01 add $0x1,%ebp80498d1: 83 ee 01 sub $0x1,%esi80498d4: 0f 85 58 ff ff ff jne 8049832 <submitr+0x335>80498da: e9 ea 03 00 00 jmp 8049cc9 <submitr+0x7cc>80498df: 8b 7c 24 28 mov 0x28(%esp),%edi80498e3: be d4 a4 04 08 mov $0x804a4d4,%esi80498e8: b8 43 00 00 00 mov $0x43,%eax80498ed: f7 c7 01 00 00 00 test $0x1,%edi80498f3: 74 1a je 804990f <submitr+0x412>80498f5: 0f b6 05 d4 a4 04 08 movzbl 0x804a4d4,%eax80498fc: 88 07 mov %al,(%edi)80498fe: 8b 7c 24 28 mov 0x28(%esp),%edi8049902: 83 c7 01 add $0x1,%edi8049905: be d5 a4 04 08 mov $0x804a4d5,%esi804990a: b8 42 00 00 00 mov $0x42,%eax804990f: f7 c7 02 00 00 00 test $0x2,%edi8049915: 74 0f je 8049926 <submitr+0x429>8049917: 0f b7 16 movzwl (%esi),%edx804991a: 66 89 17 mov %dx,(%edi)804991d: 83 c7 02 add $0x2,%edi8049920: 83 c6 02 add $0x2,%esi8049923: 83 e8 02 sub $0x2,%eax8049926: 89 c1 mov %eax,%ecx8049928: c1 e9 02 shr $0x2,%ecx804992b: f3 a5 rep movsl %ds:(%esi),%es:(%edi)804992d: ba 00 00 00 00 mov $0x0,%edx8049932: a8 02 test $0x2,%al8049934: 74 0b je 8049941 <submitr+0x444>8049936: 0f b7 16 movzwl (%esi),%edx8049939: 66 89 17 mov %dx,(%edi)804993c: ba 02 00 00 00 mov $0x2,%edx8049941: a8 01 test $0x1,%al8049943: 74 07 je 804994c <submitr+0x44f>8049945: 0f b6 04 16 movzbl (%esi,%edx,1),%eax8049949: 88 04 17 mov %al,(%edi,%edx,1)804994c: 8b 44 24 2c mov 0x2c(%esp),%eax8049950: 89 04 24 mov %eax,(%esp)8049953: e8 a8 ef ff ff call 8048900 <close@plt>8049958: b8 ff ff ff ff mov $0xffffffff,%eax804995d: e9 55 03 00 00 jmp 8049cb7 <submitr+0x7ba>8049962: 89 fd mov %edi,%ebp8049964: 8b 7c 24 2c mov 0x2c(%esp),%edi8049968: 89 5c 24 08 mov %ebx,0x8(%esp)804996c: 89 74 24 04 mov %esi,0x4(%esp)8049970: 89 3c 24 mov %edi,(%esp)8049973: e8 e8 ee ff ff call 8048860 <write@plt>8049978: 85 c0 test %eax,%eax804997a: 7f 0f jg 804998b <submitr+0x48e>804997c: e8 0f ef ff ff call 8048890 <__errno_location@plt>8049981: 83 38 04 cmpl $0x4,(%eax)8049984: 75 0f jne 8049995 <submitr+0x498>8049986: b8 00 00 00 00 mov $0x0,%eax804998b: 01 c6 add %eax,%esi804998d: 29 c3 sub %eax,%ebx804998f: 75 d7 jne 8049968 <submitr+0x46b>8049991: 85 ed test %ebp,%ebp8049993: 79 66 jns 80499fb <submitr+0x4fe>8049995: 8b 54 24 28 mov 0x28(%esp),%edx8049999: c7 02 45 72 72 6f movl $0x6f727245,(%edx)804999f: c7 42 04 72 3a 20 43 movl $0x43203a72,0x4(%edx)80499a6: c7 42 08 6c 69 65 6e movl $0x6e65696c,0x8(%edx)80499ad: c7 42 0c 74 20 75 6e movl $0x6e752074,0xc(%edx)80499b4: c7 42 10 61 62 6c 65 movl $0x656c6261,0x10(%edx)80499bb: c7 42 14 20 74 6f 20 movl $0x206f7420,0x14(%edx)80499c2: c7 42 18 77 72 69 74 movl $0x74697277,0x18(%edx)80499c9: c7 42 1c 65 20 74 6f movl $0x6f742065,0x1c(%edx)80499d0: c7 42 20 20 74 68 65 movl $0x65687420,0x20(%edx)80499d7: c7 42 24 20 73 65 72 movl $0x72657320,0x24(%edx)80499de: c7 42 28 76 65 72 00 movl $0x726576,0x28(%edx)80499e5: 8b 44 24 2c mov 0x2c(%esp),%eax80499e9: 89 04 24 mov %eax,(%esp)80499ec: e8 0f ef ff ff call 8048900 <close@plt>80499f1: b8 ff ff ff ff mov $0xffffffff,%eax80499f6: e9 bc 02 00 00 jmp 8049cb7 <submitr+0x7ba>80499fb: 8b 44 24 2c mov 0x2c(%esp),%eax80499ff: 89 44 24 48 mov %eax,0x48(%esp)8049a03: c7 44 24 4c 00 00 00 movl $0x0,0x4c(%esp)8049a0a: 008049a0b: 8d 44 24 54 lea 0x54(%esp),%eax8049a0f: 89 44 24 50 mov %eax,0x50(%esp)8049a13: b9 00 20 00 00 mov $0x2000,%ecx8049a18: 8d 94 24 54 20 00 00 lea 0x2054(%esp),%edx8049a1f: 8d 44 24 48 lea 0x48(%esp),%eax8049a23: e8 88 f9 ff ff call 80493b0 <rio_readlineb>8049a28: 85 c0 test %eax,%eax8049a2a: 7f 7a jg 8049aa6 <submitr+0x5a9>8049a2c: 8b 54 24 28 mov 0x28(%esp),%edx8049a30: c7 02 45 72 72 6f movl $0x6f727245,(%edx)8049a36: c7 42 04 72 3a 20 43 movl $0x43203a72,0x4(%edx)8049a3d: c7 42 08 6c 69 65 6e movl $0x6e65696c,0x8(%edx)8049a44: c7 42 0c 74 20 75 6e movl $0x6e752074,0xc(%edx)8049a4b: c7 42 10 61 62 6c 65 movl $0x656c6261,0x10(%edx)8049a52: c7 42 14 20 74 6f 20 movl $0x206f7420,0x14(%edx)8049a59: c7 42 18 72 65 61 64 movl $0x64616572,0x18(%edx)8049a60: c7 42 1c 20 66 69 72 movl $0x72696620,0x1c(%edx)8049a67: c7 42 20 73 74 20 68 movl $0x68207473,0x20(%edx)8049a6e: c7 42 24 65 61 64 65 movl $0x65646165,0x24(%edx)8049a75: c7 42 28 72 20 66 72 movl $0x72662072,0x28(%edx)8049a7c: c7 42 2c 6f 6d 20 73 movl $0x73206d6f,0x2c(%edx)8049a83: c7 42 30 65 72 76 65 movl $0x65767265,0x30(%edx)8049a8a: 66 c7 42 34 72 00 movw $0x72,0x34(%edx)8049a90: 8b 44 24 2c mov 0x2c(%esp),%eax8049a94: 89 04 24 mov %eax,(%esp)8049a97: e8 64 ee ff ff call 8048900 <close@plt>8049a9c: b8 ff ff ff ff mov $0xffffffff,%eax8049aa1: e9 11 02 00 00 jmp 8049cb7 <submitr+0x7ba>8049aa6: 8d 84 24 54 80 00 00 lea 0x8054(%esp),%eax8049aad: 89 44 24 10 mov %eax,0x10(%esp)8049ab1: 8d 44 24 44 lea 0x44(%esp),%eax8049ab5: 89 44 24 0c mov %eax,0xc(%esp)8049ab9: 8d 84 24 54 60 00 00 lea 0x6054(%esp),%eax8049ac0: 89 44 24 08 mov %eax,0x8(%esp)8049ac4: c7 44 24 04 c3 a5 04 movl $0x804a5c3,0x4(%esp)8049acb: 088049acc: 8d 84 24 54 20 00 00 lea 0x2054(%esp),%eax8049ad3: 89 04 24 mov %eax,(%esp)8049ad6: e8 95 ed ff ff call 8048870 <__isoc99_sscanf@plt>8049adb: 8b 44 24 44 mov 0x44(%esp),%eax8049adf: 3d c8 00 00 00 cmp $0xc8,%eax8049ae4: 0f 84 d3 00 00 00 je 8049bbd <submitr+0x6c0>8049aea: 8d 94 24 54 80 00 00 lea 0x8054(%esp),%edx8049af1: 89 54 24 14 mov %edx,0x14(%esp)8049af5: 89 44 24 10 mov %eax,0x10(%esp)8049af9: c7 44 24 0c 18 a5 04 movl $0x804a518,0xc(%esp)8049b00: 088049b01: c7 44 24 08 ff ff ff movl $0xffffffff,0x8(%esp)8049b08: ff8049b09: c7 44 24 04 01 00 00 movl $0x1,0x4(%esp)8049b10: 008049b11: 8b 54 24 28 mov 0x28(%esp),%edx8049b15: 