CompOrg Fall 2004 Lab

Lab #7 - Assembly Code Bombs (HW2 Practice)

10/20/2004

This lab involves determining what command line input is necessary to get a various programs to print "You are a wizard". Each of the programs below will print this string if you enter the right thing(s) on the command line when you run the program.

For each of the programs, you are given the assembly code for the entire program, including the function named "checkguess", this function is passed values extracted from the command line args (argv). You are also given the C code for main() so you can see how checkguess is called (and what is expected on the command line).

You can save the assembly code, compile to build an executable and run the executable using gdb to step through the code. Lab5 included some documentation on using gdb.

The files p1.s, p2.s, etc. are also available on monte.cs.rpi.edu in ~hollingd/public/lab7:


> mkdir lab7
> cp ~hollingd/public/lab7/* lab7
> cd lab7

p1: Simple comparison

p1.s main()
	.file	"p1.c"
	.section	.rodata
.LC0:
	.string	"You are a wizard\n"
.LC1:
	.string	"You are wrong\n"
	.text
.globl checkguess
	.type	checkguess,@function
checkguess:
	pushl	%ebp
	movl	%esp, %ebp
	subl	$8, %esp
	cmpl	$25, 8(%ebp)
	jne	.L2
	subl	$12, %esp
	pushl	$.LC0
	call	printf
	addl	$16, %esp
	jmp	.L1
.L2:
	subl	$12, %esp
	pushl	$.LC1
	call	printf
	addl	$16, %esp
.L1:
	leave
	ret
.Lfe1:
	.size	checkguess,.Lfe1-checkguess
	.section	.rodata
	.align 32
.LC2:
	.string	"You need to enter a number on the command line\n"
	.text
.globl main
	.type	main,@function
main:
	pushl	%ebp
	movl	%esp, %ebp
	subl	$8, %esp
	andl	$-16, %esp
	movl	$0, %eax
	subl	%eax, %esp
	cmpl	$1, 8(%ebp)
	jg	.L5
	subl	$12, %esp
	pushl	$.LC2
	call	printf
	addl	$16, %esp
	movl	$1, -8(%ebp)
	jmp	.L4
.L5:
	subl	$12, %esp
	movl	12(%ebp), %eax
	addl	$4, %eax
	pushl	(%eax)
	call	atoi
	addl	$16, %esp
	movl	%eax, -4(%ebp)
	subl	$12, %esp
	pushl	-4(%ebp)
	call	checkguess
	addl	$16, %esp
	movl	$0, -8(%ebp)
.L4:
	movl	-8(%ebp), %eax
	leave
	ret
.Lfe2:
	.size	main,.Lfe2-main
int main(int argc, char **argv) {
  int x;

  if (argc < 2 ) {
	printf("You need to enter a number on the command line\n");
	return(1);
  }

  x = atoi(argv[1]);
  checkguess(x);
  return(0);
}


p2: C strings

p2.s main()
	.file	"p2.c"
	.section	.rodata
.LC0:
	.string	"grOpmoC"
.LC1:
	.string	"You are a wizard\n"
.LC2:
	.string	"You are wrong\n"
	.text
.globl checkguess
	.type	checkguess,@function
checkguess:
	pushl	%ebp
	movl	%esp, %ebp
	subl	$8, %esp
	subl	$8, %esp
	pushl	$.LC0
	pushl	8(%ebp)
	call	strcmp
	addl	$16, %esp
	testl	%eax, %eax
	jne	.L2
	subl	$12, %esp
	pushl	$.LC1
	call	printf
	addl	$16, %esp
	jmp	.L1
.L2:
	subl	$12, %esp
	pushl	$.LC2
	call	printf
	addl	$16, %esp
.L1:
	leave
	ret
.Lfe1:
	.size	checkguess,.Lfe1-checkguess
	.section	.rodata
	.align 32
.LC3:
	.string	"You need to enter a string on the command line\n"
	.text
.globl main
	.type	main,@function
main:
	pushl	%ebp
	movl	%esp, %ebp
	subl	$8, %esp
	andl	$-16, %esp
	movl	$0, %eax
	subl	%eax, %esp
	cmpl	$1, 8(%ebp)
	jg	.L5
	subl	$12, %esp
	pushl	$.LC3
	call	printf
	addl	$16, %esp
	movl	$1, -4(%ebp)
	jmp	.L4
.L5:
	subl	$12, %esp
	movl	12(%ebp), %eax
	addl	$4, %eax
	pushl	(%eax)
	call	checkguess
	addl	$16, %esp
	movl	$0, -4(%ebp)
.L4:
	movl	-4(%ebp), %eax
	leave
	ret
.Lfe2:
	.size	main,.Lfe2-main

int main(int argc, char **argv) {

  if (argc < 2 ) {
	printf("You need to enter a string on the command line\n");
	return(1);
  }

