-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathbomb.s(With Comments)
2433 lines (2345 loc) · 121 KB
/
bomb.s(With Comments)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
bomb: file format elf64-x86-64
Disassembly of section .init:
0000000000001000 <_init>:
1000: f3 0f 1e fa endbr64
1004: 48 83 ec 08 sub $0x8,%rsp
1008: 48 8b 05 d9 5f 00 00 mov 0x5fd9(%rip),%rax # 6fe8 <__gmon_start__>
100f: 48 85 c0 test %rax,%rax
1012: 74 02 je 1016 <_init+0x16>
1014: ff d0 callq *%rax
1016: 48 83 c4 08 add $0x8,%rsp
101a: c3 retq
Disassembly of section .plt:
0000000000001020 <.plt>:
1020: ff 35 ba 5e 00 00 pushq 0x5eba(%rip) # 6ee0 <_GLOBAL_OFFSET_TABLE_+0x8>
1026: f2 ff 25 bb 5e 00 00 bnd jmpq *0x5ebb(%rip) # 6ee8 <_GLOBAL_OFFSET_TABLE_+0x10>
102d: 0f 1f 00 nopl (%rax)
1030: f3 0f 1e fa endbr64
1034: 68 00 00 00 00 pushq $0x0
1039: f2 e9 e1 ff ff ff bnd jmpq 1020 <.plt>
103f: 90 nop
1040: f3 0f 1e fa endbr64
1044: 68 01 00 00 00 pushq $0x1
1049: f2 e9 d1 ff ff ff bnd jmpq 1020 <.plt>
104f: 90 nop
1050: f3 0f 1e fa endbr64
1054: 68 02 00 00 00 pushq $0x2
1059: f2 e9 c1 ff ff ff bnd jmpq 1020 <.plt>
105f: 90 nop
1060: f3 0f 1e fa endbr64
1064: 68 03 00 00 00 pushq $0x3
1069: f2 e9 b1 ff ff ff bnd jmpq 1020 <.plt>
106f: 90 nop
1070: f3 0f 1e fa endbr64
1074: 68 04 00 00 00 pushq $0x4
1079: f2 e9 a1 ff ff ff bnd jmpq 1020 <.plt>
107f: 90 nop
1080: f3 0f 1e fa endbr64
1084: 68 05 00 00 00 pushq $0x5
1089: f2 e9 91 ff ff ff bnd jmpq 1020 <.plt>
108f: 90 nop
1090: f3 0f 1e fa endbr64
1094: 68 06 00 00 00 pushq $0x6
1099: f2 e9 81 ff ff ff bnd jmpq 1020 <.plt>
109f: 90 nop
10a0: f3 0f 1e fa endbr64
10a4: 68 07 00 00 00 pushq $0x7
10a9: f2 e9 71 ff ff ff bnd jmpq 1020 <.plt>
10af: 90 nop
10b0: f3 0f 1e fa endbr64
10b4: 68 08 00 00 00 pushq $0x8
10b9: f2 e9 61 ff ff ff bnd jmpq 1020 <.plt>
10bf: 90 nop
10c0: f3 0f 1e fa endbr64
10c4: 68 09 00 00 00 pushq $0x9
10c9: f2 e9 51 ff ff ff bnd jmpq 1020 <.plt>
10cf: 90 nop
10d0: f3 0f 1e fa endbr64
10d4: 68 0a 00 00 00 pushq $0xa
10d9: f2 e9 41 ff ff ff bnd jmpq 1020 <.plt>
10df: 90 nop
10e0: f3 0f 1e fa endbr64
10e4: 68 0b 00 00 00 pushq $0xb
10e9: f2 e9 31 ff ff ff bnd jmpq 1020 <.plt>
10ef: 90 nop
10f0: f3 0f 1e fa endbr64
10f4: 68 0c 00 00 00 pushq $0xc
10f9: f2 e9 21 ff ff ff bnd jmpq 1020 <.plt>
10ff: 90 nop
1100: f3 0f 1e fa endbr64
1104: 68 0d 00 00 00 pushq $0xd
1109: f2 e9 11 ff ff ff bnd jmpq 1020 <.plt>
110f: 90 nop
1110: f3 0f 1e fa endbr64
1114: 68 0e 00 00 00 pushq $0xe
1119: f2 e9 01 ff ff ff bnd jmpq 1020 <.plt>
111f: 90 nop
1120: f3 0f 1e fa endbr64
1124: 68 0f 00 00 00 pushq $0xf
1129: f2 e9 f1 fe ff ff bnd jmpq 1020 <.plt>
112f: 90 nop
1130: f3 0f 1e fa endbr64
1134: 68 10 00 00 00 pushq $0x10
1139: f2 e9 e1 fe ff ff bnd jmpq 1020 <.plt>
113f: 90 nop
1140: f3 0f 1e fa endbr64
1144: 68 11 00 00 00 pushq $0x11
1149: f2 e9 d1 fe ff ff bnd jmpq 1020 <.plt>
114f: 90 nop
1150: f3 0f 1e fa endbr64
1154: 68 12 00 00 00 pushq $0x12
1159: f2 e9 c1 fe ff ff bnd jmpq 1020 <.plt>
115f: 90 nop
1160: f3 0f 1e fa endbr64
1164: 68 13 00 00 00 pushq $0x13
1169: f2 e9 b1 fe ff ff bnd jmpq 1020 <.plt>
116f: 90 nop
1170: f3 0f 1e fa endbr64
1174: 68 14 00 00 00 pushq $0x14
1179: f2 e9 a1 fe ff ff bnd jmpq 1020 <.plt>
117f: 90 nop
1180: f3 0f 1e fa endbr64
1184: 68 15 00 00 00 pushq $0x15
1189: f2 e9 91 fe ff ff bnd jmpq 1020 <.plt>
118f: 90 nop
1190: f3 0f 1e fa endbr64
1194: 68 16 00 00 00 pushq $0x16
1199: f2 e9 81 fe ff ff bnd jmpq 1020 <.plt>
119f: 90 nop
11a0: f3 0f 1e fa endbr64
11a4: 68 17 00 00 00 pushq $0x17
11a9: f2 e9 71 fe ff ff bnd jmpq 1020 <.plt>
11af: 90 nop
11b0: f3 0f 1e fa endbr64
11b4: 68 18 00 00 00 pushq $0x18
11b9: f2 e9 61 fe ff ff bnd jmpq 1020 <.plt>
11bf: 90 nop
11c0: f3 0f 1e fa endbr64
11c4: 68 19 00 00 00 pushq $0x19
11c9: f2 e9 51 fe ff ff bnd jmpq 1020 <.plt>
11cf: 90 nop
11d0: f3 0f 1e fa endbr64
11d4: 68 1a 00 00 00 pushq $0x1a
11d9: f2 e9 41 fe ff ff bnd jmpq 1020 <.plt>
11df: 90 nop
11e0: f3 0f 1e fa endbr64
11e4: 68 1b 00 00 00 pushq $0x1b
11e9: f2 e9 31 fe ff ff bnd jmpq 1020 <.plt>
11ef: 90 nop
11f0: f3 0f 1e fa endbr64
11f4: 68 1c 00 00 00 pushq $0x1c
11f9: f2 e9 21 fe ff ff bnd jmpq 1020 <.plt>
11ff: 90 nop
Disassembly of section .plt.got:
0000000000001200 <__cxa_finalize@plt>:
1200: f3 0f 1e fa endbr64
1204: f2 ff 25 ed 5d 00 00 bnd jmpq *0x5ded(%rip) # 6ff8 <__cxa_finalize@GLIBC_2.2.5>
120b: 0f 1f 44 00 00 nopl 0x0(%rax,%rax,1)
Disassembly of section .plt.sec:
0000000000001210 <getenv@plt>:
1210: f3 0f 1e fa endbr64
1214: f2 ff 25 d5 5c 00 00 bnd jmpq *0x5cd5(%rip) # 6ef0 <getenv@GLIBC_2.2.5>
