Bomblab markup
没事看了下csapp，发现bomblab做起来有点像写oi题，于是又更新了。
Tip：r in_file可以让炸弹从in_file中读取key，读不进时再转stdin。
wsl要注意换行符要改成LF，且最后一行要以换行符结尾，否则会直接boom。
Phase 1
Dump of assembler code for function phase_1:
0x0000000000400ee0 <+0>: sub $0x8,%rsp # %rsp -= 8
0x0000000000400ee4 <+4>: mov $0x402400,%esi # %esi = 0x402400
0x0000000000400ee9 <+9>: callq 0x401338 <strings_not_equal>
0x0000000000400eee <+14>: test %eax,%eax
0x0000000000400ef0 <+16>: je 0x400ef7 <phase_1+23>
0x0000000000400ef2 <+18>: callq 0x40143a <explode_bomb>
0x0000000000400ef7 <+23>: add $0x8,%rsp
0x0000000000400efb <+27>: retq
输入命令：
p (char*)0x402400
$12 = 0x402400 "Border relations with Canada have never been better."
Key 1： Border relations with Canada have never been better.
Phase 2
被调用者保存（Callee saved）：被调用者需要使用时，将其入栈
调用者保存（Caller saved）：调用者调用其他函数前需要保存时，将其入栈
%rax和%rdi, %rsi, ..., %r9也是Caller saved，好处是可以当作临时变量，任意修改
Dump of assembler code for function phase_2:
0x0000000000400efc <+0>: push %rbp # 被调用者保存(callee saved)，最后pop复原
0x0000000000400efd <+1>: push %rbx
0x0000000000400efe <+2>: sub $0x28,%rsp # %rsp -= 40
0x0000000000400f02 <+6>: mov %rsp,%rsi # %rsi = %rsp
0x0000000000400f05 <+9>: callq 0x40145c <read_six_numbers> #
0x0000000000400f0a <+14>: cmpl $0x1,(%rsp) # (%rsp), 1
0x0000000000400f0e <+18>: je 0x400f30 <phase_2+52> # (%rsp) != 1 则爆炸
0x0000000000400f10 <+20>: callq 0x40143a <explode_bomb> #
0x0000000000400f15 <+25>: jmp 0x400f30 <phase_2+52> # start for loop
0x0000000000400f17 <+27>: mov -0x4(%rbx),%eax # %eax = M[%rbx - 4]
0x0000000000400f1a <+30>: add %eax,%eax # %eax *= 2
0x0000000000400f1c <+32>: cmp %eax,(%rbx) # (%rbx) , %eax
0x0000000000400f1e <+34>: je 0x400f25 <phase_2+41> # (%rbx) != %eax 则爆炸
0x0000000000400f20 <+36>: callq 0x40143a <explode_bomb> #
0x0000000000400f25 <+41>: add $0x4,%rbx # %rbx += 4
0x0000000000400f29 <+45>: cmp %rbp,%rbx # %rbx, %rbp
0x0000000000400f2c <+48>: jne 0x400f17 <phase_2+27> # %rbx != %rbp
0x0000000000400f2e <+50>: jmp 0x400f3c <phase_2+64> # end loop
0x0000000000400f30 <+52>: lea 0x4(%rsp),%rbx # %rbx = %rsp + 4 （这两行是for的初始化）
0x0000000000400f35 <+57>: lea 0x18(%rsp),%rbp # %rbp = %rsp + 24
0x0000000000400f3a <+62>: jmp 0x400f17 <phase_2+27> #
0x0000000000400f3c <+64>: add $0x28,%rsp #
0x0000000000400f40 <+68>: pop %rbx #
0x0000000000400f41 <+69>: pop %rbp #
0x0000000000400f42 <+70>: retq #
#
Dump of assembler code for function read_six_numbers: #
0x000000000040145c <+0>: sub $0x18,%rsp # %rsp -= 24
0x0000000000401460 <+4>: mov %rsi,%rdx # %rdx = %rsi
