本实验在32位Linux虚拟机中完成（点击查看安装教程）
实验内容
二进制炸弹实际是由C语言源程序生成的可执行目标代码，主程序可参考bomb.c。运行时，会按次序提示用户输入3个不同的字符串。如果输入的字符串有误，炸弹就会“爆炸”，输出一条错误信息。必须通过对可执行程序反汇编和逆向工程判断应该是哪3个数据串，从而拆除“炸弹”。
通过分析对C语言源代码生成的可执行程序进行反汇编得到的汇编代码，在实践中加深对C语言和汇编语言关联的认识。
实验过程和结果
本实验一共有30个bomb文件夹，根据学号计算我要拆26号--bomb26
打开虚拟机开始拆炸弹，设置中开启拖放和复制粘贴
选中要拆的炸弹bomb26文件夹，复制，在虚拟机桌面上右键粘贴进来
在左上角点击，搜索终端（Terminal）打开，进入文件夹
里面有三个文件，查看要拆的炸弹为2、3、6
使用objdump -d bomb > 1.txt将反汇编的内容输出到1.txt文本文档中方便查看
打开1.txt向下找到phase_2开始分析
0804906e <phase_2>:804906e: 53 push %ebx804906f: 83 ec 30 sub $0x30,%esp8049072: 8d 44 24 10 lea 0x10(%esp),%eax8049076: 50 push %eax8049077: ff 74 24 3c pushl 0x3c(%esp)804907b: e8 f2 08 00 00 call 8049972 <read_six_numbers>8049080: 83 c4 10 add $0x10,%esp8049083: 83 7c 24 08 01 cmpl $0x1,0x8(%esp)8049088: 74 0d je 8049097 <phase_2+0x29>804908a: 83 ec 0c sub $0xc,%esp804908d: 6a 02 push $0x2804908f: e8 b9 08 00 00 call 804994d <explode_bomb>8049094: 83 c4 10 add $0x10,%esp8049097: bb 01 00 00 00 mov $0x1,%ebx804909c: 89 d8 mov %ebx,%eax804909e: 83 c3 01 add $0x1,%ebx80490a1: 89 da mov %ebx,%edx80490a3: 0f af 54 84 04 imul 0x4(%esp,%eax,4),%edx80490a8: 39 54 84 08 cmp %edx,0x8(%esp,%eax,4)80490ac: 74 0d je 80490bb <phase_2+0x4d>80490ae: 83 ec 0c sub $0xc,%esp80490b1: 6a 02 push $0x280490b3: e8 95 08 00 00 call 804994d <explode_bomb>80490b8: 83 c4 10 add $0x10,%esp80490bb: 83 fb 06 cmp $0x6,%ebx80490be: 75 dc jne 804909c <phase_2+0x2e>80490c0: 83 c4 28 add $0x28,%esp80490c3: 5b pop %ebx80490c4: c3 ret 通过汇编程序可知<read_six_numbers>要输入六个数字，由下方cmpl $0x1,0x8(%esp)可知第一个数是1，不等于1则爆炸。然后进入循环，由imul 0x4(%esp,%eax,4),%edx和cmp %edx,0x8(%esp,%eax,4) 分析可知要输入的数字为上一个数乘以循环次数，（汇编指令imul 0x4(%esp,%eax,4),%edx与%esp+%eax*4+0x4形式相同，此指令和cmp %edx,0x8(%esp,%eax,4)表示要输入的数为前一个数字*循环次数，相等则继续，否则爆炸，共循环6次）即a[n]=a[n-1]*循环次数(2≤n≤6，a[1]=1)，循环次数为%ebx,然后赋值给%edx，循环结束后可得六个数字为1 2 6 24 120 720
输入进行验证，炸弹2拆除成功
继续在1.txt中找到phase_3
080490c5 <phase_3>:80490c5: 83 ec 28 sub $0x28,%esp80490c8: 8d 44 24 14 lea 0x14(%esp),%eax80490cc: 50 push %eax80490cd: 8d 44 24 17 lea 0x17(%esp),%eax80490d1: 50 push %eax80490d2: 8d 44 24 20 lea 0x20(%esp),%eax80490d6: 50 push %eax80490d7: 68 d6 9e 04 08 push $0x8049ed680490dc: ff 74 24 3c pushl 0x3c(%esp)80490e0: e8 6b f8 ff ff call 8048950 <__isoc99_sscanf@plt>80490e5: 83 c4 20 add $0x20,%esp80490e8: 