89 14 24 mov %edx,(%esp)8049b18: e8 03 ee ff ff call 8048920 <__sprintf_chk@plt>8049b1d: 8b 44 24 2c mov 0x2c(%esp),%eax8049b21: 89 04 24 mov %eax,(%esp)8049b24: e8 d7 ed ff ff call 8048900 <close@plt>8049b29: b8 ff ff ff ff mov $0xffffffff,%eax8049b2e: e9 84 01 00 00 jmp 8049cb7 <submitr+0x7ba>8049b33: b9 00 20 00 00 mov $0x2000,%ecx8049b38: 8d 94 24 54 20 00 00 lea 0x2054(%esp),%edx8049b3f: 8d 44 24 48 lea 0x48(%esp),%eax8049b43: e8 68 f8 ff ff call 80493b0 <rio_readlineb>8049b48: 85 c0 test %eax,%eax8049b4a: 7f 71 jg 8049bbd <submitr+0x6c0>8049b4c: 8b 54 24 28 mov 0x28(%esp),%edx8049b50: c7 02 45 72 72 6f movl $0x6f727245,(%edx)8049b56: c7 42 04 72 3a 20 43 movl $0x43203a72,0x4(%edx)8049b5d: c7 42 08 6c 69 65 6e movl $0x6e65696c,0x8(%edx)8049b64: c7 42 0c 74 20 75 6e movl $0x6e752074,0xc(%edx)8049b6b: c7 42 10 61 62 6c 65 movl $0x656c6261,0x10(%edx)8049b72: c7 42 14 20 74 6f 20 movl $0x206f7420,0x14(%edx)8049b79: c7 42 18 72 65 61 64 movl $0x64616572,0x18(%edx)8049b80: c7 42 1c 20 68 65 61 movl $0x61656820,0x1c(%edx)8049b87: c7 42 20 64 65 72 73 movl $0x73726564,0x20(%edx)8049b8e: c7 42 24 20 66 72 6f movl $0x6f726620,0x24(%edx)8049b95: c7 42 28 6d 20 73 65 movl $0x6573206d,0x28(%edx)8049b9c: c7 42 2c 72 76 65 72 movl $0x72657672,0x2c(%edx)8049ba3: c6 42 30 00 movb $0x0,0x30(%edx)8049ba7: 8b 44 24 2c mov 0x2c(%esp),%eax8049bab: 89 04 24 mov %eax,(%esp)8049bae: e8 4d ed ff ff call 8048900 <close@plt>8049bb3: b8 ff ff ff ff mov $0xffffffff,%eax8049bb8: e9 fa 00 00 00 jmp 8049cb7 <submitr+0x7ba>8049bbd: 80 bc 24 54 20 00 00 cmpb $0xd,0x2054(%esp)8049bc4: 0d8049bc5: 0f 85 68 ff ff ff jne 8049b33 <submitr+0x636>8049bcb: 80 bc 24 55 20 00 00 cmpb $0xa,0x2055(%esp)8049bd2: 0a8049bd3: 0f 85 5a ff ff ff jne 8049b33 <submitr+0x636>8049bd9: 80 bc 24 56 20 00 00 cmpb $0x0,0x2056(%esp)8049be0: 008049be1: 0f 85 4c ff ff ff jne 8049b33 <submitr+0x636>8049be7: b9 00 20 00 00 mov $0x2000,%ecx8049bec: 8d 94 24 54 20 00 00 lea 0x2054(%esp),%edx8049bf3: 8d 44 24 48 lea 0x48(%esp),%eax8049bf7: e8 b4 f7 ff ff call 80493b0 <rio_readlineb>8049bfc: 85 c0 test %eax,%eax8049bfe: 7f 78 jg 8049c78 <submitr+0x77b>8049c00: 8b 54 24 28 mov 0x28(%esp),%edx8049c04: c7 02 45 72 72 6f movl $0x6f727245,(%edx)8049c0a: c7 42 04 72 3a 20 43 movl $0x43203a72,0x4(%edx)8049c11: c7 42 08 6c 69 65 6e movl $0x6e65696c,0x8(%edx)8049c18: c7 42 0c 74 20 75 6e movl $0x6e752074,0xc(%edx)8049c1f: c7 42 10 61 62 6c 65 movl $0x656c6261,0x10(%edx)8049c26: c7 42 14 20 74 6f 20 movl $0x206f7420,0x14(%edx)8049c2d: c7 42 18 72 65 61 64 movl $0x64616572,0x18(%edx)8049c34: c7 42 1c 20 73 74 61 movl $0x61747320,0x1c(%edx)8049c3b: c7 42 20 74 75 73 20 movl $0x20737574,0x20(%edx)8049c42: c7 42 24 6d 65 73 73 movl $0x7373656d,0x24(%edx)8049c49: c7 42 28 61 67 65 20 movl $0x20656761,0x28(%edx)8049c50: c7 42 2c 66 72 6f 6d movl $0x6d6f7266,0x2c(%edx)8049c57: c7 42 30 20 73 65 72 movl $0x72657320,0x30(%edx)8049c5e: c7 42 34 76 65 72 00 movl $0x726576,0x34(%edx)8049c65: 8b 44 24 2c mov 0x2c(%esp),%eax8049c69: 89 04 24 mov %eax,(%esp)8049c6c: e8 8f ec ff ff call 8048900 <close@plt>8049c71: b8 ff ff ff ff mov $0xffffffff,%eax8049c76: eb 3f jmp 8049cb7 <submitr+0x7ba>8049c78: 8d 84 24 54 20 00 00 lea 0x2054(%esp),%eax8049c7f: 89 44 24 04 mov %eax,0x4(%esp)8049c83: 8b 54 24 28 mov 0x28(%esp),%edx8049c87: 89 14 24 mov %edx,(%esp)8049c8a: e8 51 eb ff ff call 80487e0 <strcpy@plt>8049c8f: 8b 44 24 2c mov 0x2c(%esp),%eax8049c93: 89 04 24 mov %eax,(%esp)8049c96: e8 65 ec ff ff call 8048900 <close@plt>8049c9b: b8 ff ff ff ff mov $0xffffffff,%eax8049ca0: 8b 54 24 28 mov 0x28(%esp),%edx8049ca4: 80 3a 4f cmpb $0x4f,(%edx)8049ca7: 75 0e jne 8049cb7 <submitr+0x7ba>8049ca9: 80 7a 01 4b cmpb $0x4b,0x1(%edx)8049cad: 75 08 jne 8049cb7 <submitr+0x7ba>8049caf: 80 7a 02 01 cmpb $0x1,0x2(%edx)8049cb3: 19 c0 sbb %eax,%eax8049cb5: f7 d0 not %eax8049cb7: 8b 8c 24 6c a0 00 00 mov 0xa06c(%esp),%ecx8049cbe: 65 33 0d 14 00 00 00 xor %gs:0x14,%ecx8049cc5: 74 78 je 8049d3f <submitr+0x842>8049cc7: eb 71 jmp 8049d3a <submitr+0x83d>8049cc9: 8d 84 24 54 40 00 00 lea 0x4054(%esp),%eax8049cd0: 89 44 24 1c mov %eax,0x1c(%esp)8049cd4: 8b 44 24 38 mov 0x38(%esp),%eax8049cd8: 89 44 24 18 mov %eax,0x18(%esp)8049cdc: 8b 54 24 34 mov 0x34(%esp),%edx8049ce0: 89 54 24 14 mov %edx,0x14(%esp)8049ce4: 8b 4c 24 30 mov 0x30(%esp),%ecx8049ce8: 89 4c 24 10 mov %ecx,0x10(%esp)8049cec: c7 44 24 0c 48 a5 04 movl $0x804a548,0xc(%esp)8049cf3: 088049cf4: c7 44 24 08 00 20 00 movl $0x2000,0x8(%esp)8049cfb: 008049cfc: c7 44 24 04 01 00 00 movl $0x1,0x4(%esp)8049d03: 008049d04: 8d bc 24 54 20 00 00 lea 0x2054(%esp),%edi8049d0b: 89 3c 24 mov %edi,(%esp)8049d0e: e8 0d ec ff ff call 8048920 <__sprintf_chk@plt>8049d13: b8 00 00 00 00 mov $0x0,%eax8049d18: b9 ff ff ff ff mov $0xffffffff,%ecx8049d1d: f2 ae repnz scas %es:(%edi),%al8049d1f: f7 d1 not %ecx8049d21: 8d 79 ff lea -0x1(%ecx),%edi8049d24: 89 fb mov %edi,%ebx8049d26: 8d b4 24 54 20 00 00 lea 0x2054(%esp),%esi8049d2d: 85 ff test %edi,%edi8049d2f: 0f 85 2d fc ff ff jne 8049962 <submitr+0x465>8049d35: e9 c1 fc ff ff jmp 80499fb <submitr+0x4fe>8049d3a: e8 91 ea ff ff call 80487d0 <__stack_chk_fail@plt>8049d3f: 81 c4 7c a0 00 00 add $0xa07c,%esp8049d45: 5b pop %ebx8049d46: 5e pop %esi8049d47: 5f pop %edi8049d48: 5d pop %ebp8049d49: c3 ret08049d4a <init_timeout>:8049d4a: 53 push %ebx8049d4b: 83 ec 18 sub $0x18,%esp8049d4e: 8b 5c 24 20 mov 0x20(%esp),%ebx8049d52: 85 db test %ebx,%ebx8049d54: 74 26 je 8049d7c <init_timeout+0x32>8049d56: c7 44 24 04 c9 94 04 movl $0x80494c9,0x4(%esp)8049d5d: 