进入目录下
./bomb
开始运行炸弹
对于炸弹command not found之类的鬼畜情况：
chmod 777 bomb
然后再运行炸弹

objdump -d bomb > bomb.s
把整个代码打到文件里去，也可以进gdb看
gdb>disas phase_1
看第一步的代码

我是bomb_217

第一步直接找按地址寻找字符串

0000000000400ead <phase_1>:400ead:   48 83 ec 08             sub    $0x8,%rsp400eb1:   be b0 23 40 00          mov    $0x4023b0,%esi  //字符串就存这，x/s 0x4023b0就出来了//I can see Russia from my house!400eb6:   e8 5c 04 00 00          callq  401317 <strings_not_equal>400ebb:   85 c0                   test   %eax,%eax400ebd:   74 05                   je     400ec4 <phase_1+0x17>400ebf:   e8 52 05 00 00          callq  401416 <explode_bomb>400ec4:   48 83 c4 08             add    $0x8,%rsp400ec8:   c3                      retq   

第二部，输入6个数，我这里是要求是以1开头，公比为2的等比数列

0000000000400ec9 <phase_2>:400ec9:   55                      push   %rbp400eca:   53                      push   %rbx400ecb:   48 83 ec 28             sub    $0x28,%rsp400ecf:   64 48 8b 04 25 28 00    mov    %fs:0x28,%rax400ed6:   00 00 400ed8:   48 89 44 24 18          mov    %rax,0x18(%rsp)400edd:   31 c0                   xor    %eax,%eax400edf:   48 89 e6                mov    %rsp,%rsi400ee2:   e8 51 05 00 00          callq  401438 <read_six_numbers>        //read 6 个数字400ee7:   83 3c 24 01             cmpl   $0x1,(%rsp)400eeb:   74 05                   je     400ef2 <phase_2+0x29>            //if !=1,爆炸400eed:   e8 24 05 00 00          callq  401416 <explode_bomb>400ef2:   48 89 e3                mov    %rsp,%rbx400ef5:   48 8d 6c 24 14          lea    0x14(%rsp),%rbp400efa:   8b 03                   mov    (%rbx),%eax400efc:   01 c0                   add    %eax,%eax                        //*2400efe:   39 43 04                cmp    %eax,0x4(%rbx)  //不等则爆炸,,,猜，六个数，等比数列，get400f01:   74 05                   je     400f08 <phase_2+0x3f>400f03:   e8 0e 05 00 00          callq  401416 <explode_bomb>400f08:   48 83 c3 04             add    $0x4,%rbx400f0c:   48 39 eb                cmp    %rbp,%rbx400f0f:   75 e9                   jne    400efa <phase_2+0x31>400f11:   48 8b 44 24 18          mov    0x18(%rsp),%rax400f16:   64 48 33 04 25 28 00    xor    %fs:0x28,%rax400f1d:   00 00 400f1f:   74 05                   je     400f26 <phase_2+0x5d>400f21:   e8 fa fb ff ff          callq  400b20 <__stack_chk_fail@plt>400f26:   48 83 c4 28             add    $0x28,%rsp400f2a:   5b                      pop    %rbx400f2b:   5d                      pop    %rbp400f2c:   c3                      retq   

