CSAPP bomblab（伪）报告

发表于

上个月就开始搞CSAPP了,之前书没看好,LAB做起来也磕磕绊绊.把书的第三章重新看了遍后,再来做.

另外,大概也要定个计划把汇编学了

之前GDB一直不太会用,通过这个机会也是学习了下,后面希望提升自己的学习力,什么不会遇上了能快速的学习.

注意不要让bomb爆炸,虽然我们不会被扣分…..我一开始都是直接炸来炸去的…..

每做完一个部分,就可以将答案保持在solution.txt中,避免重复输入,使用set args ./solution.txt来设置答案

phase_1

1
2
3
4
5
6
7
8
9
10
11
(gdb) disassemble phase_1
Dump of assembler code for function phase_1:
   0x0000000000400ee0 <+0>:	sub    $0x8,%rsp
   0x0000000000400ee4 <+4>:	mov    $0x402400,%esi
   0x0000000000400ee9 <+9>:	callq  0x401338 <strings_not_equal>
   0x0000000000400eee <+14>:	test   %eax,%eax
   0x0000000000400ef0 <+16>:	je     0x400ef7 <phase_1+23>
   0x0000000000400ef2 <+18>:	callq  0x40143a <explode_bomb>
   0x0000000000400ef7 <+23>:	add    $0x8,%rsp
   0x0000000000400efb <+27>:	retq   
End of assembler dump.

补个知识

  1. 常用寄存器有16个，分为x86通用寄存器以及r8-r15寄存器。
  2. 通用寄存器中，函数执行前后必须保持原始的寄存器有3个：是rbx、rbp、rsp。rx寄存器中，最后4个必须保持原值：r12、r13、r14、r15。
    保持原值的意义是为了让当前函数有可信任的寄存器，减小在函数调用过程中的保存&恢复操作。除了rbp、rsp用于特定用途外，其余5个寄存器可随意使用。
  3. 通用寄存器中，不必假设保存值可随意使用的寄存器有5个：是rax、rcx、rdx、rdi、rsi。其中rax用于第一个返回寄存器（当 然也可以用于其它用途），rdx用于第二个返回寄存器（在调用函数时也用于第三个参数寄存器）。rcx用于第四个参数。rdi用于第一个参数。rsi用于 第二个函数参数。
  4. r8、r9分配用于第5、第6个参数。

第一题还是不难的,注意到

1
2
0x0000000000400ee4 <+4>:	mov    $0x402400,%esi
0x0000000000400ee9 <+9>:	callq  0x401338 <strings_not_equal>

从0x402400读入一个数到%esi,然后作为第二个参数传入函数中

1
2
(gdb) x/s 0x402400
0x402400:	"Border relations with Canada have never been better."

1
2
3
4
break phase_1
run
输入一个字符串
print (char*)$rdi   第一个参数

发现第一个参数就是我们输入的,和第二个$0x402400处的对比,然后return 0就不会炸

phase_2

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
(gdb) disas phase_2
Dump of assembler code for function phase_2:
   0x0000000000400efc <+0>:	push   %rbp
   0x0000000000400efd <+1>:	push   %rbx
   0x0000000000400efe <+2>:	sub    $0x28,%rsp
   0x0000000000400f02 <+6>:	mov    %rsp,%rsi
   0x0000000000400f05 <+9>:	callq  0x40145c <read_six_numbers>
   0x0000000000400f0a <+14>:	cmpl   $0x1,(%rsp)   #比较第一个数 和 1
   0x0000000000400f0e <+18>:	je     0x400f30 <phase_2+52>
   0x0000000000400f10 <+20>:	callq  0x40143a   #炸炸炸 <explode_bomb>
   0x0000000000400f15 <+25>:	jmp    0x400f30 <phase_2+52>
   0x0000000000400f17 <+27>:	mov    -0x4(%rbx),%eax  保存rbx的值给%eax
   0x0000000000400f1a <+30>:	add    %eax,%eax   #乘以2
   0x0000000000400f1c <+32>:	cmp    %eax,(%rbx)   #第二个数和之前数的2倍比较
   0x0000000000400f1e <+34>:	je     0x400f25 <phase_2+41>
   0x0000000000400f20 <+36>:	callq  0x40143a <explode_bomb>
   0x0000000000400f25 <+41>:	add    $0x4,%rbx
   0x0000000000400f29 <+45>:	cmp    %rbp,%rbx   # 比较是否为最后一个值
   0x0000000000400f2c <+48>:	jne    0x400f17 <phase_2+27>
   0x0000000000400f2e <+50>:	jmp    0x400f3c <phase_2+64>
   0x0000000000400f30 <+52>:	lea    0x4(%rsp),%rbx
   0x0000000000400f35 <+57>:	lea    0x18(%rsp),%rbp
   0x0000000000400f3a <+62>:	jmp    0x400f17 <phase_2+27>
   0x0000000000400f3c <+64>:	add    $0x28,%rsp
   0x0000000000400f40 <+68>:	pop    %rbx
   0x0000000000400f41 <+69>:	pop    %rbp
   0x0000000000400f42 <+70>:	retq   
End of assembler dump.

