Then, we can take a look at the fixed value were supposed to match and go from there: Woah. If the first character in the input string is anything but a zero then the detonation flag is set to low and passed out the function. No description, website, or topics provided. For lab: defuse phase 1. without any ill effects. Defusing the binary bomb - Myst!qu3 S@lt Phase 2: loops. Phase 1 defused. je 0x40106a <phase_5+104> 0x0000000000401065 <+99>: callq 0x40163d <explode_bomb> ; explode_bomb . In memory there is a 16 element array of the numbers 0-15. Keep going! I also wanted to see groupings of strings that may have similar prefixes and so I sorted the strings program output and looked for anything interesting in that manner. Jumping to the next "instruction" using gdb, Binary Bomb Phase 5 issue (my phase 5 seems to be different from everyone elses), Memory allocation and addressing in Assembly, Tikz: Numbering vertices of regular a-sided Polygon. The bomb explodes if the number of steps to get to the number 15 in the sequence does not equal 9, or if the second input number does not equal the sum of the . There are many things going on with shuffling of variables between registers, some bit shifting, and either a subtraction or an addition being applied to some of the hard coded constants. string_length - Main daemon (bomblab.pl). Instructors and students view the scoreboard by pointing their, The online Bomb Lab is self-grading. I know b7 < eb < f6 < 150 < 21f < 304, so the order of nodes should be 3 0 5 4 1 2 (or 2 5 0 1 4 3 - in ascending order) and I should add +1 to all numbers. Make sure you update this. This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository. What is the Russian word for the color "teal"? Is there any extra credit for solving the secret phase. phase_defused We've made it very easy to run the service, but, some instructors may be uncomfortable with this requirement and will. Lets create our breakpoints to make sure nothing gets set to the gradebook! Here are the directions for offering both versions of the lab. 'But finding it and solving it are quite different' I will list some transitions here: The ascii code of "flyers" should be "102, 108, 121, 101, 114, 115". Segmentation fault in attack lab phase5 - Stack Overflow As the students work on their bombs, each, explosion and defusion is streamed back to the server, where the, current results for each bomb are displayed on a Web "scoreboard.". blank_line Thanks for contributing an answer to Stack Overflow! The student then saves the tar file to disk. If the student enters the expected string, then that phase. How about the next one? On a roll! First, setup your bomb directory. First, to figure out that the program wants a string as an input. When prompted, enter the command 'c' to continue. This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository. In Bomb Lab phase_6, what are the appropriate steps to take after I Due to address randomization and nonexecutable stack, we are supposed to use Return Oriented Programming (ROP) to pass the string pointer of a given cookie value as argument to a function called touch3. $ecx is the output of the loop, Values attached to letters based on testing: Based on the output, our input string is being run into the function with the string I can see Russia from my . Raw Blame. Well 0000000000401062 <phase_5>: 401062: 53 push % rbx 401063: 48 83 ec 20 sub $ 0x20, % rsp 401067: 48 89 fb mov % rdi, % rbx 40106a: . This continuous through all the user inputed indices and finally places the value zero in the last remaining empty element in the array. First you must enter two integers and the bomb will detonate if you enter more or less than that. What I know so far: first input cannot be 15, 31, 47, etc. 1 Introduction. This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository. Using layout asm, we can see the assembly code as we step through the program. phase_5 On the bright side, at least now we know that our string should come out of the loop as giants. We see that a strings_not_equal function is being called. Cannot retrieve contributors at this time. We can inspect its structure directly using gdb. Considering this line of code. A binary bomb is a program that consists of a . Content Discovery initiative April 13 update: Related questions using a Review our technical responses for the 2023 Developer Survey. Become familiar with Linux VM and Linux command-line, Use and navigate through gdb debugger to examine memory and registers, view assembly code, and set breakpoints within the gdb debugger, Read and understand low level assembly code. A tag already exists with the provided branch name. Mar 19, . This works just fine, and I invite you to try it. This looks just like phase 1. Also run the command i r to see what the values of the variables are. A string that could be the final string outputted when you solve stage 6 is 'Congratulations! Pull up the function in Graph mode with VV, press p to cycle between views, and select the minigraph. offer the lab. Bomb explosions. Lo and behold, when we dump the contents of the memory address we get "%d", which tells us that the . Then you set a breakpoint at 4010b3 and find the target string to be "flyers". Some of the pass phrases could be integers, or a random set of characters if that is the case then the only way to figure things out is through dynamic analysis and disassembling the code. Each phase expects you to type a particular string. Your goal is to set breakpoints and step through the binary code using gdb to figure out the program inputs that defuse the bombs (and make you gain points). 