Lab 1: Binary Bomb Lab

1. Lab 1: Binary Bomb Lab Goals: To gain an understanding of assembly To get your hands dirty in GDB

2. Forecast for today’s recitation: • C program compilation • Overview of the Binary Bomb Lab • Assembly basics • GDB basics • GDB “bug” • GDB demo • Assembly/C comparison practice

3. C program compilation • Steps to building an executable file from a C source code file: • Preprocessing: the preprocessor takes a C source code file and replaces preprocessor directives with source code • For example, #include and #define precede preprocessor directives • Compilation: the compiler produces an object file based on the output of the preprocessor • Assembling: conversion from assembly to machine instructions • Linking: the linker takes the object files produced by the compiler and combines them to produce a library or an executable file • If one is available, running the Makefile (using the command “make”) can do these steps for you • Alternatively, you could use the “gcc” command

4. What is a binary bomb? • Dr. Evil has created a series of so-called “binary bombs” for you to defuse by determining the password needed to prevent an “explosion” from occurring • You will only be given your bomb’s .o file because giving you the source code would make this lab far too easy • You will be expected to look at the assembly dump of this file to help you determine the passwords • It may be useful to learn how to set breakpoints to prevent explosions • Each timeyou allow the bomb to explode, you will lose ¼ point • Capped at 10 points lost • Each phase is worth 10 points out of a total of 60 points

5. Assembly vocabulary: • movlSouce, Destination • Ex: can move immediate value to a register or to memory, can move a register value to another register or to memory, can move memory to a register • CANNOT move memory to memory • lealSouce, Destination • Commonly used for computing arithmetic expressions • Ex: leal (%eax, %eax, 2), %eax would be the assembly version of C code that looks something like the following: x = x + x*2 • cmplReg1, Reg2: Reg2 “relation” Reg1 • jmpl Label • Could be of the form j“relation” (Ex: jle or jg or je) • addlSouce, Destination: Dest = Dest + Src • sublSouce, Destination: Dest= Dest - Src

6. Assembly registers: • %esp: stack pointer • %ebp: stack base pointer • %eax: function return value • %ebx, %ecx, %edx: general-purpose registers • %eip: instruction pointer (program counter)

7. Address computation examples • 0x8(%edx) => 0x8+%edx • (%edx, %ecx) => %edx + %ecx • (%edx, %ecx, 4) => %edx + 4*%ecx • 0x8( , %edx, 2) => 2*%edx + 0x8

8. What is GDB? • Command line debugging tool • Available on many different platforms • Useful outside of classroom setting • Allows you to trace a program in execution and set breakpoints along the way • Gives you a chance to inspect register contents and the assembly breakdown of your executable

9. GDB bug (applicable to new VM) • When setting a breakpoint, GDB replaces the instruction at which you are breaking with the expression “int3” as an indicator of a system interrupt so that the program will pause at that point when it is running • As a quick fix, please do the following: • Within GDB: (gdb) set code-cache off • As a permanent fix, please do the following: • Command line: $ echo "set code-cache off" >> ~/.gdbinit

10. GDB commands • break: sets break point at specified location • print: prints a specified variable or register’s value • stepi: steps through one instruction in assembly • nexti: steps through one instruction, including function calls • disas: show the disassembly of the current code • continue: continues execution after stopping at a break point • quit: exit gdb

11. GDB commands (continued) • disas [function] • disas *address • info break • info registers • x/* address: display contents of memory • x/ 4x address: display 4 32-bit hex numbers starting at address

12. GDB Demo

13. Assembly vs. C Source Code (Practice problem was adapted from Professor Mohamed Zahran’s practice exam)