The names all the functions the bomb calls

There are too many bombs for us to deal with, so we are giving each student a bomb to defuse. Your mission, which you have no choice but to accept, is to defuse your bomb before the due date. Good luck, and welcome to the bomb squad!

Step 1: Get Your Bomb

http://zeus-1.cec.gmu.edu:15225

This will display a binary bomb request form for you to fill in. Enter your user name and GMU email address and hit the Submit button. The server will build your bomb and return it to your browser in a tar file called bombk.tar, where k is the unique number of your bomb.

Important Notes:

1. Due to the heavy load on zeus, sometimes it may take up to 60-90 seconds before the bomb file is loaded on your browser. Please be patient. If you are appropriately connected (VSE lab or via VPN) and the site seems to be down, please send a message on Piazza immediately so others can chime in or an instructor can restart the server.

You must do the assignment only on zeus (specifically, zeus-1; not any other machine or zeus-2!). In fact, there is a rumor that Dr. Evil really is evil, and the bomb will always blow up if run elsewhere. There are several other tamper-proofing devices built into the bomb as well, or so we hear.

Your job for this project is to defuse your bomb. You can use several tools available to you on Zeus to help you defuse your bomb. Please look at the hints section for some tips and ideas. The best way is to use your favorite debugger gdb to step through the disassembled binary. (You may not use external tools to solve the bomb.)

then it will read the input lines from psol.txt until it reaches EOF (end of file), and then switch over to stdin. We added this feature so you don't have to keep retyping the solutions to phases you have already defused.

To avoid accidentally detonating the bomb, you will need to learn how to use gdb to single-step through the assembly code and how to set breakpoints. You will also need to learn how to inspect both the registers and the memory states. One of the nice side-effects of doing the project is that you will get very good at using a debugger. This is a crucial skill that will pay big dividends the rest of your career.

http://zeus-1.cec.gmu.edu:15225/scoreboard

This web page is updated continuously to show the progress of the class. Note that this web page is only accessible from a machine in the VSE labs or if you have connected to the VSE labs using a VPN.

•Every time you guess wrong, a message is sent to the bomb server. You could very quickly saturate the network with these messages, and cause the system administrators to revoke your computer access.

•We haven’t told you how long the strings are, nor have we told you what characters are in them. Even if you made the (incorrect) assumptions that they all are less than 80 characters long and only contain letters, then you will have 2680 guesses for each phase. This will take a very long time to run, and you will not get the answer before the assignment is due.

• objdump -t This will print out the bomb's symbol table. The symbol table includes the names of all

functions and global variables in the bomb, the names of all the functions the bomb calls, and their

cryptic form. For example, a call to sscanf might appear as:

8048c36: e8 99 fc ff ff call 80488d4 <_init+0x1a0>

asciimight come in useful.

Advice

first things the phase will do is try to 'parse' it into the form it is expecting.

• When you are trying to figure out what values are needed for a phase (particularly if the values are integers),

parameters that are sent and the return value. Examples would be like <sscanf@plt> for sscanf.

• If you end up inside a function that you don't want to step through, the gdb command finish will take you

• Understanding parameter passing is critical to this assignment. Whenever you see a reference to %rsp in the

lines before a call, this involves placing a parameter on the stack. It is never a bad idea to figure out what the

• Breakpoint guards are crucially important to success in this project. If I put a breakpoint at the start of the explode_bomb function, I can ensure that I always give myself the option not to explode. Always use breakpoint guards before attempting to run any code, even if you think you are only performing “safe” operations.

• If I use a text file as input, it will help me save time because I will not have to retype the solutions to phases which I have already solved. The text file is sensitive to file format (e.g. character encoding, system- dependent newlines, or terminating newline), so be sure to use a breakpoint guard whenever you update your solution file.

refresh

If you hit a problem where every time you use stepi, it scrolls the screen and continues to do so after a refresh, you will need to quit and restart gdb. gdb wasn’t designed for graphical modes, but it does a pretty good job at it on the average.

Tips on GDB layout modes: Previous students reported that setting your breakpoints and start running the program before running the layout commands worked more reliably than setting layouts before beginning to run the code.

If you have any crashes of gdb itself while using layout, please post on Piazza and we’ll submit trouble tickets. Please document exactly what you were doing and how you started gdb and we can look into it.