Did you know that every time you click through to a new webpage, you’re voluntarily telling that new webpage where you came from? This isn’t a trick by the NSA, its just the way the web works. As most people know, whenever you click a hyperlink, the browser sends a request to the resource on the other end of the link. What most people don’t realize is that by default the request contains the referrer field, which indicates the page where the user clicked the link.

A note to the reader: For explanation on how to set up the lab environment see the “Introduction” section of the post. If you’re looking for a specific phase: Here is Phase 1 Here is Phase 2 Here is Phase 3 Here is Phase 4 Here is Phase 5 Here is Phase 6 This phase is definitely the trickiest out of all of the other bomb lab phases. Prepare for data structures…

A note to the reader: For explanation on how to set up the lab environment see the “Introduction” section of the post. If you’re looking for a specific phase: Here is Phase 1 Here is Phase 2 Here is Phase 3 Here is Phase 4 Here is Phase 5 Here is Phase 6 Ok, let’s get right to it and dig into the <phase_5> code: So, what have we got here? First things first, we can see from the call to <string_length> at <phase_5+23> and subsequent jump equal statement our string should be six characters long.

A note to the reader: For explanation on how to set up the lab environment see the “Introduction” section of the post. If you’re looking for a specific phase: Here is Phase 1 Here is Phase 2 Here is Phase 3 Here is Phase 4 Here is Phase 5 Here is Phase 6 Phase 4 In my opinion, this is where things start to get tricky. In this phase, it is not enough to simply understand the assembly. Some pattern-recognition will be required. As usual, let’s start by taking a look at the code for this phase’s function to see if we can find a vector through which to understand what’s happening. I’m going to do so by running gdb with a test string and using disas:

A note to the reader: For explanation on how to set up the lab environment see the “Introduction” section of the post. If you’re looking for a specific phase: Here is Phase 1 Here is Phase 2 Here is Phase 3 Here is Phase 4 Here is Phase 5 Here is Phase 6 By now you know the drill. Off to our objdump file! Woah. There are a lot of conditionals here. Maybe you’re an IA32 warrior who can take one look at this code and immediately tell what is going on, but for the rest of us, an iterative approach might work better here.

A note to the reader: For explanation on how to set up the lab environment see the “Introduction” section of the post. If you’re looking for a specific phase: Here is Phase 1 Here is Phase 2 Here is Phase 3 Here is Phase 4 Here is Phase 5 Here is Phase 6 Ok, now things get a lot more interesting a lot more quickly. Let’s get started the same way we did last time, by looking at our objdump file for clues:

A note to the reader: For explanation on how to set up the lab environment see the “Introduction” section of the post. If you’re looking for a specific phase: Here is Phase 1 Here is Phase 2 Here is Phase 3 Here is Phase 4 Here is Phase 5 Here is Phase 6 Phase 1 is sort of the “Hello World” of the Bomb Lab. You will have to run through the reverse engineering process, but there won’t be much in the way of complicated assembly to decipher or tricky mental hoops to jump through. To begin, let’s take a look at the <phase_1> function in our objdump file:

The first step on your way to getting through the bomb lab will be setting up your environment. This page will assume that you have decided to do the lab for fun and profit. If you are a student, you’ve probably already been given these materials by your professor. Get to work. You can find all the necessary files on the “Lab Assignments” page of Bryant and O’Hallaron’s website, or you can download all the pieces individually.