Bomb Lab实验phase_6链表指针结构

前置知识

汇编语言—跳转指令jge、jg、jle、jl、jne、je、jb
JGE 前>=后 Jump if greater or equal
JG 前>后 Jump if greater
JLE 前<=后 Jump if less or equal
JL 前<后 Jump if less
JNE 前不等于后 Jump if not equal
JE 前等于后 Jump if equal
更多信息
注：前后关系具体情况，具体分析。（本题中的前后关系和示例中相对位置相反）

1、前期准备

00000000004010dc <phase_6>:
  4010dc:	41 56                	push   %r14
  4010de:	41 55                	push   %r13
  4010e0:	41 54                	push   %r12
  4010e2:	55                   	push   %rbp
  4010e3:	53                   	push   %rbx                     
  4010e4:	48 83 ec 60          	sub    $0x60,%rsp               
  4010e8:	64 48 8b 04 25 28 00 	mov    %fs:0x28,%rax
  4010ef:	00 00 
  4010f1:	48 89 44 24 58       	mov    %rax,0x58(%rsp)          
  4010f6:	31 c0                	xor    %eax,%eax
  4010f8:	48 89 e6             	mov    %rsp,%rsi
  4010fb:	e8 69 03 00 00       	callq  401469 <read_six_numbers>

2、数据处理

  401100:	49 89 e4             	mov    %rsp,%r12
  401103:	49 89 e5             	mov    %rsp,%r13
  401106:	41 be 00 00 00 00    	mov    $0x0,%r14d
  40110c:	eb 25                	jmp    401133 <phase_6+0x57>
  40110e:	e8 34 03 00 00       	callq  401447 <explode_bomb>
  401113:	eb 2d                	jmp    401142 <phase_6+0x66>
  401115:	83 c3 01             	add    $0x1,%ebx                
  401118:	83 fb 05             	cmp    $0x5,%ebx                
  40111b:	7f 12                	jg     40112f <phase_6+0x53>    
  40111d:	48 63 c3             	movslq %ebx,%rax               
  401120:	8b 04 84             	mov    (%rsp,%rax,4),%eax
  401123:	39 45 00             	cmp    %eax,0x0(%rbp)           
  401126:	75 ed                	jne    401115 <phase_6+0x39>    
  401128:	e8 1a 03 00 00       	callq  401447 <explode_bomb>    
  40112d:	eb e6                	jmp    401115 <phase_6+0x39>    
  40112f:	49 83 c5 04          	add    $0x4,%r13                
  401133:	4c 89 ed             	mov    %r13,%rbp                
  401136:	41 8b 45 00          	mov    0x0(%r13),%eax           
  40113a:	83 e8 01             	sub    $0x1,%eax               
  40113d:	83 f8 05             	cmp    $0x5,%eax               
  401140:	77 cc                	ja     40110e <phase_6+0x32>   
  401142:	41 83 c6 01          	add    $0x1,%r14d               
  401146:	41 83 fe 06          	cmp    $0x6,%r14d              
  40114a:	74 05                	je     401151 <phase_6+0x75>  
  40114c:	44 89 f3             	mov    %r14d,%ebx 
  40114f:	eb cc                	jmp    40111d <phase_6+0x41>

伪代码

int *r12 = *r13 = *rsp;
r14d = 0;
do {
	*rbp = *r13;
	eax = r13;
	eax--;
	if (eax>5) bomb;
	else {
		ebx = r14d++;
		rax = ebx;
		eax = rsp[rax];
		while(eax!=rbp[0]) {
			ebx++;
			if(ebx>5) {
				r13 = r13->next;//原来r13的下一个元素；
				continue;
			}
		}
	}
}while(r14d!=6)

将链表中所有数据减7取绝对值

  401151:	49 8d 4c 24 18       	lea    0x18(%r12),%rcx
  401156:	ba 07 00 00 00       	mov    $0x7,%edx                
  40115b:	89 d0                	mov    %edx,%eax                
  40115d:	41 2b 04 24          	sub    (%r12),%eax              
  401161:	41 89 04 24          	mov    %eax,(%r12)
  401165:	49 83 c4 04          	add    $0x4,%r12
  401169:	4c 39 e1             	cmp    %r12,%rcx
  40116c:	75 ed                	jne    40115b <phase_6+0x7f>

伪代码

rcx = null;
do {
	eax = edx = 7;
	r12->value = eax - r12->value; 
	r12 = r12->next;
}while(r12!=rcx)