121b: 0f 1f 44 00 00 nopl 0x0(%rax,%rax,1)
0000000000001220 <free@plt>:
1220: f3 0f 1e fa endbr64
1224: f2 ff 25 cd 5c 00 00 bnd jmpq *0x5ccd(%rip) # 6ef8 <free@GLIBC_2.2.5>
122b: 0f 1f 44 00 00 nopl 0x0(%rax,%rax,1)
0000000000001230 <strcasecmp@plt>:
1230: f3 0f 1e fa endbr64
1234: f2 ff 25 c5 5c 00 00 bnd jmpq *0x5cc5(%rip) # 6f00 <strcasecmp@GLIBC_2.2.5>
123b: 0f 1f 44 00 00 nopl 0x0(%rax,%rax,1)
0000000000001240 <__errno_location@plt>:
1240: f3 0f 1e fa endbr64
1244: f2 ff 25 bd 5c 00 00 bnd jmpq *0x5cbd(%rip) # 6f08 <__errno_location@GLIBC_2.2.5>
124b: 0f 1f 44 00 00 nopl 0x0(%rax,%rax,1)
0000000000001250 <strcpy@plt>:
1250: f3 0f 1e fa endbr64
1254: f2 ff 25 b5 5c 00 00 bnd jmpq *0x5cb5(%rip) # 6f10 <strcpy@GLIBC_2.2.5>
125b: 0f 1f 44 00 00 nopl 0x0(%rax,%rax,1)
0000000000001260 <puts@plt>:
1260: f3 0f 1e fa endbr64
1264: f2 ff 25 ad 5c 00 00 bnd jmpq *0x5cad(%rip) # 6f18 <puts@GLIBC_2.2.5>
126b: 0f 1f 44 00 00 nopl 0x0(%rax,%rax,1)
0000000000001270 <write@plt>:
1270: f3 0f 1e fa endbr64
1274: f2 ff 25 a5 5c 00 00 bnd jmpq *0x5ca5(%rip) # 6f20 <write@GLIBC_2.2.5>
127b: 0f 1f 44 00 00 nopl 0x0(%rax,%rax,1)
0000000000001280 <__stack_chk_fail@plt>:
1280: f3 0f 1e fa endbr64
1284: f2 ff 25 9d 5c 00 00 bnd jmpq *0x5c9d(%rip) # 6f28 <__stack_chk_fail@GLIBC_2.4>
128b: 0f 1f 44 00 00 nopl 0x0(%rax,%rax,1)
0000000000001290 <alarm@plt>:
1290: f3 0f 1e fa endbr64
1294: f2 ff 25 95 5c 00 00 bnd jmpq *0x5c95(%rip) # 6f30 <alarm@GLIBC_2.2.5>
129b: 0f 1f 44 00 00 nopl 0x0(%rax,%rax,1)
00000000000012a0 <close@plt>:
12a0: f3 0f 1e fa endbr64
12a4: f2 ff 25 8d 5c 00 00 bnd jmpq *0x5c8d(%rip) # 6f38 <close@GLIBC_2.2.5>
12ab: 0f 1f 44 00 00 nopl 0x0(%rax,%rax,1)
00000000000012b0 <read@plt>:
12b0: f3 0f 1e fa endbr64
12b4: f2 ff 25 85 5c 00 00 bnd jmpq *0x5c85(%rip) # 6f40 <read@GLIBC_2.2.5>
12bb: 0f 1f 44 00 00 nopl 0x0(%rax,%rax,1)
00000000000012c0 <fgets@plt>:
12c0: f3 0f 1e fa endbr64
12c4: f2 ff 25 7d 5c 00 00 bnd jmpq *0x5c7d(%rip) # 6f48 <fgets@GLIBC_2.2.5>
12cb: 0f 1f 44 00 00 nopl 0x0(%rax,%rax,1)
00000000000012d0 <signal@plt>:
12d0: f3 0f 1e fa endbr64
12d4: f2 ff 25 75 5c 00 00 bnd jmpq *0x5c75(%rip) # 6f50 <signal@GLIBC_2.2.5>
12db: 0f 1f 44 00 00 nopl 0x0(%rax,%rax,1)
00000000000012e0 <gethostbyname@plt>:
12e0: f3 0f 1e fa endbr64
12e4: f2 ff 25 6d 5c 00 00 bnd jmpq *0x5c6d(%rip) # 6f58 <gethostbyname@GLIBC_2.2.5>
12eb: 0f 1f 44 00 00 nopl 0x0(%rax,%rax,1)
00000000000012f0 <__memmove_chk@plt>:
12f0: f3 0f 1e fa endbr64
12f4: f2 ff 25 65 5c 00 00 bnd jmpq *0x5c65(%rip) # 6f60 <__memmove_chk@GLIBC_2.3.4>
12fb: 0f 1f 44 00 00 nopl 0x0(%rax,%rax,1)
0000000000001300 <memcpy@plt>:
1300: f3 0f 1e fa endbr64
1304: f2 ff 25 5d 5c 00 00 bnd jmpq *0x5c5d(%rip) # 6f68 <memcpy@GLIBC_2.14>
130b: 0f 1f 44 00 00 nopl 0x0(%rax,%rax,1)
0000000000001310 <malloc@plt>:
1310: f3 0f 1e fa endbr64
1314: f2 ff 25 55 5c 00 00 bnd jmpq *0x5c55(%rip) # 6f70 <malloc@GLIBC_2.2.5>
131b: 0f 1f 44 00 00 nopl 0x0(%rax,%rax,1)
0000000000001320 <fflush@plt>:
1320: f3 0f 1e fa endbr64
1324: f2 ff 25 4d 5c 00 00 bnd jmpq *0x5c4d(%rip) # 6f78 <fflush@GLIBC_2.2.5>
132b: 0f 1f 44 00 00 nopl 0x0(%rax,%rax,1)
0000000000001330 <__isoc99_sscanf@plt>:
1330: f3 0f 1e fa endbr64
1334: f2 ff 25 45 5c 00 00 bnd jmpq *0x5c45(%rip) # 6f80 <__isoc99_sscanf@GLIBC_2.7>
133b: 0f 1f 44 00 00 nopl 0x0(%rax,%rax,1)
0000000000001340 <__printf_chk@plt>:
1340: f3 0f 1e fa endbr64
1344: f2 ff 25 3d 5c 00 00 bnd jmpq *0x5c3d(%rip) # 6f88 <__printf_chk@GLIBC_2.3.4>
134b: 0f 1f 44 00 00 nopl 0x0(%rax,%rax,1)
0000000000001350 <fopen@plt>:
1350: f3 0f 1e fa endbr64
1354: f2 ff 25 35 5c 00 00 bnd jmpq *0x5c35(%rip) # 6f90 <fopen@GLIBC_2.2.5>
135b: 0f 1f 44 00 00 nopl 0x0(%rax,%rax,1)
0000000000001360 <gethostname@plt>:
1360: f3 0f 1e fa endbr64
1364: f2 ff 25 2d 5c 00 00 bnd jmpq *0x5c2d(%rip) # 6f98 <gethostname@GLIBC_2.2.5>
136b: 0f 1f 44 00 00 nopl 0x0(%rax,%rax,1)
0000000000001370 <exit@plt>:
1370: f3 0f 1e fa endbr64
1374: f2 ff 25 25 5c 00 00 bnd jmpq *0x5c25(%rip) # 6fa0 <exit@GLIBC_2.2.5>
137b: 0f 1f 44 00 00 nopl 0x0(%rax,%rax,1)
0000000000001380 <connect@plt>:
1380: f3 0f 1e fa endbr64
1384: f2 ff 25 1d 5c 00 00 bnd jmpq *0x5c1d(%rip) # 6fa8 <connect@GLIBC_2.2.5>
138b: 0f 1f 44 00 00 nopl 0x0(%rax,%rax,1)
0000000000001390 <__fprintf_chk@plt>:
1390: f3 0f 1e fa endbr64
1394: f2 ff 25 15 5c 00 00 bnd jmpq *0x5c15(%rip) # 6fb0 <__fprintf_chk@GLIBC_2.3.4>
139b: 0f 1f 44 00 00 nopl 0x0(%rax,%rax,1)
00000000000013a0 <sleep@plt>:
13a0: f3 0f 1e fa endbr64