83 f8 02 cmp $0x2,%eax80490eb: 7f 0d jg 80490fa <phase_3+0x35>80490ed: 83 ec 0c sub $0xc,%esp80490f0: 6a 03 push $0x380490f2: e8 56 08 00 00 call 804994d <explode_bomb>80490f7: 83 c4 10 add $0x10,%esp80490fa: 83 7c 24 0c 07 cmpl $0x7,0xc(%esp)80490ff: 0f 87 43 01 00 00 ja 8049248 <phase_3+0x183>8049105: 8b 44 24 0c mov 0xc(%esp),%eax8049109: ff 24 85 e0 9e 04 08 jmp *0x8049ee0(,%eax,4)8049110: b8 77 00 00 00 mov $0x77,%eax8049115: 81 7c 24 08 51 02 00 cmpl $0x251,0x8(%esp)804911c: 00 804911d: 0f 84 37 01 00 00 je 804925a <phase_3+0x195>8049123: 83 ec 0c sub $0xc,%esp8049126: 6a 03 push $0x38049128: e8 20 08 00 00 call 804994d <explode_bomb>804912d: 83 c4 10 add $0x10,%esp8049130: b8 77 00 00 00 mov $0x77,%eax8049135: e9 20 01 00 00 jmp 804925a <phase_3+0x195>804913a: b8 76 00 00 00 mov $0x76,%eax804913f: 81 7c 24 08 b6 01 00 cmpl $0x1b6,0x8(%esp)8049146: 00 8049147: 0f 84 0d 01 00 00 je 804925a <phase_3+0x195>804914d: 83 ec 0c sub $0xc,%esp8049150: 6a 03 push $0x38049152: e8 f6 07 00 00 call 804994d <explode_bomb>8049157: 83 c4 10 add $0x10,%esp804915a: b8 76 00 00 00 mov $0x76,%eax804915f: e9 f6 00 00 00 jmp 804925a <phase_3+0x195>8049164: b8 67 00 00 00 mov $0x67,%eax8049169: 81 7c 24 08 b4 03 00 cmpl $0x3b4,0x8(%esp)8049170: 00 8049171: 0f 84 e3 00 00 00 je 804925a <phase_3+0x195>8049177: 83 ec 0c sub $0xc,%esp804917a: 6a 03 push $0x3804917c: e8 cc 07 00 00 call 804994d <explode_bomb>8049181: 83 c4 10 add $0x10,%esp8049184: b8 67 00 00 00 mov $0x67,%eax8049189: e9 cc 00 00 00 jmp 804925a <phase_3+0x195>804918e: b8 63 00 00 00 mov $0x63,%eax8049193: 81 7c 24 08 87 01 00 cmpl $0x187,0x8(%esp)804919a: 00 804919b: 0f 84 b9 00 00 00 je 804925a <phase_3+0x195>80491a1: 83 ec 0c sub $0xc,%esp80491a4: 6a 03 push $0x380491a6: e8 a2 07 00 00 call 804994d <explode_bomb>80491ab: 83 c4 10 add $0x10,%esp80491ae: b8 63 00 00 00 mov $0x63,%eax80491b3: e9 a2 00 00 00 jmp 804925a <phase_3+0x195>80491b8: b8 64 00 00 00 mov $0x64,%eax80491bd: 81 7c 24 08 46 02 00 cmpl $0x246,0x8(%esp)80491c4: 00 80491c5: 0f 84 8f 00 00 00 je 804925a <phase_3+0x195>80491cb: 83 ec 0c sub $0xc,%esp80491ce: 6a 03 push $0x380491d0: e8 78 07 00 00 call 804994d <explode_bomb>80491d5: 83 c4 10 add $0x10,%esp80491d8: b8 64 00 00 00 mov $0x64,%eax80491dd: