csapp二进制炸弹

[weixin_44914839]

0000000000400ff3 <phase_3>:
400ff3: 48 83 ec 18 sub $0x18,%rsp
400ff7: 48 8d 4c 24 0c lea 0xc(%rsp),%rcx
400ffc: 48 8d 54 24 08 lea 0x8(%rsp),%rdx
401001: be cd 29 40 00 mov $0x4029cd,%esi
401006: b8 00 00 00 00 mov $0x0,%eax
40100b: e8 a0 fc ff ff callq 400cb0 <__isoc99_sscanf@plt>
401010: 83 f8 01 cmp $0x1,%eax
401013: 7f 05 jg 40101a <phase_3+0x27>
401015: e8 77 06 00 00 callq 401691 <explode_bomb>
40101a: 83 7c 24 08 07 cmpl $0x7,0x8(%rsp)
40101f: 77 66 ja 401087 <phase_3+0x94>
401021: 8b 44 24 08 mov 0x8(%rsp),%eax
401025: ff 24 c5 00 27 40 00 jmpq *0x402700(,%rax,8)
40102c: b8 00 00 00 00 mov $0x0,%eax
401031: eb 05 jmp 401038 <phase_3+0x45>
401033: b8 4b 00 00 00 mov $0x4b,%eax
401038: 2d b2 00 00 00 sub $0xb2,%eax
40103d: eb 05 jmp 401044 <phase_3+0x51>
40103f: b8 00 00 00 00 mov $0x0,%eax
401044: 05 07 03 00 00 add $0x307,%eax
401049: eb 05 jmp 401050 <phase_3+0x5d>
40104b: b8 00 00 00 00 mov $0x0,%eax
401050: 2d eb 01 00 00 sub $0x1eb,%eax
401055: eb 05 jmp 40105c <phase_3+0x69>
401057: b8 00 00 00 00 mov $0x0,%eax
40105c: 05 eb 01 00 00 add $0x1eb,%eax
401061: eb 05 jmp 401068 <phase_3+0x75>
401063: b8 00 00 00 00 mov $0x0,%eax
401068: 2d eb 01 00 00 sub $0x1eb,%eax
40106d: eb 05 jmp 401074 <phase_3+0x81>
40106f: b8 00 00 00 00 mov $0x0,%eax
401074: 05 eb 01 00 00 add $0x1eb,%eax
401079: eb 05 jmp 401080 <phase_3+0x8d>
40107b: b8 00 00 00 00 mov $0x0,%eax
401080: 2d eb 01 00 00 sub $0x1eb,%eax
401085: eb 0a jmp 401091 <phase_3+0x9e>
401087: e8 05 06 00 00 callq 401691 <explode_bomb>
40108c: b8 00 00 00 00 mov $0x0,%eax
401091: 83 7c 24 08 05 cmpl $0x5,0x8(%rsp)
401096: 7f 06 jg 40109e <phase_3+0xab>
401098: 3b 44 24 0c cmp 0xc(%rsp),%eax
40109c: 74 05 je 4010a3 <phase_3+0xb0>
40109e: e8 ee 05 00 00 callq 401691 <explode_bomb>
4010a3: 48 83 c4 18 add $0x18,%rsp
4010a7: c3 retq
我知道是switch结构但是想知道每个case是怎么对应的

[weixin_44914839]

