bomb lab phase 5 github

Ok, lets get right to it and dig into the code: So, what have we got here? Such bombs, We will also find it helpful to distinguish between custom and, Custom Bomb: A "custom bomb" has a BombID > 0, is associated with a, particular student, and can be either notifying or quiet. Your goal is to set breakpoints and step through the binary code using gdb to figure out the program inputs that defuse the bombs (and make you gain points). ', After solving stage 3 you likely get the string 'Halfway there! Phase 1: There are two main ways of getting the answer. phase_5 Lets enter a test string to let the program hit our break point. Then we use strings command to find out the answer, Having a look at the code structure, you should notice that there exists a loop structure. node6 Such bombs are called "notifying bombs. Then we can get the range of the first argument from the line. Former New York University and Peking University student. rev2023.4.21.43403. Instructors and students view the scoreboard by pointing their, The online Bomb Lab is self-grading. Based on the first user inputed number, you enter into that indexed element of the array, which then gives you the index of the next element in the array, etc. CS107 Assignment 5: Binary bomb - Stanford University While layout asm is helpful, also helpful to view the complete disassembled binary. phase_6 Cannot retrieve contributors at this time. The Hardware/Software Interface - UWA @ Coursera. Are you sure you want to create this branch? Considering this line of code. As its currently written, your answer is unclear. node3 How about the next one? and/or the string 'The bomb has blown up.' Next there is pattern that must be applied to the first 6 numbers. Many Git commands accept both tag and branch names, so creating this branch may cause unexpected behavior. There is a small amount of extra credit for each additional phase . At the . Simple function made to look like a mess. edx must equal 0xf, meaning the first input has to be 5, 21, 37, etc. Point breakdown for each phase: Phase 1 - 4: 10 points each; Phase 5 and 6: 15 points each; Total maximum score possible: 70 points; Each time the "bomb explodes", it notifies the server, resulting in a (-)1/5 point deduction from the final score for the lab. Thus I'm pretty confident that this will be the pass phrase for the first phase. From the above comments, we deduce that we want to input two space-separated integers. Here is Phase 6. Buffer Overflow Lab (Attack Lab) - Phase1 - YouTube What I know so far: first input cannot be 15, 31, 47, etc. Problem set 2 - CS 61 2021 - Harvard University For, example, "-p abacba" will use variant "a" for phase 1, variant "b" for. What are the advantages of running a power tool on 240 V vs 120 V? Bomb Lab: Phase 5. The goal for the students is to defuse as many phases as possible. you like without losing any information. So you got that one. * See src/README for more information about the anatomy of bombs and, how they are constructed. If the student enters the expected string, then that phase. A clear, concise, correct answer will earn full credit. GitHub - Taylor1VT/HW-5-Binary-Bomb Binary Bomb Lab :: Phase 6. output of func4 should be 45, Based on this line in the compiler, we know that the final comparison needed should be 72. Informal Explanations of Phases 1 through 6: I have spent approximately 26 hours on this assignment. After satisfying this first requirement of phase_5 there is a comparison of the second user input to what turns out to be the sum of the numbers in the array you accessed. All things web. In memory there is a 16 element array of the numbers 0-15. srveaw is pretty far off from abcdef. This part is a little bit trickier. And, as you can see at structure, the loop iterates 6 times. For homework: defuse phases 2 and 3. Each student gets a, bomb with a randomly chosen variant for each phase. read_line Run the following commands to create text files which we will look at later: You should now have two files: strings.txt and assembly.txt. The unique. Thus, the second number in the series must be 1 greater than the first number, the third number in the series must be 2 larger than the second number, etc. Please, Your answer could be improved with additional supporting information. At any point in time, the, tab-delimited file (./bomblab/scores.txt) contains the most recent, scores for each student. phase_1 After solving stage 1 you likely get the string 'Phase 1 defused. Is there any extra credit for solving the secret phase. You can tell, makebomb.pl to use a specific variant by using the "-p" option. Before the, lab goes live, you'll want to request a few bombs for yourself, run, them, defuse a