eb 7b jmp 804925a <phase_3+0x195>80491df: b8 6c 00 00 00 mov $0x6c,%eax80491e4: 81 7c 24 08 3d 01 00 cmpl $0x13d,0x8(%esp)80491eb: 00 80491ec: 74 6c je 804925a <phase_3+0x195>80491ee: 83 ec 0c sub $0xc,%esp80491f1: 6a 03 push $0x380491f3: e8 55 07 00 00 call 804994d <explode_bomb>80491f8: 83 c4 10 add $0x10,%esp80491fb: b8 6c 00 00 00 mov $0x6c,%eax8049200: eb 58 jmp 804925a <phase_3+0x195>8049202: b8 73 00 00 00 mov $0x73,%eax8049207: 81 7c 24 08 3c 03 00 cmpl $0x33c,0x8(%esp)804920e: 00 804920f: 74 49 je 804925a <phase_3+0x195>8049211: 83 ec 0c sub $0xc,%esp8049214: 6a 03 push $0x38049216: e8 32 07 00 00 call 804994d <explode_bomb>804921b: 83 c4 10 add $0x10,%esp804921e: b8 73 00 00 00 mov $0x73,%eax8049223: eb 35 jmp 804925a <phase_3+0x195>8049225: b8 6b 00 00 00 mov $0x6b,%eax804922a: 81 7c 24 08 97 02 00 cmpl $0x297,0x8(%esp)8049231: 00 8049232: 74 26 je 804925a <phase_3+0x195>8049234: 83 ec 0c sub $0xc,%esp8049237: 6a 03 push $0x38049239: e8 0f 07 00 00 call 804994d <explode_bomb>804923e: 83 c4 10 add $0x10,%esp8049241: b8 6b 00 00 00 mov $0x6b,%eax8049246: eb 12 jmp 804925a <phase_3+0x195>8049248: 83 ec 0c sub $0xc,%esp804924b: 6a 03 push $0x3804924d: e8 fb 06 00 00 call 804994d <explode_bomb>8049252: 83 c4 10 add $0x10,%esp8049255: b8 6b 00 00 00 mov $0x6b,%eax804925a: 3a 44 24 07 cmp 0x7(%esp),%al804925e: 74 0d je 804926d <phase_3+0x1a8>8049260: 83 ec 0c sub $0xc,%esp8049263: 6a 03 push $0x38049265: e8 e3 06 00 00 call 804994d <explode_bomb>804926a: 83 c4 10 add $0x10,%esp804926d: 83 c4 1c add $0x1c,%esp8049270: c3 ret 使用x/s查看0x8049ed6中的内容得知要输入三个数据，一个整数，一个字符，一个整数
由cmpl $0x7,0xc(%esp)可知第一个数字小于7这里取0。然后有jmp *0x8049ee0(,%eax,4)，此处为switch语句，查看地址为0x8049110
下方mov $0x77,%eax和cmpl $0x251,0x8(%esp)等于则跳转表示%esp+8的值要等于251H，十进制为593。然后跳转到0x804925a进行 cmp 0x7(%esp),%al表示%esp+7的值等于AL的值则跳转，AL中的值为77H，为’w’的ASCII码。所以要输入的两个数字和一个字符为0 w 593
输入进行验证，炸弹3拆除成功
继续向下找到phase_6
080493b0 <phase_6>:80493b0: 83 ec 10 sub $0x10,%esp80493b3: 6a 0a push $0xa80493b5: 6a 00 push $0x080493b7: ff 74 24 1c pushl 0x1c(%esp)80493bb: e8 f0 f5 ff ff call 80489b0 <strtol@plt>80493c0: a3 74 c1 04 08 mov %eax,0x804c17480493c5: c7 04 24 74 c1 04 08 movl $0x804c174,(%esp)80493cc: e8 88 ff ff ff call 8049359 <fun6>80493d1: 8b 40 08 mov 0x8(%eax),%eax80493d4: 