088049d5e: c7 04 24 0e 00 00 00 movl $0xe,(%esp)8049d65: e8 36 ea ff ff call 80487a0 <signal@plt>8049d6a: 85 db test %ebx,%ebx8049d6c: b8 00 00 00 00 mov $0x0,%eax8049d71: 0f 48 d8 cmovs %eax,%ebx8049d74: 89 1c 24 mov %ebx,(%esp)8049d77: e8 44 ea ff ff call 80487c0 <alarm@plt>8049d7c: 83 c4 18 add $0x18,%esp8049d7f: 5b pop %ebx8049d80: c3 ret08049d81 <init_driver>:8049d81: 57 push %edi8049d82: 56 push %esi8049d83: 53 push %ebx8049d84: 83 ec 40 sub $0x40,%esp8049d87: 8b 74 24 50 mov 0x50(%esp),%esi8049d8b: 65 a1 14 00 00 00 mov %gs:0x14,%eax8049d91: 89 44 24 3c mov %eax,0x3c(%esp)8049d95: 31 c0 xor %eax,%eax8049d97: c7 44 24 04 01 00 00 movl $0x1,0x4(%esp)8049d9e: 008049d9f: c7 04 24 0d 00 00 00 movl $0xd,(%esp)8049da6: e8 f5 e9 ff ff call 80487a0 <signal@plt>8049dab: c7 44 24 04 01 00 00 movl $0x1,0x4(%esp)8049db2: 008049db3: c7 04 24 1d 00 00 00 movl $0x1d,(%esp)8049dba: e8 e1 e9 ff ff call 80487a0 <signal@plt>8049dbf: c7 44 24 04 01 00 00 movl $0x1,0x4(%esp)8049dc6: 008049dc7: c7 04 24 1d 00 00 00 movl $0x1d,(%esp)8049dce: e8 cd e9 ff ff call 80487a0 <signal@plt>8049dd3: c7 44 24 08 00 00 00 movl $0x0,0x8(%esp)8049dda: 008049ddb: c7 44 24 04 01 00 00 movl $0x1,0x4(%esp)8049de2: 008049de3: c7 04 24 02 00 00 00 movl $0x2,(%esp)8049dea: e8 c1 ea ff ff call 80488b0 <socket@plt>8049def: 89 c3 mov %eax,%ebx8049df1: 85 c0 test %eax,%eax8049df3: 79 4e jns 8049e43 <init_driver+0xc2>8049df5: c7 06 45 72 72 6f movl $0x6f727245,(%esi)8049dfb: c7 46 04 72 3a 20 43 movl $0x43203a72,0x4(%esi)8049e02: c7 46 08 6c 69 65 6e movl $0x6e65696c,0x8(%esi)8049e09: c7 46 0c 74 20 75 6e movl $0x6e752074,0xc(%esi)8049e10: c7 46 10 61 62 6c 65 movl $0x656c6261,0x10(%esi)8049e17: c7 46 14 20 74 6f 20 movl $0x206f7420,0x14(%esi)8049e1e: c7 46 18 63 72 65 61 movl $0x61657263,0x18(%esi)8049e25: c7 46 1c 74 65 20 73 movl $0x73206574,0x1c(%esi)8049e2c: c7 46 20 6f 63 6b 65 movl $0x656b636f,0x20(%esi)8049e33: 66 c7 46 24 74 00 movw $0x74,0x24(%esi)8049e39: b8 ff ff ff ff mov $0xffffffff,%eax8049e3e: e9 33 01 00 00 jmp 8049f76 <init_driver+0x1f5>8049e43: c7 04 24 d4 a5 04 08 movl $0x804a5d4,(%esp)8049e4a: e8 81 ea ff ff call 80488d0 <gethostbyname@plt>8049e4f: 85 c0 test %eax,%eax8049e51: 75 68 jne 8049ebb <init_driver+0x13a>8049e53: c7 06 45 72 72 6f movl $0x6f727245,(%esi)8049e59: c7 46 04 72 3a 20 44 movl $0x44203a72,0x4(%esi)8049e60: c7 46 08 4e 53 20 69 movl $0x6920534e,0x8(%esi)8049e67: c7 46 0c 73 20 75 6e movl $0x6e752073,0xc(%esi)8049e6e: c7 46 10 61 62 6c 65 movl $0x656c6261,0x10(%esi)8049e75: c7 46 14 20 74 6f 20 movl $0x206f7420,0x14(%esi)8049e7c: c7 46 18 72 65 73 6f movl $0x6f736572,0x18(%esi)8049e83: c7 46 1c 6c 76 65 20 movl $0x2065766c,0x1c(%esi)8049e8a: c7 46 20 73 65 72 76 movl $0x76726573,0x20(%esi)8049e91: c7 46 24 65 72 20 61 movl $0x61207265,0x24(%esi)8049e98: c7 46 28 64 64 72 65 movl $0x65726464,0x28(%esi)8049e9f: 66 c7 46 2c 73 73 movw $0x7373,0x2c(%esi)8049ea5: c6 46 2e 00 movb $0x0,0x2e(%esi)8049ea9: 89 1c 24 mov %ebx,(%esp)8049eac: e8 4f ea ff ff call 8048900 <close@plt>8049eb1: b8 ff ff ff ff mov $0xffffffff,%eax8049eb6: e9 bb 00 00 00 jmp 8049f76 <init_driver+0x1f5>8049ebb: 8d 7c 24 2c lea 0x2c(%esp),%edi8049ebf: c7 44 24 2c 00 00 00 movl $0x0,0x2c(%esp)8049ec6: 008049ec7: c7 44 24 30 00 00 00 movl $0x0,0x30(%esp)8049ece: 008049ecf: c7 44 24 34 00 00 00 movl $0x0,0x34(%esp)8049ed6: 008049ed7: c7 44 24 38 00 00 00 movl $0x0,0x38(%esp)8049ede: 008049edf: 66 c7 44 24 2c 02 00 movw $0x2,0x2c(%esp)8049ee6: c7 44 24 0c 0c 00 00 movl $0xc,0xc(%esp)8049eed: 008049eee: 8b 50 0c mov 0xc(%eax),%edx8049ef1: 89 54 24 08 mov %edx,0x8(%esp)8049ef5: 8b 40 10 mov 0x10(%eax),%eax8049ef8: 8b 00 mov (%eax),%eax8049efa: 89 44 24 04 mov %eax,0x4(%esp)8049efe: 8d 44 24 30 lea 0x30(%esp),%eax8049f02: 89 04 24 mov %eax,(%esp)8049f05: e8 06 e9 ff ff call 8048810 <__memmove_chk@plt>8049f0a: 66 c7 44 24 2e 3b 6e movw $0x6e3b,0x2e(%esp)8049f11: c7 44 24 08 10 00 00 movl $0x10,0x8(%esp)8049f18: 008049f19: 89 7c 24 04 mov %edi,0x4(%esp)8049f1d: 89 1c 24 mov %ebx,(%esp)8049f20: e8 cb e9 ff ff call 80488f0 <connect@plt>8049f25: 85 c0 test %eax,%eax8049f27: 79 37 jns 8049f60 <init_driver+0x1df>8049f29: c7 44 24 10 d4 a5 04 movl $0x804a5d4,0x10(%esp)8049f30: 088049f31: c7 44 24 0c 94 a5 04 movl $0x804a594,0xc(%esp)8049f38: 088049f39: c7 44 24 08 ff ff ff movl $0xffffffff,0x8(%esp)8049f40: ff8049f41: c7 44 24 04 01 00 00 movl $0x1,0x4(%esp)8049f48: 008049f49: 89 34 24 mov %esi,(%esp)8049f4c: e8 cf e9 ff ff call 8048920 <__sprintf_chk@plt>8049f51: 89 1c 24 mov %ebx,(%esp)8049f54: e8 a7 e9 ff ff call 8048900 <close@plt>8049f59: b8 ff ff ff ff mov $0xffffffff,%eax8049f5e: eb 16 jmp 8049f76 <init_driver+0x1f5>8049f60: 89 1c 24 mov %ebx,(%esp)8049f63: e8 98 e9 ff ff call 8048900 <close@plt>8049f68: 66 c7 06 4f 4b movw $0x4b4f,(%esi)8049f6d: c6 46 02 00 movb $0x0,0x2(%esi)8049f71: b8 00 00 00 00 mov $0x0,%eax8049f76: 8b 54 24 3c mov 0x3c(%esp),%edx8049f7a: 65 33 15 14 00 00 00 xor %gs:0x14,%edx8049f81: 74 05 je 8049f88 <init_driver+0x207>8049f83: e8 48 e8 ff ff call 80487d0 <__stack_chk_fail@plt>8049f88: 83 c4 40 add $0x40,%esp8049f8b: 5b pop %ebx8049f8c: 5e pop %esi8049f8d: 5f pop %edi8049f8e: c3 ret08049f8f <driver_post>:8049f8f: 53 push %ebx8049f90: 83 ec 28 sub $0x28,%esp8049f93: 8b 44 24 30 mov 0x30(%esp),%eax8049f97: 8b 54 24 34 mov 0x34(%esp),%edx8049f9b: 8b 5c 24 3c mov 0x3c(%esp),%ebx8049f9f: 83 7c 24 38 00 cmpl $0x0,0x38(%esp)8049fa4: 74 28 je 8049fce <driver_post+0x3f>8049fa6: 89 54 24 08 mov %edx,0x8(%esp)8049faa: c7 44 24 