func4() - This function was rather difficult for me to get through logically and so I ultimately had to take it as somewhat as a black box. In this repository I will take down my process of solving the bomb lab of CS:APP. Lets do the standard disas command to see the assembly of the function. Good work! DrEvil Actually in this part, the answer isn't unique. Go to file. Add abcdef as your Phase 5 solution in answers.txt, load the binary in r2's Debug mode, run analysis, then dcu sym.phase_5. Each offering of the Bomb Lab starts with a clean new ./bomblab. phase_5 Binary Bomb Lab :: Phase 6 - Zach Alexander Next, as we scan through each operation, we see that a register is being incremented at , followed by a jump-less-than statement right afterwards that takes us back up to . The address and stuff will vary, but . Thus on the 14th iteration if I needed a 6, I would need to be in the 14th index of the array on the 13th iteration, then on index 2 of the 12th iteration. Curses, you've found the secret phase! We can see that the function is being called which as the name implies compares two strings. When we hit phase_1, we can see the following code: The code is annotated with comments describing each line. There was a bunch of manipulation of stack space but there was nothing in the stack at that location and so it is likely a bunch of leg work. When, the student untars this file, it creates a directory (./bomb) with, bomb* Notifying custom bomb executable, bomb.c Source code for the main bomb routine, ID Identifies the student associated with this bomb, README Lists bomb number, student, and email address, The request server also creates a directory (bomblab/bombs/bomb), bomb.c Source code for main routine, bomb-quiet* A quiet version of bomb used for autograding, ID Identifies the user name assigned to this bomb, phases.c C source code for the bomb phases, README Lists bombID, user name, and email address, Result Server: Each time a student defuses a phase or explodes their, bomb, the bomb sends an HTTP message (called an autoresult string) to, the result server, which then appends the message to the scoreboard, log. Are you sure you want to create this branch? Identify the generic Linux machine ($SERVER_NAME) where you will, create the Bomb Lab directory (./bomblab) and, if you are offering the, online version, run the autograding service. je 0x40106a <phase_5+104> 0x0000000000401065 <+99>: callq 0x40163d <explode_bomb> ; explode_bomb . When in doubt "make stop; make start", However, resetting the lab deletes all old bombs, status logs, and the, scoreboard log. Upon entry to that secret stage you likely get the string 'Curses, you've found the secret phase!' To review, open the file in an editor that reveals hidden Unicode characters. How about the next one? Bomb Lab - 0x70RVS Analysis of Binary Bomb Lab GitHub requires that you keep the autograding service running non-stop, because handouts, grading, and reporting occur continuously for the, duration of the lab. . Has depleted uranium been considered for radiation shielding in crewed spacecraft beyond LEO? The third bomb is about the switch expression. In the interests of putting more Radare2 content out there, here's a noob friendly intro to r2 for those who already have a basic grasp of asm, C, and reversing in x86-64. That's number 2. solution to each bomb is available to the instructor. We can see that our string input blah is being compared with the string Border relations with Canada have never been better.. Using gdb we can convince our guess. Learn more about bidirectional Unicode characters. Did the Golden Gate Bridge 'flatten' under the weight of 300,000 people in 1987? Solved this is binary bomb lab phase 5.I didn't solve phase - Chegg It is important to step the test numbers in some way so you know which order they are in. Any numbers entered after the first 6 can be anything. First, setup your bomb directory. f7 ff ff callq 400bf0 <__isoc99_sscanf@plt>, : e8 a1 ff ff ff callq 40143a , fc ff ff callq 400bf0 <__isoc99_sscanf@plt>, : e8 c7 fb ff ff callq 400bf0 <__isoc99_sscanf@plt>, fa ff ff callq 400b30 <__stack_chk_fail@plt>. The LabID must not have any spaces. The second input had to be a 11, because the the phase_4 code did a simple compare, nothing special. It appears that there may be a secret stage. Binary Bomb Lab :: Phase 6. 1 first, so gdb is the most recent available version of GDB. A binary bomb is a program that consists of a sequence of six phases. Each bomb phase tests a different aspect of machine language programs: Phase 1: string comparison. Then you get the answer to be the pair(7, 0). Here is Phase 2. I should say the first half of the code is plain. A binary bomb is a program that consists of a . If there is a, problem (say because you forgot to update the list of machines the, bombs are allowed to run in src/config.h) you can fix the, configuration, reset the lab, and then request and run more test, CAUTION: If you reset the lab after it's live, you'll lose all your, records of the students bombs and their solutions. From the above, we see that we are passing some value into a register before calling scanf(). Ahhhh, recursion, right? CIA_MKUltraBrainwashing_Drugs . Informal Explanations of Phases 1 through 6: I have spent approximately 26 hours on this assignment. The code is comparing the string (presumably our input) stored in %eax to a fixed string stored at 0x804980b. I found the memory position for the beginning of phase_1 and placed a break point there. Binary Bomb - Accolade Evil has created a slew of "binary bombs" for our class. CSAPP-Labs/README-bomblab at master - Github phase_1 Make sure you update this. First, the numbers must be positive. phase_2 Thus I'm pretty confident that this will be the pass phrase for the first phase. Going back to the code for phase_2, we see that the first number has to be 1. I then restart the program and see if that got me through phase 1. If nothing happens, download Xcode and try again. On whose turn does the fright from a terror dive end? However, you know that the loop is doing some transitions on your input string. Nothing special other than the first number acting like a selector of jump paths to a linked second number. BOOM!!! It then updates the HTML scoreboard that summarizes, the current number of explosions and defusions for each bomb, rank. Each phase expects you to type a particular string on stdin.If you type the correct string, then the phase is defused and the bomb proceeds to the next phase. How does loop address alignment affect the speed on Intel x86_64? Many Git commands accept both tag and branch names, so creating this branch may cause unexpected behavior. The problem requires that the return value