提醒还是有的,注意<read_six_numbers>

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
(gdb) disas read_six_numbers
Dump of assembler code for function read_six_numbers:
   0x000000000040145c <+0>:	sub    $0x18,%rsp
   0x0000000000401460 <+4>:	mov    %rsi,%rdx
   0x0000000000401463 <+7>:	lea    0x4(%rsi),%rcx
   0x0000000000401467 <+11>:	lea    0x14(%rsi),%rax
   0x000000000040146b <+15>:	mov    %rax,0x8(%rsp)
   0x0000000000401470 <+20>:	lea    0x10(%rsi),%rax
   0x0000000000401474 <+24>:	mov    %rax,(%rsp)
   0x0000000000401478 <+28>:	lea    0xc(%rsi),%r9
   0x000000000040147c <+32>:	lea    0x8(%rsi),%r8
   0x0000000000401480 <+36>:	mov    $0x4025c3,%esi
   0x0000000000401485 <+41>:	mov    $0x0,%eax
   0x000000000040148a <+46>:	callq  0x400bf0 <__isoc99_sscanf@plt>
   0x000000000040148f <+51>:	cmp    $0x5,%eax
   0x0000000000401492 <+54>:	jg     0x401499 <read_six_numbers+61>
   0x0000000000401494 <+56>:	callq  0x40143a <explode_bomb>
   0x0000000000401499 <+61>:	add    $0x18,%rsp
   0x000000000040149d <+65>:	retq   
End of assembler dump.

可以看出,这个函数是读了6个32位整数,首先有0x18 = 24 = 6 x 4,4x8位就是32位,另外下面的代码也有读入过程.

继续看phase_2

cmpl $0x1,(%rsp)`比较第一个数 和 1

直接写注释来的好.(⊙﹏⊙)