13a4: f2 ff 25 0d 5c 00 00 bnd jmpq *0x5c0d(%rip) # 6fb8 <sleep@GLIBC_2.2.5>
13ab: 0f 1f 44 00 00 nopl 0x0(%rax,%rax,1)
00000000000013b0 <__ctype_b_loc@plt>:
13b0: f3 0f 1e fa endbr64
13b4: f2 ff 25 05 5c 00 00 bnd jmpq *0x5c05(%rip) # 6fc0 <__ctype_b_loc@GLIBC_2.3>
13bb: 0f 1f 44 00 00 nopl 0x0(%rax,%rax,1)
00000000000013c0 <__sprintf_chk@plt>:
13c0: f3 0f 1e fa endbr64
13c4: f2 ff 25 fd 5b 00 00 bnd jmpq *0x5bfd(%rip) # 6fc8 <__sprintf_chk@GLIBC_2.3.4>
13cb: 0f 1f 44 00 00 nopl 0x0(%rax,%rax,1)
00000000000013d0 <socket@plt>:
13d0: f3 0f 1e fa endbr64
13d4: f2 ff 25 f5 5b 00 00 bnd jmpq *0x5bf5(%rip) # 6fd0 <socket@GLIBC_2.2.5>
13db: 0f 1f 44 00 00 nopl 0x0(%rax,%rax,1)
Disassembly of section .text:
00000000000013e0 <_start>:
13e0: f3 0f 1e fa endbr64
13e4: 31 ed xor %ebp,%ebp
13e6: 49 89 d1 mov %rdx,%r9
13e9: 5e pop %rsi
13ea: 48 89 e2 mov %rsp,%rdx
13ed: 48 83 e4 f0 and $0xfffffffffffffff0,%rsp
13f1: 50 push %rax
13f2: 54 push %rsp
13f3: 4c 8d 05 66 1e 00 00 lea 0x1e66(%rip),%r8 # 3260 <__libc_csu_fini>
13fa: 48 8d 0d ef 1d 00 00 lea 0x1def(%rip),%rcx # 31f0 <__libc_csu_init>
1401: 48 8d 3d c1 00 00 00 lea 0xc1(%rip),%rdi # 14c9 <main>
1408: ff 15 d2 5b 00 00 callq *0x5bd2(%rip) # 6fe0 <__libc_start_main@GLIBC_2.2.5>
140e: f4 hlt
140f: 90 nop
0000000000001410 <deregister_tm_clones>:
1410: 48 8d 3d 49 70 00 00 lea 0x7049(%rip),%rdi # 8460 <stdout@@GLIBC_2.2.5>
1417: 48 8d 05 42 70 00 00 lea 0x7042(%rip),%rax # 8460 <stdout@@GLIBC_2.2.5>
141e: 48 39 f8 cmp %rdi,%rax
1421: 74 15 je 1438 <deregister_tm_clones+0x28>
1423: 48 8b 05 ae 5b 00 00 mov 0x5bae(%rip),%rax # 6fd8 <_ITM_deregisterTMCloneTable>
142a: 48 85 c0 test %rax,%rax
142d: 74 09 je 1438 <deregister_tm_clones+0x28>
142f: ff e0 jmpq *%rax
1431: 0f 1f 80 00 00 00 00 nopl 0x0(%rax)
1438: c3 retq
1439: 0f 1f 80 00 00 00 00 nopl 0x0(%rax)
0000000000001440 <register_tm_clones>:
1440: 48 8d 3d 19 70 00 00 lea 0x7019(%rip),%rdi # 8460 <stdout@@GLIBC_2.2.5>
1447: 48 8d 35 12 70 00 00 lea 0x7012(%rip),%rsi # 8460 <stdout@@GLIBC_2.2.5>
144e: 48 29 fe sub %rdi,%rsi
1451: 48 89 f0 mov %rsi,%rax
1454: 48 c1 ee 3f shr $0x3f,%rsi
1458: 48 c1 f8 03 sar $0x3,%rax
145c: 48 01 c6 add %rax,%rsi
145f: 48 d1 fe sar %rsi
1462: 74 14 je 1478 <register_tm_clones+0x38>
1464: 48 8b 05 85 5b 00 00 mov 0x5b85(%rip),%rax # 6ff0 <_ITM_registerTMCloneTable>
146b: 48 85 c0 test %rax,%rax
146e: 74 08 je 1478 <register_tm_clones+0x38>
1470: ff e0 jmpq *%rax
1472: 66 0f 1f 44 00 00 nopw 0x0(%rax,%rax,1)
1478: c3 retq
1479: 0f 1f 80 00 00 00 00 nopl 0x0(%rax)
0000000000001480 <__do_global_dtors_aux>:
1480: f3 0f 1e fa endbr64
1484: 80 3d fd 6f 00 00 00 cmpb $0x0,0x6ffd(%rip) # 8488 <completed.8060>
148b: 75 2b jne 14b8 <__do_global_dtors_aux+0x38>
148d: 55 push %rbp
148e: 48 83 3d 62 5b 00 00 cmpq $0x0,0x5b62(%rip) # 6ff8 <__cxa_finalize@GLIBC_2.2.5>
1495: 00
1496: 48 89 e5 mov %rsp,%rbp
1499: 74 0c je 14a7 <__do_global_dtors_aux+0x27>
149b: 48 8b 3d 66 5b 00 00 mov 0x5b66(%rip),%rdi # 7008 <__dso_handle>
14a2: e8 59 fd ff ff callq 1200 <__cxa_finalize@plt>
14a7: e8 64 ff ff ff callq 1410 <deregister_tm_clones>
14ac: c6 05 d5 6f 00 00 01 movb $0x1,0x6fd5(%rip) # 8488 <completed.8060>
14b3: 5d pop %rbp
14b4: c3 retq
14b5: 0f 1f 00 nopl (%rax)
14b8: c3 retq
14b9: 0f 1f 80 00 00 00 00 nopl 0x0(%rax)
00000000000014c0 <frame_dummy>:
14c0: f3 0f 1e fa endbr64
14c4: e9 77 ff ff ff jmpq 1440 <register_tm_clones>
00000000000014c9 <main>:
14c9: f3 0f 1e fa endbr64
14cd: 53 push %rbx
14ce: 83 ff 01 cmp $0x1,%edi
14d1: 74 51 je 1524 <main+0x5b>
14d3: 48 89 f3 mov %rsi,%rbx
14d6: 83 ff 02 cmp $0x2,%edi
14d9: 75 7b jne 1556 <main+0x8d>
14db: 48 8b 7e 08 mov 0x8(%rsi),%rdi
14df: 48 8d 35 b0 32 00 00 lea 0x32b0(%rip),%rsi # 4796 <transition_table+0x3d6>
14e6: e8 65 fe ff ff callq 1350 <fopen@plt>
14eb: 48 89 05 9e 6f 00 00 mov %rax,0x6f9e(%rip) # 8490 <infile>
14f2: 48 85 c0 test %rax,%rax
14f5: 74 3d je 1534 <main+0x6b>
14f7: e8 64 08 00 00 callq 1d60 <initialize_bomb>
14fc: 48 89 c3 mov %rax,%rbx
14ff: 81 38 11 fa 22 20 cmpl $0x2022fa11,(%rax)
1505: 74 72 je 1579 <main+0xb0>
1507: 48 8d 35 7a 2b 00 00 lea 0x2b7a(%rip),%rsi # 4088 <_IO_stdin_used+0x88>
150e: bf 01 00 00 00 mov $0x1,%edi
1513: b8 00 00 00 00 mov $0x0,%eax
1518: e8 23 fe ff ff callq 1340 <__printf_chk@plt>
151d: b8 00 00 00 00 mov $0x0,%eax
1522: 5b pop %rbx
1523: c3 retq
1524: 48 8b 05 45 6f 00 00 mov 0x6f45(%rip),%rax # 8470 <stdin@@GLIBC_2.2.5>
152b: 48 89 05 5e 6f 00 00 mov %rax,0x6f5e(%rip) # 8490 <infile>
1532: eb c3 jmp 14f7 <main+0x2e>
1534: 48 8b 4b 08 mov 0x8(%rbx),%rcx