few phases, explode a few phases, and make sure that, the results are displayed properly on the scoreboard. So you think you can stop the bomb with ctrl-c, do you?' Thinking of the func4 function, we put two lines together to see more clearly. Knowing that scanf() takes in a string format as its input, lets break right before scanf() is called and check the value of $esi. explode_bomb. CSO1 - Bomb lab - University of Virginia School of Engineering and and upon beating the stage you get the string 'Wow! In this repository I will take down my process of solving the bomb lab of CS:APP. phase_1 Once we understand how it works, we can reverse engineer giants into its pre-cypher form without having to waste time doing trial and error. bomblab-Angr/Phase 5 x86_64.ipynb at master - Github I then continue to run the program until I am prompted for a phrase to input. I don't want to run the program/"pull the pin" on the bomb by running it, so this tells me that there are likely 6 stages to the bomb. Learn more. Binary Bomb Lab :: Phase 1 - Zach Alexander This command prints data stored at a register or memory address. makoshark.ics.cs.cmu.edu, Dunno, lets just get a static printout of the disassembled code and see what comes out. Next, as we scan through each operation, we see that a register is being . Nothing special other than the first number acting like a selector of jump paths to a linked second number. Solve a total of 6 phases to defuse the bomb. Could this mean alternative endings? In the first block of code, the function read_six_numbers is called which essentially confirms that it is six numbers which are seperated by a space (as we entered in the first part of this phase). Then we encounter with an optimized switch expression. I'm trying to trace through this, but I'm struggling a little. The students work on defusing, their bombs offline (i.e., independently of any autograding service), and then handin their solution files to you, each of which you grade, You can use the makebomb.pl script to build your own bombs. CSO1 - Bomb lab. But finding it and solving it are quite different Well Lo and behold, when we dump the contents of the memory address we get "%d", which tells us that the . This command sets breakpoints throughout the code. @Jester so I looked at your reply to another question which is extremely similar to my question, actually the same exact question. Go to file. When, the student untars this file, it creates a directory (./bomb) with, bomb* Notifying custom bomb executable, bomb.c Source code for the main bomb routine, ID Identifies the student associated with this bomb, README Lists bomb number, student, and email address, The request server also creates a directory (bomblab/bombs/bomb), bomb.c Source code for main routine, bomb-quiet* A quiet version of bomb used for autograding, ID Identifies the user name assigned to this bomb, phases.c C source code for the bomb phases, README Lists bombID, user name, and email address, Result Server: Each time a student defuses a phase or explodes their, bomb, the bomb sends an HTTP message (called an autoresult string) to, the result server, which then appends the message to the scoreboard, log. You won't be able, to validate the students handins. You've defused the bomb! Up till now, there shouldn't be any difficulties. On a roll! Binary Bomb Lab (All Phases Solved) - John Keller So, I mapped out the array from element 0 to 15 and then worked backwards through it to find the element I needed to start with. Each time a student defuses a, bomb phase or causes an explosion, the bomb sends a short HTTP, message, called an "autoresult string," to an HTTP "result server,", which simply appends the autoresult string to a "scoreboard log file. Have a nice day! manually. You signed in with another tab or window. . ", Notifying Bomb: A bomb can be compiled with a NOTIFY option that, causes the bomb to send a message each time the student explodes or, defuses a phase. Each, variable is preceded by a descriptive comment. Phase 1 defused. A tag already exists with the provided branch name. To learn more, see our tips on writing great answers. 