00000000004010a8 <func4>: 4010a8: 53 push %rbx 4010a9: 89 d0 mov %edx,%eax 4010ab: 29 f0 sub %esi,%eax 4010ad: 89 c3 mov %eax,%ebx 4010af: c1 eb 1f shr $0x1f,%ebx 4010b2: 01 d8 add %ebx,%eax 4010b4: d1 f8 sar %eax 4010b6: 8d 1c 30 lea (%rax,%rsi,1),%ebx 4010b9: 39 fb cmp %edi,%ebx 4010bb: 7e 0c jle 4010c9 <func4+0x21> 4010bd: 8d 53 ff lea -0x1(%rbx),%edx 4010c0: e8 e3 ff ff ff callq 4010a8 <func4> 4010c5: 01 d8 add %ebx,%eax 4010c7: eb 10 jmp 4010d9 <func4+0x31> 4010c9: 89 d8 mov %ebx,%eax 4010cb: 39 fb cmp %edi,%ebx 4010cd: 7d 0a jge 4010d9 <func4+0x31> 4010cf: 8d 73 01 lea 0x1(%rbx),%esi 4010d2: e8 d1 ff ff ff callq 4010a8 <func4> 4010d7: 01 d8 add %ebx,%eax 4010d9: 5b pop %rbx 4010da: c3 retq 00000000004010db <phase_4>: 4010db: 48 83 ec 18 sub $0x18,%rsp 4010df: 48 8d 4c 24 0c lea 0xc(%rsp),%rcx 4010e4: 48 8d 54 24 08 lea 0x8(%rsp),%rdx 4010e9: be cd 29 40 00 mov $0x4029cd,%esi 4010ee: b8 00 00 00 00 mov $0x0,%eax 4010f3: e8 b8 fb ff ff callq 400cb0 <__isoc99_sscanf@plt> 4010f8: 83 f8 02 cmp $0x2,%eax 4010fb: 75 07 jne 401104 <phase_4+0x29> 4010fd: 83 7c 24 08 0e cmpl $0xe,0x8(%rsp) 401102: 76 05 jbe 401109 <phase_4+0x2e> 401104: e8 88 05 00 00 callq 401691 <explode_bomb> 401109: ba 0e 00 00 00 mov $0xe,%edx 40110e: be 00 00 00 00 mov $0x0,%esi 401113: 8b 7c 24 08 mov 0x8(%rsp),%edi 401117: e8 8c ff ff ff callq 4010a8 <func4> 40111c: 83 f8 15 cmp $0x15,%eax 40111f: 75 07 jne 401128 <phase_4+0x4d> 401121: 83 7c 24 0c 15 cmpl $0x15,0xc(%rsp) 401126: 74 05 je 40112d <phase_4+0x52> 401128: e8 64 05 00 00 callq 401691 <explode_bomb> 40112d: 48 83 c4 18 add $0x18,%rsp 401131: c3 retq

[weixin_44914839]

0000000000401132 <phase_5>: 401132: 48 83 ec 18 sub $0x18,%rsp 401136: 48 8d 4c 24 0c lea 0xc(%rsp),%rcx 40113b: 48 8d 54 24 08 lea 0x8(%rsp),%rdx 401140: be cd 29 40 00 mov $0x4029cd,%esi 401145: b8 00 00 00 00 mov $0x0,%eax 40114a: e8 61 fb ff ff callq 400cb0 <__isoc99_sscanf@plt> 40114f: 83 f8 01 cmp $0x1,%eax 401152: 7f 05 jg 401159 <phase_5+0x27> 401154: e8 38 05 00 00 callq 401691 <explode_bomb> 401159: 8b 44 24 08 mov 0x8(%rsp),%eax 40115d: 83 e0 0f and $0xf,%eax 401160: 89 44 24 08 mov %eax,0x8(%rsp) 401164: 83 f8 0f cmp $0xf,%eax 401167: 74 2c je 401195 <phase_5+0x63> 401169: b9 00 00 00 00 mov $0x0,%ecx 40116e: ba 00 00 00 00 mov $0x0,%edx 401173: 83 c2 01 add $0x1,%edx 401176: 48 98 cltq 401178: 8b 04 85 40 27 40 00 mov 0x402740(,%rax,4),%eax 40117f: 01 c1 add %eax,%ecx 401181: 83 f8 0f cmp $0xf,%eax 401184: 75 ed jne 401173 <phase_5+0x41> 401186: 89 44 24 08 mov %eax,0x8(%rsp) 40118a: 83 fa 0f cmp $0xf,%edx 40118d: 75 06 jne 401195 <phase_5+0x63> 40118f: 3b 4c 24 0c cmp 0xc(%rsp),%ecx 401193: 74 05 je 40119a <phase_5+0x68> 401195: e8 f7 04 00 00 callq 401691 <explode_bomb> 40119a: 48 83 c4 18 add $0x18,%rsp 40119e: c3 retq

[weixin_44914839]

第五 第六个也求帮忙看一下，感谢

[日立奔腾浪潮微软松下联想]

jmpq *0x402700(,%rax,8)
这个0x402700处应该是一个跳转表，存储了rax=0..7的跳转入口，这些入口是否是后面的40102c、401033之类的就不得而知了