04 e7 a5 04 movl $0x804a5e7,0x4(%esp)8049fb1: 088049fb2: c7 04 24 01 00 00 00 movl $0x1,(%esp)8049fb9: e8 e2 e8 ff ff call 80488a0 <__printf_chk@plt>8049fbe: 66 c7 03 4f 4b movw $0x4b4f,(%ebx)8049fc3: c6 43 02 00 movb $0x0,0x2(%ebx)8049fc7: b8 00 00 00 00 mov $0x0,%eax8049fcc: eb 49 jmp 804a017 <driver_post+0x88>8049fce: 85 c0 test %eax,%eax8049fd0: 74 37 je 804a009 <driver_post+0x7a>8049fd2: 80 38 00 cmpb $0x0,(%eax)8049fd5: 74 32 je 804a009 <driver_post+0x7a>8049fd7: 89 5c 24 18 mov %ebx,0x18(%esp)8049fdb: 89 54 24 14 mov %edx,0x14(%esp)8049fdf: c7 44 24 10 fe a5 04 movl $0x804a5fe,0x10(%esp)8049fe6: 088049fe7: 89 44 24 0c mov %eax,0xc(%esp)8049feb: c7 44 24 08 02 a6 04 movl $0x804a602,0x8(%esp)8049ff2: 088049ff3: c7 44 24 04 6e 3b 00 movl $0x3b6e,0x4(%esp)8049ffa: 008049ffb: c7 04 24 d4 a5 04 08 movl $0x804a5d4,(%esp)804a002: e8 f6 f4 ff ff call 80494fd <submitr>804a007: eb 0e jmp 804a017 <driver_post+0x88>804a009: 66 c7 03 4f 4b movw $0x4b4f,(%ebx)804a00e: c6 43 02 00 movb $0x0,0x2(%ebx)804a012: b8 00 00 00 00 mov $0x0,%eax804a017: 83 c4 28 add $0x28,%esp804a01a: 5b pop %ebx804a01b: c3 ret804a01c: 90 nop804a01d: 90 nop804a01e: 90 nop804a01f: 90 nop0804a020 <__libc_csu_init>:804a020: 55 push %ebp804a021: 57 push %edi804a022: 31 ff xor %edi,%edi804a024: 56 push %esi804a025: 53 push %ebx804a026: e8 35 e9 ff ff call 8048960 <__x86.get_pc_thunk.bx>804a02b: 81 c3 c9 1f 00 00 add $0x1fc9,%ebx804a031: 83 ec 1c sub $0x1c,%esp804a034: 8b 6c 24 30 mov 0x30(%esp),%ebp804a038: 8d b3 20 ff ff ff lea -0xe0(%ebx),%esi804a03e: e8 e1 e6 ff ff call 8048724 <_init>804a043: 8d 83 20 ff ff ff lea -0xe0(%ebx),%eax804a049: 29 c6 sub %eax,%esi804a04b: c1 fe 02 sar $0x2,%esi804a04e: 85 f6 test %esi,%esi804a050: 74 27 je 804a079 <__libc_csu_init+0x59>804a052: 8d b6 00 00 00 00 lea 0x0(%esi),%esi804a058: 8b 44 24 38 mov 0x38(%esp),%eax804a05c: 89 2c 24 mov %ebp,(%esp)804a05f: 89 44 24 08 mov %eax,0x8(%esp)804a063: 8b 44 24 34 mov 0x34(%esp),%eax804a067: 89 44 24 04 mov %eax,0x4(%esp)804a06b: ff 94 bb 20 ff ff ff call *-0xe0(%ebx,%edi,4)804a072: 83 c7 01 add $0x1,%edi804a075: 39 f7 cmp %esi,%edi804a077: 75 df jne 804a058 <__libc_csu_init+0x38>804a079: 83 c4 1c add $0x1c,%esp804a07c: 5b pop %ebx804a07d: 5e pop %esi804a07e: 5f pop %edi804a07f: 5d pop %ebp804a080: c3 ret804a081: eb 0d jmp 804a090 <__libc_csu_fini>804a083: 90 nop804a084: 90 nop804a085: 90 nop804a086: 90 nop804a087: 90 nop804a088: 90 nop804a089: 90 nop804a08a: 90 nop804a08b: 90 nop804a08c: 90 nop804a08d: 90 nop804a08e: 90 nop804a08f: 90 nop0804a090 <__libc_csu_fini>:804a090: f3 c3 repz ret804a092: 90 nop804a093: 90 nop804a094: 90 nop804a095: 90 nop804a096: 90 nop804a097: 90 nop804a098: 90 nop804a099: 90 nop804a09a: 90 nop804a09b: 90 nop804a09c: 90 nop804a09d: 90 nop804a09e: 90 nop804a09f: 90 nop0804a0a0 <__do_global_ctors_aux>:804a0a0: 55 push %ebp804a0a1: 89 e5 mov %esp,%ebp804a0a3: 53 push %ebx804a0a4: 83 ec 04 sub $0x4,%esp804a0a7: a1 14 bf 04 08 mov 0x804bf14,%eax804a0ac: 83 f8 ff cmp $0xffffffff,%eax804a0af: 74 13 je 804a0c4 <__do_global_ctors_aux+0x24>804a0b1: bb 14 bf 04 08 mov $0x804bf14,%ebx804a0b6: 66 90 xchg %ax,%ax804a0b8: 83 eb 04 sub $0x4,%ebx804a0bb: ff d0 call *%eax804a0bd: 8b 03 mov (%ebx),%eax804a0bf: 83 f8 ff cmp $0xffffffff,%eax804a0c2: 75 f4 jne 804a0b8 <__do_global_ctors_aux+0x18>804a0c4: 83 c4 04 add $0x4,%esp804a0c7: 5b pop %ebx804a0c8: 5d pop %ebp804a0c9: c3 retDisassembly of section .fini:0804a0cc <_fini>:804a0cc: 53 push %ebx804a0cd: 83 ec 08 sub $0x8,%esp804a0d0: e8 8b e8 ff ff call 8048960 <__x86.get_pc_thunk.bx>804a0d5: 81 c3 1f 1f 00 00 add $0x1f1f,%ebx804a0db: e8 90 e8 ff ff call 8048970 <__do_global_dtors_aux>804a0e0: 83 c4 08 add $0x8,%esp804a0e3: 5b pop %ebx804a0e4: c3 ret
下面我附上自己的实验报告
实验报告
Bomb lab实验
湖南大学信息科学与工程学院
计科21XX wolf （学号20210801XXXX）
目录
前言
<Phase_1>字符串比较
<Phase_2>循环
<Phase_3>分支语句与跳转表
<Phase_4>递归调用
<func_4>递归函数体分析
<phase_5>字符串末尾累加
<phase_6>链表
<secret_phase>二叉检索树（BinarySearchTree）
<phase_defused>寻找隐藏关入口
<secret_phase>隐藏关
<fun7>检索目标元素
深度拓展与思考：
进一步思考树结构的实现：
<撒花完结>
附录：自己写的各部分phase的c代码
void phase_1()
void phase_2()
void phase_3()
int func4(int n, int x)
void phase_4()
void phase_6()
int fun7(int *x, int input)
void secret_phase()
前言
bomb实验，感觉十分有趣。它非常考验对于汇编代码的理解，很考验读汇编代码的能力与写汇编代码的能力。这个实验十分推荐自己独立完成，可以独立完成之后再去CSDN上校对自己的思路与寻求更新的思路，会有一种茅塞顿开的领悟之感。下面总结了几点感悟。
1、总的来说，给的汇编代码有很多，甚至有很多汇编代码段。但对于解题来说，不是每一个汇编代码段我们都要细看（当然如果是为了加深对于汇编的理解，也可以认真研究）。比如说一些把名字能够很好表示含义的函数，如phase1中的<strings_not_equal>函数和phase2中的<read_six_numbers>函数等，光是看名字就可以比较有效地理解其意义，就没必要细看了（当然有时还是看几眼防止逻辑上正反的问题）。
2、单是针对解题而言，一个方法是先关注<explode_bomb>段。既然我们的目标是不要爆炸，那么我可以在所有引向爆炸的路上避免，即可。
3、题目中往往藏着提示，根据这些提示可以很快找到方向，比如phase1根据strings可以马上发现我们要研究的对象是字符串，而phase2根据six numbers可以很快发现我们要研究的是6个数字。这样一来我们就可以很快地找到思路，避免对着冗长的汇编代码发呆。
4、感到纸笔演算比较困难？不妨借助强大的gdb功能进行推算。
5、熟悉循环结构，熟悉循环控制变量，熟悉函数调用时的堆栈空间变化，这将为解题带来很大帮助。
6、熟悉一些常见的数据结构的汇编级实现，如二叉检索树、链表等，这是必要的基础理解。
7、对于递归函数，弄清楚其某一层的意思，总结出递归表达式，写出c代码，这样可以加深我们的理解。
8、有条件应对每一段汇编代码写出相对应的c代码。
<Phase_1>字符串比较
（1）首先关注导致爆炸的关键代码段
8048b77: 85 c0 test %eax,%eax8048b79: 74 05 je 8048b80 <phase_1+0x20>8048b7b: e8 f6 05 00 00 call 8049176 <explode_bomb>不难发现，导致爆炸的原因是没有je，如果je了，就会跳转到安全的地方。若%eax值为0，test将其相与，若结果为0，则成功跳转。这个%eax是<strings_not_equal>函数的返回值，故其实我们要比较两个字符串是否相等，其中一个应该是我们输入的，另外一个是题目保存在某个地址的。我们的目标就是找到题目把这个答案保存在哪里。
既然这个函数是比较两个字符串的相等与否，那必然会把两个字符串所在地址传到函数中。关注到前面的这句话
8048b63: c7 44 24 04 44 a2 04 movl $0x804a244,0x4(%esp)发现将一个小可爱放到了0x4(%esp)，如果比较敏感的话，这里恰好是调用函数传参的地方。那就没得跑了，这个0x804a244如无意外就应该是答案所在的地址。我们以s类型查看该地址，发现确实就是答案。
至此我们得到phase1的答案
I am for medical liability at the federal level.