大概就是1乘以2 ,然后重复…

答案就是1 2 4 8 16 32

然后设置断点验证即可

phase_3

不肝了,今天1.30睡的,明天7.00起,要不然给自己耳光.对应刚刚才写了的随想,肝帝计划,计划容易一时,难在坚持,加油,明早继续更

2.00睡不着,起来更

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
(gdb) disas phase_3
Dump of assembler code for function phase_3:
   0x0000000000400f43 <+0>:	sub    $0x18,%rsp
   0x0000000000400f47 <+4>:	lea    0xc(%rsp),%rcx
   0x0000000000400f4c <+9>:	lea    0x8(%rsp),%rdx
   0x0000000000400f51 <+14>:	mov    $0x4025cf,%esi
   0x0000000000400f56 <+19>:	mov    $0x0,%eax
   0x0000000000400f5b <+24>:	callq  0x400bf0 <__isoc99_sscanf@plt>
   0x0000000000400f60 <+29>:	cmp    $0x1,%eax
   0x0000000000400f63 <+32>:	jg     0x400f6a <phase_3+39>
   0x0000000000400f65 <+34>:	callq  0x40143a <explode_bomb>
   0x0000000000400f6a <+39>:	cmpl   $0x7,0x8(%rsp)
   0x0000000000400f6f <+44>:	ja     0x400fad <phase_3+106>
   0x0000000000400f71 <+46>:	mov    0x8(%rsp),%eax
   0x0000000000400f75 <+50>:	jmpq   *0x402470(,%rax,8)
   0x0000000000400f7c <+57>:	mov    $0xcf,%eax
   0x0000000000400f81 <+62>:	jmp    0x400fbe <phase_3+123>
   0x0000000000400f83 <+64>:	mov    $0x2c3,%eax
   0x0000000000400f88 <+69>:	jmp    0x400fbe <phase_3+123>
   0x0000000000400f8a <+71>:	mov    $0x100,%eax
   0x0000000000400f8f <+76>:	jmp    0x400fbe <phase_3+123>
   0x0000000000400f91 <+78>:	mov    $0x185,%eax
   0x0000000000400f96 <+83>:	jmp    0x400fbe <phase_3+123>
   0x0000000000400f98 <+85>:	mov    $0xce,%eax
   0x0000000000400f9d <+90>:	jmp    0x400fbe <phase_3+123>
   0x0000000000400f9f <+92>:	mov    $0x2aa,%eax
   0x0000000000400fa4 <+97>:	jmp    0x400fbe <phase_3+123>
   0x0000000000400fa6 <+99>:	mov    $0x147,%eax
   0x0000000000400fab <+104>:	jmp    0x400fbe <phase_3+123>
   0x0000000000400fad <+106>:	callq  0x40143a <explode_bomb>
   0x0000000000400fb2 <+111>:	mov    $0x0,%eax
   0x0000000000400fb7 <+116>:	jmp    0x400fbe <phase_3+123>
   0x0000000000400fb9 <+118>:	mov    $0x137,%eax
   0x0000000000400fbe <+123>:	cmp    0xc(%rsp),%eax
   0x0000000000400fc2 <+127>:	je     0x400fc9 <phase_3+134>
   0x0000000000400fc4 <+129>:	callq  0x40143a <explode_bomb>
   0x0000000000400fc9 <+134>:	add    $0x18,%rsp
   0x0000000000400fcd <+138>:	retq   
End of assembler dump.

注意到jmpq *0x402470(,%rax,8)我们可以发现程序使用了跳转表

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
(gdb) x/1xg 0x402470
0x402470:	0x0000000000400f7c
(gdb) x/1xg 0x402478
0x402478:	0x0000000000400fb9
(gdb) x/1xg 0x402480
0x402480:	0x0000000000400f83
(gdb) x/1xg 0x402488
0x402488:	0x0000000000400f8a
(gdb) x/1xg 0x402490
0x402490:	0x0000000000400f91
(gdb) x/1xg 0x402498
0x402498:	0x0000000000400f98
(gdb) x/1xg 0x4024a0
0x4024a0:	0x0000000000400f9f
(gdb) x/1xg 0x4024a8
0x4024a8:	0x0000000000400fa6

1
2
3
4
5
6
7
8
9
%rax(输入参数1)       跳转地址            0xc(%rsp)(输入参数2)
0               0x0000000000400f7c       0xcf  207
1               0x0000000000400fb9       0x137 311
2               0x0000000000400f83       0x2c3 707
3               0x0000000000400f8a       0x100 256
4               0x0000000000400f91       0x185 389
5               0x0000000000400f98       0xce  206
6               0x0000000000400f9f       0x2aa 682
7               0x0000000000400fa6       0x147 327

ok啦

phase_4

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
(gdb) disas phase_4
Dump of assembler code for function phase_4:
   0x000000000040100c <+0>:	sub    $0x18,%rsp
   0x0000000000401010 <+4>:	lea    0xc(%rsp),%rcx
   0x0000000000401015 <+9>:	lea    0x8(%rsp),%rdx
   0x000000000040101a <+14>:	mov    $0x4025cf,%esi
   0x000000000040101f <+19>:	mov    $0x0,%eax
   0x0000000000401024 <+24>:	callq  0x400bf0 <__isoc99_sscanf@plt>
   0x0000000000401029 <+29>:	cmp    $0x2,%eax
   0x000000000040102c <+32>:	jne    0x401035 <phase_4+41>
   0x000000000040102e <+34>:	cmpl   $0xe,0x8(%rsp)
   0x0000000000401033 <+39>:	jbe    0x40103a <phase_4+46>
   0x0000000000401035 <+41>:	callq  0x40143a <explode_bomb>
   0x000000000040103a <+46>:	mov    $0xe,%edx
   0x000000000040103f <+51>:	mov    $0x0,%esi
   0x0000000000401044 <+56>:	mov    0x8(%rsp),%edi
   0x0000000000401048 <+60>:	callq  0x400fce <func4>
   0x000000000040104d <+65>:	test   %eax,%eax
   0x000000000040104f <+67>:	jne    0x401058 <phase_4+76>
   0x0000000000401051 <+69>:	cmpl   $0x0,0xc(%rsp)
   0x0000000000401056 <+74>:	je     0x40105d <phase_4+81>
   0x0000000000401058 <+76>:	callq  0x40143a <explode_bomb>
   0x000000000040105d <+81>:	add    $0x18,%rsp
   0x0000000000401061 <+85>:	retq