本段是按照链表edx中的value值大小进行排序并暂存到rsp中

  40116e:	be 00 00 00 00       	mov    $0x0,%esi // esi = 0
  401173:	eb 1a                	jmp    40118f <phase_6+0xb3>
  401175:	48 8b 52 08          	mov    0x8(%rdx),%rdx  //rdx += 8;
  401179:	83 c0 01             	add    $0x1,%eax	// eax = 1;
  40117c:	39 c8                	cmp    %ecx,%eax	//if eax!=ecx
  40117e:	75 f5                	jne    401175 <phase_6+0x99>	// then 
  401180:	48 89 54 f4 20       	mov    %rdx,0x20(%rsp,%rsi,8)	//rsp += 8*rsi+0x20 = rdx; 
  401185:	48 83 c6 01          	add    $0x1,%rsi
  401189:	48 83 fe 06          	cmp    $0x6,%rsi	// if rsi==6
  40118d:	74 14                	je     4011a3 <phase_6+0xc7>	//then 
  40118f:	8b 0c b4             	mov    (%rsp,%rsi,4),%ecx  //ecx = (rsp+=4*rsi)
  401192:	b8 01 00 00 00       	mov    $0x1,%eax	//eax = 1
  401197:	ba d0 32 60 00       	mov    $0x6032d0,%edx	//edx = list_node
  40119c:	83 f9 01             	cmp    $0x1,%ecx	//if ecx>1;
  40119f:	7f d4                	jg     401175 <phase_6+0x99> //then
  4011a1:	eb dd                	jmp    401180 <phase_6+0xa4>

int rsi = esi = 0;
do {
	ecx = rsp[rsi]
	eax = 1;
	rdx = edx = *list_node;//$0x6032d0是链表头结点地址
	if(ecx>1) {
		do {
			rdx = rdx->next;
			eax++;
		}while(ecx!=eax)
	}
	rsp[8+2*rsi] = rdx->value  // 0x20==32一个字符按4个字节 32/4 = 8；
	rsi++;
}while(rsi!=6)

下面这段主要是将存放在rsp中的值存放到**%rbx** 中 ；

  4011a3:	48 8b 5c 24 20       	mov    0x20(%rsp),%rbx		//rbx = rsp+0x20;
  4011a8:	48 8b 44 24 28       	mov    0x28(%rsp),%rax	//rax = rsp+0x28;
  4011ad:	48 89 43 08          	mov    %rax,0x8(%rbx)	//rbx+8 = rax;

  4011b1:	48 8b 54 24 30       	mov    0x30(%rsp),%rdx	//rdx = rsp+0x30;
  4011b6:	48 89 50 08          	mov    %rdx,0x8(%rax)	//rax+8 = rdx;
  4011ba:	48 8b 44 24 38       	mov    0x38(%rsp),%rax	//rax = rsp+0x38;
  4011bf:	48 89 42 08          	mov    %rax,0x8(%rdx)	//rdx+8 = rax;
  4011c3:	48 8b 54 24 40       	mov    0x40(%rsp),%rdx	//rdx = rsp+0x40;
  4011c8:	48 89 50 08          	mov    %rdx,0x8(%rax)	//rax+8 = rdx;
  4011cc:	48 8b 44 24 48       	mov    0x48(%rsp),%rax	//rax = rsp+0x48;
  4011d1:	48 89 42 08          	mov    %rax,0x8(%rdx)	//rdx+8 = rax;
  4011d5:	48 c7 40 08 00 00 00 	movq   $0x0,0x8(%rax)	//rax+8 = 0; 
  4011dc:	00 

这段说明以 %rbx 为首地址的链表中存储的值单调递减
及图中node节点中value的值经变换（转为10进制）调整（前面做调整）后 单调递减

  4011dd:	bd 05 00 00 00       	mov    $0x5,%ebp	//ebp = 5;
  4011e2:	eb 09                	jmp    4011ed <phase_6+0x111>	
  **4011e4**:	48 8b 5b 08          	mov    0x8(%rbx),%rbx	//rbx = rbx+8;
  4011e8:	83 ed 01             	sub    $0x1,%ebp	//ebp = ebp-1;
  4011eb:	74 11                	je     **4011fe** <phase_6+0x122>	
  4011ed:	48 8b 43 08          	mov    0x8(%rbx),%rax	//rax = rbx+8;
  4011f1:	8b 00                	mov    (%rax),%eax	// eax = rax;
  4011f3:	39 03                	cmp    %eax,(%rbx)	// if rbx>eax
  4011f5:	7d ed                	jge    **4011e4** <phase_6+0x108> // then
  4011f7:	e8 4b 02 00 00       	callq  401447 <explode_bomb>
  4011fc:	eb e6                	jmp    4011e4 <phase_6+0x108>
  **4011fe**:	48 8b 44 24 58       	mov    0x58(%rsp),%rax	//rax = rsp+58
  401203:	64 48 33 04 25 28 00 	xor    %fs:0x28,%rax

伪代码

int ebp = 5;
do{
	rax = rbx->next;
	eax = rax;
	if(rbx->value > eax->value){
		rbx = rbx->next;
		ebp--;
	}else bomb;
}while(ebp>0);

3、结束收尾

  40120a:	00 00 
  40120c:	75 0d                	jne    40121b <phase_6+0x13f>
  40120e:	48 83 c4 60          	add    $0x60,%rsp
  401212:	5b                   	pop    %rbx
  401213:	5d                   	pop    %rbp
  401214:	41 5c                	pop    %r12
  401216:	41 5d                	pop    %r13
  401218:	41 5e                	pop    %r14
  40121a:	c3                   	retq   
  40121b:	e8 e0 f8 ff ff       	callq  400b00 <__stack_chk_fail@plt>

详细信息请参考：【深入理解计算机系统csapp】Bomb Lab 实验3