1538: 48 8b 13 mov (%rbx),%rdx
153b: 48 8d 35 c2 2a 00 00 lea 0x2ac2(%rip),%rsi # 4004 <_IO_stdin_used+0x4>
1542: bf 01 00 00 00 mov $0x1,%edi
1547: e8 f4 fd ff ff callq 1340 <__printf_chk@plt>
154c: bf 08 00 00 00 mov $0x8,%edi
1551: e8 1a fe ff ff callq 1370 <exit@plt>
1556: 48 8b 16 mov (%rsi),%rdx
1559: 48 8d 35 c1 2a 00 00 lea 0x2ac1(%rip),%rsi # 4021 <_IO_stdin_used+0x21>
1560: bf 01 00 00 00 mov $0x1,%edi
1565: b8 00 00 00 00 mov $0x0,%eax
156a: e8 d1 fd ff ff callq 1340 <__printf_chk@plt>
156f: bf 08 00 00 00 mov $0x8,%edi
1574: e8 f7 fd ff ff callq 1370 <exit@plt>
1579: 48 8d 3d 48 2b 00 00 lea 0x2b48(%rip),%rdi # 40c8 <_IO_stdin_used+0xc8>
1580: e8 db fc ff ff callq 1260 <puts@plt>
1585: 48 8d 3d 7c 2b 00 00 lea 0x2b7c(%rip),%rdi # 4108 <_IO_stdin_used+0x108>
158c: e8 cf fc ff ff callq 1260 <puts@plt>
1591: e8 83 0c 00 00 callq 2219 <read_line>
1596: 48 89 c7 mov %rax,%rdi
1599: e8 0f 02 00 00 callq 17ad <phase_1>
159e: 48 89 df mov %rbx,%rdi
15a1: e8 be 0d 00 00 callq 2364 <phase_defused>
15a6: 48 8d 3d 9b 2b 00 00 lea 0x2b9b(%rip),%rdi # 4148 <_IO_stdin_used+0x148>
15ad: e8 ae fc ff ff callq 1260 <puts@plt>
15b2: e8 62 0c 00 00 callq 2219 <read_line>
15b7: 48 89 c7 mov %rax,%rdi
15ba: e8 12 02 00 00 callq 17d1 <phase_2>
15bf: 48 89 df mov %rbx,%rdi
15c2: e8 9d 0d 00 00 callq 2364 <phase_defused>
15c7: 48 8d 3d 6d 2a 00 00 lea 0x2a6d(%rip),%rdi # 403b <_IO_stdin_used+0x3b>
15ce: e8 8d fc ff ff callq 1260 <puts@plt>
15d3: e8 41 0c 00 00 callq 2219 <read_line>
15d8: 48 89 c7 mov %rax,%rdi
15db: e8 6e 02 00 00 callq 184e <phase_3>
15e0: 48 89 df mov %rbx,%rdi
15e3: e8 7c 0d 00 00 callq 2364 <phase_defused>
15e8: 48 8d 3d 69 2a 00 00 lea 0x2a69(%rip),%rdi # 4058 <_IO_stdin_used+0x58>
15ef: e8 6c fc ff ff callq 1260 <puts@plt>
15f4: e8 20 0c 00 00 callq 2219 <read_line>
15f9: 48 89 c7 mov %rax,%rdi
15fc: e8 3f 03 00 00 callq 1940 <phase_4>
1601: 48 89 df mov %rbx,%rdi
1604: e8 5b 0d 00 00 callq 2364 <phase_defused>
1609: 48 8d 3d 68 2b 00 00 lea 0x2b68(%rip),%rdi # 4178 <_IO_stdin_used+0x178>
1610: e8 4b fc ff ff callq 1260 <puts@plt>
1615: e8 ff 0b 00 00 callq 2219 <read_line>
161a: 48 89 c7 mov %rax,%rdi
161d: e8 9d 03 00 00 callq 19bf <phase_5>
1622: 48 89 df mov %rbx,%rdi
1625: e8 3a 0d 00 00 callq 2364 <phase_defused>
162a: 48 8d 3d 36 2a 00 00 lea 0x2a36(%rip),%rdi # 4067 <_IO_stdin_used+0x67>
1631: e8 2a fc ff ff callq 1260 <puts@plt>
1636: e8 de 0b 00 00 callq 2219 <read_line>
163b: 48 89 c7 mov %rax,%rdi
163e: e8 cb 03 00 00 callq 1a0e <phase_6>
1643: 48 89 df mov %rbx,%rdi
1646: e8 19 0d 00 00 callq 2364 <phase_defused>
164b: 48 89 df mov %rbx,%rdi
164e: e8 cd fb ff ff callq 1220 <free@plt>
1653: e9 c5 fe ff ff jmpq 151d <main+0x54>
0000000000001658 <abracadabra>:
1658: f3 0f 1e fa endbr64
165c: 48 81 ec a8 00 00 00 sub $0xa8,%rsp
1663: 64 48 8b 04 25 28 00 mov %fs:0x28,%rax
166a: 00 00
166c: 48 89 84 24 98 00 00 mov %rax,0x98(%rsp)
1673: 00
1674: 31 c0 xor %eax,%eax
1676: 48 8d 4c 24 0c lea 0xc(%rsp),%rcx
167b: 48 8d 54 24 08 lea 0x8(%rsp),%rdx
1680: 48 83 ec 08 sub $0x8,%rsp
1684: 48 8d 44 24 28 lea 0x28(%rsp),%rax
1689: 50 push %rax
168a: 48 8d 44 24 2c lea 0x2c(%rsp),%rax
168f: 50 push %rax
1690: 48 8d 44 24 30 lea 0x30(%rsp),%rax
1695: 50 push %rax
1696: 4c 8d 4c 24 34 lea 0x34(%rsp),%r9
169b: 4c 8d 44 24 30 lea 0x30(%rsp),%r8
16a0: 48 8d 35 f5 2a 00 00 lea 0x2af5(%rip),%rsi # 419c <_IO_stdin_used+0x19c>
16a7: 48 8d 3d 6a 6e 00 00 lea 0x6e6a(%rip),%rdi # 8518 <input_strings+0x78>
16ae: b8 00 00 00 00 mov $0x0,%eax
16b3: e8 78 fc ff ff callq 1330 <__isoc99_sscanf@plt>
16b8: 48 83 c4 20 add $0x20,%rsp
16bc: 83 f8 07 cmp $0x7,%eax
16bf: 74 20 je 16e1 <abracadabra+0x89>
16c1: b8 00 00 00 00 mov $0x0,%eax
16c6: 48 8b b4 24 98 00 00 mov 0x98(%rsp),%rsi
16cd: 00
16ce: 64 48 33 34 25 28 00 xor %fs:0x28,%rsi
16d5: 00 00
16d7: 75 2b jne 1704 <abracadabra+0xac>
16d9: 48 81 c4 a8 00 00 00 add $0xa8,%rsp
16e0: c3 retq
16e1: 48 8d 7c 24 20 lea 0x20(%rsp),%rdi
16e6: 48 8d 35 cb 2a 00 00 lea 0x2acb(%rip),%rsi # 41b8 <_IO_stdin_used+0x1b8>
16ed: e8 1d 06 00 00 callq 1d0f <strings_not_equal>
16f2: 85 c0 test %eax,%eax
16f4: 74 07 je 16fd <abracadabra+0xa5>
16f6: b8 00 00 00 00 mov $0x0,%eax
16fb: eb c9 jmp 16c6 <abracadabra+0x6e>
16fd: b8 01 00 00 00 mov $0x1,%eax
1702: eb c2 jmp 16c6 <abracadabra+0x6e>
1704: e8 77 fb ff ff callq 1280 <__stack_chk_fail@plt>
0000000000001709 <alohomora>:
1709: f3 0f 1e fa endbr64
170d: 48 81 ec 98 00 00 00 sub $0x98,%rsp
1714: 64 48 8b 04 25 28 00 mov %fs:0x28,%rax
171b: 00 00
