Binary Bomb Lab - Phase 6 What is happening to my nodes?

0

After looking through the assembly, I know I need a pass that is

6 ints long - Each int in the pass is unique - The ints are in the range of 1 to 6

(gdb) disas
Dump of assembler code for function phase_6:
   0x0000000000401182 <+0>:     push   %r14
   0x0000000000401184 <+2>:     push   %r13
   0x0000000000401186 <+4>:     push   %r12
   0x0000000000401188 <+6>:     push   %rbp
   0x0000000000401189 <+7>:     push   %rbx
   0x000000000040118a <+8>:     sub    $0x50,%rsp
   0x000000000040118e <+12>:    mov    %rsp,%rsi
   0x0000000000401191 <+15>:    callq  0x401801 <read_six_numbers>
   0x0000000000401196 <+20>:    mov    %rsp,%r12
   0x0000000000401199 <+23>:    mov    %rsp,%r14
   0x000000000040119c <+26>:    mov    $0x0,%r13d
   0x00000000004011a2 <+32>:    mov    %r14,%rbp
   0x00000000004011a5 <+35>:    mov    (%r14),%eax
   0x00000000004011a8 <+38>:    sub    $0x1,%eax
   0x00000000004011ab <+41>:    cmp    $0x5,%eax
   0x00000000004011ae <+44>:    jbe    0x4011b5 <phase_6+51>
   0x00000000004011b0 <+46>:    callq  0x4016a5 <explode_bomb>
   0x00000000004011b5 <+51>:    add    $0x1,%r13d
   0x00000000004011b9 <+55>:    cmp    $0x6,%r13d
   0x00000000004011bd <+59>:    je     0x4011e0 <phase_6+94>
   0x00000000004011bf <+61>:    mov    %r13d,%ebx
   0x00000000004011c2 <+64>:    movslq %ebx,%rax
   0x00000000004011c5 <+67>:    mov    (%rsp,%rax,4),%edx
   0x00000000004011c8 <+70>:    cmp    %edx,0x0(%rbp)
   0x00000000004011cb <+73>:    jne    0x4011d2 <phase_6+80>
   0x00000000004011cd <+75>:    callq  0x4016a5 <explode_bomb>
   0x00000000004011d2 <+80>:    add    $0x1,%ebx
   0x00000000004011d5 <+83>:    cmp    $0x5,%ebx
   0x00000000004011d8 <+86>:    jle    0x4011c2 <phase_6+64>
   0x00000000004011da <+88>:    add    $0x4,%r14
   0x00000000004011de <+92>:    jmp    0x4011a2 <phase_6+32>
   0x00000000004011e0 <+94>:    lea    0x18(%rsp),%rcx
   0x00000000004011e5 <+99>:    mov    $0x7,%edx
---Type <return> to continue, or q <return> to quit---
   0x00000000004011ea <+104>:   mov    %edx,%eax
   0x00000000004011ec <+106>:   sub    (%r12),%eax
   0x00000000004011f0 <+110>:   mov    %eax,(%r12)
   0x00000000004011f4 <+114>:   add    $0x4,%r12
   0x00000000004011f8 <+118>:   cmp    %rcx,%r12
   0x00000000004011fb <+121>:   jne    0x4011ea <phase_6+104>
   0x00000000004011fd <+123>:   mov    $0x0,%esi
   0x0000000000401202 <+128>:   jmp    0x40121e <phase_6+156>
   0x0000000000401204 <+130>:   mov    0x8(%rdx),%rdx
   0x0000000000401208 <+134>:   add    $0x1,%eax
   0x000000000040120b <+137>:   cmp    %ecx,%eax
   0x000000000040120d <+139>:   jne    0x401204 <phase_6+130>
   0x000000000040120f <+141>:   mov    %rdx,0x20(%rsp,%rsi,2)
   0x0000000000401214 <+146>:   add    $0x4,%rsi
   0x0000000000401218 <+150>:   cmp    $0x18,%rsi
   0x000000000040121c <+154>:   je     0x401232 <phase_6+176>
   0x000000000040121e <+156>:   mov    (%rsp,%rsi,1),%ecx
   0x0000000000401221 <+159>:   mov    $0x1,%eax
   0x0000000000401226 <+164>:   mov    $0x604320,%edx
   0x000000000040122b <+169>:   cmp    $0x1,%ecx
   0x000000000040122e <+172>:   jg     0x401204 <phase_6+130>
   0x0000000000401230 <+174>:   jmp    0x40120f <phase_6+141>
   0x0000000000401232 <+176>:   mov    0x20(%rsp),%rbx
   0x0000000000401237 <+181>:   mov    0x28(%rsp),%rax
   0x000000000040123c <+186>:   mov    %rax,0x8(%rbx)
   0x0000000000401240 <+190>:   mov    0x30(%rsp),%rdx
   0x0000000000401245 <+195>:   mov    %rdx,0x8(%rax)
   0x0000000000401249 <+199>:   mov    0x38(%rsp),%rax
   0x000000000040124e <+204>:   mov    %rax,0x8(%rdx)
   0x0000000000401252 <+208>:   mov    0x40(%rsp),%rdx
   0x0000000000401257 <+213>:   mov    %rdx,0x8(%rax)
   0x000000000040125b <+217>:   mov    0x48(%rsp),%rax
   0x0000000000401260 <+222>:   mov    %rax,0x8(%rdx)
   0x0000000000401264 <+226>:   movq   $0x0,0x8(%rax)
---Type <return> to continue, or q <return> to quit---
   0x000000000040126c <+234>:   mov    $0x5,%ebp
   0x0000000000401271 <+239>:   mov    0x8(%rbx),%rax
   0x0000000000401275 <+243>:   mov    (%rax),%edx
=> 0x0000000000401277 <+245>:   cmp    %edx,(%rbx)
   0x0000000000401279 <+247>:   jge    0x401280 <phase_6+254>
   0x000000000040127b <+249>:   callq  0x4016a5 <explode_bomb>
   0x0000000000401280 <+254>:   mov    0x8(%rbx),%rbx
   0x0000000000401284 <+258>:   sub    $0x1,%ebp
   0x0000000000401287 <+261>:   jne    0x401271 <phase_6+239>
   0x0000000000401289 <+263>:   add    $0x50,%rsp
   0x000000000040128d <+267>:   pop    %rbx
   0x000000000040128e <+268>:   pop    %rbp
   0x000000000040128f <+269>:   pop    %r12
   0x0000000000401291 <+271>:   pop    %r13
   0x0000000000401293 <+273>:   pop    %r14
   0x0000000000401295 <+275>:   retq
End of assembler dump.
(gdb) x/3x $rbx
0x604370 <node6>:       0x00000139      0x00000006      0x00604360
(gdb) x/3x *($rbx+8)
0x604360 <node5>:       0x000000af      0x00000005      0x00604350
(gdb) x/3x *(*($rbx+8)+8)
0x604350 <node4>:       0x00000149      0x00000004      0x00604340
(gdb) x/3x *(*(*($rbx+8)+8)+8)
0x604340 <node3>:       0x0000033b      0x00000003      0x00604330
(gdb) x/3x *(*(*(*($rbx+8)+8)+8)+8)
0x604330 <node2>:       0x0000023f      0x00000002      0x00604320
(gdb) x/3x *(*(*(*(*($rbx+8)+8)+8)+8)+8)
0x604320 <node1>:       0x0000006d      0x00000001      0x00000000