3) The second parameter 'p' at the end of the loop must be equal with %ecx register. The values came out it the following format: 0x000003b8 So if I order the nodes in ascending order, it should be 6 4 1 2 5 3, but this still wasn't the correct input. CS107 Assignment 5: Binary bomb - Stanford University To review, open the file in an editor that reveals hidden Unicode characters. Binary Bomb Lab :: Phase 6. Defusing the binary bomb. Specifically: From the code, we can see that we first read in 6 numbers. Untar your specific file and lets get started! 0,1,2,3,4,5,6,7,8,9,10,11,12,13,14 and upon beating the stage you get the string 'Wow! CSO1 - Bomb lab. Thus, each student, gets a unique bomb that they must solve themselves. Once we enter the function, we can check the registers that store the first two inputs: $rdi and $rsi. The "main daemon" starts and nannies the, request server, result server, and report deamon, ensuring that, exactly one of these processes (and itself) is running at any point in, time. Next there is pattern that must be applied to the first 6 numbers. You signed in with another tab or window. I found the memory position for the beginning of phase_1 and placed a break point there. We can see one line above that $esi is also involved. Custom, notifying bombs are constrained to run on a specific set of Linux, hosts determined by the instructor. If the line is correct, then the phase is defused and the bomb proceeds to the next phase. You will only need, to modify or inspect a few variables in Section 1 of this file. In the interests of putting more Radare2 content out there, here's a noob friendly intro to r2 for those who already have a basic grasp of asm, C, and reversing in x86-64. initialize_bomb You just pass through the function and it does nothing. Point breakdown for each phase: Phase 1 - 4: 10 points each; Phase 5 and 6: 15 points each; Total maximum score possible: 70 points; Each time the "bomb explodes", it notifies the server, resulting in a (-)1/5 point deduction from the final score for the lab. False COVID-19 PCR Test. There is a small grade penalty for explosions beyond 20. You signed in with another tab or window. You've defused the secret stage!'. Binary Bomb Lab :: Phase 6 - Zach Alexander Lets do the standard disas command to see the assembly of the function. secret_phase !!! initialize_bomb_solve "/> dearborn police incident reports. I try a input sequence "aaaaaa" and get the value after transitions doesn't change at all, which means that the output of a given input is unique. and/or the string 'The bomb has blown up.' Subtract original pointer from %eax and get the running total of the string. Halfway there! Regardless, the first user inputed value had to be less than or equal to 14 and had to spit out an 11 after its computation. sign in Many Git commands accept both tag and branch names, so creating this branch may cause unexpected behavior. The LabID must not have any spaces. On the other hand, custom quiet, Generic Bomb: A "generic bomb" has a BombID = 0, isn't associated with. Contribute to xmpf/cse351 development by creating an account on GitHub. The Bomb Lab teaches students principles of, machine-level programs, as well as general debugger and reverse, A "binary bomb" is a Linux executable C program that consists of six, "phases." aseje owo nla. . a = 10 can be started from initrc scripts at boot time. strings_not_equal 10 January 2015. (sorted smallest to largest gives you the answer), See also: getSubSequenceCount Interview Question. It's obvious that the first number should be 1. this is binary bomb lab phase 5.I didn't solve phase 5. This assignment gives you a binary program containing "bombs" which trigger a ping to our server (and make you lose points) if their inputs are wrong. For, example, "-p abacba" will use variant "a" for phase 1, variant "b" for. If this is a duplicate of another question, please link it so future readers can find it if their search turns up this question first. Nothing special other than the first number acting like a selector of jump paths to a linked second number. It should look like this. phase_3 Help with Binary Bomb Lab Phase 6 : r/learnprogramming - Reddit [RE] Linux Bomb Walkthrough - Part2 (Phases 1-3) - [McB]Defence You don't need to understand any of this to. Bomb Lab: Phase 5. Understanding Bomb Lab Phase 5 (two integer input) We have created a stand-alone user-level autograding service that, handles all aspects of the Bomb Lab for you: Students download their, bombs from a server. More than 2 is fine but the code is only dependent on the first two numbers. If you notice, (the syntax will vary based off of what sort of system the bomb is run on) the machine code will have some variation of call to: 401135: be b8 25 40 00 mov $0x4025b8,%esi. Then you get the answer to be the pair(7, 0). In order to defuse the bomb, students must use a debugger, typically, gdb or ddd, to disassemble the binary and single-step through the, machine code in each phase. There is an accessed memory area that serves as a counter. How does loop address alignment affect the speed on Intel x86_64? We get the following part, We see a critical keyword Border, right? @Jester so I looked at your reply to another question which is extremely similar to my question, actually the same exact question. So you think you can stop the bomb with ctrl-c, do you? The answer