171d: 48 89 84 24 88 00 00 mov %rax,0x88(%rsp)
1724: 00
1725: 31 c0 xor %eax,%eax
1727: 48 8d 4c 24 0c lea 0xc(%rsp),%rcx
172c: 48 8d 54 24 08 lea 0x8(%rsp),%rdx
1731: 4c 8d 44 24 10 lea 0x10(%rsp),%r8
1736: 48 8d 35 6b 2a 00 00 lea 0x2a6b(%rip),%rsi # 41a8 <_IO_stdin_used+0x1a8>
173d: 48 8d 3d c4 6e 00 00 lea 0x6ec4(%rip),%rdi # 8608 <input_strings+0x168>
1744: e8 e7 fb ff ff callq 1330 <__isoc99_sscanf@plt>
1749: 83 f8 03 cmp $0x3,%eax
174c: 74 20 je 176e <alohomora+0x65>
174e: b8 00 00 00 00 mov $0x0,%eax
1753: 48 8b b4 24 88 00 00 mov 0x88(%rsp),%rsi
175a: 00
175b: 64 48 33 34 25 28 00 xor %fs:0x28,%rsi
1762: 00 00
1764: 75 42 jne 17a8 <alohomora+0x9f>
1766: 48 81 c4 98 00 00 00 add $0x98,%rsp
176d: c3 retq
176e: 48 8d 54 24 10 lea 0x10(%rsp),%rdx
1773: 0f b6 02 movzbl (%rdx),%eax
1776: 84 c0 test %al,%al
1778: 74 0b je 1785 <alohomora+0x7c>
177a: 83 c0 02 add $0x2,%eax
177d: 88 02 mov %al,(%rdx)
177f: 48 83 c2 01 add $0x1,%rdx
1783: eb ee jmp 1773 <alohomora+0x6a>
1785: 48 8d 7c 24 10 lea 0x10(%rsp),%rdi
178a: 48 8d 35 47 2a 00 00 lea 0x2a47(%rip),%rsi # 41d8 <_IO_stdin_used+0x1d8>
1791: e8 79 05 00 00 callq 1d0f <strings_not_equal>
1796: 85 c0 test %eax,%eax
1798: 74 07 je 17a1 <alohomora+0x98>
179a: b8 00 00 00 00 mov $0x0,%eax
179f: eb b2 jmp 1753 <alohomora+0x4a>
17a1: b8 01 00 00 00 mov $0x1,%eax
17a6: eb ab jmp 1753 <alohomora+0x4a>
17a8: e8 d3 fa ff ff callq 1280 <__stack_chk_fail@plt>
00000000000017ad <phase_1>:
17ad: f3 0f 1e fa endbr64
17b1: 48 83 ec 08 sub $0x8,%rsp
17b5: 48 8d 35 44 2a 00 00 lea 0x2a44(%rip),%rsi # 4200 <_IO_stdin_used+0x200>
17bc: e8 4e 05 00 00 callq 1d0f <strings_not_equal>
17c1: 85 c0 test %eax,%eax
17c3: 75 05 jne 17ca <phase_1+0x1d>
17c5: 48 83 c4 08 add $0x8,%rsp
17c9: c3 retq
17ca: e8 17 09 00 00 callq 20e6 <explode_bomb>
17cf: eb f4 jmp 17c5 <phase_1+0x18>
00000000000017d1 <phase_2>:
17d1: f3 0f 1e fa endbr64
17d5: 53 push %rbx
17d6: 48 83 ec 20 sub $0x20,%rsp
17da: 64 48 8b 04 25 28 00 mov %fs:0x28,%rax
17e1: 00 00
17e3: 48 89 44 24 18 mov %rax,0x18(%rsp)
17e8: 31 c0 xor %eax,%eax
17ea: 48 89 e6 mov %rsp,%rsi
17ed: e8 e2 09 00 00 callq 21d4 <read_six_numbers>
实际上，read_six_numbers对于解决炸弹没有什么作用，只是一个sscanf的功能
(读入string, 转换为六个数,存放在%rsp栈中, 可以使用 x/nwd $rsp 检查栈的内存内容).
17f2: 83 3c 24 00 cmpl $0x0,(%rsp)
17f6: 75 07 jne 17ff <phase_2+0x2e>
17f8: 83 7c 24 04 01 cmpl $0x1,0x4(%rsp)
17fd: 74 05 je 1804 <phase_2+0x33> 第二个数是1, 因此跳过炸弹.
17ff: e8 e2 08 00 00 callq 20e6 <explode_bomb>
1804: bb 02 00 00 00 mov $0x2,%ebx
1809: eb 08 jmp 1813 <phase_2+0x42> //To: 1813
180b: e8 d6 08 00 00 callq 20e6 <explode_bomb>
1810: 83 c3 01 add $0x1,%ebx
1813: 83 fb 05 cmp $0x5,%ebx
1816: 7f 1b jg 1833 <phase_2+0x62> //当%ebx大于5的时候，去往1833.
1818: 48 63 d3 movslq %ebx,%rdx
181b: 8d 4b fe lea -0x2(%rbx),%ecx
181e: 48 63 c9 movslq %ecx,%rcx
1821: 8d 43 ff lea -0x1(%rbx),%eax
1824: 48 98 cltq
在此之后与输入发生联系.
1826: 8b 04 84 mov (%rsp,%rax,4),%eax
1829: 03 04 8c add (%rsp,%rcx,4),%eax
182c: 39 04 94 cmp %eax,(%rsp,%rdx,4) //这一步隐含着Fibonacci数列的递推.
182f: 74 df je 1810 <phase_2+0x3f> //相等时，去往1810.
1831: eb d8 jmp 180b <phase_2+0x3a> //爆炸.
1833: 48 8b 44 24 18 mov 0x18(%rsp),%rax
1838: 64 48 33 04 25 28 00 xor %fs:0x28,%rax
183f: 00 00
1841: 75 06 jne 1849 <phase_2+0x78>
1843: 48 83 c4 20 add $0x20,%rsp
1847: 5b pop %rbx
1848: c3 retq
1849: e8 32 fa ff ff callq 1280 <__stack_chk_fail@plt>
000000000000184e <phase_3>:
184e: f3 0f 1e fa endbr64
1852: 48 83 ec 18 sub $0x18,%rsp
1856: 64 48 8b 04 25 28 00 mov %fs:0x28,%rax
185d: 00 00
185f: 48 89 44 24 08 mov %rax,0x8(%rsp)
1864: 31 c0 xor %eax,%eax
1866: 48 8d 4c 24 04 lea 0x4(%rsp),%rcx
186b: 48 89 e2 mov %rsp,%rdx
186e: 48 8d 35 83 2e 00 00 lea 0x2e83(%rip),%rsi # 46f8 <transition_table+0x338>
//%rsi:0x5565b22606f8 -> "%d %d" -> 输入两个整数.
//%rdi: 输入的两个整数编码为字符串.
1875: e8 b6 fa ff ff callq 1330 <__isoc99_sscanf@plt>
//将输入传到%rsp栈中
187a: 83 f8 01 cmp $0x1,%eax
187d: 7e 1b jle 189a <phase_3+0x4c> //%rax(unsigned)如果大于1, 去往炸弹189a.
187f: 8b 04 24 mov (%rsp),%eax //把第一个输入进去的数传给了%rax.
1882: 83 f8 07 cmp $0x7,%eax
1885: 77 64 ja 18eb <phase_3+0x9d> //%rax(unsigned)如果大于7, 就去往炸弹18eb.
1887: 89 c0 mov %eax,%eax
1889: 48 8d 15 d0 2a 00 00 lea 0x2ad0(%rip),%rdx # 4360 <_IO_stdin_used+0x360>
1890: 48 63 04 82 movslq (%rdx,%rax,4),%rax
1894: 48 01 d0 add %rdx,%rax
1897: 3e ff e0 notrack jmpq *%rax //去往18cf.
189a: e8 47 08 00 00 callq 20e6 <explode_bomb>
189f: eb de jmp 187f <phase_3+0x31>
18a1: b8 a6 02 00 00 mov $0x2a6,%eax
18a6: 39 44 24 04 cmp %eax,0x4(%rsp)
18aa: 75 52 jne 18fe <phase_3+0xb0> //如果不相等, 就去往炸弹18fe.
