The names all the functions the bomb calls
Step 1: Get Your Bomb
Each group of students will attempt to defuse their own personalized bomb. Each bomb is a Linux binary executable file that has been compiled from a C program. To obtain your group’s bomb, one (and only one) of the group members should point your Web browser to the bomb request daemon at
• README: Identifies the bomb and its owners.
1
Step 2: Defuse Your Bomb
You can use many tools to help you with this; please look at the hints section for some tips and ideas. The best way is to use your favorite debugger to step through the disassembled binary.
• Phase 2: loops
• Phase 3: conditionals/switches
Each bomb phase is defused by inputing an appropriate string. If you input the wrong string for a phase, the bomb explodes. The bomb ignores blank input lines.
If you run your bomb with a command line argument, for example,
Logistics
As usual, you may work in a group of up to 2 people.
http://www.cs.umbc.edu/˜cmsc313/313/313Bomb-Spring10.html
This web page is updated continuously to show the progress of each group.
• Every time you guess wrong, a message is sent to the staff. You could very quickly saturate the network with these messages, and cause the system administrators to revoke your computer access.
• We haven’t told you how long the strings are, nor have we told you what characters are in them. Even if you made the (wrong) assumptions that they all are less than 80 characters long and only contain letters, then you will have 2680guesses for each phase. This will take a very long time to run, and you will not get the answer before the assignment is due.
– To keep the bomb from blowing up every time you type in a wrong input, you’ll want to learn how to set breakpoints.
– The CS:APP Student Site at http://csapp.cs.cmu.edu/public/students.html has a very handy single-page gdb summary.
This will print out the bomb’s symbol table. The symbol table includes the names of all functions and global variables in the bomb, the names of all the functions the bomb calls, and their addresses. You may learn something by looking at the function names!
• objdump -d
To determine that the call was to sscanf, you would need to disassemble within gdb. To disassem-ble in gdb, use the disassemble command.
• strings