0x0000000000401463 <+7>: lea 0x4(%rsi),%rcx # %rcx = %rsi + 4
0x0000000000401467 <+11>: lea 0x14(%rsi),%rax # %rax = %rsi + 20
0x000000000040146b <+15>: mov %rax,0x8(%rsp) # M[8+%rsp] = %rax
0x0000000000401470 <+20>: lea 0x10(%rsi),%rax # %rax = %rsi + 16
0x0000000000401474 <+24>: mov %rax,(%rsp) # M[%rsp] = %rax
0x0000000000401478 <+28>: lea 0xc(%rsi),%r9 # %r9 = %rsi + 12
0x000000000040147c <+32>: lea 0x8(%rsi),%r8 # %r8 = %rsi + 8
0x0000000000401480 <+36>: mov $0x4025c3,%esi # %esi = 0x4025c3 "%d %d %d %d %d %d"
0x0000000000401485 <+41>: mov $0x0,%eax # %eax = 0
0x000000000040148a <+46>: callq 0x400bf0 <__isoc99_sscanf@plt> # rdi 不变，还是读入值
0x000000000040148f <+51>: cmp $0x5,%eax # %eax , 0x5
0x0000000000401492 <+54>: jg 0x401499 <read_six_numbers+61> # %eax > 0x5则不爆炸
0x0000000000401494 <+56>: callq 0x40143a <explode_bomb>
0x0000000000401499 <+61>: add $0x18,%rsp # %rsp += 24
0x000000000040149d <+65>: retq
# p (char*)0x4025c3
# $1 = 0x4025c3 "%d %d %d %d %d %d"
# 源码：sscanf(input,"%d%d%d%d%d%d", %rsi, %rsi+4, %rsi+8, %rsi+12, %rsi+16, %rsi+20);
read_six_numbers确实就是读了6个数，只需注意超过6个参数，多余的参数会分配在栈中
代码一看就是一个简单的for循环
Key 2: 1 2 4 8 16 32
Phase 3
Dump of assembler code for function phase_3:
0x0000000000400f43 <+0>: sub $0x18,%rsp #
0x0000000000400f47 <+4>: lea 0xc(%rsp),%rcx # %rcx = %rsp + 12
0x0000000000400f4c <+9>: lea 0x8(%rsp),%rdx # %rdx = %rsp + 8
0x0000000000400f51 <+14>: mov $0x4025cf,%esi # %esi = 0x4025cf "%d %d"
0x0000000000400f56 <+19>: mov $0x0,%eax
0x0000000000400f5b <+24>: callq 0x400bf0 <__isoc99_sscanf@plt> # sscanf(input, "%d%d", %rsp+8, %rsp+12)
# 记为 x,y
0x0000000000400f60 <+29>: cmp $0x1,%eax # %eax, 1
0x0000000000400f63 <+32>: jg 0x400f6a <phase_3+39> # 读入<=1个数就爆炸
0x0000000000400f65 <+34>: callq 0x40143a <explode_bomb>
0x0000000000400f6a <+39>: cmpl $0x7,0x8(%rsp) # x, 7
0x0000000000400f6f <+44>: ja 0x400fad <phase_3+106> # if(x>7) 爆炸
0x0000000000400f71 <+46>: mov 0x8(%rsp),%eax # %eax = x
0x0000000000400f75 <+50>: jmpq *0x402470(,%rax,8) # switch (x)
0x0000000000400f7c <+57>: mov $0xcf,%eax # x=0 : %eax = 207
0x0000000000400f81 <+62>: jmp 0x400fbe <phase_3+123>
0x0000000000400f83 <+64>: mov $0x2c3,%eax # x=2 : %eax = 707
0x0000000000400f88 <+69>: jmp 0x400fbe <phase_3+123>
0x0000000000400f8a <+71>: mov $0x100,%eax # x=3 : %eax = 256
0x0000000000400f8f <+76>: jmp 0x400fbe <phase_3+123>
0x0000000000400f91 <+78>: mov $0x185,%eax # x=4 : %eax = 185
0x0000000000400f96 <+83>: jmp 0x400fbe <phase_3+123>
0x0000000000400f98 <+85>: mov $0xce,%eax # x=5 : %eax = 206