18ac: 48 8b 44 24 08 mov 0x8(%rsp),%rax
18b1: 64 48 33 04 25 28 00 xor %fs:0x28,%rax //%rax=0.
18b8: 00 00
18ba: 75 49 jne 1905 <phase_3+0xb7>
18bc: 48 83 c4 18 add $0x18,%rsp
18c0: c3 retq
18c1: b8 97 03 00 00 mov $0x397,%eax
18c6: eb de jmp 18a6 <phase_3+0x58>
18c8: b8 64 01 00 00 mov $0x164,%eax
18cd: eb d7 jmp 18a6 <phase_3+0x58>
18cf: b8 24 03 00 00 mov $0x324,%eax //此时$eax里面是0x324.
18d4: eb d0 jmp 18a6 <phase_3+0x58>
18d6: b8 d4 00 00 00 mov $0xd4,%eax
18db: eb c9 jmp 18a6 <phase_3+0x58>
18dd: b8 01 03 00 00 mov $0x301,%eax
18e2: eb c2 jmp 18a6 <phase_3+0x58>
18e4: b8 0e 03 00 00 mov $0x30e,%eax
18e9: eb bb jmp 18a6 <phase_3+0x58>
18eb: e8 f6 07 00 00 callq 20e6 <explode_bomb>
18f0: b8 00 00 00 00 mov $0x0,%eax
18f5: eb af jmp 18a6 <phase_3+0x58>
18f7: b8 ef 00 00 00 mov $0xef,%eax
18fc: eb a8 jmp 18a6 <phase_3+0x58>
18fe: e8 e3 07 00 00 callq 20e6 <explode_bomb>
1903: eb a7 jmp 18ac <phase_3+0x5e>
1905: e8 76 f9 ff ff callq 1280 <__stack_chk_fail@plt>
000000000000190a <func4>:
190a: f3 0f 1e fa endbr64
190e: 53 push %rbx
190f: 89 d0 mov %edx,%eax
1911: 29 f0 sub %esi,%eax
1913: 89 c3 mov %eax,%ebx
1915: c1 eb 1f shr $0x1f,%ebx
1918: 01 c3 add %eax,%ebx
191a: d1 fb sar %ebx
191c: 01 f3 add %esi,%ebx
191e: 39 fb cmp %edi,%ebx
1920: 7f 06 jg 1928 <func4+0x1e>
1922: 7c 10 jl 1934 <func4+0x2a>
1924: 89 d8 mov %ebx,%eax
1926: 5b pop %rbx
1927: c3 retq
1928: 8d 53 ff lea -0x1(%rbx),%edx
192b: e8 da ff ff ff callq 190a <func4>
1930: 01 c3 add %eax,%ebx
1932: eb f0 jmp 1924 <func4+0x1a>
1934: 8d 73 01 lea 0x1(%rbx),%esi
1937: e8 ce ff ff ff callq 190a <func4>
193c: 01 c3 add %eax,%ebx
193e: eb e4 jmp 1924 <func4+0x1a>
0000000000001940 <phase_4>:
1940: f3 0f 1e fa endbr64
1944: 48 83 ec 18 sub $0x18,%rsp
1948: 64 48 8b 04 25 28 00 mov %fs:0x28,%rax
194f: 00 00
1951: 48 89 44 24 08 mov %rax,0x8(%rsp)
1956: 31 c0 xor %eax,%eax
1958: 48 8d 4c 24 04 lea 0x4(%rsp),%rcx
195d: 48 89 e2 mov %rsp,%rdx
1960: 48 8d 35 91 2d 00 00 lea 0x2d91(%rip),%rsi # 46f8 <transition_table+0x338>
%rsi:0x55872f0136f8 -> "%d, %d" -> 表明输入要求是两个整数.
%rdi:存放(char*)输入.
1967: e8 c4 f9 ff ff callq 1330 <__isoc99_sscanf@plt>
输入进去的两个数被传到了%rsp栈中.
196c: 83 f8 02 cmp $0x2,%eax
196f: 75 0c jne 197d <phase_4+0x3d>
1971: 8b 04 24 mov (%rsp),%eax //把第一个输入进去的数传给了%rax.
1974: 85 c0 test %eax,%eax
1976: 78 05 js 197d <phase_4+0x3d> //如果第一个输入，那么去往炸弹197d.
1978: 83 f8 0e cmp $0xe,%eax //如果第一个输入小于等于14, 那么去往1982(跳过炸弹), 否则炸弹爆炸.
197b: 7e 05 jle 1982 <phase_4+0x42>
197d: e8 64 07 00 00 callq 20e6 <explode_bomb>
1982: ba 0e 00 00 00 mov $0xe,%edx
1987: be 00 00 00 00 mov $0x0,%esi
198c: 8b 3c 24 mov (%rsp),%edi
198f: e8 76 ff ff ff callq 190a <func4>
1994: 83 f8 12 cmp $0x12,%eax //这个0x12也是十六进制啊! 表示18.
1997: 75 07 jne 19a0 <phase_4+0x60> //如果func4的返回值不是0x12, 就去往炸弹19a0.
1999: 83 7c 24 04 12 cmpl $0x12,0x4(%rsp)
199e: 74 05 je 19a5 <phase_4+0x65> //如果%rsp栈中的第二个数不是0x12, 就去往炸弹,否则可以跳过炸弹去往19a5.
19a0: e8 41 07 00 00 callq 20e6 <explode_bomb>
19a5: 48 8b 44 24 08 mov 0x8(%rsp),%rax
19aa: 64 48 33 04 25 28 00 xor %fs:0x28,%rax
19b1: 00 00
19b3: 75 05 jne 19ba <phase_4+0x7a>
19b5: 48 83 c4 18 add $0x18,%rsp //回收%rsp栈中空间.
19b9: c3 retq
19ba: e8 c1 f8 ff ff callq 1280 <__stack_chk_fail@plt>
00000000000019bf <phase_5>:
19bf: f3 0f 1e fa endbr64
19c3: 53 push %rbx
19c4: 48 89 fb mov %rdi,%rbx
%rdi:盛放输入进去的字符串.
%rbx:存放输入进去的字符串的地址.
19c7: e8 2b 03 00 00 callq 1cf7 <string_length>
19cc: 83 f8 06 cmp $0x6,%eax
19cf: 75 28 jne 19f9 <phase_5+0x3a> //如果返回值不是6, 那么去往炸弹19f9.
19d1: b9 00 00 00 00 mov $0x0,%ecx
19d6: b8 00 00 00 00 mov $0x0,%eax
19db: 83 f8 05 cmp $0x5,%eax
19de: 7f 20 jg 1a00 <phase_5+0x41>
19e0: 48 63 d0 movslq %eax,%rdx //Mask:掩码, 去最后一个字节.
19e3: 0f b6 14 13 movzbl (%rbx,%rdx,1),%edx
19e7: 83 e2 0f and $0xf,%edx
19ea: 48 8d 35 8f 29 00 00 lea 0x298f(%rip),%rsi # 4380 <array.3500>
19f1: 03 0c 96 add (%rsi,%rdx,4),%ecx
19f4: 83 c0 01 add $0x1,%eax
19f7: eb e2 jmp 19db <phase_5+0x1c>
19f9: e8 e8 06 00 00 callq 20e6 <explode_bomb>
19fe: eb d1 jmp 19d1 <phase_5+0x12>
1a00: 83 f9 41 cmp $0x41,%ecx
1a03: 75 02 jne 1a07 <phase_5+0x48> //如果%rcx的值不是0x41(Ascii:'A'), 就去往炸弹1a07.