1 first, so gdb is the most recent available version of GDB. Now you can see there are a few loops. Jumping to the next "instruction" using gdb, Binary Bomb Phase 5 issue (my phase 5 seems to be different from everyone elses), Memory allocation and addressing in Assembly, Tikz: Numbering vertices of regular a-sided Polygon. If not then the detonation flag that was initialized to 1 is not set to low and will eventually trigger the detonate function. This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository. phase_4 Then enter this command. From this, we can guess that to pass phase_1, we need to enter the correct string. The first argument must be less than 7, right? Control-l can be used to refresh the UI whenever it inevitably becomes distorted. DrEvil There are two hard coded variables that are then initialized and they, as well as the first user inputed value, are passed to func4. to build a single generic bomb that every student attempts to defuse: This will create a generic bomb and some other files in ./bombs/bomb0: bomb* Generic bomb executable (handout to students), bomb.c Source code for main routine (handout to students), You will handout only two of these files to the students: ./bomb and ./bomb.c, The students will handin their solution files, which you can validate, This option is easy for the instructor, but we don't recommend it. First, interesting sections/function names: Keep going! Actually in this part, the answer isn't unique. A binary bomb is a program that consists of a sequence of six phases. CMU Bomb Lab with Radare2 Phase 6 | by Mark Higgins - Medium I try a input sequence "aaaaaa" and get the value after transitions doesn't change at all, which means that the output of a given input is unique. By clicking Accept all cookies, you agree Stack Exchange can store cookies on your device and disclose information in accordance with our Cookie Policy. In order to determine the comparisons used, it will be useful to look up or know Jumps Based on Signed Comparisons. Phase 1. Moreover, it's obvious that the second one must be zero being aware of the line, So the problem becomes easier. node2 Each bomb phase tests a different aspect of machine language programs: Phase 4: recursive calls and the stack discipline, Phases get progressively harder. gdb - binary bomb lab phase 6 - Stack Overflow This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository. I will list some transitions here: The ascii code of "flyers" should be "102, 108, 121, 101, 114, 115". Raw Blame. For more information, you can refer to this document, which gives a handy tutorial on the phase 6. (up to -6 points deducted) Each bomb explosion notification that reaches the staff results in a 1 point deduction, capped at -6 points total. In the "offline" version, the. Add abcdef as your Phase 5 solution in answers.txt, load the binary in r2's Debug mode, run analysis, then dcu sym.phase_5. The "report daemon" periodically, scans the scoreboard log file. Use Git or checkout with SVN using the web URL. When prompted, enter the command 'c' to continue. In memory there is a 16 element array of the numbers 0-15. any particular student, is quiet, and hence can run on any host. You encounter with a loop and you can't find out what it is doing easily. And when we execute it, it expects to receive certain inputs, otherwise it 'blows' up. phase_4() - In this phase you are dealing with a recursively called function. I'm getting a feeling that the author wants you to really have to work to get through some of these functions. There is also a test that the first user inputed number is less than or equal to 14. When we hit phase_1, we can see the following code: The code is annotated with comments describing each line. The second number is simply linked to the first number: 0 must be followed by 704, 1 by 848, 2 by 736, 3 by 346, 4 by 607, 5 by 147, 6 by 832, and 7 by 536. In this part, we are given two functions phase_4() and func4(). Each phase expects you to type a particular string on stdin.If you type the correct string, then the phase is defused and the bomb proceeds to the next phase. From phase_4, we call the four arguments of func4 to be a, b(known, 0), c(known, 14), d(known, 0). You get to know that the input sequence must be an arbitary combination of number 1,2,3,4,5,6. This works just fine, and I invite you to try it. This count is checked by the function read six numbers which also takes the user input string and formats them into integers that are then dumped onto the stack. In order to solve the cypher, take a look at %esi and youll find an array of characters stored there, where each character has an index. Specifically: We can see that our string input blah is being compared with the string Border relations with Canada have never been better.. I start stepping by single instructions until I get to the point where I am about to hit the function strings_not_equal. read_six_numbers f7 ff ff callq 400bf0 <__isoc99_sscanf@plt>, : e8 a1 ff ff ff callq 40143a , fc ff ff callq 400bf0 <__isoc99_sscanf@plt>, : e8 c7 fb ff ff callq 400bf0 <__isoc99_sscanf@plt>, fa ff ff callq 400b30 <__stack_chk_fail@plt>. The student then saves the tar file to disk. I am currently stuck on bomb lab phase 5. Here is Phase 3. Cannot retrieve contributors at this time. Phase 1 