0x0000000000400f9d <+90>: jmp 0x400fbe <phase_3+123>
0x0000000000400f9f <+92>: mov $0x2aa,%eax # x=6 : %eax = 682
0x0000000000400fa4 <+97>: jmp 0x400fbe <phase_3+123>
0x0000000000400fa6 <+99>: mov $0x147,%eax # x=7 : eax = 327
0x0000000000400fab <+104>: jmp 0x400fbe <phase_3+123>
0x0000000000400fad <+106>: callq 0x40143a <explode_bomb>
0x0000000000400fb2 <+111>: mov $0x0,%eax
0x0000000000400fb7 <+116>: jmp 0x400fbe <phase_3+123>
0x0000000000400fb9 <+118>: mov $0x137,%eax # x=1 : eax = 311
0x0000000000400fbe <+123>: cmp 0xc(%rsp),%eax
0x0000000000400fc2 <+127>: je 0x400fc9 <phase_3+134> # eax != y 就爆炸
0x0000000000400fc4 <+129>: callq 0x40143a <explode_bomb>
0x0000000000400fc9 <+134>: add $0x18,%rsp
0x0000000000400fcd <+138>: retq
# p (*((long**)0x402470))@8
# $3 = {0x400f7c <phase_3+57>, 0x400fb9 <phase_3+118>, 0x400f83 <phase_3+64>, 0x400f8a <phase_3+71>, 0x400f91 <phase_3+78>, 0x400f98 <phase_3+85>, 0x400f9f <phase_3+92>, 0x400fa6 <phase_3+99>}
第一个数在0~7中，第二个数对应上即可，有8个可行的key
Key3：0 207
Phase 4
Dump of assembler code for function phase_4:
0x000000000040100c <+0>: sub $0x18,%rsp
0x0000000000401010 <+4>: lea 0xc(%rsp),%rcx
0x0000000000401015 <+9>: lea 0x8(%rsp),%rdx
0x000000000040101a <+14>: mov $0x4025cf,%esi
0x000000000040101f <+19>: mov $0x0,%eax
0x0000000000401024 <+24>: callq 0x400bf0 <__isoc99_sscanf@plt> # sscanf(input, "%d%d", %rsp+8, %rsp+12)
0x0000000000401029 <+29>: cmp $0x2,%eax # 读入两数记为x，y
0x000000000040102c <+32>: jne 0x401035 <phase_4+41> # ensure input contains numbers
0x000000000040102e <+34>: cmpl $0xe,0x8(%rsp) # x, 15
0x0000000000401033 <+39>: jbe 0x40103a <phase_4+46> # if(x>15) 爆炸
0x0000000000401035 <+41>: callq 0x40143a <explode_bomb>
0x000000000040103a <+46>: mov $0xe,%edx # %edx = 15
0x000000000040103f <+51>: mov $0x0,%esi # %esi = 0
0x0000000000401044 <+56>: mov 0x8(%rsp),%edi # %edi = x
0x0000000000401048 <+60>: callq 0x400fce <func4> # func4(x, 0, 15)
0x000000000040104d <+65>: test %eax,%eax
0x000000000040104f <+67>: jne 0x401058 <phase_4+76> # func4 返回值非零则爆炸
0x0000000000401051 <+69>: cmpl $0x0,0xc(%rsp) # y, 0
0x0000000000401056 <+74>: je 0x40105d <phase_4+81> # y!=0 则爆炸
0x0000000000401058 <+76>: callq 0x40143a <explode_bomb>
0x000000000040105d <+81>: add $0x18,%rsp
0x0000000000401061 <+85>: retq
Dump of assembler code for function func4:
0x0000000000400fce <+0>: sub $0x8,%rsp #
0x0000000000400fd2 <+4>: mov %edx,%eax #
0x0000000000400fd4 <+6>: sub %esi,%eax # %eax = %edx - %esi
0x0000000000400fd6 <+8>: mov %eax,%ecx #