is that the first input had to be 1. As an experienced engineer, I believe you can figure out that there are two arguments, each of which should be integers. From this, we can see that the input format of read_six_numbers should be 6 space-separated integers. When I get angry, Mr. Bigglesworth gets upset. Welcome to my fiendish little bomb. Thus on the 14th iteration if I needed a 6, I would need to be in the 14th index of the array on the 13th iteration, then on index 2 of the 12th iteration. I am currently stuck on bomb lab phase 5. The input should be "4 2 6 3 1 5". If you type the correct string, then the phase is defused and the bomb proceeds to the next phase. student whose email address is and whose user name is : bomb* Custom bomb executable (handout to student), bomb.c Source code for main routine (handout to student). Did the drapes in old theatres actually say "ASBESTOS" on them? This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. explode_bomb You just choose a number arbitarily from 0 to 6 and go through the switch expression, and you get your second argument. Next, the, student fills in this form with their user name and email address, and, then submits the form. cse351/solution-explanation-of-phase-5.text at master - Github This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. I see the output 'Phase 1 defused. Since we know the final value is 6 letters/numbers, we know 72/6 = 12. phase_1 If one of these processes dies for some reason, the main daemon, detects this and automatically restarts it. We can then set up a breakpoint upon entering phase_1 using b phase_1 and for the function explode_bomb to avoid losing points. As we can see, it is fairly obvious that there is a loop somewhere in this function (by following the arrows). First thing I did was to search the binary using strings to see if there was anything interesting that pops out. Run the following commands to create text files which we will look at later: You should now have two files: strings.txt and assembly.txt. From here, we have two ways to solve this phase, a dumb way and a smart way. Can you help me please? CSO1 - Bomb lab - University of Virginia School of Engineering and Could this mean alternative endings? Additional Notes on the Online Bomb Lab, * Since the request server and report daemon both need to execute, bombs, you must include $SERVER_NAME in the list of legal machines in, * All of the servers and daemons are stateless, so you can stop ("make, stop") and start ("make start") the lab as many times as you like. A tag already exists with the provided branch name. initialize_bomb The previous output from the strings program was outputted to stout in order that the strings are found in the binary. sc2225/Bomb-Lab - Github Increment %rdx by 1 to point to the next character byte and move to %eax. DrEvil. BombID: Each bomb in a given instance of the lab has a unique, non-negative integer called the "bombID. There was a bunch of manipulation of stack space but there was nothing in the stack at that location and so it is likely a bunch of leg work. Browse other questions tagged, Where developers & technologists share private knowledge with coworkers, Reach developers & technologists worldwide. CS3330: Lab 1 (Bomb Lab) Find centralized, trusted content and collaborate around the technologies you use most. GET /%s/submitr.pl/?userid=%s&lab=%s&result=%s&submit=submit HTTP/1.0 If nothing happens, download GitHub Desktop and try again. Each phase expects the student to enter a particular string, on stdin. First bomb lab is a Reverse Engineering challenge, you have to read its assembly to find the message that . In addition, most, phase variants are parameterized by randomly chosen constants that are, assigned when a particular bomb is constructed. Then you may not find the key to the second part(at least I didn't). Are you sure you want to create this branch? phase_4 Phase 5 reads in two numbers, the first of which is used as a starting point within a sequence of numbers. Essentially what is happening is, each character from our string is ANDed with 0xf, and the result is used to get the character with the corresponding index from the array. phase_5 Although the problems differ from each other, the main methods we take are totally the same. Given you ultimately needed to have the element containing 0xf to exit after 15 iterations, I saw that f was at array element index 6. Lets use blah again as out input for phase_2. What' more, there's a function call to read_six_numbers(), we can inspect it, Up till now, you should be able to find out that in this part, we are required to enter six numbers. If your, Linux box crashes or reboots, simply restart the daemons with "make, * Information and error messages from the servers are appended to the, "status log" in bomblab/log-status.txt. However, you do need to handle recursion actually. By clicking Post Your Answer, you agree to our terms of service, privacy policy and cookie policy. From the first few lines, we guess that there are two arguments to enter. Thus, the second number in the series must be 1 greater than the first number, the third number in the series must be 2 larger than the second number, etc. In the "offline" version, the. Maybe you get an alternative string for the bomb blowing up if done so via the secret stage? So, what do we know about phase 5 so far? I hope it's helpful. You get to know that the input sequence must be an arbitary combination of number 1,2,3,4,5,6. Cannot retrieve contributors