第三部，
输 x/s 0x40258f 看到”%d %d”，说明输入格式是两个int
switch语句，rax越大要干的事越少，懒一点吧
有多组解。。。。

0000000000400f2d <phase_3>:400f2d:   48 83 ec 18             sub    $0x18,%rsp400f31:   64 48 8b 04 25 28 00    mov    %fs:0x28,%rax400f38:   00 00 400f3a:   48 89 44 24 08          mov    %rax,0x8(%rsp)400f3f:   31 c0                   xor    %eax,%eax400f41:   48 8d 4c 24 04          lea    0x4(%rsp),%rcx400f46:   48 89 e2                mov    %rsp,%rdx400f49:   be 8f 25 40 00          mov    $0x40258f,%esi               //x/s 0x40258f: "%d %d"400f4e:   e8 8d fc ff ff          callq  400be0 <__isoc99_sscanf@plt>400f53:   83 f8 01                cmp    $0x1,%eax400f56:   7f 05                   jg     400f5d <phase_3+0x30>               400f58:   e8 b9 04 00 00          callq  401416 <explode_bomb>               //if (%eax<=1) 炸400f5d:   83 3c 24 07             cmpl   $0x7,(%rsp)                         400f61:   77 5b                   ja     400fbe <phase_3+0x91>               //if (%rsp>7) 炸400f63:   8b 04 24                mov    (%rsp),%eax400f66:   ff 24 c5 00 24 40 00    jmpq   *0x402400(,%rax,8) //x/x 0x402400 0x6d    %rax=0//x/x 0x402408 0x74    %rax=1//x/x 0x402410 0x80    %rax=2//x/x 0x402418 0x8c    %rax=3//x/x 0x402420 0x96    %rax=4//x/x 0x402428 0xa0    %rax=5 //x/x 0x402430 0xaa    %rax=6 boom 见下面的！！！//x/x 0x402438 0xb4    %rax=7 boom400f6d:   b8 7c 01 00 00          mov    $0x17c,%eax400f72:   eb 05                   jmp    400f79 <phase_3+0x4c>400f74:   b8 00 00 00 00          mov    $0x0,%eax                           400f79:   2d de 03 00 00          sub    $0x3de,%eax                         400f7e:   eb 05                   jmp    400f85 <phase_3+0x58>400f80:   b8 00 00 00 00          mov    $0x0,%eax                           400f85:   05 49 01 00 00          add    $0x149,%eax                         400f8a:   eb 05                   jmp    400f91 <phase_3+0x64>400f8c:   b8 00 00 00 00          mov    $0x0,%eax400f91:   83 e8 3f                sub    $0x3f,%eax                          400f94:   eb 05                   jmp    400f9b <phase_3+0x6e>400f96:   b8 00 00 00 00          mov    $0x0,%eax                //%rax=4 太烦的事我都不太会做400f9b:   83 c0 3f                add    $0x3f,%eax                          400f9e:   eb 05                   jmp    400fa5 <phase_3+0x78>400fa0:   b8 00 00 00 00          mov    $0x0,%eax      //%rax=5 算出来是-0x3f=-63,get,懒惰即美德400fa5:   83 e8 3f                sub    $0x3f,%eax                         400fa8:   eb 05                   jmp    400faf <phase_3+0x82>400faa:   b8 00 00 00 00          mov    $0x0,%eax400faf:   83 c0 3f                add    $0x3f,%eax                         400fb2:   eb 05                   jmp    400fb9 <phase_3+0x8c>400fb4:   b8 00 00 00 00          mov    $0x0,%eax                           //%rax=7,不能太懒啊400fb9:   83 e8 3f                sub    $0x3f,%eax                         400fbc:   eb 0a                   jmp    400fc8 <phase_3+0x9b>400fbe:   e8 53 04 00 00          callq  401416 <explode_bomb>400fc3:   b8 00 00 00 00          mov    $0x0,%eax400fc8:   83 3c 24 05             cmpl   $0x5,(%rsp)                         400fcc:   7f 06                   jg     400fd4 <phase_3+0xa7>               //>5,炸！！！400fce:   3b 44 24 04             cmp    0x4(%rsp),%eax400fd2:   74 05                   je     400fd9 <phase_3+0xac>400fd4:   e8 3d 04 00 00          callq  401416 <explode_bomb>               //与输入的不等,炸400fd9:   48 8b 44 24 08          mov    0x8(%rsp),%rax400fde:   64 48 33 04 25 28 00    xor    %fs:0x28,%rax400fe5:   00 00 400fe7:   74 05                   je     400fee <phase_3+0xc1>400fe9:   e8 32 fb ff ff          callq  400b20 <__stack_chk_fail@plt>400fee:   48 83 c4 18             add    $0x18,%rsp400ff2:   c3                      retq   