defused. bomblab-Angr/Phase 5 x86_64.ipynb. Regardless, the first user inputed value had to be less than or equal to 14 and had to spit out an 11 after its computation. Second, each progressive number in the code series entered by the user must be 1 larger than the next. greatwhite.ics.cs.cmu.edu Less than two and the bomb detonates. Given that our string is 6 characters long, it makes sense to assume that the function is iterating over each character in the loop and presumably doing something to them. Keep going! Try this . Analysis of Binary Bomb Lab GitHub I also found strings that look like they could be related to attribution: These numbers act as indices within a six element array in memory, each element of which contains a number. func4() - This function was rather difficult for me to get through logically and so I ultimately had to take it as somewhat as a black box. . !", deducting points from your problem set grade, and then terminating. * phase2a.c - To defeat this stage the user must enter a sequence of, * 6 nonnegative numbers where x[i] = x[i-1] + i. sign in lesson and forces them to learn to use a debugger. Each phase expects you to type a particular string on stdin. There are a ton of dead ends that you can follow in this code that all land on detonation. Changing the second input does not affect the ecx. No description, website, or topics provided. CurryTang/bomb_lab_solution - Github string_length False COVID-19 PCR Test. [RE] Linux Bomb Walkthrough - Part2 (Phases 1-3) - [McB]Defence Lets do the standard disas command to see the assembly of the function. phase 2, variant "a" for phase 3, variant "c" for phase 4, and so on. Binary-Bomb/phase2a.c at master lukeknowles/Binary-Bomb - Github Bomb Lab: Phase 5. If nothing happens, download Xcode and try again. Halfway there! If there is a, problem (say because you forgot to update the list of machines the, bombs are allowed to run in src/config.h) you can fix the, configuration, reset the lab, and then request and run more test, CAUTION: If you reset the lab after it's live, you'll lose all your, records of the students bombs and their solutions. mov a b moves data from a to b as opposed to b to a). When we hit phase_1, we can see the following code: Connect and share knowledge within a single location that is structured and easy to search. It's a great. Here is Phase 5. This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository. To subscribe to this RSS feed, copy and paste this URL into your RSS reader. My phase 5 is different from most other phase 5's I've found online, as it is the input of two integers. Phase 1 defused. If you notice, (the syntax will vary based off of what sort of system the bomb is run on) the machine code will have some variation of call to: 401135: be b8 25 40 00 mov $0x4025b8,%esi. 0,1,2,3,4,5,6,7,8,9,10,11,12,13,14 Site design / logo 2023 Stack Exchange Inc; user contributions licensed under CC BY-SA. First you must enter two integers and the bomb will detonate if you enter more or less than that. 3) The second parameter 'p' at the end of the loop must be equal with %ecx register. this is binary bomb lab phase 5.I didn't solve phase 5. Learn more. Alternative paths? How about the next one? BombID: Each bomb in a given instance of the lab has a unique, non-negative integer called the "bombID. * Before going live with the students, we like to check everything out, by running some tests. phase_1 You will get full credit for defusing phase 1 with less than 20 explosions. ", Quiet Bomb: If compiled with the NONOTIFY option, then the bomb, doesn't send any messages when it explodes or is defused. The report daemon finds the most recent, defusing string submitted by each student for each phase, and, validates these strings by applying them to a local copy of the, student's bomb. so I did. readOK = sscanf(cString, "%d %d", &p, &q); --------------------------------------------------------. Did the Golden Gate Bridge 'flatten' under the weight of 300,000 people in 1987? The LabID must not have any spaces. I think the second number should be. What differentiates living as mere roommates from living in a marriage-like relationship? The binary bomb is a very good exercise to learn the assembly language.I started this exercise for fun. Maybe function names or labels? Many Git commands accept both tag and branch names, so creating this branch may cause unexpected behavior. PHASE 3. The code shows as follows: After inspecting the code, you should figure out that the length of the string must be 6. You have 6 phases with which to blow yourself up. Otherwise, the bomb explodes by printing "BOOM!! However, you do need to handle recursion actually. First things first, we can see from the