CS:APP 第三章

家庭作业

3.68

$A\in(6,10],B\in(4,8],A\times B\in(44,46]\Rightarrow A=9,B=5$。

3.69

1. $CNT=7$；

2. typedef struct {
     long idx;
     long x[4];
   } a_struct;

3.70

1. 字段	偏移量
   $\verb|e1.p|$	0
   $\verb|e1.y|$	8
   $\verb|e2.x|$	0
   $\verb|e2.next|$	8

2. 16

3. void proc (union ele *up) {
     up->e2.x = *(up->e2.next->e1.p) - up->e1.y;
   }

bomblab

Phase 1

void phase_1(char str[]) {
  if (strings_not_equal(str, "Border relations with Canada have never been better.") != 0) {
    explode_bomb();
  }
}

$\verb|strings_not_equal|$ 接受两个字符串作为参数，在两者不相等时返回 $\verb|1|$，否则返回 $\verb|0|$。

Phase 2

void phase_2(char str[]) {
  int x[6];
  read_six_numbers(x);

  if (x[0] != 1) {
    explode_bomb();
  } else {
    for (int i = 1; i < 6; i++) {
      if (x[i] != x[i - 1] * 2) {
        explode_bomb();
      }
    }
  }
}

$\verb|read_six_numbers(int x[])|$ 读入 6 个整数，并依次存入 $\verb|x[0]|$ 至 $\verb|x[5]|$。

Phase 3

void phase_3(char str[]) {
  int x, y;
  if (sscanf(str, "%d %d", &x, &y) <= 1) {
    explode_bomb();
  }
  
  if (x > 7 || x < 0) {
    explode_bomb();
  }
  int z;
  switch (x) {
    case 0:
      z = 0xcf;
      break;
    case 2:
      z = 0x2c3;
      break;
    case 3:
      z = 0x100;
      break;
    case 4:
      z = 0x185;
      break;
    case 5:
      z = 0xce;
      break;
    case 6:
      z = 0x2aa;
      break;
    case 7:
      z = 0x147;
      break;
    default:
      z = 0x137;
  }
  if (y != z) {
    explode_bomb();
  }
}

Phase 4

int func4(int x, int y, int z) {
  int mid = y + (z - y) / 2;
  if (mid <= x) {
    if (mid >= x) {
      return 0;
    } else {
      return 2 * func4(x, mid + 1, z) + 1;
    }
  } else {
    return 2 * func4(x, y, mid - 1);
  }
}

void phase_4(char str[]) {
  int x, y;
  if (sscanf(str, "%d %d", &x, &y) != 2) {
    explode_bomb();
  }

  if (x > 15 || x < 0) {
    explode_bomb();
  }
  if (func4(x, 0, 15) != 0 || y != 0) {
    explode_bomb();
  }
}

Phase 5

void phase_5(char str[]) {
  if (string_length(str) != 6) {
    explode_bomb();
  }

  char str2[7];
  for (int i = 0; i < 6; i++) {
    str2[i] = "maduiersnfotvbyl"[str[i] & 0xF];
  }
  str2[6] = 0;

  if (strings_not_equal(str2, "flyers") != 0) {
    explode_bomb();
  }
}

Phase 6

struct chain_node {
  int val;
  int id;
  struct chain_node *next;
} c[6] = {
  {0x014c, 1, &c[1]}, 
  {0x00a8, 2, &c[2]}, 
  {0x039c, 3, &c[3]}, 
  {0x02b3, 4, &c[4]}, 
  {0x01dd, 5, &c[5]},
  {0x01bb, 6}
};

void phase_6(char str[]) {
  int x[6];
  read_six_numbers(x);
  
  for (int i = 0; ; i++) {
    if (x[i] <= 0 || x[i] > 6) {
      explode_bomb();
    }
    if (i == 5) {
      break;
    }
    for (int j = i + 1; j < 6; j++) {
      if (x[i] == x[j]) {
        explode_bomb();
      }
    }
  }

  for (int i = 0; i < 6; i++) {
    x[i] = 7 - x[i];
  }

  struct chain_node *y[6];
  for (int i = 0; i < 6; i++) {
    chain_node *p = c[0];
    for (int j = 1; j < x[i]; j++) {
      p = p->next;
    }
    y[i] = p;
  }

  for (int i = 1; i < 6; i++) {
    y[i - 1]->next = y[i];
  }
  y[5]->next = NULL;

  chain_node *p = y[0];
  for (int i = 5; i > 0; i--) {
    if (p->val < p->next->val) {
      explode_bomb();
    }
    p = p->next;
  }
}

进入 Secret Phase

char buf[6][80];

char* read_line() {
  ...
  char *str = buf[num_input_strings];
  ...
  num_input_strings++;
  ...
  return str;
}

void phase_defused() {
  ...
  if (num_input_strings == 6) {
    int a, b;
    char c[LEN];
    if (sscanf(buf[3], "%d %d %s", &a, &b, c) == 3 && strings_not_equal(c, "DrEvil") == 0) {
      ...
      secret_phase();
      ...
    }
  }
}

Secret Phase

const struct __attribute__((aligned(32))) tree_node {
  int val;
  const struct tree_node *ls, *rs;
} t[15] = {
  {0x024, &t[1], &t[2]},
  {0x008, &t[5], &t[3]},
  {0x032, &t[4], &t[6]},
  {0x016, &t[12], &t[10]},
  {0x02d, &t[7], &t[13]},
  {0x006, &t[8], &t[11]},
  {0x06b, &t[9], &t[14]},
  {0x028, NULL, NULL},
  {0x001, NULL, NULL},
  {0x063, NULL, NULL},
  {0x023, NULL, NULL},
  {0x007, NULL, NULL},
  {0x014, NULL, NULL},
  {0x02f, NULL, NULL},
  {0x3e9, NULL, NULL}
};

int fun7(struct tree_node *x, int y) {
  if (x == NULL) {
    return -1;
  } else {
    if (x->val <= y) {
      if (x->val == y) {
        return 0;
      } else {
        return 2 * fun7(x->rs, y) + 1;
      }
    } else {
      return 2 * fun7(x->ls, y);
    }
  }
}

void secret_phase() {
  long x = strtol(read_line(), NULL, 10);

  if (x > 1001 || x < 1) {
    explode_bomb();
  }

  if (fun7(t, x) != 2) {
    explode_bomb();
  }
  ...
}

attacklab

https://git.gzezfisher.top/FISHER_/CSAPP-sol/src/branch/main/attack