  checkguess(argv[1]);

  return(0);
}


p3: Conditionals (with numbers)

p3.s main()
	.file	"p3.c"
	.section	.rodata
.LC0:
	.string	"You are wrong\n"
.LC1:
	.string	"You are a wizard\n"
	.text
.globl checkguess
	.type	checkguess,@function
checkguess:
	pushl	%ebp
	movl	%esp, %ebp
	subl	$8, %esp
	cmpl	$0, 8(%ebp)
	jg	.L3
	cmpl	$9, 12(%ebp)
	jle	.L3
	movl	12(%ebp), %eax
	addl	8(%ebp), %eax
	cmpl	$5, %eax
	jne	.L3
	jmp	.L2
.L3:
	subl	$12, %esp
	pushl	$.LC0
	call	printf
	addl	$16, %esp
	jmp	.L1
.L2:
	subl	$12, %esp
	pushl	$.LC1
	call	printf
	addl	$16, %esp
.L1:
	leave
	ret
.Lfe1:
	.size	checkguess,.Lfe1-checkguess
	.section	.rodata
	.align 32
.LC2:
	.string	"You need to enter two numbers on the command line\n"
	.text
.globl main
	.type	main,@function
main:
	pushl	%ebp
	movl	%esp, %ebp
	subl	$24, %esp
	andl	$-16, %esp
	movl	$0, %eax
	subl	%eax, %esp
	cmpl	$2, 8(%ebp)
	jg	.L6
	subl	$12, %esp
	pushl	$.LC2
	call	printf
	addl	$16, %esp
	movl	$1, -12(%ebp)
	jmp	.L5
.L6:
	subl	$12, %esp
	movl	12(%ebp), %eax
	addl	$4, %eax
	pushl	(%eax)
	call	atoi
	addl	$16, %esp
	movl	%eax, -4(%ebp)
	subl	$12, %esp
	movl	12(%ebp), %eax
	addl	$8, %eax
	pushl	(%eax)
	call	atoi
	addl	$16, %esp
	movl	%eax, -8(%ebp)
	subl	$8, %esp
	pushl	-8(%ebp)
	pushl	-4(%ebp)
	call	checkguess
	addl	$16, %esp
	movl	$0, -12(%ebp)
.L5:
	movl	-12(%ebp), %eax
	leave
	ret
.Lfe2:
	.size	main,.Lfe2-main

int main(int argc, char **argv) {
  int x,y;

  if (argc < 3 ) {
	printf("You need to enter two numbers on the command line\n");
	return(1);
  }

  x = atoi(argv[1]);
  y = atoi(argv[2]);
  checkguess(x,y);
  return(0);
}



p4: Switch statement

p4.s main()
	.file	"p4.c"
	.section	.rodata
.LC0:
	.string	"You are wrong\n"
.LC1:
	.string	"You are a wizard\n"
	.text
.globl checkguess
	.type	checkguess,@function
checkguess:
	pushl	%ebp
	movl	%esp, %ebp
	subl	$8, %esp
	movl	$3, -4(%ebp)
	movl	$0, -8(%ebp)
	cmpl	$7, 8(%ebp)
	ja	.L2
	movl	8(%ebp), %eax
	sall	$2, %eax
	movl	.L11(%eax), %eax
	jmp	*%eax
	.section	.rodata
	.align 4
	.align 4
.L11:
	.long	.L3
	.long	.L4
	.long	.L5
	.long	.L6
	.long	.L7
	.long	.L8
	.long	.L9
	.long	.L10
	.text
.L3:
	movl	$12, -8(%ebp)
	jmp	.L2
.L4:
	movl	$4, -8(%ebp)
	jmp	.L2
.L5:
	movl	$7, -8(%ebp)
	jmp	.L2
.L6:
	movl	$1, -8(%ebp)
	jmp	.L2
.L7:
	movl	$23, -8(%ebp)
	jmp	.L2
.L8:
	movl	$14, -8(%ebp)
	jmp	.L2
.L9:
	movl	$102, -8(%ebp)
	jmp	.L2
.L10:
	movl	$-2, -8(%ebp)
.L2:
	cmpl	$0, -8(%ebp)
	jne	.L13
	subl	$12, %esp
	pushl	$.LC0
	call	printf
	addl	$16, %esp
	jmp	.L1
.L13:
	movl	-8(%ebp), %eax
	leal	-4(%ebp), %edx
	addl	%eax, (%edx)
	movl	-4(%ebp), %eax
	cmpl	12(%ebp), %eax
	jne	.L14
	subl	$12, %esp
	pushl	$.LC1
	call	printf
	addl	$16, %esp
	jmp	.L1
.L14:
	subl	$12, %esp
	pushl	$.LC0
	call	printf
	addl	$16, %esp
.L1:
	leave
	ret
.Lfe1:
	.size	checkguess,.Lfe1-checkguess
	.section	.rodata
	.align 32
.LC2:
	.string	"You need to enter two numbers on the command line\n"
	.text
.globl main
	.type	main,@function
main:
	pushl	%ebp
	movl	%esp, %ebp
	subl	$24, %esp
	andl	$-16, %esp
	movl	$0, %eax
	subl	%eax, %esp
	cmpl	$2, 8(%ebp)
	jg	.L17
	subl	$12, %esp
	pushl	$.LC2
	call	printf
	addl	$16, %esp
	movl	$1, -12(%ebp)
	jmp	.L16
.L17:
	subl	$12, %esp
	movl	12(%ebp), %eax
	addl	$4, %eax
	pushl	(%eax)
	call	atoi
	addl	$16, %esp
	movl	%eax, -4(%ebp)
	subl	$12, %esp
	movl	12(%ebp), %eax
	addl	$8, %eax
	pushl	(%eax)
	call	atoi
	addl	$16, %esp
	movl	%eax, -8(%ebp)
	subl	$8, %esp
	pushl	-8(%ebp)
	pushl	-4(%ebp)
	call	checkguess
	addl	$16, %esp
	movl	$0, -12(%ebp)
.L16:
	movl	-12(%ebp), %eax
	leave
	ret
.Lfe2:
	.size	main,.Lfe2-main