第四步，递归函数
偷了个懒，地柜函数没有认真看（其实是看哭了）
然后发现了数据很小
第一个数0xe之内，第二个数是7
我们可以用“爆炸穷举法”（自己yy的名字）
把答案搞出来就好了,(智障只能这么乱搞了)

0000000000400ff3 <func4>:400ff3:   48 83 ec 08             sub    $0x8,%rsp400ff7:   89 d0                   mov    %edx,%eax400ff9:   29 f0                   sub    %esi,%eax400ffb:   89 c1                   mov    %eax,%ecx                      //qnmd递归函数看不懂400ffd:   c1 e9 1f                shr    $0x1f,%ecx401000:   01 c8                   add    %ecx,%eax401002:   d1 f8                   sar    %eax401004:   8d 0c 30                lea    (%rax,%rsi,1),%ecx401007:   39 f9                   cmp    %edi,%ecx401009:   7e 0c                   jle    401017 <func4+0x24>            //if (%ecx>=%edi)40100b:   8d 51 ff                lea    -0x1(%rcx),%edx40100e:   e8 e0 ff ff ff          callq  400ff3 <func4>401013:   01 c0                   add    %eax,%eax401015:   eb 15                   jmp    40102c <func4+0x39>            //return401017:   b8 00 00 00 00          mov    $0x0,%eax40101c:   39 f9                   cmp    %edi,%ecx40101e:   7d 0c                   jge    40102c <func4+0x39>            // if (%ecx>=%edi)return401020:   8d 71 01                lea    0x1(%rcx),%esi401023:   e8 cb ff ff ff          callq  400ff3 <func4>401028:   8d 44 00 01             lea    0x1(%rax,%rax,1),%eax40102c:   48 83 c4 08             add    $0x8,%rsp401030:   c3                      retq   0000000000401031 <phase_4>:401031:   48 83 ec 18             sub    $0x18,%rsp401035:   64 48 8b 04 25 28 00    mov    %fs:0x28,%rax40103c:   00 00 40103e:   48 89 44 24 08          mov    %rax,0x8(%rsp)401043:   31 c0                   xor    %eax,%eax                       //%eax=0401045:   48 8d 4c 24 04          lea    0x4(%rsp),%rcx40104a:   48 89 e2                mov    %rsp,%rdx40104d:   be 8f 25 40 00          mov    $0x40258f,%esi                  //x/s 40258f "%d %d"401052:   e8 89 fb ff ff          callq  400be0 <__isoc99_sscanf@plt>401057:   83 f8 02                cmp    $0x2,%eax                       40105a:   75 06                   jne    401062 <phase_4+0x31>// %eax!=2,boom,读入数字数量!=240105c:   83 3c 24 0e             cmpl   $0xe,(%rsp)401060:   76 05                   jbe    401067 <phase_4+0x36>           //(%rsp)>e,boom401062:   e8 af 03 00 00          callq  401416 <explode_bomb>401067:   ba 0e 00 00 00          mov    $0xe,%edx40106c:   be 00 00 00 00          mov    $0x0,%esi//第二个数字是7，第一个数字是e范围内的401071:   8b 3c 24                mov    (%rsp),%edi                     //穷举吧，哈哈，我懒401074:   e8 7a ff ff ff          callq  400ff3 <func4>           //14 7，妈的从0开始穷举，累死了401079:   83 f8 07                cmp    $0x7,%eax                       //%eax!=7,boom40107c:   75 07                   jne    401085 <phase_4+0x54>40107e:   83 7c 24 04 07          cmpl   $0x7,0x4(%rsp)401083:   74 05                   je     40108a <phase_4+0x59>           //(%rsp)+4!=7,boom401085:   e8 8c 03 00 00          callq  401416 <explode_bomb>40108a:   48 8b 44 24 08          mov    0x8(%rsp),%rax40108f:   64 48 33 04 25 28 00    xor    %fs:0x28,%rax401096:   00 00 401098:   74 05                   je     40109f <phase_4+0x6e>40109a:   e8 81 fa ff ff          callq  400b20 <__stack_chk_fail@plt>40109f:   48 83 c4 18             add    $0x18,%rsp4010a3:   c3                      retq   