注意到jne 0x401058 <phase_4+76>,发现这个函数jump到了自己,应该是个递归函数
disas func4

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
(gdb) disas func4
Dump of assembler code for function func4:
   0x0000000000400fce <+0>:	sub    $0x8,%rsp
   0x0000000000400fd2 <+4>:	mov    %edx,%eax
   0x0000000000400fd4 <+6>:	sub    %esi,%eax
   0x0000000000400fd6 <+8>:	mov    %eax,%ecx
   0x0000000000400fd8 <+10>:	shr    $0x1f,%ecx
   0x0000000000400fdb <+13>:	add    %ecx,%eax
   0x0000000000400fdd <+15>:	sar    %eax
   0x0000000000400fdf <+17>:	lea    (%rax,%rsi,1),%ecx
   0x0000000000400fe2 <+20>:	cmp    %edi,%ecx
   0x0000000000400fe4 <+22>:	jle    0x400ff2 <func4+36>
   0x0000000000400fe6 <+24>:	lea    -0x1(%rcx),%edx
   0x0000000000400fe9 <+27>:	callq  0x400fce <func4>
   0x0000000000400fee <+32>:	add    %eax,%eax
   0x0000000000400ff0 <+34>:	jmp    0x401007 <func4+57>
   0x0000000000400ff2 <+36>:	mov    $0x0,%eax
   0x0000000000400ff7 <+41>:	cmp    %edi,%ecx
   0x0000000000400ff9 <+43>:	jge    0x401007 <func4+57>
   0x0000000000400ffb <+45>:	lea    0x1(%rcx),%esi
   0x0000000000400ffe <+48>:	callq  0x400fce <func4>
   0x0000000000401003 <+53>:	lea    0x1(%rax,%rax,1),%eax
   0x0000000000401007 <+57>:	add    $0x8,%rsp
   0x000000000040100b <+61>:	retq   
End of assembler dump.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
int func4(int a, int b, int c)
{
    int result;
    result = c;
    result = result - b;
    int tmp = result;
    tmp = (unsigned)tmp >> 31;
    result = result + tmp;
    result = result / 2;
    tmp = result + b;
    if(tmp > a)
    {
        c = tmp - 1;
        result = func4(a, b, c);
        return (2 * result);
    }
    result = 0;
    if(tmp < a)
    {
        b = tmp + 1;
        result = func4(a, b, c);
        return (1 + 2 * result);
    }
    return result;
}

