bomb lab phase_6 stuck

0
    <+0>: push   %r13
    <+2>: push   %r12
    <+4>: push   %rbp
    <+5>: push   %rbx
    <+6>: sub    $0x68,%rsp
    <+10>: mov    %fs:0x28,%rax
    <+19>: mov    %rax,0x58(%rsp)
    <+24>: xor    %eax,%eax
    <+26>: mov    %rsp,%r12
    <+29>: mov    %r12,%rsi
    <+32>: callq  0x5555555558cc <read_six_numbers>
    <+37>: mov    $0x0,%r13d
    <+43>: jmp    0x555555555594 <phase_6+82>
    <+45>: callq  0x5555555558a6 <explode_bomb>
    <+50>: jmp    0x5555555555a3 <phase_6+97>
    <+52>: add    $0x1,%ebx
    <+55>: cmp    $0x5,%ebx
    <+58>: jg     0x555555555590 <phase_6+78>
    <+60>: movslq %ebx,%rax
    <+63>: mov    (%rsp,%rax,4),%eax
    <+66>: cmp    %eax,0x0(%rbp)
    <+69>: jne    0x555555555576 <phase_6+52>
    <+71>: callq  0x5555555558a6 <explode_bomb>
    <+76>: jmp    0x555555555576 <phase_6+52>
    <+78>: add    $0x4,%r12
    <+82>: mov    %r12,%rbp
    <+85>: mov    (%r12),%eax
    <+89>: sub    $0x1,%eax
    <+92>: cmp    $0x5,%eax
    <+95>: ja     0x55555555556f <phase_6+45>
    <+97>: add    $0x1,%r13d
    <+101>:cmp    $0x6,%r13d
    <+105>:je     0x5555555555e2 <phase_6+160>
    <+107>:mov    %r13d,%ebx
    <+110>:jmp    0x55555555557e <phase_6+60>
    <+112>:mov    0x8(%rdx),%rdx
    <+116>:add    $0x1,%eax
    <+119>:cmp    %ecx,%eax
    <+121>:jne    0x5555555555b2 <phase_6+112>
    <+123>:mov    %rdx,0x20(%rsp,%rsi,8)
    <+128>:add    $0x1,%rsi
    <+132>:cmp    $0x6,%rsi
    <+136>:je     0x5555555555e9 <phase_6+167>
    <+138>:mov    (%rsp,%rsi,4),%ecx
    <+141>:mov    $0x1,%eax
    <+146>:lea    0x202c25(%rip),%rdx        # 0x555555758200 <node1>
    <+153>:cmp    $0x1,%ecx
    <+156>:jg     0x5555555555b2 <phase_6+112>
    <+158>:jmp    0x5555555555bd <phase_6+123>
    <+160>:mov    $0x0,%esi
    <+165>:jmp    0x5555555555cc <phase_6+138>
    <+167>:mov    0x20(%rsp),%rbx
    <+172>:mov    0x28(%rsp),%rax
    <+177>:mov    %rax,0x8(%rbx)
    <+181>:mov    0x30(%rsp),%rdx
    <+186>:mov    %rdx,0x8(%rax)
    <+190>:mov    0x38(%rsp),%rax
    <+195>:mov    %rax,0x8(%rdx)
    <+199>:mov    0x40(%rsp),%rdx
    <+204>:mov    %rdx,0x8(%rax)
    <+208>:mov    0x48(%rsp),%rax
    <+213>:mov    %rax,0x8(%rdx)
    <+217>:movq   $0x0,0x8(%rax)
    <+225>:mov    $0x5,%ebp
    <+230>:jmp    0x555555555633 <phase_6+241>
    <+232>:mov    0x8(%rbx),%rbx
    <+236>:sub    $0x1,%ebp
    <+239>:je     0x555555555644 <phase_6+258>
    <+241>:mov    0x8(%rbx),%rax
    <+245>:mov    (%rax),%eax
    <+247>:cmp    %eax,(%rbx)
    <+249>:jle    0x55555555562a <phase_6+232>
    <+251>:callq  0x5555555558a6 <explode_bomb>
    <+256>:jmp    0x55555555562a <phase_6+232>
    <+258>:mov    0x58(%rsp),%rax
    <+263>:xor    %fs:0x28,%rax
    <+272>:jne    0x55555555565f <phase_6+285>
    <+274>:add    $0x68,%rsp
    <+278>:pop    %rbx
    <+279>:pop    %rbp
    <+280>:pop    %r12
    <+282>:pop    %r13
    <+284>:retq   
    <+285>:callq  0x555555554e50 <__stack_chk_fail@plt>[/code] 

first i tried to find value of rdx, near 112. and i found some value

    node 1 = |322
    node 2 = ,|003
    node 3 = |342|000
    node 4 = |376|002
    node 5 = |213
    node 6 = |272

like this. so i put in answer 4,3,1,6,5,2 but it is not work so i try descending it not work too. so i use using another and find different value

node1=0x000000d2
node2=0x000002e2 
node3=0x0000032c
node4=0x000002fe
node5=0x0000018b
node6=0x000000ba

so i change this decimal and i compare each value and put in answer to ascending and descending it is not work too. why it is not answer?

assembly
x86
reverse-engineering
asked on Stack Overflow Oct 19, 2020 by Pengu

0 Answers

Nobody has answered this question yet.


User contributions licensed under CC BY-SA 3.0