我们输入答案，验证通过。
<Phase_2>循环
这道题一开始我花了太多时间去研究<read_six_numbers>函数体了，后来发现其实不是很有这个必要。包括还犯了一个错误就是没有借助Linux强大的gdb功能进行推算，试图纯用纸笔和人脑进行计算，这真的是愚蠢至极。
这道题的提示实际上就藏在<read_six_numbers>这个函数的名字中，顾名思义，就是我们输入6个数字，程序对这6个数字进行验证。那我们的目标就是找出这6个数字。再结合之前总结的“找到什么导致爆炸”，我们很容易关注到这个代码段。
8048b9d: 83 7c 24 18 00 cmpl $0x0,0x18(%esp)8048ba2: 75 07 jne 8048bab <phase_2+0x27>8048ba4: 83 7c 24 1c 01 cmpl $0x1,0x1c(%esp)8048ba9: 74 05 je 8048bb0 <phase_2+0x2c>8048bab: e8 c6 05 00 00 call 8049176 <explode_bomb>M[0x18(%esp)]在和0比较，如果不相等，会导致跳转并爆炸，那0x18(%esp)肯定为0；
M[0x1c(%esp)]在和1比较，如果相等，就会跳转到爆炸后的安全代码段，否则爆炸，所以0x1c(%esp)为1；
那么既然用来作为比较，肯定这两个值都是我们输入的关键值，假设我们输入的数值为数组m的数。我们猜测M[0x18(%esp)]和M[0x1c(%esp)]为m[1]和m[2]（即我们输入的第一个和第二个数值），即我们尝试输入0,1,2,3,4,5
发现我们在 0x8048bab这个点没有爆炸，那么我们的猜测是正确的，前两个数分别是0,1。
然后关注到这个jne指令，如果不满足%esi里的值等于%ebx里的值，那么会回到mov指令的地方。这说明了两点。第一，这里有一个循环；第二，mov前的两个lea应该进行了一个初始化。由前面M[0x18(%esp)]和M[0x1c(%esp)]为m[1]和m[2]，这里M[0x20(%esp)]应该是m[3]（即第三个数），mov -0x8(%ebx),%eax和add -0x4(%ebx),%eax这两步很好理解，就是在把前两个进行累加并放在%eax中，和M[%ebx]进行比较，需要相等。
8048bb0: 8d 5c 24 20 lea 0x20(%esp),%ebx8048bb4: 8d 74 24 30 lea 0x30(%esp),%esi8048bb8: 8b 43 f8 mov -0x8(%ebx),%eax8048bbb: 03 43 fc add -0x4(%ebx),%eax8048bbe: 39 03 cmp %eax,(%ebx)8048bc0: 74 05 je 8048bc7 <phase_2+0x43>8048bc2: e8 af 05 00 00 call 8049176 <explode_bomb>8048bc7: 83 c3 04 add $0x4,%ebx8048bca: 39 f3 cmp %esi,%ebx8048bcc: 75 ea jne 8048bb8 <phase_2+0x34>8048bce: 83 c4 34 add $0x34,%esp8048bd1: 5b pop %ebx8048bd2: 5e pop %esi8048bd3: c3 ret也就是说，第三个数是前两个数的加和。再关注到add $0x4,%ebx这一步，这是在将处理地址增加，也就是现在%ebx中保存m[4]的地址了。从而实现了循环的传递。
这里的 cmp %esi,%ebx是循环的跳出判定，其实可以看到%esi内存放的0x30(%esp)正好是六个数的数组的结束地址，这就很好地解释了这个循环。
根据上述分析，随着循环进行，答案依次为0,1,1,2,3,5。是一个斐波那契数列。
我们输入答案，验证通过。
<Phase_3>分支语句与跳转表
首先关注这一段调用scanf函数前的前置工作，实际上干的事情就是把scanf(“%d”,&a)中的几个地址参数&a给确定好，我们看到关键的有这三个0x28(%esp)、0x2f(%esp)、0x24(%esp)。而这三个在向调用函数传递的位置也是连续的0x10(%esp)、0xc(%esp)、0x8(%esp)。也就是说，把读入进来的数分别存放在这三个位置上。
再根据我们对scanf的了解，应该还要传递读取的方式。movl $0x804a29e,0x4(%esp)应该干的就是这个事情，我们可以用字符的形式查看这个地址0x804a29e
可以发现我们需要输入的是一个整数，一个字符和一个整数，中间以空格隔开。
8048bd7: 8d 44 24 28 lea 0x28(%esp),%eax8048bdb: 89 44 24 10 mov %eax,0x10(%esp)8048bdf: 8d 44 24 2f lea 0x2f(%esp),%eax8048be3: 89 44 24 0c mov %eax,0xc(%esp)8048be7: 8d 44 24 24 lea 0x24(%esp),%eax8048beb: 89 44 24 08 mov %eax,0x8(%esp)8048bef: c7 44 24 04 9e a2 04 movl $0x804a29e,0x4(%esp)8048bf6: 088048bf7: 8b 44 24 40 mov 0x40(%esp),%eax8048bfb: 89 04 24 mov %eax,(%esp)8048bfe: e8 6d fc ff ff call 8048870 <__isoc99_sscanf@plt>上面关注了我们输入的形式，接下来继续阅读代码，尝试解出这三个值。
8048bfe: e8 6d fc ff ff call 8048870 <__isoc99_sscanf@plt>8048c03: 83 f8 02 cmp $0x2,%eax8048c06: 7f 05 jg 8048c0d <phase_3+0x39>8048c08: e8 69 05 00 00 call 8049176 <explode_bomb>8048c0d: 83 7c 24 24 07 cmpl $0x7,0x24(%esp)8048c12: 0f 87 fc 00 00 00 ja 8048d14 <phase_3+0x140>根据这一段逻辑，这里要避开两个炸弹，要求的条件是call函数返回后%eax内的值>2且0x24(%esp)<=7，这里0x24(%esp)内存放的应该是跳转的数n，所以从这里可以看出这个case语句应该有0~7这8个选项，跳转表有8个终点。
我们假定这个0x24(%esp)里存放的是我们第一个读入的数，我们尝试输入一个5，发现它真的被存在%eax内，可以确定第一个输入的数决定跳转地址。
看到这一句话，关注到这应该是一个跳转表。
8048c1c: ff 24 85 c0 a2 04 08 jmp *0x804a2c0(,%eax,4)而跳转表的首地址应该是0x804a2c0。
我们看一看跳转表（其实可以根据上面推断出应该有8个，但为了不缺漏，我们可以直接查看10个，更加方便）
这样我们就拿到了跳转表的终点地址。
接下来的8个这样的结构，实际上是多个case分支的下要干的事情以及判定。
8048c23: b8 64 00 00 00 mov $0x64,%eax8048c28: 81 7c 24 28 80 00 00 cmpl $0x80,0x28(%esp)8048c2f: 008048c30: 0f 84 e8 00 00 00 je 8048d1e <phase_3+0x14a>8048c36: e8 3b 05 00 00 call 8049176 <explode_bomb>8048c3b: b8 64 00 00 00 mov $0x64,%eax8048c40: e9 d9 00 00 00 jmp 8048d1e <phase_3+0x14a>我们以第一个举例，首先0x28(%esp)要等于0x80，然后再关注所有case分支最终跳转的汇合点。不难发现这里还要比较%eax的值和0x2f(%esp)保存的值是否相等。
总结来说，对于我们输入的一组数据n，c，m。这里分别判定了在n分支下c和m是否为给定值。对于这个分支，是c=0x64，m=0x80，也就是字符为d，数为128。
8048d1e: 3a 44 24 2f cmp 0x2f(%esp),%al8048d22: 74 05 je 8048d29 <phase_3+0x155>8048d24: e8 4d 04 00 00 call 8049176 <explode_bomb>8048d29: 83 c4 3c add $0x3c,%esp8048d2c: c3 ret我们输入0 d 128进行验证，发现验证正确。
同理，另外7组跳转表也可以一一得出相应的答案。本题一共8组答案，任意一组输入都为正确。
| n | C(hex) | M(hex) | c | m |
| 0 | 0x64 | 0x80 | d | 128 |
| 1 | 0x6f | 0x135 | o | 309 |
| 2 | 0x67 | 0x348 | g | 840 |
| 3 | 0x6b | 0x16d | k | 365 |
| 4 | 0x75 | 0x1d7 | u | 471 |
| 5 | 0x72 | 0x31b | r | 795 |
| 6 | 0x6e | 0x204 | n | 516 |
| 7 | 0x6f | 0xb0 | o | 176 |
最终答案即为
| n | c | m |
| 0 | d | 128 |
| 1 | o | 309 |
| 2 | g | 840 |
| 3 | k | 365 |
| 4 | u | 471 |
| 5 | r | 795 |
| 6 | n | 516 |
| 7 | o | 176 |
<Phase_4>递归调用
这道题与上一道题的代码有很大的相似之处。
像是这一段
8048d8d: 8d 44 24 18 lea 0x18(%esp),%eax8048d91: 89 44 24 0c mov %eax,0xc(%esp)8048d95: 8d 44 24 1c lea 0x1c(%esp),%eax8048d99: 89 44 24 08 mov %eax,0x8(%esp)8048d9d: c7 44 24 04 83 a4 04 movl $0x804a483,0x4(%esp)和这一段
8048dac: e8 bf fa ff ff call 8048870 <__isoc99_sscanf@plt>分别是传递用scanf所读取数的存放位置，和scanf函数本身。这个思路我们在上一道题就已经看到过了。第一件事情肯定是查看这个地址，获取读入的类型。
可见这次是读入两个整数。
这一点也可以从下面看出来，这里%eax是scanf函数的返回值，也就是读入数的个数，若这个个数不为2，就会爆炸。
8048db1: 83 f8 02 cmp $0x2,%eax8048db4: 75 0e jne 8048dc4 <phase_4+0x3a>接着由以下两句，%eax存的是我们输入的第二个值，我们称它为x。
8048db6: 8b 44 24 18 mov 0x18(%esp),%eax8048dba: 83 f8 01 cmp $0x1,%eax再关注到这里对x的两个限制。有1<x<=4，所以x有3个可能的取值，分别是1,2,3。
8048dba: 83 f8 01 cmp $0x1,%eax8048dbd: 7e 05 jle 8048dc4 <phase_4+0x3a>8048dbf: 83 f8 04 cmp $0x4,%eax 8048dc2: 7e 05 jle 8048dc9 <phase_4+0x3f>8048dc4: e8 ad 03 00 00 call 8049176 <explode_bomb>接下来有一个取巧的方法，就是让电脑帮我们计算出结果，我们再直接拿。
关注到这一句话，这里将我们输入的第一个数（我们称它为check）和%eax比较，若相等则正确否则爆炸。那么如果我们直接在这一步break，再使用info r查看%eax的值，不就可以轻轻松松取得答案了嘛。
8048ddd: 3b 44 24 1c cmp 0x1c(%esp),%eax下面以x=2为例，按照这个思路操作一下。
可以得出结果为176，代入之后成功，说明我们的想法是正确的。
<func_4>递归函数体分析
当然，出于对自己的要求以及对func4函数的尊敬，我还是看了一遍func4函数。
下面是一些分析。
（1）主函数
Phase_4中这一段，很详细地描述了func_4函数的两个参数，(%esp)也就是第一个参数，是9，也就是递归层数，我们称作n；0x4(%esp)也就是第二个参数，是x。
所以func_4(n,x)
8048dc9: 8b 44 24 18 mov 0x18(%esp),%eax8048dcd: 89 44 24 04 mov %eax,0x4(%esp)8048dd1: c7 04 24 09 00 00 00 movl $0x9,(%esp)8048dd8: e8 50 ff ff ff call 8048d2d <func4>接下来真正进入func_4函数
（2）寄存器保护
首先，开头的这三步