因此phase_4破译可能结果为：

0 0

1 0

3 0

7 0

phase_5

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
(gdb) disas phase_5
Dump of assembler code for function phase_5:
   0x0000000000401062 <+0>:	push   %rbx
   0x0000000000401063 <+1>:	sub    $0x20,%rsp
   0x0000000000401067 <+5>:	mov    %rdi,%rbx   %rdi保存输入的字符串指针
   0x000000000040106a <+8>:	mov    %fs:0x28,%rax
   0x0000000000401073 <+17>:	mov    %rax,0x18(%rsp)
   0x0000000000401078 <+22>:	xor    %eax,%eax
   0x000000000040107a <+24>:	callq  0x40131b <string_length>   计算输入字符串长度
   0x000000000040107f <+29>:	cmp    $0x6,%eax   判断输入字符串长度是否等于6
   0x0000000000401082 <+32>:	je     0x4010d2 <phase_5+112>
   0x0000000000401084 <+34>:	callq  0x40143a <explode_bomb>
   0x0000000000401089 <+39>:	jmp    0x4010d2 <phase_5+112>
   0x000000000040108b <+41>:	movzbl (%rbx,%rax,1),%ecx  复制输入字符串的第%rax个字符到%ecx中
   0x000000000040108f <+45>:	mov    %cl,(%rsp)
   0x0000000000401092 <+48>:	mov    (%rsp),%rdx
   0x0000000000401096 <+52>:	and    $0xf,%edx
   0x0000000000401099 <+55>:	movzbl 0x4024b0(%rdx),%edx
   0x00000000004010a0 <+62>:	mov    %dl,0x10(%rsp,%rax,1)
   0x00000000004010a4 <+66>:	add    $0x1,%rax  偏移量+1
   0x00000000004010a8 <+70>:	cmp    $0x6,%rax  判断%rax是否等于6,不等于6继续循环
   0x00000000004010ac <+74>:	jne    0x40108b <phase_5+41>
   0x00000000004010ae <+76>:	movb   $0x0,0x16(%rsp)
   0x00000000004010b3 <+81>:	mov    $0x40245e,%esi
   0x00000000004010b8 <+86>:	lea    0x10(%rsp),%rdi
   0x00000000004010bd <+91>:	callq  0x401338 <strings_not_equal>     判断%esi和%rdi指向的字符串是否相等
   0x00000000004010c2 <+96>:	test   %eax,%eax
   0x00000000004010c4 <+98>:	je     0x4010d9 <phase_5+119>
   0x00000000004010c6 <+100>:	callq  0x40143a <explode_bomb>
   0x00000000004010cb <+105>:	nopl   0x0(%rax,%rax,1)
   0x00000000004010d0 <+110>:	jmp    0x4010d9 <phase_5+119>
   0x00000000004010d2 <+112>:	mov    $0x0,%eax
   0x00000000004010d7 <+117>:	jmp    0x40108b <phase_5+41>
   0x00000000004010d9 <+119>:	mov    0x18(%rsp),%rax
   0x00000000004010de <+124>:	xor    %fs:0x28,%rax
   0x00000000004010e7 <+133>:	je     0x4010ee <phase_5+140>
   0x00000000004010e9 <+135>:	callq  0x400b30 <__stack_chk_fail@plt>
   0x00000000004010ee <+140>:	add    $0x20,%rsp
   0x00000000004010f2 <+144>:	pop    %rbx
   0x00000000004010f3 <+145>:	retq   
End of assembler dump.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
(gdb) disas string_length
Dump of assembler code for function string_length:
   0x000000000040131b <+0>:	cmpb   $0x0,(%rdi)
   0x000000000040131e <+3>:	je     0x401332 <string_length+23>
   0x0000000000401320 <+5>:	mov    %rdi,%rdx
   0x0000000000401323 <+8>:	add    $0x1,%rdx
   0x0000000000401327 <+12>:	mov    %edx,%eax
   0x0000000000401329 <+14>:	sub    %edi,%eax
   0x000000000040132b <+16>:	cmpb   $0x0,(%rdx)
   0x000000000040132e <+19>:	jne    0x401323 <string_length+8>
   0x0000000000401330 <+21>:	repz retq## secret_phase
   0x0000000000401332 <+23>:	mov    $0x0,%eax
   0x0000000000401337 <+28>:	retq   
End of assembler dump.
(gdb)

这个可以说是phase_1的升版本了,注意到movzbl (%rbx,%rax,1),%ecx 复制输入字符串的第%rax个字符到%ecx中每次取该字符串的一个字符,然后比对,然后+1,并且由开始的代码可知.字符串是6字符

1
2
3
4
(gdb) x/s 0x4024b0
0x4024b0 <array.3449>:	"maduiersnfotvbylSo you think you can stop the bomb with ctrl-c, do you?"
(gdb) x/s 0x40245e
0x40245e:	"flyers"

phase_6

第6个好难啊 QAQ

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
(gdb) disas phase_6
Dump of assembler code for function phase_6:
   0x00000000004010f4 <+0>: push   %r14                                将被调用者保存寄存器压入栈
   0x00000000004010f6 <+2>: push   %r13
   0x00000000004010f8 <+4>: push   %r12
   0x00000000004010fa <+6>: push   %rbp
   0x00000000004010fb <+7>: push   %rbx                                %rsp = 0x7fffffffe2c0
   0x00000000004010fc <+8>: sub    $0x50,%rsp                          分配栈空间 %rsp = 0x7fffffffe270
   0x0000000000401100 <+12>:    mov    %rsp,%r13

   0x0000000000401103 <+15>:    mov    %rsp,%rsi
   0x0000000000401106 <+18>:    callq  0x40145c <read_six_numbers>     读入6个值,保存至从 %rsi 开始的地址

   0x000000000040110b <+23>:    mov    %rsp,%r14
   0x000000000040110e <+26>:    mov    $0x0,%r12d                      %r12 置0,并且%r13 %r14 %rbp 均和 %rsp 指向相同地址 0x7fffffffe270