0x0000000000400fd8 <+10>: shr $0x1f,%ecx #
0x0000000000400fdb <+13>: add %ecx,%eax # %eax += %eax >>> 31
0x0000000000400fdd <+15>: sar %eax # %eax >>= 1 (k=1 by default)
0x0000000000400fdf <+17>: lea (%rax,%rsi,1),%ecx # %ecx = %rax + %rsi + 1
0x0000000000400fe2 <+20>: cmp %edi,%ecx #
0x0000000000400fe4 <+22>: jle 0x400ff2 <func4+36> # if(%ecx <= %edi) jump
0x0000000000400fe6 <+24>: lea -0x1(%rcx),%edx # %edx = %rcx - 1
0x0000000000400fe9 <+27>: callq 0x400fce <func4>
0x0000000000400fee <+32>: add %eax,%eax # %eax *= 2
0x0000000000400ff0 <+34>: jmp 0x401007 <func4+57>
0x0000000000400ff2 <+36>: mov $0x0,%eax # %eax = 0
0x0000000000400ff7 <+41>: cmp %edi,%ecx # %ecx, %edi
0x0000000000400ff9 <+43>: jge 0x401007 <func4+57> # if(%ecx >= %edi) jump
0x0000000000400ffb <+45>: lea 0x1(%rcx),%esi # %esi = %rcx + 1
0x0000000000400ffe <+48>: callq 0x400fce <func4>
0x0000000000401003 <+53>: lea 0x1(%rax,%rax,1),%eax # %eax = %rax * 3 + 1
0x0000000000401007 <+57>: add $0x8,%rsp #
0x000000000040100b <+61>: retq
这个func4太迷惑了，把爆炸函数设个断点就不会爆炸非常安全，所以知道x<=15, y=0后试一下发现1 0就过了= =
最怪的是%ecx，但把%rsi, %rdx看成一个区间就很简单了，<+17>处的%ecx就是mid，<+13>可能是因为/2向0取整
可以写出func4的原型：
def func4(x, l, r):
m = (l+r)/2 + 1
if(x<m): return func(x, l, m-1)*2
elif(x==m): return 0
else: return func(x, m+1, r)*3+1
所以x取0,1,3,7都是可以的
Key4:0 0
Phase 5
tip: b *0x0000000000401062,ni/si,info reg可以在汇编代码中单步调试
Dump of assembler code for function phase_5:
0x0000000000401062 <+0>: push %rbx
0x0000000000401063 <+1>: sub $0x20,%rsp
0x0000000000401067 <+5>: mov %rdi,%rbx # %rbx = %rdi
0x000000000040106a <+8>: mov %fs:0x28,%rax # 保护栈溢出，书中P200,201
0x0000000000401073 <+17>: mov %rax,0x18(%rsp)
0x0000000000401078 <+22>: xor %eax,%eax #
0x000000000040107a <+24>: callq 0x40131b <string_length>
0x000000000040107f <+29>: cmp $0x6,%eax
0x0000000000401082 <+32>: je 0x4010d2 <phase_5+112> # 保证串长为6
0x0000000000401084 <+34>: callq 0x40143a <explode_bomb>
0x0000000000401089 <+39>: jmp 0x4010d2 <phase_5+112>
# loop start
0x000000000040108b <+41>: movzbl (%rbx,%rax,1),%ecx # %ecx = input[%rax]
0x000000000040108f <+45>: mov %cl,(%rsp) # (%rsp) = %cl (%ecx的低1字节)
0x0000000000401092 <+48>: mov (%rsp),%rdx #
0x0000000000401096 <+52>: and $0xf,%edx # #%rdx = %cl & 15
0x0000000000401099 <+55>: movzbl 0x4024b0(%rdx),%edx # %rdx = "maduiersnfotvbyl"[%cl & 15]
# p *((char*)0x4024b0)@16 \\ $2 = "maduiersnfotvbyl"
0x00000000004010a0 <+62>: mov %dl,0x10(%rsp,%rax,1) # *(%rsp+%rax+16) = %dl
0x00000000004010a4 <+66>: add $0x1,%rax # %rax ++
0x00000000004010a8 <+70>: cmp $0x6,%rax