1a05: 5b pop %rbx
1a06: c3 retq
1a07: e8 da 06 00 00 callq 20e6 <explode_bomb>
1a0c: eb f7 jmp 1a05 <phase_5+0x46>
0000000000001a0e <phase_6>:
1a0e: f3 0f 1e fa endbr64
1a12: 41 54 push %r12
1a14: 55 push %rbp
1a15: 53 push %rbx
1a16: 48 83 ec 60 sub $0x60,%rsp
1a1a: 64 48 8b 04 25 28 00 mov %fs:0x28,%rax
1a21: 00 00
1a23: 48 89 44 24 58 mov %rax,0x58(%rsp)
1a28: 31 c0 xor %eax,%eax
1a2a: 48 89 e6 mov %rsp,%rsi
1a2d: e8 a2 07 00 00 callq 21d4 <read_six_numbers>
与phase_2一样的套路, 输入整数倍编码为字符串, 然后传到%rsp栈中.
1a32: bd 00 00 00 00 mov $0x0,%ebp
1a37: eb 27 jmp 1a60 <phase_6+0x52>
1a39: e8 a8 06 00 00 callq 20e6 <explode_bomb>
1a3e: eb 33 jmp 1a73 <phase_6+0x65>
1a40: 83 c3 01 add $0x1,%ebx //计数器:%ebx.
1a43: 83 fb 05 cmp $0x5,%ebx
1a46: 7f 15 jg 1a5d <phase_6+0x4f> //当%ebx等于6时, 去往1a5d.
1a48: 48 63 c5 movslq %ebp,%rax
1a4b: 48 63 d3 movslq %ebx,%rdx
1a4e: 8b 3c 94 mov (%rsp,%rdx,4),%edi //逐个调用输入元素.
1a51: 39 3c 84 cmp %edi,(%rsp,%rax,4)
1a54: 75 ea jne 1a40 <phase_6+0x32> //表明输入要求是留个都不相等的数.
1a56: e8 8b 06 00 00 callq 20e6 <explode_bomb>
1a5b: eb e3 jmp 1a40 <phase_6+0x32>
1a5d: 44 89 e5 mov %r12d,%ebp //每次循环这里+1.
1a60: 83 fd 05 cmp $0x5,%ebp
1a63: 7f 17 jg 1a7c <phase_6+0x6e> //跳转到下一部分.
1a65: 48 63 c5 movslq %ebp,%rax
1a68: 8b 04 84 mov (%rsp,%rax,4),%eax
1a6b: 83 e8 01 sub $0x1,%eax
1a6e: 83 f8 05 cmp $0x5,%eax
1a71: 77 c6 ja 1a39 <phase_6+0x2b> //如果此时%rax大于5, 那么去往炸弹1a39
1a73: 44 8d 65 01 lea 0x1(%rbp),%r12d //一开始第一次循环会跳到这里来, 给%r12d赋上初值1.
1a77: 44 89 e3 mov %r12d,%ebx //之后相当于二重循环, %r12d是给%ebx赋值的外层变量.
1a7a: eb c7 jmp 1a43 <phase_6+0x35>
//二重循环的目的就是告诉我们, 这是六个小于6的并且两两不等的数.
1a7c: be 00 00 00 00 mov $0x0,%esi
1a81: eb 08 jmp 1a8b <phase_6+0x7d>
1a83: 48 89 54 cc 20 mov %rdx,0x20(%rsp,%rcx,8)
1a88: 83 c6 01 add $0x1,%esi
1a8b: 83 fe 05 cmp $0x5,%esi
1a8e: 7f 1d jg 1aad <phase_6+0x9f> //跳往下一部分.
1a90: b8 01 00 00 00 mov $0x1,%eax
1a95: 48 8d 15 b4 65 00 00 lea 0x65b4(%rip),%rdx # 8050 <node1> 这么明显的提示是链表...
1a9c: 48 63 ce movslq %esi,%rcx
1a9f: 39 04 8c cmp %eax,(%rsp,%rcx,4)
1aa2: 7e df jle 1a83 <phase_6+0x75>
1aa4: 48 8b 52 08 mov 0x8(%rdx),%rdx
1aa8: 83 c0 01 add $0x1,%eax
1aab: eb ef jmp 1a9c <phase_6+0x8e>
1aad: 48 8b 5c 24 20 mov 0x20(%rsp),%rbx
1ab2: 48 89 d9 mov %rbx,%rcx
1ab5: b8 01 00 00 00 mov $0x1,%eax
1aba: eb 12 jmp 1ace <phase_6+0xc0> //Jump To Middle: 循环.
1abc: 48 63 d0 movslq %eax,%rdx
1abf: 48 8b 54 d4 20 mov 0x20(%rsp,%rdx,8),%rdx
1ac4: 48 89 51 08 mov %rdx,0x8(%rcx)
1ac8: 83 c0 01 add $0x1,%eax
1acb: 48 89 d1 mov %rdx,%rcx
1ace: 83 f8 05 cmp $0x5,%eax
1ad1: 7e e9 jle 1abc <phase_6+0xae>
1ad3: 48 c7 41 08 00 00 00 movq $0x0,0x8(%rcx)
1ada: 00
1adb: bd 00 00 00 00 mov $0x0,%ebp
1ae0: eb 07 jmp 1ae9 <phase_6+0xdb>
1ae2: 48 8b 5b 08 mov 0x8(%rbx),%rbx //数据对齐.
1ae6: 83 c5 01 add $0x1,%ebp
1ae9: 83 fd 04 cmp $0x4,%ebp
1aec: 7f 11 jg 1aff <phase_6+0xf1>
1aee: 48 8b 43 08 mov 0x8(%rbx),%rax
1af2: 8b 00 mov (%rax),%eax //交换
1af4: 39 03 cmp %eax,(%rbx)
1af6: 7d ea jge 1ae2 <phase_6+0xd4> //递减(?), 否则不能跳过炸弹.
1af8: e8 e9 05 00 00 callq 20e6 <explode_bomb>
1afd: eb e3 jmp 1ae2 <phase_6+0xd4>
1aff: 48 8b 44 24 58 mov 0x58(%rsp),%rax
1b04: 64 48 33 04 25 28 00 xor %fs:0x28,%rax
1b0b: 00 00
1b0d: 75 09 jne 1b18 <phase_6+0x10a>
1b0f: 48 83 c4 60 add $0x60,%rsp
1b13: 5b pop %rbx
1b14: 5d pop %rbp
1b15: 41 5c pop %r12
1b17: c3 retq
1b18: e8 63 f7 ff ff callq 1280 <__stack_chk_fail@plt>
0000000000001b1d <emulate_fsm>:
1b1d: f3 0f 1e fa endbr64
1b21: 55 push %rbp
1b22: 53 push %rbx
1b23: 48 83 ec 08 sub $0x8,%rsp
1b27: 89 fd mov %edi,%ebp
1b29: 48 89 f3 mov %rsi,%rbx
1b2c: eb 27 jmp 1b55 <emulate_fsm+0x38>
1b2e: 0f be 03 movsbl (%rbx),%eax
1b31: 83 e8 30 sub $0x30,%eax
1b34: 48 63 ed movslq %ebp,%rbp
1b37: 48 98 cltq
1b39: 48 8d 3c c5 00 00 00 lea 0x0(,%rax,8),%rdi
1b40: 00
1b41: 48 29 c7 sub %rax,%rdi
1b44: 48 01 ef add %rbp,%rdi
1b47: 48 8d 05 72 28 00 00 lea 0x2872(%rip),%rax # 43c0 <transition_table>
1b4e: 8b 2c b8 mov (%rax,%rdi,4),%ebp
1b51: 48 83 c3 01 add $0x1,%rbx
1b55: 0f b6 03 movzbl (%rbx),%eax
1b58: 84 c0 test %al,%al
1b5a: 74 0e je 1b6a <emulate_fsm+0x4d>
1b5c: 83 e8 30 sub $0x30,%eax
1b5f: 3c 01 cmp $0x1,%al
1b61: 76 cb jbe 1b2e <emulate_fsm+0x11>
1b63: e8 7e 05 00 00 callq 20e6 <explode_bomb>
1b68: eb c4 jmp 1b2e <emulate_fsm+0x11>
1b6a: 89 e8 mov %ebp,%eax
1b6c: 48 83 c4 08 add $0x8,%rsp
1b70: 5b pop %rbx
1b71: 5d pop %rbp
1b72: c3 retq
0000000000001b73 <check_synchronizing_sequence>:
1b73: f3 0f 1e fa endbr64
1b77: 41 54 push %r12
1b79: 55 push %rbp