8048d30: 89 5c 24 10 mov %ebx,0x10(%esp)8048d34: 89 74 24 14 mov %esi,0x14(%esp)8048d38: 89 7c 24 18 mov %edi,0x18(%esp)和结尾的这三步
8048d7a: 8b 5c 24 10 mov 0x10(%esp),%ebx8048d7e: 8b 74 24 14 mov 0x14(%esp),%esi8048d82: 8b 7c 24 18 mov 0x18(%esp),%edi将三个寄存器里的值先放在主存中保存，在函数结束之后再放回寄存器内，这是因为在这个函数中，这几个寄存器要被用到，这是一种保护的措施。这是一种在函数调用间很常见的步骤，在本题的具体的原因还有待研究。
（3）传参的保存
接下来关注这一句（建立）
8048d2d: 83 ec 1c sub $0x1c,%esp和这两句（传参保存）
8048d3c: 8b 74 24 20 mov 0x20(%esp),%esi8048d40: 8b 5c 24 24 mov 0x24(%esp),%ebx 可以发现，%ebx存的是x，%esi存的是n。
（4）递归边界条件
接下来是递归的边界条件。
第一个条件，test是判0，若n=0，返回0。
8048d44: 85 f6 test %esi,%esi8048d46: 7e 2b jle 8048d73 <func4+0x46>第二个条件，若n=1，返回%ebx内的值，也就是x。
8048d48: 83 fe 01 cmp $0x1,%esi8048d4b: 74 2b je 8048d78 <func4+0x4b>（5）递归函数执行部分
再接下来是递归函数的执行部分。
这是第一段，计算func4(n-1,x)+x并保存在%edi内
8048d4d: 89 5c 24 04 mov %ebx,0x4(%esp)8048d51: 8d 46 ff lea -0x1(%esi),%eax8048d54: 89 04 24 mov %eax,(%esp)8048d57: e8 d1 ff ff ff call 8048d2d <func4>8048d5c: 8d 3c 18 lea (%eax,%ebx,1),%edi下面是第二段，计算func4(n-2,x)，再和%edi相加，保存在%ebx内。
8048d5f: 89 5c 24 04 mov %ebx,0x4(%esp)8048d63: 83 ee 02 sub $0x2,%esi8048d66: 89 34 24 mov %esi,(%esp)8048d69: e8 bf ff ff ff call 8048d2d <func4>8048d6e: 8d 1c 07 lea (%edi,%eax,1),%ebx最后若n不是0或1，返回%ebx的值。
（5）总结
总的来看，就是计算了func4(n-1,x)+func4(n-2,x)+x的值并返回；若n=0，返回0；若n=1，返回x。知道了这个，我们就可以写一段c程序来模拟这件事，并靠自己得出结果。
#include <iostream>
using namespace std;
int result(int n, int x)
{if (n == 0)return 0;if (n == 1)return x;return (result(n - 1, x) + result(n - 2, x) + x);
}
int main()
{int x;x = 4;cout << result(9, x) << endl;return 0;
}最后输出的结果就是check的值。证明我们推断正确。
所以本题的答案如下。
| Check | x |
| 176 | 2 |
| 264 | 3 |
| 352 | 4 |
<phase_5>字符串末尾累加
首先分析题目。
（1）比较字符个数
首先关注到第一个炸弹点，字符个数，这里的string_length猜测是返回了我们输入字符的个数，且必须要等于6，也就是说限定了我们必须输入6位字符。
8048df7: e8 4f 02 00 00 call 804904b <string_length>8048dfc: 83 f8 06 cmp $0x6,%eax8048dff: 74 05 je 8048e06 <phase_5+0x1a>8048e01: e8 70 03 00 00 call 8049176 <explode_bomb>（2）赋初值、各寄存器含义、以及初探循环
这里给寄存器%eax赋了初值0，给寄存器%edx赋了初值0。
8048e06: ba 00 00 00 00 mov $0x0,%edx8048e0b: b8 00 00 00 00 mov $0x0,%eax结合后面%eax寄存器自增以及与6比较并跳转（如下），不难发现%eax应该承担着一个循环控制变量i的作用。而与6相比较，不难发现这其实是一个遍历我们输入字符串各个位置的循环，总共执行6次。
8048e1e: 83 c0 01 add $0x1,%eax8048e21: 83 f8 06 cmp $0x6,%eax8048e24: 75 ea jne 8048e10 <phase_5+0x24>再结合跳出循环后%edx与固定值相比较，我们不难发现，实际上这个%edx是一个累加器。而第i重循环的作用也正是不断地给这个累加器加上一个特定的值，这个特定的值与我们输入的字符串的第i位有关。
8048e26: 83 fa 38 cmp $0x38,%edx8048e29: 74 05 je 8048e30 <phase_5+0x44>8048e2b: e8 46 03 00 00 call 8049176 <explode_bomb>（3）循环执行体
其实循环执行体很简单，就只有如下几句，它想干的事情是这样的。s[i]的末4位与0xf相与，结果以整数形式存储，记作r。（s[i]本应该是8位，这里实际上取了它的末4位，结果共有16种，即0~15）。访问（基地址0x804a2e0+4*r）这个地址，记作target_address，把这个地址上的值累加到寄存器%edx上。这就结束了。
8048e10: 0f be 0c 03 movsbl (%ebx,%eax,1),%ecx8048e14: 83 e1 0f and $0xf,%ecx8048e17: 03 14 8d e0 a2 04 08 add 0x804a2e0(,%ecx,4),%edx（4）累加结果比较
最后%edx与0x38，也就是十进制下的56比较，要求%ebx内的值等于它。
分析完题目之后，我们要来解题了。要知道输入什么字符能最终得到正确的累加结果。我们可以先查看所有（基地址0x804a2e0+4*r）关于r从0到15的结果。如下。
查阅ASCII码表后，我们可以总结出下表。
| 可能字符 | 字符ascii码末4位 | Target_address | 单次累加值 | ||||||
| Bin | Hex | ||||||||
| (space) | 0 | @ | P | 、 | p | 0000 | 0 | Bias+0 | 2 |
| ! | 1 | A | Q | a | q | 0001 | 1 | Bias+0x4 | 10 |
| “ | 2 | B | R | b | r | 0010 | 2 | Bias+0x8 | 6 |
| # | 3 | C | S | c | s | 0011 | 3 | Bias+0xc | 1 |
| $ | 4 | D | T | d | t | 0100 | 4 | Bias+10 | 12 |
| % | 5 | E | U | e | u | 0101 | 5 | Bias+0x14 | 16 |
| & | 6 | F | V | f | v | 0110 | 6 | Bias+0x18 | 9 |
| . | 7 | G | W | g | w | 0111 | 7 | Bias+0x1c | 3 |
| ( | 8 | H | X | h | x | 1000 | 8 | Bias+20 | 4 |
| ) | 9 | I | Y | i | y | 1001 | 9 | Bias+0x24 | 7 |
| * | : | J | Z | j | z | 1010 | a | Bias+0x28 | 14 |
| + | ; | K | [ | k | { | 1011 | b | Bias+0x2c | 5 |
| < | L | / | l | | | 1100 | c | Bias+30 | 11 | |
| = | M | ] | m | } | 1101 | d | Bias+0x34 | 8 | |
| > | N | ^ | n | 1110 | e | Bias+0x38 | 15 | ||
| ? | O | o | 1111 | f | Bias+0x3c | 13 | |||
以本题要求最后6个字符的累加值为56，我们可以取BJMBJM这个字符串，因为B对应6，而J对应14，M对应8，加和正好为56。
由此我们可以看到，这道题的答案应该有很多组，只要按照上表其最终累加结果为56即可。我们不再一一列出。
附上使用BJMBJM验证的结果。
可见我们的推论是正确的。
<phase_6>链表
总述：
有六个节点，每个节点中已预先存储了一个值。要求我们按照顺序输入节点编号，来保证其中结点的值依次递增。
首先，我们来对代码进行静态的分析。
（1）读入节点编号
08048e35 <phase_6>:8048e35: 56 push %esi8048e36: 53 push %ebx8048e37: 83 ec 44 sub $0x44,%esp8048e3a: 8d 44 24 10 lea 0x10(%esp),%eax8048e3e: 89 44 24 04 mov %eax,0x4(%esp)8048e42: 8b 44 24 50 mov 0x50(%esp),%eax8048e46: 89 04 24 mov %eax,(%esp)8048e49: e8 5d 04 00 00 call 80492ab <read_six_numbers>这里没有什么可说的，就是读入节点编号。
（2）第一阶段：合规性检验
确保六个数字符合规定。规定是指，不超过6，不重复，即必须是1、2、3、4、5、6的排列。
8048e4e: be 00 00 00 00 mov $0x0,%esi #initial esi=08048e53: 8b 44 b4 10 mov 0x10(%esp,%esi,4),%eax #loop 外层(控制变量esi)8048e57: 83 e8 01 sub $0x1,%eax8048e5a: 83 f8 05 cmp $0x5,%eax8048e5d: 76 05 jbe 8048e64 <phase_6+0x2f> #eax<=6正常(控制变量ebx)8048e5f: e8 12 03 00 00 call 8049176 <explode_bomb>8048e64: 83 c6 01 add $0x1,%esi #esi++8048e67: 83 fe 06 cmp $0x6,%esi8048e6a: 74 33 je 8048e9f <phase_6+0x6a> #esi=6，跳出循环8048e6c: 89 f3 mov %esi,%ebx #esi！=68048e6e: 8b 44 9c 10 mov 0x10(%esp,%ebx,4),%eax #loop 内层8048e72: 39 44 b4 0c cmp %eax,0xc(%esp,%esi,4)8048e76: 75 05 jne 8048e7d <phase_6+0x48> #8048e78: e8 f9 02 00 00 call 8049176 <explode_bomb>8048e7d: 83 c3 01 add $0x1,%ebx #ebx++8048e80: 83 fb 05 cmp $0x5,%ebx8048e83: 7e e9 jle 8048e6e <phase_6+0x39> #loop 内层 ebx：esi..58048e85: eb cc jmp 8048e53 <phase_6+0x1e> #loop 外层 esi：0..5这部分代码，使用c++可以写成如下形式。
有一个循环的嵌套，其中，外层循环的控制变量为%esi，内层循环的控制变量为%ebx
if (a[0] > 6)bomb();for (int i = 1; i < 6; i++){if (a[i] > 6)bomb();for (int j = i; j < 6; j++){if (a[j] == a[i - 1])bomb();}}（3）第二阶段：排序