0x00000000004010ac <+74>: jne 0x40108b <phase_5+41> # if(rax!=6)jump back
0x00000000004010ae <+76>: movb $0x0,0x16(%rsp)
0x00000000004010b3 <+81>: mov $0x40245e,%esi # 0x40245e "flyers"
0x00000000004010b8 <+86>: lea 0x10(%rsp),%rdi
0x00000000004010bd <+91>: callq 0x401338 <strings_not_equal>
0x00000000004010c2 <+96>: test %eax,%eax
0x00000000004010c4 <+98>: je 0x4010d9 <phase_5+119>
0x00000000004010c6 <+100>: callq 0x40143a <explode_bomb>
0x00000000004010cb <+105>: nopl 0x0(%rax,%rax,1)
0x00000000004010d0 <+110>: jmp 0x4010d9 <phase_5+119>
0x00000000004010d2 <+112>: mov $0x0,%eax # %eax = 0
0x00000000004010d7 <+117>: jmp 0x40108b <phase_5+41> # loop
0x00000000004010d9 <+119>: mov 0x18(%rsp),%rax
0x00000000004010de <+124>: xor %fs:0x28,%rax
0x00000000004010e7 <+133>: je 0x4010ee <phase_5+140>
0x00000000004010e9 <+135>: callq 0x400b30 <__stack_chk_fail@plt>
0x00000000004010ee <+140>: add $0x20,%rsp
0x00000000004010f2 <+144>: pop %rbx
0x00000000004010f3 <+145>: retq
Dump of assembler code for function string_length:
0x000000000040131b <+0>: cmpb $0x0,(%rdi)
0x000000000040131e <+3>: je 0x401332 <string_length+23>
0x0000000000401320 <+5>: mov %rdi,%rdx
0x0000000000401323 <+8>: add $0x1,%rdx # %rdx ++
0x0000000000401327 <+12>: mov %edx,%eax
0x0000000000401329 <+14>: sub %edi,%eax # %eax = %edi - %edx
0x000000000040132b <+16>: cmpb $0x0,(%rdx)
0x000000000040132e <+19>: jne 0x401323 <string_length+8>
0x0000000000401330 <+21>: repz retq # 可无视，书中P141
0x0000000000401332 <+23>: mov $0x0,%eax
0x0000000000401337 <+28>: retq
发现要求输入串长==6，然后将每个字符的ascii mod16后按"maduiersnfotvbyl"映射，需要得到"flyers"。
Key5：9?>567
Phase 6
Dump of assembler code for function phase_6:
0x00000000004010f4 <+0>: push %r14
0x00000000004010f6 <+2>: push %r13
0x00000000004010f8 <+4>: push %r12
0x00000000004010fa <+6>: push %rbp
0x00000000004010fb <+7>: push %rbx
0x00000000004010fc <+8>: sub $0x50,%rsp # 80
0x0000000000401100 <+12>: mov %rsp,%r13 # %r13, %rsi = %rsp
0x0000000000401103 <+15>: mov %rsp,%rsi
0x0000000000401106 <+18>: callq 0x40145c <read_six_numbers> # %rsp, %rsp+4, ..., %rsp+20
0x000000000040110b <+23>: mov %rsp,%r14 # %r14 = %rsp (= %r13)
0x000000000040110e <+26>: mov $0x0,%r12d # %r12 = 0 (注意%r12是int，没用过高32位)
0x0000000000401114 <+32>: mov %r13,%rbp # %rbp = %r13
0x0000000000401117 <+35>: mov 0x0(%r13),%eax #
0x000000000040111b <+39>: sub $0x1,%eax # %eax = *%r13 - 1
0x000000000040111e <+42>: cmp $0x5,%eax
0x0000000000401121 <+45>: jbe 0x401128 <phase_6+52> # %eax >5 则爆炸
0x0000000000401123 <+47>: callq 0x40143a <explode_bomb>