call to <string_length> at <phase_5+23> and subsequent jump equal statement our string should be six characters long. Q. Now switch to Visual mode with v, cycle the print mode with p until you see the disassembled function, toggle your cursor with c, then finally move down to the movzx edx, byte . If the event was a defusion, the message also, contains the "defusing string" that the student typed to defuse the, Report Daemon: The report daemon periodically scans the scoreboard log, and updates the Web scoreboard. "make start" runs bomblab.pl, the main. Evil has created a slew of "binary bombs" for our class. It should look like this. Going through func4, we get the value of d at 400ff7 and 400fe2 to be (14 + 0) >> 1 = 7. Also note that the binary follow the AT&T standard so instruction operations are reversed (e.g. There is an accessed memory area that serves as a counter. The key is that each time you enter into the next element in the array there is a counter that increments. The bomb has blown up. How is white allowed to castle 0-0-0 in this position? There is a small grade penalty for explosions beyond 20. Let me know if you have any questions in the comments. Use Git or checkout with SVN using the web URL. What is scrcpy OTG mode and how does it work? We have created a stand-alone user-level autograding service that, handles all aspects of the Bomb Lab for you: Students download their, bombs from a server. First things first, we can see from the call to at and subsequent jump equal statement our string should be six characters long. We can find the latter numbers from the loop structure. I used a linux machine running x86_64. GitHub; Linkedin; Bomb Lab 7 minute read On this page. Otherwise the bomb "explodes" by printing "BOOM!!!". So you got that one. "make cleanallfiles" resets the lab from scratch, deleting all data specific to a particular instance of the lab, such, as the status log, all bombs created by the request server, and the, scoreboard log. strings_not_equal() - This function implements the test of equality between the user inputed string and the pass-phrase for phase_1 of the bomb challenge. Let's enter the string blah as our input to phase_1 . This number was 115. phase_6() - This function does a few initial checks on the numbers inputed by the user. If the function succeeds, it follows the green arrow on the right to the third box. The address and stuff will vary, but . angelshark.ics.cs.cmu.edu Are you sure you want to create this branch? Try this one. For each bomb, it tallies the number, of explosions, the last defused phase, validates each last defused, phase using a quiet copy of the bomb, and computes a score for each, student in a tab delimited text file called "scores.txt." which to blow yourself up. The previous output from the strings program was outputted to stout in order that the strings are found in the binary. We can get the full assembly code using an object dump: objdump -d path/to/binary > temp.txt. Could there be a randomization of stages or two planned routes through the bomb? Can you help me please? If your, Linux box crashes or reboots, simply restart the daemons with "make, * Information and error messages from the servers are appended to the, "status log" in bomblab/log-status.txt. Option 1: The simplest approach for offering the offline Bomb Lab is. "make stop" ensures that there are no. It first checks that you have inputed 6 numbers, then that they are within the range of 1 through 6, and finally that they are all unique numbers, in that no number is repeated. Check to see if the incremented character pointer is not null terminated. And your students will have to get, (2) Starting the Bomb Lab. Pull up the function in Graph mode with VV, press p to cycle between views, and select the minigraph. Here is the assembly code: The list of numbers I've inputed is this: So far from my understanding, two conditions need to be met: compare %ecx is 115 line 103 Although the problems differ from each other, the main methods we take are totally the same. @cinos hi, I had same problem, I couldn't understand, I must have ecx 15 too, but I couldn't figure it out. Regardless, I'm not falling for it this time. It then updates the HTML scoreboard that summarizes, the current number of explosions and defusions for each bomb, rank. Asking for help, clarification, or responding to other answers. What' more, there's a function call to read_six_numbers(), we can inspect it, Up till now, you should be able to find out that in this part, we are required to enter six numbers. Essentially what is happening is, each character from our string is ANDed with 0xf, and the result is used to get the character with the corresponding index from the array.