看到代码这么短，还没有递归
是不是感觉很简单的感觉。。。。
你们啊。NAIVE
恶心，恶心，恶心
输入一个长度为6的字符串
然后要求以其ascii码值最后一位的为*4的数组下标的那个元素，加起来=一个值（我这是2d）
是不是拗口的一笔？？？
看下面的注释吧，要看数组元素 ，x/x 0x402440@16 。。好像是这个，，忘了
下面有个for循环，就是取字符串每一位
根据看到的数组里面元素，把字符串凑出来就好了

00000000004010a4 <phase_5>:4010a4:   53                      push   %rbx4010a5:   48 89 fb                mov    %rdi,%rbx4010a8:   e8 4c 02 00 00          callq  4012f9 <string_length>4010ad:   83 f8 06                cmp    $0x6,%eax4010b0:   74 05                   je     4010b7 <phase_5+0x13>            //%eax=6=length4010b2:   e8 5f 03 00 00          callq  401416 <explode_bomb>4010b7:   48 89 d8                mov    %rbx,%rax4010ba:   48 8d 7b 06             lea    0x6(%rbx),%rdi4010be:   b9 00 00 00 00          mov    $0x0,%ecx4010c3:   0f b6 10                movzbl (%rax),%edx                      //for4010c6:   83 e2 0f                and    $0xf,%edx//字符的16进制最后一位，对应下面的数组中元素（16进制）4010c9:   03 0c 95 40 24 40 00    add    0x402440(,%rdx,4),%ecx           //array={2,a,6,1,c,10,9,3,4,7,e,5,b,8,f,d}4010d0:   48 83 c0 01             add    $0x1,%rax4010d4:   48 39 f8                cmp    %rdi,%rax                        //rax=rdi break4010d7:   75 ea                   jne    4010c3 <phase_5+0x1f>            //endfor4010d9:   83 f9 2d                cmp    $0x2d,%ecx                       //we need ecx=2d4010dc:   74 05                   je     4010e3 <phase_5+0x3f>4010de:   e8 33 03 00 00          callq  401416 <explode_bomb>4010e3:   5b                      pop    %rbx4010e4:   c3                      retq   

最后一步，，卧艹艹艹艹艹艹艹艹艹艹艹艹
怎么可以这么长！！！！！！
大体就是输入6个数，1到6范围，不重复
最后对应的数组元素递减（其实是链表辣，数组好理解一点是不是）
x/x 0x6032f0,,,数组就出来了
然后排序吧，