My input was 1 2 3 4 5 6, but the linked list made was 6 5 4 3 2 1, so it should making the list from the end first. After organizing the numbers from greatest to smallest which gave me 3 2 4 6 5 1. I put in 1 5 6 4 2 3 hoping that 3 will be placed first as its the biggest but what was made instead was this

(gdb) x/3x $rbx
0x604370 <node6>:       0x00000139      0x00000006      0x00604330
(gdb) x/3x *($rbx+8)
0x604330 <node2>:       0x0000023f      0x00000002      0x00604320
(gdb) x/3x *(*($rbx+8)+8)
0x604320 <node1>:       0x0000006d      0x00000001      0x00604340
(gdb) x/3x *(*(*($rbx+8)+8)+8)
0x604340 <node3>:       0x0000033b      0x00000003      0x00604360
(gdb) x/3x *(*(*(*($rbx+8)+8)+8)+8)
0x604360 <node5>:       0x000000af      0x00000005      0x00604350
(gdb) x/3x *(*(*(*(*($rbx+8)+8)+8)+8)+8)
0x604350 <node4>:       0x00000149      0x00000004      0x00000000

Giving me a linked list of 6 2 1 3 5 4. What am I doing wrong that is causing this to happen?

assembly
x86
reverse-engineering
asked on Stack Overflow Sep 12, 2016 by J Mei

0 Answers

Nobody has answered this question yet.


User contributions licensed under CC BY-SA 3.0