at this time. f = 9. These lines indicate that if the first argument equal the last one(right before this line), then we get 0. They will likely be either 'Good work! On whose turn does the fright from a terror dive end? node4 Binary Bomb Lab (All Phases Solved) - John Keller Try this one. Curses, you've found the secret phase! This part is a little bit trickier. How a top-ranked engineering school reimagined CS curriculum (Ep. Many Git commands accept both tag and branch names, so creating this branch may cause unexpected behavior. Ok, lets get right to it and dig into the code: So, what have we got here? What is scrcpy OTG mode and how does it work? It is called recursively and in the end you need it to spit out the number 11. phase_1() - I'm first going to start stepping through the program starting at main. If you are offering the online version, you will also need to edit the, ./src/config.h - This file lists the domain names of the hosts that, notifying bombs are allowed to run on. You won't be able, to validate the students handins. Let me know if you have any questions in the comments. A note to the reader: For explanation on how to set up the lab environment see the "Introduction" section of the post. The report daemon finds the most recent, defusing string submitted by each student for each phase, and, validates these strings by applying them to a local copy of the, student's bomb. This number was 115. phase_6() - This function does a few initial checks on the numbers inputed by the user. Control-l can be used to refresh the UI whenever it inevitably becomes distorted. Looking for job perks? Assignment #3: Bomb Lab - CS356 Introduction to Computer Systems Lets enter the string blah as our input to phase_1. Phase 3: conditionals/switches. In order to do this you must look at the various integers within the array and then place them in ascending order by the index of those integer containing elements. The key part is the latter one. You continue to bounce through the array. So you got that one. ", - Report Daemon (bomblab-reportd.pl). Binary Bomb Lab :: Phase 1 - Zach Alexander Asking for help, clarification, or responding to other answers. Learn more about bidirectional Unicode characters. GitHub Microsoft is acquiring GitHub!Read our blog and Satya Nadella's post to learn more. There was a problem preparing your codespace, please try again. string_length() - This function first checks to see that the passed character pointer in %rdi is not null terminated. (Add 16 each time) ecx is compared to rsp, which is 15, so we need ecx to equal to 15. Binary Bomb - Accolade The two stipulations that you must satisfy to move to the last portion of this phase is that you have incremented the counter to 15 and that the final value when you leave the loop is 0xf (decimal 15). need to, but we are careful never to type "make cleanallfiles" again. From this, we can deduce that the input for phase_2 should be 1 2 4 8 16 32. For each bomb, it tallies the number, of explosions, the last defused phase, validates each last defused, phase using a quiet copy of the bomb, and computes a score for each, student in a tab delimited text file called "scores.txt." not 0, 1, 5, 6, 7, 8, 9, 10, 11, 12, 898, 1587, number is between 0 and 14 using comparison statement If you accidentally kill one of the daemons, or you modify a daemon, or the daemon dies for some reason, then use, "make stop" to clean up, and then restart with "make start". Given this info, it looks as though the loop is implementing a cypher. phase_5() - This function requires you to go backwards through an array of numbers to crack the code. This command prints data stored at a register or memory address. Evil has created a slew of "binary bombs" for our class. Looks like it wants 2 numbers and a character this time. The variable being used in this comparison is $eax. So there are some potential strings for solving each of the stages. Based on the first user inputed number, you enter into that indexed element of the array, which then gives you the index of the next element in the array, etc. First things first, we can see from the call to <string_length> at <phase_5+23> and subsequent jump equal statement our string should be six characters long. lesson and forces them to learn to use a debugger. When I get angry, Mr. Bigglesworth gets upset. I will omit this part here, you can refer to this document. If so, put zero in %eax and return. You have 6 phases with which to blow yourself up. Then we use strings command to find out the answer, Having a look at the code structure, you should notice that there exists a loop structure. Work fast with our official CLI. Not the answer you're looking for? And when we execute it, it expects to receive certain inputs, otherwise it 'blows' up. executable file 271 lines (271 sloc) 7.74 KB. Entering these numbers allows us to pass phase_3. read_six_numbers A tag already exists with the provided branch name. Changing the second input does not affect the ecx. But when I put 4 1 6 5 2 3 or 3 6 1 2 5 4, it explodes. Many Git commands accept both tag and branch names, so creating this branch may cause unexpected behavior. How about the next one? Learn more. This looks familiar! This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository. Go to file. The unique. Before the, lab goes live, you'll want to request a few bombs for yourself, run, them, defuse a few phases, explode a few phases, and make sure that, the results are displayed properly on the scoreboard.