0x0000000000401128 <+52>: add $0x1,%r12d # %r12 += 1
0x000000000040112c <+56>: cmp $0x6,%r12d
0x0000000000401130 <+60>: je 0x401153 <phase_6+95> # %r12 == 6 end loop
0x0000000000401132 <+62>: mov %r12d,%ebx # %ebx = %r12d
0x0000000000401135 <+65>: movslq %ebx,%rax # %rax = %ebx (sign extension)
0x0000000000401138 <+68>: mov (%rsp,%rax,4),%eax # %eax = input[%r12d]
0x000000000040113b <+71>: cmp %eax,0x0(%rbp) # *%rbp, %eax
0x000000000040113e <+74>: jne 0x401145 <phase_6+81> # 相等则爆炸
0x0000000000401140 <+76>: callq 0x40143a <explode_bomb>
0x0000000000401145 <+81>: add $0x1,%ebx # %ebx++
0x0000000000401148 <+84>: cmp $0x5,%ebx
0x000000000040114b <+87>: jle 0x401135 <phase_6+65> # if(%ebx <= 5) jump
0x000000000040114d <+89>: add $0x4,%r13 # %r13 += 4
0x0000000000401151 <+93>: jmp 0x401114 <phase_6+32>
0x0000000000401153 <+95>: lea 0x18(%rsp),%rsi # %rsi = %rsp + 24
0x0000000000401158 <+100>: mov %r14,%rax # %rax = %r14
0x000000000040115b <+103>: mov $0x7,%ecx # %ecx = 7
0x0000000000401160 <+108>: mov %ecx,%edx #
0x0000000000401162 <+110>: sub (%rax),%edx #
0x0000000000401164 <+112>: mov %edx,(%rax) # *%rax = %ecx - *%rax
0x0000000000401166 <+114>: add $0x4,%rax # %rax -= 4
0x000000000040116a <+118>: cmp %rsi,%rax
0x000000000040116d <+121>: jne 0x401160 <phase_6+108> # if(%rax != %rsi) jump
# 这里循环6次，将每个数用7减去
0x000000000040116f <+123>: mov $0x0,%esi # %esi = 0
0x0000000000401174 <+128>: jmp 0x401197 <phase_6+163>
0x0000000000401176 <+130>: mov 0x8(%rdx),%rdx # %rdx = *(%rdx+8)
0x000000000040117a <+134>: add $0x1,%eax
0x000000000040117d <+137>: cmp %ecx,%eax
0x000000000040117f <+139>: jne 0x401176 <phase_6+130> # %eax + 1 != %ecx
0x0000000000401181 <+141>: jmp 0x401188 <phase_6+148>
0x0000000000401183 <+143>: mov $0x6032d0,%edx
0x0000000000401188 <+148>: mov %rdx,0x20(%rsp,%rsi,2) # %rsp + 32 + 2*%rsi
0x000000000040118d <+153>: add $0x4,%rsi # %rsi += 4
0x0000000000401191 <+157>: cmp $0x18,%rsi
0x0000000000401195 <+161>: je 0x4011ab <phase_6+183> # if rsi == 24
0x0000000000401197 <+163>: mov (%rsp,%rsi,1),%ecx # %ecx = *(%rsp+%rsi)
0x000000000040119a <+166>: cmp $0x1,%ecx
0x000000000040119d <+169>: jle 0x401183 <phase_6+143> # %ecx <= 1
0x000000000040119f <+171>: mov $0x1,%eax # %eax = 1
0x00000000004011a4 <+176>: mov $0x6032d0,%edx #
0x00000000004011a9 <+181>: jmp 0x401176 <phase_6+130>
0x00000000004011ab <+183>: mov 0x20(%rsp),%rbx # %rbx = B[0]，node指针
0x00000000004011b0 <+188>: lea 0x28(%rsp),%rax # %rax = &B[1]