   0x0000000000401114 <+32>:    mov    %r13,%rbp
   0x0000000000401117 <+35>:    mov    0x0(%r13),%eax                  将第 %r13 指向的输入数复制到 %eax
   0x000000000040111b <+39>:    sub    $0x1,%eax                       将输入数减1
   0x000000000040111e <+42>:    cmp    $0x5,%eax                       判断输入数是否小于等于6,因为上一步中减1操作
   0x0000000000401121 <+45>:    jbe    0x401128 <phase_6+52>           若大于6,则调用 explode_bomb
   0x0000000000401123 <+47>:    callq  0x40143a <explode_bomb>
=========================================================================================================================================================
   0x0000000000401128 <+52>:    add    $0x1,%r12d                      将 %r12 加1
   0x000000000040112c <+56>:    cmp    $0x6,%r12d                      判断 %r12 是否等于6
   0x0000000000401130 <+60>:    je     0x401153 <phase_6+95>           若等于6,跳转,否则继续执行
   0x0000000000401132 <+62>:    mov    %r12d,%ebx                      将 %r12 复制到 %ebx

   0x0000000000401135 <+65>:    movslq %ebx,%rax                       将 %ebx 符号位扩展复制到 %rax
   0x0000000000401138 <+68>:    mov    (%rsp,%rax,4),%eax              将第 %ebx 输入数复制到 %eax
   0x000000000040113b <+71>:    cmp    %eax,0x0(%rbp)                  比较 %r13 指向的输入数和 第 %ebx 输入数 是否相等
   0x000000000040113e <+74>:    jne    0x401145 <phase_6+81>           如果相等,则调用 explode_bomb
   0x0000000000401140 <+76>:    callq  0x40143a <explode_bomb>
   0x0000000000401145 <+81>:    add    $0x1,%ebx                       将 %ebx 加1
   0x0000000000401148 <+84>:    cmp    $0x5,%ebx                       判断 %ebx 是否小于等于5
   0x000000000040114b <+87>:    jle    0x401135 <phase_6+65>           若小于等于,跳转,否则继续执行;该循环判断 %r13 指向的数据和其后输入数不相等

   0x000000000040114d <+89>:    add    $0x4,%r13                       将 %r13 指向下一个输入数,该循环判断所有的输入数全部不相等
   0x0000000000401151 <+93>:    jmp    0x401114 <phase_6+32>
=========================================================================================================================================================
   0x0000000000401153 <+95>:    lea    0x18(%rsp),%rsi                 将 %rsi 指向栈中跳过读入数据位置作为结束标记,并且 %r14 仍和 %rsp 指向同一个位置
   0x0000000000401158 <+100>:   mov    %r14,%rax                       将 %r14 复制到 %rax
   0x000000000040115b <+103>:   mov    $0x7,%ecx
   0x0000000000401160 <+108>:   mov    %ecx,%edx                       将立即数0x7复制到 %edx
   0x0000000000401162 <+110>:   sub    (%rax),%edx                     立即数7减去 %r14 指向的数据
   0x0000000000401164 <+112>:   mov    %edx,(%rax)                     将7减的结果存回 %r14 执行的内存单元
   0x0000000000401166 <+114>:   add    $0x4,%rax                       %rax 指向下一个输入数
   0x000000000040116a <+118>:   cmp    %rsi,%rax                       比较是否达到输入数组的末尾,
   0x000000000040116d <+121>:   jne    0x401160 <phase_6+108>          该循环使用立即数7减去每个输入数据
==========================================================================================================================================================
   0x000000000040116f <+123>:   mov    $0x0,%esi                       将 %rsi 置0
   0x0000000000401174 <+128>:   jmp    0x401197 <phase_6+163>