00000000004010e5 <phase_6>:4010e5:   41 55                   push   %r134010e7:   41 54                   push   %r124010e9:   55                      push   %rbp4010ea:   53                      push   %rbx4010eb:   48 83 ec 68             sub    $0x68,%rsp4010ef:   64 48 8b 04 25 28 00    mov    %fs:0x28,%rax4010f6:   00 00 4010f8:   48 89 44 24 58          mov    %rax,0x58(%rsp)4010fd:   31 c0                   xor    %eax,%eax4010ff:   48 89 e6                mov    %rsp,%rsi401102:   e8 31 03 00 00          callq  401438 <read_six_numbers>         //6 nums401107:   49 89 e4                mov    %rsp,%r1240110a:   41 bd 00 00 00 00       mov    $0x0,%r13d401110:   4c 89 e5                mov    %r12,%rbp401113:   41 8b 04 24             mov    (%r12),%eax401117:   83 e8 01                sub    $0x1,%eax40111a:   83 f8 05                cmp    $0x5,%eax40111d:   76 05                   jbe    401124 <phase_6+0x3f>40111f:   e8 f2 02 00 00          callq  401416 <explode_bomb>            //num!=6,boom401124:   41 83 c5 01             add    $0x1,%r13d401128:   41 83 fd 06             cmp    $0x6,%r13d40112c:   74 3d                   je     40116b <phase_6+0x86>40112e:   44 89 eb                mov    %r13d,%ebx401131:   48 63 c3                movslq %ebx,%rax401134:   8b 04 84                mov    (%rsp,%rax,4),%eax401137:   39 45 00                cmp    %eax,0x0(%rbp)40113a:   75 05                   jne    401141 <phase_6+0x5c>40113c:   e8 d5 02 00 00          callq  401416 <explode_bomb>           //>6,boom401141:   83 c3 01                add    $0x1,%ebx401144:   83 fb 05                cmp    $0x5,%ebx401147:   7e e8                   jle    401131 <phase_6+0x4c>401149:   49 83 c4 04             add    $0x4,%r1240114d:   eb c1                   jmp    401110 <phase_6+0x2b>40114f:   48 8b 52 08             mov    0x8(%rdx),%rdx401153:   83 c0 01                add    $0x1,%eax401156:   39 c8                   cmp    %ecx,%eax401158:   75 f5                   jne    40114f <phase_6+0x6a>40115a:   48 89 54 74 20          mov    %rdx,0x20(%rsp,%rsi,2)40115f:   48 83 c6 04             add    $0x4,%rsi401163:   48 83 fe 18             cmp    $0x18,%rsi401167:   75 07                   jne    401170 <phase_6+0x8b>401169:   eb 19                   jmp    401184 <phase_6+0x9f>40116b:   be 00 00 00 00          mov    $0x0,%esi401170:   8b 0c 34                mov    (%rsp,%rsi,1),%ecx401173:   b8 01 00 00 00          mov    $0x1,%eax401178:   ba f0 32 60 00          mov    $0x6032f0,%edx                 //array40117d:   83 f9 01                cmp    $0x1,%ecx401180:   7f cd                   jg     40114f <phase_6+0x6a>401182:   eb d6                   jmp    40115a <phase_6+0x75>401184:   48 8b 5c 24 20          mov    0x20(%rsp),%rbx401189:   48 8d 44 24 20          lea    0x20(%rsp),%rax40118e:   48 8d 74 24 48          lea    0x48(%rsp),%rsi401193:   48 89 d9                mov    %rbx,%rcx401196:   48 8b 50 08             mov    0x8(%rax),%rdx40119a:   48 89 51 08             mov    %rdx,0x8(%rcx)40119e:   48 83 c0 08             add    $0x8,%rax4011a2:   48 89 d1                mov    %rdx,%rcx4011a5:   48 39 f0                cmp    %rsi,%rax4011a8:   75 ec                   jne    401196 <phase_6+0xb1>4011aa:   48 c7 42 08 00 00 00    movq   $0x0,0x8(%rdx)4011b1:   00 4011b2:   bd 05 00 00 00          mov    $0x5,%ebp4011b7:   48 8b 43 08             mov    0x8(%rbx),%rax4011bb:   8b 00                   mov    (%rax),%eax4011bd:   39 03                   cmp    %eax,(%rbx)4011bf:   7e 05                   jle    4011c6 <phase_6+0xe1>4011c1:   e8 50 02 00 00          callq  401416 <explode_bomb>        //若递增，boom4011c6:   48 8b 5b 08             mov    0x8(%rbx),%rbx4011ca:   83 ed 01                sub    $0x1,%ebp4011cd:   75 e8                   jne    4011b7 <phase_6+0xd2>4011cf:   48 8b 44 24 58          mov    0x58(%rsp),%rax4011d4:   64 48 33 04 25 28 00    xor    %fs:0x28,%rax4011db:   00 00 4011dd:   74 05                   je     4011e4 <phase_6+0xff>4011df:   e8 3c f9 ff ff          callq  400b20 <__stack_chk_fail@plt>4011e4:   48 83 c4 68             add    $0x68,%rsp4011e8:   5b                      pop    %rbx4011e9:   5d                      pop    %rbp4011ea:   41 5c                   pop    %r124011ec:   41 5d                   pop    %r134011ee:   c3                      retq  

累死了，，，，
感谢LJL的支持