Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Defusing a binary bomb with gdb – Part 1

blog.carlosgaldino.com

Post reply on HN
Print view View original

11–20 of 22 posts

Re: Defusing a binary bomb with gdb – Part 1

#11

Post by carlosdp »

jedmeyers wrote: post #6
carlosdp wrote: post #4

I took the course the book was designed for at CMU (and with the guys who wrote it, all CS majors have to take it), everyone on campus always knew when "bomb-lab" was happening because people would post on FB "Just defused a bomb", confusing anyone who was new around =P Not setting off the bomb is pretty easy as long as you remember to set a break point right before the "explode" function before every gdb run. Super…

If I am not mistaken, the book is called Computer Systems: A Programmer's Perspective (CS:APP) by Randal E. Bryant and David R. O'Hallaron. It's very nicely written, and 3rd edition just came out this year. Coursera also has an archive of a great course based on this book from University of Washington - 'The Hardware/Software Interface'.

You're right, that's what it's called (still have my copy at home). I took the course with Bryant and O'Hallaron. Super smart guys, very nice too. They're the kind of professors that really care more about students learning the stuff rather than administrative stuff or arbitrary policies.

Haven't seen the Coursera course, but it'd be really hard to make a bad course based on this book. It's both creative enough to keep attention, and doesn't skip anything.

Re: Defusing a binary bomb with gdb – Part 1

#12

Post by carlosdp »

tylerkahn wrote: post #9

In the course I took, the program would call home whenever it exploded and deduct points from your grade on the assignment. So naturally I just went in with hexedit and deleted that particular call to that function in explode_bomb.

Yea, that's how it works at CMU too. Usually, we just made sure to set a breakpoint there.

Re: Defusing a binary bomb with gdb – Part 1

#13

Post by carlosdp »

brbsix wrote: post #10

It was a pain in the butt to find the bomb executable, so for anyone interested, here is the link for a Linux/x86-64 binary bomb: http://csapp.cs.cmu.edu/3e/bomb.tar

Well that's part of it, the real meat is in "phases.c", which would need to be generated by the instructors (and uniquely for each student). This way no two student's answers are both the same, and there's no public source code to reference to figure out what the bomb is "doing" to the input and what input it actually needs in order to "defuse" properly, without trial-and-error and debugging, or reading the ASM disassembly throughly if that's your style.

Re: Defusing a binary bomb with gdb – Part 1

#14

Post by carlosdp »

zokier wrote: post #7

At least for the first stage you don't actually need to run the executable (under gdb or otherwise). You can just get the string with objdump: $ objdump -s --start-address 0x402400 bomb|head bomb: file format elf64-x86-64 Contents of section .rodata: 402400 426f7264 65722072 656c6174 696f6e73 Border relations 402410 20776974 68204361 6e616461 20686176 with Canada hav 402420 65206e65 76657220 6265656e 20626574 e never…

It's actually possible to defuse the whole thing by just decompiling it into assembly and reading that, but you have to really know and be comfortable with ASM. There are a handful of students that do it each year at CMU though, so it's not unsurmountable.

Students who are really comfortable with ASM will get through it fast by reading it, and those who are less so will GDB their way to the right answer. Which is exactly how a good CS assignment should work, where it scales for each skill level very well. Hence one of the reasons this book is great!

Re: Defusing a binary bomb with gdb – Part 1

#15

Post by joeyaiello »

carlosdp wrote: post #4

I took the course the book was designed for at CMU (and with the guys who wrote it, all CS majors have to take it), everyone on campus always knew when "bomb-lab" was happening because people would post on FB "Just defused a bomb", confusing anyone who was new around =P Not setting off the bomb is pretty easy as long as you remember to set a break point right before the "explode" function before every gdb run. Super…

I also took a class designed around this class at UCLA. The bomb lab was absolutely the standout, both in terms of what I learned and how much I enjoyed it.

Didn't see it mentioned, but the really cool thing is that the bomb required internet access and would phone home to a server to dock points if you let it go off. As you said, all it required was that one breakpoint, but it still made everything feel more critical.

Re: Defusing a binary bomb with gdb – Part 1

#16

Post by carlosdp »

joeyaiello wrote: post #15
carlosdp wrote: post #4

I took the course the book was designed for at CMU (and with the guys who wrote it, all CS majors have to take it), everyone on campus always knew when "bomb-lab" was happening because people would post on FB "Just defused a bomb", confusing anyone who was new around =P Not setting off the bomb is pretty easy as long as you remember to set a break point right before the "explode" function before every gdb run. Super…

I also took a class designed around this class at UCLA. The bomb lab was absolutely the standout, both in terms of what I learned and how much I enjoyed it. Didn't see it mentioned, but the really cool thing is that the bomb required internet access and would phone home to a server to dock points if you let it go off. As you said, all it required was that one breakpoint, but it still made everything feel more critica…

Yea, I didn't mention the "phone home" part, that's important =P

Even though it is "easy" to avoid it, there were still a bunch of people who accidentally triggered it every semester.

Re: Defusing a binary bomb with gdb – Part 1

#17

Post by mafuyu »

joeyaiello wrote: post #15
carlosdp wrote: post #4

I took the course the book was designed for at CMU (and with the guys who wrote it, all CS majors have to take it), everyone on campus always knew when "bomb-lab" was happening because people would post on FB "Just defused a bomb", confusing anyone who was new around =P Not setting off the bomb is pretty easy as long as you remember to set a break point right before the "explode" function before every gdb run. Super…

I also took a class designed around this class at UCLA. The bomb lab was absolutely the standout, both in terms of what I learned and how much I enjoyed it. Didn't see it mentioned, but the really cool thing is that the bomb required internet access and would phone home to a server to dock points if you let it go off. As you said, all it required was that one breakpoint, but it still made everything feel more critica…

I remember opening up the binary in IDA and patching out all the phoning home, allowing me to tinker with it as I pleased. I then patched out all the key checking and hooked it back online, only to realize in horror that all the inputs were validated server side. :(

Re: Defusing a binary bomb with gdb – Part 1

#19

Post by [deleted] »

DIVx0 wrote: post #2

This was one of my favorite lab assignments when I was at university. If I recall correctly this lab was run back to back with another really fun one out of the same book. The other had to do with modifying code to take advantage of some compiler optimizations. Loop unrolling, array layout, stuff like that. allow me to brag a bit: I was the only one in my class to not set off the bomb!

[deleted]

Re: Defusing a binary bomb with gdb – Part 1

#20

Post by carlosgaldino »

joeyaiello wrote: post #15
carlosdp wrote: post #4

I took the course the book was designed for at CMU (and with the guys who wrote it, all CS majors have to take it), everyone on campus always knew when "bomb-lab" was happening because people would post on FB "Just defused a bomb", confusing anyone who was new around =P Not setting off the bomb is pretty easy as long as you remember to set a break point right before the "explode" function before every gdb run. Super…

I also took a class designed around this class at UCLA. The bomb lab was absolutely the standout, both in terms of what I learned and how much I enjoyed it. Didn't see it mentioned, but the really cool thing is that the bomb required internet access and would phone home to a server to dock points if you let it go off. As you said, all it required was that one breakpoint, but it still made everything feel more critica…

Maybe the online part is only available for students enrolled at CMU which is not my case. Self-study students download a different binary. Although it would be fun if it also had some online stuff.
Post reply on HN