0x00000000004011b5 <+193>: lea 0x50(%rsp),%rsi # %rsi = %rsp + 80，末尾
0x00000000004011ba <+198>: mov %rbx,%rcx # %rcx = %rbx
0x00000000004011bd <+201>: mov (%rax),%rdx # %rdx = *%rax
0x00000000004011c0 <+204>: mov %rdx,0x8(%rcx) # %rcx->next = %rdx
0x00000000004011c4 <+208>: add $0x8,%rax # %rax += 8
0x00000000004011c8 <+212>: cmp %rsi,%rax
0x00000000004011cb <+215>: je 0x4011d2 <phase_6+222> # if %rax == %rsp + 80
0x00000000004011cd <+217>: mov %rdx,%rcx # %rcx = %rdx
0x00000000004011d0 <+220>: jmp 0x4011bd <phase_6+201>
0x00000000004011d2 <+222>: movq $0x0,0x8(%rdx) # *(%rdx+8) = 0
0x00000000004011da <+230>: mov $0x5,%ebp # %rbp = 5
0x00000000004011df <+235>: mov 0x8(%rbx),%rax #
0x00000000004011e3 <+239>: mov (%rax),%eax # %rax = %rbx->next对应的数
0x00000000004011e5 <+241>: cmp %eax,(%rbx)
0x00000000004011e7 <+243>: jge 0x4011ee <phase_6+250> # 需要%rbx>=%next，否则爆炸
0x00000000004011e9 <+245>: callq 0x40143a <explode_bomb>
0x00000000004011ee <+250>: mov 0x8(%rbx),%rbx # %rbx = %rbx->next
0x00000000004011f2 <+254>: sub $0x1,%ebp # %ebp --
0x00000000004011f5 <+257>: jne 0x4011df <phase_6+235> # 不等则回跳，全0时就跳出去了
0x00000000004011f7 <+259>: add $0x50,%rsp
0x00000000004011fb <+263>: pop %rbx
0x00000000004011fc <+264>: pop %rbp
0x00000000004011fd <+265>: pop %r12
0x00000000004011ff <+267>: pop %r13
0x0000000000401201 <+269>: pop %r14
0x0000000000401203 <+271>: retq
93行前：
for(int i=0;i<6;++i){ // %r12
assert(1<=a[i]&&a[i]<=6); // 如果a[i]<1则<+45>处cmp会下溢出到很大的数
for(int j=i+1;j<6;++j) // %ebx
assert(a[i]!=a[j]);
}
需要保证输入6个数互不相等且<=6，显然需要输入一个排列。知道这个之后枚举就行了
123-181行：
简要分析：
i %esi
j %eax
k %edx
c %ecx
i=0;
goto C;
A://+130
k+=16;++j;
if(j!=c)goto A;
else goto B2;
B://+143
k=0x6032d0;
B2:
*(%rsp+32+i*2) = k;
i+=4;
if(i==24)goto end;
C://+163
c=*(%rsp+i);
if(c<=1) goto B;
j=1;k=0x6032d0;
goto A;
实现非常怪，分析一波可以发现是%rsp + 32开始的这个long long数组是输出
第<+130>行非常的迷惑，只能通过查看内存知道rdx的取值，实际上rdx每次会加上16。似乎是结构体的地址，发现应该是个链表。
(gdb) p *6304464@4
$67 = {332, 1, 6304480, 0}
(gdb) p *6304480@4
$68 = {168, 2, 6304496, 0}
(gdb) p *6304496@4
$69 = {924, 3, 6304512, 0}
排列被映射成了链表上的节点。例：
356421
421356
6304512, 6304480, 6304464, 6304496, 6304528, 6304544
183-230行重设对next指针使链表按照上面顺序排列。
0x00000000004011ab in phase_6()
(gdb) p *0x6032d0@(4*6)
$77 = {332, 1, 6304480, 0, 168, 2, 6304496,
0, 924, 3, 6304512, 0, 691, 4, 6304528,
0, 477, 5, 6304544, 0, 443, 6, 0, 0}
之后就是在判断链表的第一个数是否有序。
链表：332 168 924 691 477 443
顺序：5 6 1 2 3 4
逆：3 4 5 6 1 2
反推：4 3 2 1 6 5
Key6：4 3 2 1 6 5
总结：纯纯的折磨，吐了。
博主是蒟蒻，有问题请指出，谢谢！
本博客中博文均为原创，未经博主允许请勿随意转载，谢谢。
本博客中博文均为原创，未经博主允许请勿随意转载，谢谢。