int main(int argc, char **argv) {
  int x,y;

  if (argc < 3 ) {
	printf("You need to enter two numbers on the command line\n");
	return(1);
  }

  x = atoi(argv[1]);
  y = atoi(argv[2]);
  checkguess(x,y);
  return(0);
}


p5: C Struct/Linked List (hard!)

p5.s main()
	.file	"p5.c"
.globl x4
	.data
	.align 4
	.type	x4,@object
	.size	x4,12
x4:
	.long	3
	.long	4
	.long	0
.globl x3
	.align 4
	.type	x3,@object
	.size	x3,12
x3:
	.long	7
	.long	2
	.long	x4
.globl x2
	.align 4
	.type	x2,@object
	.size	x2,12
x2:
	.long	1
	.long	1
	.long	x3
.globl x1
	.align 4
	.type	x1,@object
	.size	x1,12
x1:
	.long	5
	.long	6
	.long	x2
	.section	.rodata
.LC0:
	.string	"You are a wizard\n"
.LC1:
	.string	"You are wrong\n"
	.text
.globl checkguess
	.type	checkguess,@function
checkguess:
	pushl	%ebp
	movl	%esp, %ebp
	subl	$8, %esp
	movl	$x1, -4(%ebp)
	movl	$0, -8(%ebp)
.L2:
	cmpl	$0, -4(%ebp)
	jne	.L4
	jmp	.L3
.L4:
	movl	-4(%ebp), %eax
	movl	(%eax), %edx
	leal	-8(%ebp), %eax
	addl	%edx, (%eax)
	movl	-4(%ebp), %eax
	movl	8(%eax), %eax
	movl	%eax, -4(%ebp)
	jmp	.L2
.L3:
	movl	8(%ebp), %eax
	cmpl	-8(%ebp), %eax
	jne	.L5
	subl	$12, %esp
	pushl	$.LC0
	call	printf
	addl	$16, %esp
	jmp	.L1
.L5:
	subl	$12, %esp
	pushl	$.LC1
	call	printf
	addl	$16, %esp
.L1:
	leave
	ret
.Lfe1:
	.size	checkguess,.Lfe1-checkguess
	.section	.rodata
	.align 32
.LC2:
	.string	"You need to enter a number on the command line\n"
	.text
.globl main
	.type	main,@function
main:
	pushl	%ebp
	movl	%esp, %ebp
	subl	$8, %esp
	andl	$-16, %esp
	movl	$0, %eax
	subl	%eax, %esp
	cmpl	$1, 8(%ebp)
	jg	.L8
	subl	$12, %esp
	pushl	$.LC2
	call	printf
	addl	$16, %esp
	movl	$1, -8(%ebp)
	jmp	.L7
.L8:
	subl	$12, %esp
	movl	12(%ebp), %eax
	addl	$4, %eax
	pushl	(%eax)
	call	atoi
	addl	$16, %esp
	movl	%eax, -4(%ebp)
	subl	$12, %esp
	pushl	-4(%ebp)
	call	checkguess
	addl	$16, %esp
	movl	$0, -8(%ebp)
.L7:
	movl	-8(%ebp), %eax
	leave
	ret
.Lfe2:
	.size	main,.Lfe2-main

int main(int argc, char **argv) {
  int x;

  if (argc < 2 ) {
	printf("You need to enter a number on the command line\n");
	return(1);
  }

  x = atoi(argv[1]);
  checkguess(x);
  return(0);
}



Need more? - try this one: hard.s