8048e87: 8b 52 08 mov 0x8(%edx),%edx #ecx>1：通过循环得到编号对应的数据地址8048e8a: 83 c0 01 add $0x1,%eax8048e8d: 39 c8 cmp %ecx,%eax #loop28048e8f: 75 f6 jne 8048e87 <phase_6+0x52>8048e91: 89 54 b4 28 mov %edx,0x28(%esp,%esi,4) #将编号对应的数据地址放入数组中8048e95: 83 c3 01 add $0x1,%ebx #ebx++8048e98: 83 fb 06 cmp $0x6,%ebx8048e9b: 75 07 jne 8048ea4 <phase_6+0x6f> #ebx！=6，重复循环8048e9d: eb 1c jmp 8048ebb <phase_6+0x86> #ebx=6跳出8048e9f: bb 00 00 00 00 mov $0x0,%ebx #第二阶段开始：esi=6跳出循环后8048ea4: 89 de mov %ebx,%esi8048ea6: 8b 4c 9c 10 mov 0x10(%esp,%ebx,4),%ecx8048eaa: b8 01 00 00 00 mov $0x1,%eax8048eaf: ba 3c c1 04 08 mov $0x804c13c,%edx #给定数据首地址放入%edx8048eb4: 83 f9 01 cmp $0x1,%ecx8048eb7: 7f ce jg 8048e87 <phase_6+0x52> #ecx>18048eb9: eb d6 jmp 8048e91 <phase_6+0x5c> #ecx=1,没必要进入loop2注意到有给定一个地址，我们发现循环loop2在不断访问(%edx+8)，遂查看这些地址。
注意到给定地址0x804c13c储存在%edx内，而在%ecx>1时，会通过循环不断将(%edx+8)所对应的值赋值给%edx。实际上，我们查看每一个地址的(%edx+8)会发现，这实际上是一个链表型的结构，每两个结构之间相邻12个字节，而这12个字节被用来存3样东西。(%edx+8)也就是储存的第三项数据，实际上就是下一结构的地址。这一段是循环loop2的解释。
为方便说明，我们约定如下：
0x10(%esp,%ebx,4)开始的，为我们输入的六个元素按顺序排列，约定为数组a[]
0x28(%esp,%esi,4)为新数组，约定为b[]
所以这里我们可以看出来是通过循环访问（循环控制变量为%ebx）输入的编号a[i].对于特定的一次编号i，若其为1，则就将链表结构的第一个节点的地址0x804c13c移至一个新的数组b[i]；若不为1，则通过循环loop2（上面解释过）找到这个编号i对对应的节点，将其地址（0x804c148、0x804c154、0x804c160、0x804c16c、0x804c178中的一个）移至b[i]。
使用c来更直观地表述如下。
for (int i = 0; i < 6; i++){if (a[i] > 1) // 实际上这句可以不要，放这里可以看得更清晰一点{for (int j = 1; j < a[i]; j++){head = head->next;}b[i] = &head;}}这实际上是一个排序的过程。
（4）第三阶段：复写下一状态（链表重组）
8048ebb: 8b 5c 24 28 mov 0x28(%esp),%ebx #第三阶段开始：ebx=6跳出循环后8048ebf: 8b 44 24 2c mov 0x2c(%esp),%eax8048ec3: 89 43 08 mov %eax,0x8(%ebx) #*b[0]->next=*b[1]8048ec6: 8b 54 24 30 mov 0x30(%esp),%edx8048eca: 89 50 08 mov %edx,0x8(%eax) #*b[1]->next=*b[2]8048ecd: 8b 44 24 34 mov 0x34(%esp),%eax8048ed1: 89 42 08 mov %eax,0x8(%edx) #*b[2]->next=*b[3]8048ed4: 8b 54 24 38 mov 0x38(%esp),%edx8048ed8: 89 50 08 mov %edx,0x8(%eax) #*b[3]->next=*b[4]8048edb: 8b 44 24 3c mov 0x3c(%esp),%eax8048edf: 89 42 08 mov %eax,0x8(%edx) #*b[4]->next=*b[5]8048ee2: c7 40 08 00 00 00 00 movl $0x0,0x8(%eax)这一部分根据上一阶段的排序结果来对链表节点进行重组，按照我们输入的数组a[]的顺序来重新排列链表节点的顺序。
（5）检验数据域递增性
最后，查看输入顺序是否正确，即在按照我们输入的数组a[]进行重新排列后，链表内节点的data域是否递增。
8048ee9: be 05 00 00 00 mov $0x5,%esi #loop（循环控制变量为%esi）8048eee: 8b 43 08 mov 0x8(%ebx),%eax8048ef1: 8b 10 mov (%eax),%edx8048ef3: 39 13 cmp %edx,(%ebx)8048ef5: 7e 05 jle 8048efc <phase_6+0xc7> #要求(0x8(%ebx))<(%ebx)，即递增8048ef7: e8 7a 02 00 00 call 8049176 <explode_bomb>8048efc: 8b 5b 08 mov 0x8(%ebx),%ebx8048eff: 83 ee 01 sub $0x1,%esi8048f02: 75 ea jne 8048eee <phase_6+0xb9>8048f04: 83 c4 44 add $0x44,%esp8048f07: 5b pop %ebx8048f08: 5e pop %esi8048f09: c3 ret用c来更清晰地表示：
// 第四阶段：检验数据域递增性struct node *head;for (int i = 5; i > 0; i--){if (head->data > head->next->data)bomb();}（6）node类型分析
事实上，如果我们对这个节点进行一个查看，截图如下。
不难发现其实节点有三个域，第一个是数据域，存储的是值的大小；第二个是编号域，反应的是节点的编号（实际上用处不大）；第三个是next域，是指针类型，指向下一个节点的地址。这是一个典型的链表结构。
根据上述分析，若要输入正确的顺序，我们必须得知道每个节点的数据域是多少。
查看每个节点的数据域，我们发现它们按顺序分别是0xf8、0x12e、0x3e、0x19e、0x2d6、0x277。排序过后的编码应该为3、1、2、4、6、5.输入验证，发现正确。
<secret_phase>二叉检索树（BinarySearchTree）
前言：这道题比较难看出来，是一个二叉检索树并且寻找目标节点的编号。最终实现的目标是我们输入一个数input，它所在的位置与题目中所规定的相符合。
<phase_defused>寻找隐藏关入口
关注到main函数部分，每次在调用相应的phase之后都会调用<phase_defused>，猜测可能跟隐藏关卡相关，所以必须要对这一段函数进行研究。
（下图为main函数的phase_3、4在完成档次验证后都调用了<phase_defused>）
下面查看<phase_defused>代码
080492fb <phase_defused>:80492fb: 81 ec 8c 00 00 00 sub $0x8c,%esp8049301: 65 a1 14 00 00 00 mov %gs:0x14,%eax8049307: 89 44 24 7c mov %eax,0x7c(%esp)804930b: 31 c0 xor %eax,%eax804930d: 83 3d cc c3 04 08 06 cmpl $0x6,0x804c3cc8049314: 75 72 jne 8049388 <phase_defused+0x8d> #若前6关都通过则进入，否则自动跳出8049316: 8d 44 24 2c lea 0x2c(%esp),%eax804931a: 89 44 24 10 mov %eax,0x10(%esp)804931e: 8d 44 24 28 lea 0x28(%esp),%eax8049322: 89 44 24 0c mov %eax,0xc(%esp)8049326: 8d 44 24 24 lea 0x24(%esp),%eax804932a: 89 44 24 08 mov %eax,0x8(%esp)804932e: c7 44 24 04 89 a4 04 movl $0x804a489,0x4(%esp) #"%d %d %s"，即两个数字后还要输入字符串8049335: 088049336: c7 04 24 d0 c4 04 08 movl $0x804c4d0,(%esp)804933d: e8 2e f5 ff ff call 8048870 <__isoc99_sscanf@plt> #第四关中同样出现了此段调用8049342: 83 f8 03 cmp $0x3,%eax8049345: 75 35 jne 804937c <phase_defused+0x81> #若第四关中输入个数不是3个，不触发发现在<phase_defused>内有一个判定，若前6关都通过才会触发隐藏关卡，否则跳过。触发隐藏关卡之后，首先判定第四关中输入的是不是两个整数与一个字符串。我们知道，第四关的答案是两个整数，但是如果要进入隐藏关卡，这里需要在两个整数之后再输入一个字符串。
（查看输入格式的截图）
这里将我们在第四关中输入的字符串作为第一个参数，将给定字符串（也就是答案）作为第二个参数，传递给字符串相等性判定函数。若我们输入的与给定值一样，则会向终端输出信息，并进入隐藏关卡。进入隐藏关卡后，调用<secret_phase>段。
8049347: c7 44 24 04 92 a4 04 movl $0x804a492,0x4(%esp) #第二个参数"DrEvil"804934e: 08804934f: 8d 44 24 2c lea 0x2c(%esp),%eax #第一个参数8049353: 89 04 24 mov %eax,(%esp)8049356: e8 09 fd ff ff call 8049064 <strings_not_equal> #比较密码是否相等（重点关注）804935b: 85 c0 test %eax,%eax804935d: 75 1d jne 804937c <phase_defused+0x81> #若第四关中输入的密码错误，不触发804935f: c7 04 24 58 a3 04 08 movl $0x804a358,(%esp)8049366: e8 95 f4 ff ff call 8048800 <puts@plt>804936b: c7 04 24 80 a3 04 08 movl $0x804a380,(%esp)8049372: e8 89 f4 ff ff call 8048800 <puts@plt> #这一段是输出"找到隐藏关"的记录8049377: e8 df fb ff ff call 8048f5b <secret_phase> #进入隐藏关804937c: c7 04 24 b8 a3 04 08 movl $0x804a3b8,(%esp) #输出通过（未触发隐藏关）8049383: e8 78 f4 ff ff call 8048800 <puts@plt>8049388: 8b 44 24 7c mov 0x7c(%esp),%eax804938c: 65 33 05 14 00 00 00 xor %gs:0x14,%eax8049393: 74 05 je 804939a <phase_defused+0x9f>8049395: e8 36 f4 ff ff call 80487d0 <__stack_chk_fail@plt>804939a: 81 c4 8c 00 00 00 add $0x8c,%esp（查看给定密码的截图）
（在第四关中输入正确的密码后，向终端提示已经成功进入隐藏关卡）
<secret_phase>隐藏关
在这一段中，首先从终端读入字符串，通过strtol函数将字符串转换为长整型数。
Strol的原型函数为long int strtol(const char *nptr,char **endptr,int base);其中第一个参数为待转换的字符串首地址，第二个参数为转换的首地址，第三个参数为转换的进制（范围为2至36）这里是0xa，即转换为十进制。
若我们输入的就是数值，通过strol函数返回的值即为我们输入的数值，不作改变。我们称它为input。而后，input作为第二个参数传递入fun7函数，给定地址作为第一个参数传递入fun7。
