Question

0x00000000004010cc <+0>:   push %r13
0x00000000004010ce <+2>:   push %r12
0x00000000004010d0 <+4>:   push %rbp
0x00000000004010d1 <+5>:   push %rbx
0x00000000004010d2 <+6>:   sub $0x68,%rsp
0x00000000004010d6 <+10>:   mov %fs:0x28,%rax
0x00000000004010df <+19>:   mov %rax,0x58(%rsp)
0x00000000004010e4 <+24>:   xor %eax,%eax
0x00000000004010e6 <+26>:   mov %rsp,%rsi
0x00000000004010e9 <+29>:   callq 0x40159a <read_six_numbers>
0x00000000004010ee <+34>:   mov %rsp,%r12
0x00000000004010f1 <+37>:   mov $0x0,%r13d
0x00000000004010f7 <+43>:   mov %r12,%rbp
0x00000000004010fa <+46>:   mov (%r12),%eax
0x00000000004010fe <+50>:   sub $0x1,%eax
0x0000000000401101 <+53>:   cmp $0x5,%eax
0x0000000000401104 <+56>:   jbe 0x40110b <phase_6+63>
0x0000000000401106 <+58>:   callq 0x401564 <explode_bomb>
0x000000000040110b <+63>:   add $0x1,%r13d
0x000000000040110f <+67>:   cmp $0x6,%r13d
0x0000000000401113 <+71>:   je 0x401152 <phase_6+134>
0x0000000000401115 <+73>:   mov %r13d,%ebx
0x0000000000401118 <+76>:   movslq %ebx,%rax
0x000000000040111b <+79>:   mov (%rsp,%rax,4),%eax
0x000000000040111e <+82>:   cmp %eax,0x0(%rbp)
0x0000000000401121 <+85>:   jne 0x401128 <phase_6+92>
0x0000000000401123 <+87>:   callq 0x401564 <explode_bomb>
0x0000000000401128 <+92>:   add $0x1,%ebx
0x000000000040112b <+95>:   cmp $0x5,%ebx
0x000000000040112e <+98>:   jle 0x401118 <phase_6+76>
0x0000000000401130 <+100>:   add $0x4,%r12
0x0000000000401134 <+104>:   jmp 0x4010f7 <phase_6+43>
0x0000000000401136 <+106>:   mov 0x8(%rdx),%rdx
0x000000000040113a <+110>:   add $0x1,%eax
0x000000000040113d <+113>:   cmp %ecx,%eax
0x000000000040113f <+115>:   jne 0x401136 <phase_6+106>
0x0000000000401141 <+117>:   mov %rdx,0x20(%rsp,%rsi,2)
0x0000000000401146 <+122>:   add $0x4,%rsi
0x000000000040114a <+126>:   cmp $0x18,%rsi
0x000000000040114e <+130>:   jne 0x401157 <phase_6+139>
0x0000000000401150 <+132>:   jmp 0x40116b <phase_6+159>
0x0000000000401152 <+134>:   mov $0x0,%esi
---Type <return> to continue, or q <return> to quit---
0x0000000000401157 <+139>:   mov (%rsp,%rsi,1),%ecx
0x000000000040115a <+142>:   mov $0x1,%eax
0x000000000040115f <+147>:   mov $0x604300,%edx
0x0000000000401164 <+152>:   cmp $0x1,%ecx
0x0000000000401167 <+155>:   jg 0x401136 <phase_6+106>
0x0000000000401169 <+157>:   jmp 0x401141 <phase_6+117>
0x000000000040116b <+159>:   mov 0x20(%rsp),%rbx
0x0000000000401170 <+164>:   lea 0x20(%rsp),%rax
0x0000000000401175 <+169>:   lea 0x48(%rsp),%rsi
0x000000000040117a <+174>:   mov %rbx,%rcx
0x000000000040117d <+177>:   mov 0x8(%rax),%rdx
0x0000000000401181 <+181>:   mov %rdx,0x8(%rcx)
0x0000000000401185 <+185>:   add $0x8,%rax
0x0000000000401189 <+189>:   mov %rdx,%rcx
0x000000000040118c <+192>:   cmp %rsi,%rax
0x000000000040118f <+195>:   jne 0x40117d <phase_6+177>
0x0000000000401191 <+197>:   movq $0x0,0x8(%rdx)
0x0000000000401199 <+205>:   mov $0x5,%ebp
0x000000000040119e <+210>:   mov 0x8(%rbx),%rax
0x00000000004011a2 <+214>:   mov (%rax),%eax
=> 0x00000000004011a4 <+216>:   cmp %eax,(%rbx)
0x00000000004011a6 <+218>:   jge 0x4011ad <phase_6+225>
0x00000000004011a8 <+220>:   callq 0x401564 <explode_bomb>
0x00000000004011ad <+225>:   mov 0x8(%rbx),%rbx
0x00000000004011b1 <+229>:   sub $0x1,%ebp
0x00000000004011b4 <+232>:   jne 0x40119e <phase_6+210>
0x00000000004011b6 <+234>:   mov 0x58(%rsp),%rax
0x00000000004011bb <+239>:   xor %fs:0x28,%rax
0x00000000004011c4 <+248>:   je 0x4011cb <phase_6+255>
0x00000000004011c6 <+250>:   callq 0x400b00 <__stack_chk_fail@plt>
0x00000000004011cb <+255>:   add $0x68,%rsp
0x00000000004011cf <+259>:   pop %rbx
0x00000000004011d0 <+260>:   pop %rbp
0x00000000004011d1 <+261>:   pop %r12
0x00000000004011d3 <+263>:   pop %r13
0x00000000004011d5 <+265>:   retq   

This is the phase_6 from the bomb lab, looking for the answer. The answer should be six digits from 1 to 6, and distinc to each other.

Answer 1

the node is :

0x603970 <node1> 0x000000f6
0x603978 <node1+8> 0x603960
0x603960 <node2> 0x00000304
0x693968 <node2+8> 0x603950
0x603950 <node3> 0x000000b7
0x603958 <node3+8> 0x603940
0x603940 <node4> 0x000000eb
0x603948 <node4+8> 0x603930
0x603930 <node5> 0x0000021f
0x603938 <node5+8> 0x603920
0x603920 <node6> 0x00000150
0x603928 <node6+8> 0x000000

So, the value of node1 to node6 are f6, 304, b7, eb, 21f, 150. I know b7 < eb < f6 < 150 < 21f < 304, so the order of nodes should be 3 0 5 4 1 2 (or 2 5 0 1 4 3 - in ascending order) and I should add +1 to all numbers.

On <+97> and <+102>, notice that the code sets %eax to 7 and subtracts (%rdx). In other words you have to put each of your 6 values into function f(x) = 7-x.