1b7a: 53 push %rbx
1b7b: 48 89 fd mov %rdi,%rbp
1b7e: 48 89 fe mov %rdi,%rsi
1b81: bf 00 00 00 00 mov $0x0,%edi
1b86: e8 92 ff ff ff callq 1b1d <emulate_fsm>
1b8b: 41 89 c4 mov %eax,%r12d
1b8e: bb 01 00 00 00 mov $0x1,%ebx
1b93: 83 fb 06 cmp $0x6,%ebx
1b96: 7f 14 jg 1bac <check_synchronizing_sequence+0x39>
1b98: 48 89 ee mov %rbp,%rsi
1b9b: 89 df mov %ebx,%edi
1b9d: e8 7b ff ff ff callq 1b1d <emulate_fsm>
1ba2: 44 39 e0 cmp %r12d,%eax
1ba5: 75 0f jne 1bb6 <check_synchronizing_sequence+0x43>
1ba7: 83 c3 01 add $0x1,%ebx
1baa: eb e7 jmp 1b93 <check_synchronizing_sequence+0x20>
1bac: b8 00 00 00 00 mov $0x0,%eax
1bb1: 5b pop %rbx
1bb2: 5d pop %rbp
1bb3: 41 5c pop %r12
1bb5: c3 retq
1bb6: b8 ff ff ff ff mov $0xffffffff,%eax
1bbb: eb f4 jmp 1bb1 <check_synchronizing_sequence+0x3e>
0000000000001bbd <secret_phase>:
1bbd: f3 0f 1e fa endbr64
1bc1: 55 push %rbp
1bc2: 53 push %rbx
1bc3: 48 83 ec 18 sub $0x18,%rsp
1bc7: 64 48 8b 04 25 28 00 mov %fs:0x28,%rax
1bce: 00 00
1bd0: 48 89 44 24 08 mov %rax,0x8(%rsp)
1bd5: 31 c0 xor %eax,%eax
1bd7: e8 3d 06 00 00 callq 2219 <read_line>
1bdc: 48 89 c5 mov %rax,%rbp
1bdf: bb 00 00 00 00 mov $0x0,%ebx
1be4: eb 08 jmp 1bee <secret_phase+0x31>
1be6: e8 fb 04 00 00 callq 20e6 <explode_bomb>
1beb: 83 c3 01 add $0x1,%ebx
1bee: 48 63 c3 movslq %ebx,%rax
1bf1: 80 7c 05 00 00 cmpb $0x0,0x0(%rbp,%rax,1)
1bf6: 74 07 je 1bff <secret_phase+0x42>
1bf8: 83 fb 0c cmp $0xc,%ebx
1bfb: 7e ee jle 1beb <secret_phase+0x2e>
1bfd: eb e7 jmp 1be6 <secret_phase+0x29>
1bff: 48 89 ef mov %rbp,%rdi
1c02: e8 6c ff ff ff callq 1b73 <check_synchronizing_sequence>
1c07: 85 c0 test %eax,%eax
1c09: 75 51 jne 1c5c <secret_phase+0x9f>
1c0b: 48 8d 3d 4e 26 00 00 lea 0x264e(%rip),%rdi # 4260 <_IO_stdin_used+0x260>
1c12: e8 49 f6 ff ff callq 1260 <puts@plt>
1c17: 48 8d 3d 6a 26 00 00 lea 0x266a(%rip),%rdi # 4288 <_IO_stdin_used+0x288>
1c1e: e8 3d f6 ff ff callq 1260 <puts@plt>
1c23: 48 8d 3d ae 26 00 00 lea 0x26ae(%rip),%rdi # 42d8 <_IO_stdin_used+0x2d8>
1c2a: e8 31 f6 ff ff callq 1260 <puts@plt>
1c2f: 48 8d 3d e2 26 00 00 lea 0x26e2(%rip),%rdi # 4318 <_IO_stdin_used+0x318>
1c36: e8 25 f6 ff ff callq 1260 <puts@plt>
1c3b: 48 8d 7c 24 04 lea 0x4(%rsp),%rdi
1c40: e8 1f 07 00 00 callq 2364 <phase_defused>
1c45: 48 8b 44 24 08 mov 0x8(%rsp),%rax
1c4a: 64 48 33 04 25 28 00 xor %fs:0x28,%rax
1c51: 00 00
1c53: 75 0e jne 1c63 <secret_phase+0xa6>
1c55: 48 83 c4 18 add $0x18,%rsp
1c59: 5b pop %rbx
1c5a: 5d pop %rbp
1c5b: c3 retq
1c5c: e8 85 04 00 00 callq 20e6 <explode_bomb>
1c61: eb a8 jmp 1c0b <secret_phase+0x4e>
1c63: e8 18 f6 ff ff callq 1280 <__stack_chk_fail@plt>
0000000000001c68 <sig_handler>:
1c68: f3 0f 1e fa endbr64
1c6c: 50 push %rax
1c6d: 58 pop %rax
1c6e: 48 83 ec 08 sub $0x8,%rsp
1c72: 48 8d 3d 7f 27 00 00 lea 0x277f(%rip),%rdi # 43f8 <transition_table+0x38>
1c79: e8 e2 f5 ff ff callq 1260 <puts@plt>
1c7e: bf 03 00 00 00 mov $0x3,%edi
1c83: e8 18 f7 ff ff callq 13a0 <sleep@plt>
1c88: 48 8d 35 e2 29 00 00 lea 0x29e2(%rip),%rsi # 4671 <transition_table+0x2b1>
1c8f: bf 01 00 00 00 mov $0x1,%edi
1c94: b8 00 00 00 00 mov $0x0,%eax
1c99: e8 a2 f6 ff ff callq 1340 <__printf_chk@plt>
1c9e: 48 8b 3d bb 67 00 00 mov 0x67bb(%rip),%rdi # 8460 <stdout@@GLIBC_2.2.5>
1ca5: e8 76 f6 ff ff callq 1320 <fflush@plt>
1caa: bf 01 00 00 00 mov $0x1,%edi
1caf: e8 ec f6 ff ff callq 13a0 <sleep@plt>
1cb4: 48 8d 3d be 29 00 00 lea 0x29be(%rip),%rdi # 4679 <transition_table+0x2b9>
1cbb: e8 a0 f5 ff ff callq 1260 <puts@plt>
1cc0: bf 10 00 00 00 mov $0x10,%edi
1cc5: e8 a6 f6 ff ff callq 1370 <exit@plt>
0000000000001cca <invalid_phase>:
1cca: f3 0f 1e fa endbr64
1cce: 50 push %rax
1ccf: 58 pop %rax
1cd0: 48 83 ec 08 sub $0x8,%rsp
1cd4: 48 89 fa mov %rdi,%rdx
1cd7: 48 8d 35 a3 29 00 00 lea 0x29a3(%rip),%rsi # 4681 <transition_table+0x2c1>
1cde: bf 01 00 00 00 mov $0x1,%edi
1ce3: b8 00 00 00 00 mov $0x0,%eax
1ce8: e8 53 f6 ff ff callq 1340 <__printf_chk@plt>
1ced: bf 08 00 00 00 mov $0x8,%edi
1cf2: e8 79 f6 ff ff callq 1370 <exit@plt>
0000000000001cf7 <string_length>:
1cf7: f3 0f 1e fa endbr64
1cfb: b8 00 00 00 00 mov $0x0,%eax
1d00: 80 3f 00 cmpb $0x0,(%rdi)
1d03: 74 09 je 1d0e <string_length+0x17>
1d05: 48 83 c7 01 add $0x1,%rdi
1d09: 83 c0 01 add $0x1,%eax
1d0c: eb f2 jmp 1d00 <string_length+0x9>
1d0e: c3 retq
0000000000001d0f <strings_not_equal>:
1d0f: f3 0f 1e fa endbr64
1d13: 41 54 push %r12
1d15: 55 push %rbp
1d16: 53 push %rbx
1d17: 48 89 fb mov %rdi,%rbx
1d1a: 48 89 f5 mov %rsi,%rbp