8b 40 08 mov 0x8(%eax),%eax80493d7: 8b 40 08 mov 0x8(%eax),%eax80493da: 8b 40 08 mov 0x8(%eax),%eax80493dd: 83 c4 10 add $0x10,%esp80493e0: 8b 15 74 c1 04 08 mov 0x804c174,%edx80493e6: 39 10 cmp %edx,(%eax)80493e8: 74 0d je 80493f7 <phase_6+0x47>80493ea: 83 ec 0c sub $0xc,%esp80493ed: 6a 06 push $0x680493ef: e8 59 05 00 00 call 804994d <explode_bomb>80493f4: 83 c4 10 add $0x10,%esp80493f7: 83 c4 0c add $0xc,%esp80493fa: c3 ret 还有一个fun6
08049359 <fun6>:8049359: 56 push %esi804935a: 53 push %ebx804935b: 8b 44 24 0c mov 0xc(%esp),%eax804935f: 8b 70 08 mov 0x8(%eax),%esi8049362: c7 40 08 00 00 00 00 movl $0x0,0x8(%eax)8049369: 89 c2 mov %eax,%edx804936b: 85 f6 test %esi,%esi804936d: 75 2c jne 804939b <fun6+0x42>804936f: eb 3c jmp 80493ad <fun6+0x54>8049371: 89 d1 mov %edx,%ecx8049373: 8b 51 08 mov 0x8(%ecx),%edx8049376: 85 d2 test %edx,%edx8049378: 74 08 je 8049382 <fun6+0x29>804937a: 39 1a cmp %ebx,(%edx)804937c: 7f f3 jg 8049371 <fun6+0x18>804937e: eb 02 jmp 8049382 <fun6+0x29>8049380: 89 c1 mov %eax,%ecx8049382: 39 d1 cmp %edx,%ecx8049384: 74 05 je 804938b <fun6+0x32>8049386: 89 71 08 mov %esi,0x8(%ecx)8049389: eb 02 jmp 804938d <fun6+0x34>804938b: 89 f0 mov %esi,%eax804938d: 8b 4e 08 mov 0x8(%esi),%ecx8049390: 89 56 08 mov %edx,0x8(%esi)8049393: 85 c9 test %ecx,%ecx8049395: 74 16 je 80493ad <fun6+0x54>8049397: 89 ce mov %ecx,%esi8049399: 89 c2 mov %eax,%edx804939b: 85 d2 test %edx,%edx804939d: 74 e1 je 8049380 <fun6+0x27>804939f: 8b 1e mov (%esi),%ebx80493a1: 89 c1 mov %eax,%ecx80493a3: 39 1a cmp %ebx,(%edx)80493a5: 7f cc jg 8049373 <fun6+0x1a>80493a7: 89 c2 mov %eax,%edx80493a9: 89 f0 mov %esi,%eax80493ab: eb e0 jmp 804938d <fun6+0x34>80493ad: 5b pop %ebx80493ae: 5e pop %esi80493af: c3 ret <strtol@plt>输入并读取一行字符，将字符转换为长整型，并规定了长整型的大小。可能是链表结构，头节点为0x804c174，判断输入的数字是否和调用函数fun6返回的值相等，相等则成功拆除，不相等则炸弹爆炸。使用指令查看节点中的内容并继续查看后续节点
由后续4个mov 0x8(%eax),%eax和mov 0x804c174,%edx和cmp %edx,(%eax)可知要输入的值为0x804c1a4中的内容270H，转换成十进制为624
输入进行验证，炸弹6拆除成功
到此为止，2、3、6炸弹全部拆除成功
最后
phase_3中，有多个结果都正确，因为第一个输入的数字不同，跳转到的地址不同，所有的结果如下：
0 w(77H) 593(251H)
1 v(76H) 438(1B6H)
2 g(67H) 948(3B4H)
3 c(63H) 391(187H)
4 d(64H) 582(246H)
5 l(6CH) 317(13DH)
6 s(73H) 828(33CH)
7 k(6BH) 663(297H)
phase_6中，即使没有分析出结果，不知道要输入哪个节点中的内容，还可以一个一个查看，全部试一遍也能找到答案（虽然不建议这样做）