   0x0000000000401176 <+130>:   mov    0x8(%rdx),%rdx                  将 0x8(%rdx) 指向内存单元的内容复制到 %rdx, 指向链表下一个元素
   0x000000000040117a <+134>:   add    $0x1,%eax                       将 %eax 加1
   0x000000000040117d <+137>:   cmp    %ecx,%eax                       比较 %ecx 和 %eax 是否相等
   0x000000000040117f <+139>:   jne    0x401176 <phase_6+130>          不相等,继续遍历链表,最终 %rdx 指向链表的第 %ecx 个节点
   0x0000000000401181 <+141>:   jmp    0x401188 <phase_6+148>
   0x0000000000401183 <+143>:   mov    $0x6032d0,%edx                  重置链表首地址
   0x0000000000401188 <+148>:   mov    %rdx,0x20(%rsp,%rsi,2)
   0x000000000040118d <+153>:   add    $0x4,%rsi
   0x0000000000401191 <+157>:   cmp    $0x18,%rsi
   0x0000000000401195 <+161>:   je     0x4011ab <phase_6+183>

   0x0000000000401197 <+163>:   mov    (%rsp,%rsi,1),%ecx              将 (%rsp + %rsi) 指向的数据复制到 %ecx
   0x000000000040119a <+166>:   cmp    $0x1,%ecx                       比较 %ecx 是否小于等于1
   0x000000000040119d <+169>:   jle    0x401183 <phase_6+143>          若小于等于,跳转,否则继续执行, 等于1, %edx 直接指向链表首地址
   0x000000000040119f <+171>:   mov    $0x1,%eax                       将 %eax 置1
   0x00000000004011a4 <+176>:   mov    $0x6032d0,%edx                  将 %rdx 指向内存单元 0x6032d0
   0x00000000004011a9 <+181>:   jmp    0x401176 <phase_6+130>          跳转; 该循环根据输入数将链表中对应的第输入数个节点的地址复制到 0x20(%rsp) 开始的栈中
 ==========================================================================================================================================================
   0x00000000004011ab <+183>:   mov    0x20(%rsp),%rbx                 将0x20(%rsp)的链表节点地址复制到 %rbx
   0x00000000004011b0 <+188>:   lea    0x28(%rsp),%rax                 将 %rax 指向栈中下一个链表节点的地址
   0x00000000004011b5 <+193>:   lea    0x50(%rsp),%rsi                 将 %rsi 指向保存的链表节点地址的末尾
   0x00000000004011ba <+198>:   mov    %rbx,%rcx

   0x00000000004011bd <+201>:   mov    (%rax),%rdx
   0x00000000004011c0 <+204>:   mov    %rdx,0x8(%rcx)                  将栈中指向的后一个节点的地址复制到前一个节点的地址位置
   0x00000000004011c4 <+208>:   add    $0x8,%rax                       移动到下一个节点
   0x00000000004011c8 <+212>:   cmp    %rsi,%rax                       判断6个节点是否遍历完毕
   0x00000000004011cb <+215>:   je     0x4011d2 <phase_6+222>
   0x00000000004011cd <+217>:   mov    %rdx,%rcx
   0x00000000004011d0 <+220>:   jmp    0x4011bd <phase_6+201>
   0x00000000004011d2 <+222>:   movq   $0x0,0x8(%rdx)                  该循环按照7减去输入数据的索引重新调整链表
==========================================================================================================================================================
   0x00000000004011da <+230>:   mov    $0x5,%ebp
   0x00000000004011df <+235>:   mov    0x8(%rbx),%rax                  将 %rax 指向 %rbx 下一个链表节点
   0x00000000004011e3 <+239>:   mov    (%rax),%eax
   0x00000000004011e5 <+241>:   cmp    %eax,(%rbx)                     比较链表节点中第一个字段值的大小,如果前一个节点值大于后一个节点值,跳转
   0x00000000004011e7 <+243>:   jge    0x4011ee <phase_6+250>
   0x00000000004011e9 <+245>:   callq  0x40143a <explode_bomb>
   0x00000000004011ee <+250>:   mov    0x8(%rbx),%rbx                  将 %rbx 向后移动,指向栈中下一个链表节点的地址
   0x00000000004011f2 <+254>:   sub    $0x1,%ebp                       判断循环是否结束,该循环判断栈中重新调整后的链表节点是否按照降序排列
   0x00000000004011f5 <+257>:   jne    0x4011df <phase_6+235>
   0x00000000004011f7 <+259>:   add    $0x50,%rsp
   0x00000000004011fb <+263>:   pop    %rbx
   0x00000000004011fc <+264>:   pop    %rbp
   0x00000000004011fd <+265>:   pop    %r12
   0x00000000004011ff <+267>:   pop    %r13
   0x0000000000401201 <+269>:   pop    %r14
   0x0000000000401203 <+271>:   retq
End of assembler dump.

secret_phase