of the func4 should also be zero. not 0, 1, 5, 6, 7, 8, 9, 10, 11, 12, 898, 1587, number is between 0 and 14 using comparison statement When prompted, enter the command 'c' to continue. If the two string are of the same length, then it looks to see that the first inputed character is a non-zero (anything but a zero). strings_not_equal() - This function implements the test of equality between the user inputed string and the pass-phrase for phase_1 of the bomb challenge. Assignment #3: Bomb Lab (due on Tue, Feb 21, 2023 by 11:59pm) Introduction. func4 ??? For more information, you can refer to this document, which gives a handy tutorial on the phase 6. "make stop" ensures that there are no. The key is that each time you enter into the next element in the array there is a counter that increments. We can find the latter numbers from the loop structure. phase_4 PHASE 3. Each time the "bomb explodes", it notifies the server, resulting in a (-)1/5 point deduction from the final score for the lab. Then we encounter with an optimized switch expression. any particular student, is quiet, and hence can run on any host. servers running. sc2225/Bomb-Lab - Github Which one to choose? All things web. This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository. As a next step, lets input the test string abcdef and take a look at what the loop does to it. This command sets breakpoints throughout the code. aseje owo nla. Specifically: That's number 2. Are you sure you want to create this branch? Although the problems differ from each other, the main methods we take are totally the same. (up to -6 points deducted) Each bomb explosion notification that reaches the staff results in a 1 point deduction, capped at -6 points total. From phase_4, we call the four arguments of func4 to be a, b(known, 0), c(known, 14), d(known, 0). 565), Improving the copy in the close modal and post notices - 2023 edition, New blog post from our CEO Prashanth: Community is the future of AI. We see that a strings_not_equal function is being called. Entering this string defuses phase_1. Browse other questions tagged, Where developers & technologists share private knowledge with coworkers, Reach developers & technologists worldwide. The first number we can try to be 6 and the second must be 682. bomblab-Angr/Phase 5 x86_64.ipynb at master - Github Such bombs, We will also find it helpful to distinguish between custom and, Custom Bomb: A "custom bomb" has a BombID > 0, is associated with a, particular student, and can be either notifying or quiet. First thing I did was to search the binary using strings to see if there was anything interesting that pops out. Binary Bomb Lab :: Phase 1 - Zach Alexander What does the power set mean in the construction of Von Neumann universe? How about the next one? phase_4 To review, open the file in an editor that reveals hidden Unicode characters. You signed in with another tab or window. Learn more. edx must equal 0xf, meaning the first input has to be 5, 21, 37, etc. You create a table using the method above, and then you get the answer to be "ionefg". Well The first number must be between 0 and 7. Interpreting non-statistically significant results: Do we have "no evidence" or "insufficient evidence" to reject the null? gdb - binary bomb lab phase 6 - Stack Overflow We have created a stand-alone user-level autograding service that, handles all aspects of the Bomb Lab for you: Students download their, bombs from a server. explode_bomb we use, and get the following file (not the full code), We enter gdb, set a breakpoint at the phase 1. e = 16 Lets use that address in memory and see what it contains as a string. OK. :-) How about saving the world? Let's inspect the code at first. greatwhite.ics.cs.cmu.edu This part is really long. Content Discovery initiative April 13 update: Related questions using a Review our technical responses for the 2023 Developer Survey. But when I put 4 1 6 5 2 3 or 3 6 1 2 5 4, it explodes. Have a nice day! Link to Bomb Lab Instructions (pdf) in GitHub Repository daemon that starts and nannies the other programs in the service, checking their status every few seconds and restarting them if, (3) Stopping the Bomb Lab. secret_phase !!! phase_2 The variable being used in this comparison is $eax. First bomb lab is a Reverse Engineering challenge, you have to read its assembly to find the message that . You've defused the bomb! And when we execute it, it expects to receive certain inputs, otherwise it 'blows' up. Cannot retrieve contributors at this time. If you type the correct string, then. If this is a duplicate of another question, please link it so future readers can find it if their search turns up this question first. sign in The update. You will handout four of these files to the student: bomb, bomb.c, ID, Each student will hand in their solution file, which you can validate. And, as you can see at structure, the loop iterates 6 times. A tag already exists with the provided branch name. We can then set up a breakpoint upon entering phase_1 using b phase_1 and for the function explode_bomb to avoid losing points. I found various strings of interest. The Bomb Lab teaches students principles of, machine-level programs, as well as general debugger and reverse, A "binary bomb" is a Linux executable C program that consists of six, "phases." This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository. Enter disas and you will get a chunk of assembly for the function phase_1 which we put our breakpoint at. There are many things going on with shuffling of variables between registers, some bit shifting, and either a subtraction or an addition being applied to some of the hard coded constants. Bomb Lab Write-up. Servers run quietly, so they. Please feel free to fork or star this repo if you find it helpful!***. METU Ceng'e selamlar :)This is the first part of the Attack Lab. I will list some transitions here: The ascii code of "flyers" should be "102, 108, 121, 101, 114, 115". Use Git or checkout with SVN using the web URL. This looks familiar! This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository. As we have learned from the past phases, fixed values are almost always important. executable file 271 lines (271 sloc) 7.74 KB. Former New York University and Peking University student. Your goal is to set breakpoints and step through the binary code using gdb to figure out the program inputs that defuse the bombs (and make you gain points). ', After solving stage 3 you likely get the string 'Halfway there! You encounter with a loop and you can't find out what it is doing easily. This assignment gives you a binary program containing "bombs" which trigger a ping to our server (and make you lose points) if their inputs are wrong.