08048f5b <secret_phase>:8048f5b: 53 push %ebx8048f5c: 83 ec 18 sub $0x18,%esp8048f5f: e8 39 02 00 00 call 804919d <read_line>8048f64: c7 44 24 08 0a 00 00 movl $0xa,0x8(%esp) #参数38048f6b: 008048f6c: c7 44 24 04 00 00 00 movl $0x0,0x4(%esp) #参数28048f73: 008048f74: 89 04 24 mov %eax,(%esp) #参数1：read_line的返回值8048f77: e8 64 f9 ff ff call 80488e0 <strtol@plt>8048f7c: 89 c3 mov %eax,%ebx8048f7e: 8d 40 ff lea -0x1(%eax),%eax8048f81: 3d e8 03 00 00 cmp $0x3e8,%eax #0x3e8=10008048f86: 76 05 jbe 8048f8d <secret_phase+0x32> #strtol返回值<10008048f88: e8 e9 01 00 00 call 8049176 <explode_bomb>8048f8d: 89 5c 24 04 mov %ebx,0x4(%esp) #参数2：strtol的返回值(即为输入值input)8048f91: c7 04 24 88 c0 04 08 movl $0x804c088,(%esp) #*0x804c088="0x24"即36 参数18048f98: e8 6d ff ff ff call 8048f0a <fun7>8048f9d: 85 c0 test %eax,%eax8048f9f: 74 05 je 8048fa6 <secret_phase+0x4b> #fun7返回值得是08048fa1: e8 d0 01 00 00 call 8049176 <explode_bomb>8048fa6: c7 04 24 78 a2 04 08 movl $0x804a278,(%esp) #输出隐藏关通过8048fad: e8 4e f8 ff ff call 8048800 <puts@plt>8048fb2: e8 44 03 00 00 call 80492fb <phase_defused>8048fb7: 83 c4 18 add $0x18,%esp8048fba: 5b pop %ebx8048fbb: c3 ret（查看给定地址值）
（查看最后会输出什么[不必要，纯粹为了好玩]）
最后期待的是fun7返回的是0，这样就能够正确解出。
<fun7>检索目标元素
发现%ecx中一直存放我们之前输入的input值，从未被改变过。根据传入指针x所对应的值*x的值与input的关系来确定下一步的走向。有如下递归关系：
递归边界为x=0，即访问到最低地址，就返回-1（错误），事实上永远不可能访问到这个地方，因为这一段代码不是程序能够访问到的。
08048f0a <fun7>:8048f0a: 53 push %ebx8048f0b: 83 ec 18 sub $0x18,%esp8048f0e: 8b 54 24 20 mov 0x20(%esp),%edx #读取参数1放入%edx(x)8048f12: 8b 4c 24 24 mov 0x24(%esp),%ecx #读取参数2放入%ecx(input)8048f16: 85 d2 test %edx,%edx8048f18: 74 37 je 8048f51 <fun7+0x47> #x为0，返回-18048f1a: 8b 1a mov (%edx),%ebx8048f1c: 39 cb cmp %ecx,%ebx #比较input和*x8048f1e: 7e 13 jle 8048f33 <fun7+0x29>8048f20: 89 4c 24 04 mov %ecx,0x4(%esp) #*x>input 参数2：input8048f24: 8b 42 04 mov 0x4(%edx),%eax8048f27: 89 04 24 mov %eax,(%esp) #参数1：(x+4)8048f2a: e8 db ff ff ff call 8048f0a <fun7>8048f2f: 01 c0 add %eax,%eax8048f31: eb 23 jmp 8048f56 <fun7+0x4c> #返回(2fun7())8048f33: b8 00 00 00 00 mov $0x0,%eax #*x<=input8048f38: 39 cb cmp %ecx,%ebx8048f3a: 74 1a je 8048f56 <fun7+0x4c> #*x=input，返回08048f3c: 89 4c 24 04 mov %ecx,0x4(%esp) #参数2：input8048f40: 8b 42 08 mov 0x8(%edx),%eax8048f43: 89 04 24 mov %eax,(%esp) #参数1：(x+8)8048f46: e8 bf ff ff ff call 8048f0a <fun7> #调用fun7()8048f4b: 8d 44 00 01 lea 0x1(%eax,%eax,1),%eax8048f4f: eb 05 jmp 8048f56 <fun7+0x4c> #返回(2fun7()+1)8048f51: b8 ff ff ff ff mov $0xffffffff,%eax8048f56: 83 c4 18 add $0x18,%esp8048f59: 5b pop %ebx8048f5a: c3 ret就解这一道题而言，实际上十分轻松。因为要求返回0，我们只需要第一次进入这个递归结构的时候，就让input=x，它就退出并返回0了。在之前的<secret_phase>中我们已经查看过*0x804c088的值为0x24，即为36，所以这道题答案就是36，输入答案即可得到正确的结果。隐藏关卡就结束了。
深度拓展与思考：
事实上，之前的学长学姐和本级的同学有遇到要求返回值不是0的情况，这个时候就需要代入进去递归一下了。
此时有几个需要考虑的点：
- 最深层的那一层递归返回的结果肯定是0；
- 根据需要的结果来确定递归的层数以及所走路线。
举例说明：
若要求返回2，则一定是fun7(x,input)=2fun7(x+4)=2fun7(x+4+8)+1，即第一层是*x<input的，返回2fun7(x+4)；而第二层是*x>input，返回2fun7(x+8)+1；第三层是*x=input，返回0。在这种情况下只需要查看*（*（x+4）+8）即可找到正确的答案。
进一步思考树结构的实现：
实际上，本题为二叉检索树，上面我是将其作为一个数组去计算的，虽然也能做出最终的结果，但是显然不容易理解，下面我将从二叉检索树的角度重新理解本题。
本质上，如果我们以12字节为步长查看从0x804c088开始的地址空间，我们会发现这实际上是一个链表结构，每个节点都有三个域。第一位的是数据域，第二、三位是指针域，分别指向左孩子和右孩子的地址。
对于一个节点地址x来说，x为其数据域，（x+4）为其左孩子指针域，（x+8）为其右孩子指针域。所以上面我们在*x<input时访问（x+8），即访问其右孩子，这是根据二叉检索树的性质，该节点右边的肯定比该节点的数据要大。若*x>input也是同理的，本质上我们就是在模拟进行这个二叉检索树的检索过程。
如根据上面查看到的结果，我可以画出该二叉检索树的示意图如下。
研究到这个层面，就能够比较有效地解决问题较为复杂的问题了。
比如有同学遇到的要求fun7返回6，那么就可以看作是
即答案为0x23，十进制下为35。
解释原因也比较简单。
Fun7(x,input)=2*fun7(x+4,input)=2*[fun7(*(x+4)+8,input)+1]
=2*{2*fun7(*(*(x+4)+8)+8,input)+1]+1}=2*(2*(0+1)+1)=6
那么*(*(x+4)+8)+8就应该是最终的地址，也就是我们应该的输入值input，
因为input=*(*(x+4)+8)+8时才会返回0。
而根据上面这张图，就是先访问左孩子，再访问两次右孩子。
<撒花完结>
将所有答案保存进ans.txt内
（红框内可去掉，该题多解，只取一组即可）
（本来第四组也可以多解，但是要进入隐藏关，就只写了一组）
运行，可以得到所有炸弹都被成功拆除的提示。
至此，bomb-lab算是正式结束了。
附录：自己写的各部分phase的c代码（仅供参考看懂意思，不可运行）
void bomb()
{
}void phase_1()
{string s_ori = "I am for medical liability at the federal level.";string s_input;scanf("%s", &s_input);if (strings_not_equal(s_input, s_ori))bomb();
}void phase_2()
{int m[6];scanf("%d %d %d %d %d %d", &m[0], &m[1], &m[2], &m[3], &m[4], &m[5]);if (m[0] != 0)bomb();if (m[1] != 1)bomb();for (int i = 2; i <= 5; i++){int temp = m[i - 1] + m[i - 2];if (temp != m[i])bomb();}
}void phase_3()
{int n;char c;int m;if (scanf("%d %c %d", n, c, m) <= 2)bomb();if (n > 7)bomb();char temp;switch (n){case 0:if (m != 0x80)bomb();temp = 0x64;break;case 1:if (m != 0x135)bomb();temp = 0x6f;break;case 2:if (m != 0x348)bomb();temp = 0x67;break;case 3:if (m != 0x16d)bomb();temp = 0x6b;break;case 4:if (m != 0x1d7)bomb();temp = 0x75;break;case 5:if (m != 0x31b)bomb();temp = 0x72;break;case 6:if (m != 0x204)bomb();temp = 0x6e;break;case 7:if (m != 0xb0)bomb();temp = 0x6f;break;}if (temp != c)bomb();
}int func4(int n, int x)
{if (n == 0)return 0;if (n == 1)return x;return (result(n - 1, x) + result(n - 2, x) + x);
}void phase_4()
{int check, x;if (scanf("%d %d", check, x) != 2)bomb();if (x <= 1)bomb();if (x > 4)bomb();if (func4(9, x) != check)bomb();
}
void phase_5()
{string s;scanf("%s", s);if (string_length(s) != 6)bomb();int total = 0;for (int i = 0; i < 6; i++){total += m[s[i] & 0xf];}if (total != 0x38)bomb();
}void phase_6()
{int a[6];scanf("%d %d %d %d %d %d", &a[0], &a[1], &a[2], &a[3], &a[4], &a[5]);// 第一阶段：合规性检验if (a[0] > 6)bomb();for (int i = 1; i < 6; i++){if (a[i] > 6)bomb();for (int j = i; j < 6; j++){if (a[j] == a[i - 1])bomb();}}// 第二阶段：排序struct node{int data;int number;node *next;} struct node head;for (int i = 0; i < 6; i++){if (a[i] > 1) // 实际上这句可以不要，放这里可以看得更清晰一点{for (int j = 1; j < a[i]; j++){head = head->next;}b[i] = &head;}}// 第三阶段：复写下一状态*b[0]->next = *b[1];*b[1]->next = *b[2];*b[2]->next = *b[3];*b[3]->next = *b[4];*b[4]->next = *b[5];// 第四阶段：检验数据域递增性struct node *head;for (int i = 5; i > 0; i--){if (head->data > head->next->data)bomb();}
}
int fun7(int *x, int input)
{if (x == 0)return -1;if (*x > input)return 2 * fun7(x + 4, input); // 在左孩子中寻找else{if (*x == input) // 寻找到了return 0;else //*x<inputreturn 2 * fun7(x + 8, input) + 1; // 在右孩子中寻找}
}void secret_phase()
{readline();long input = strtol(readline(), 0x0, 0xa);if (input > 1000)bomb();if (fun7(0x804c088, input))bomb();
}这篇关于HNU-计算机系统-实验3-BombLab的文章就介绍到这儿，希望我们推荐的文章对编程师们有所帮助！
