15-213-15-513-Introduction-to-Computer-Systems/exam1-s10-solutions.txt at main · powcoder/15-213-15-513-Introduction-to-Computer-Systems · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
https://powcoder.com
代写代考加微信 powcoder
Assignment Project Exam Help
Add WeChat powcoder
https://powcoder.com
代写代考加微信 powcoder
Assignment Project Exam Help
Add WeChat powcoder
Solution Key to 15213-s10 Exam 1

Problem 1.
Part 1: c
Part 2: a
Part 3: a,b,c
Part 4: a
Part 5: a
Part 6: b
Part 7: d

-------------------------------------------------------------------------------
Problem 2.

Part 1:
int mystery(int i)
{
  if ( i!= 0 ) return i + mystery(i-1);
     return i;
}

Part 2:
cmp $0x0, %eax

Part 3:
There is a jump to line 0x8048364 so 0x8048361 is not actually
executed everytime 0x8048364 is.


Problem 3.

Part 1:
0xffd3d208

Part 2:
0x080483cd

Part 3 (table):

arg1: 0xffd3d1f0 15
arg2: 0xffd3d1f4 7/64
arg3: 0xffd3d1f8 NaN
arg4: 0xffd3d1fc 2^(-149)

-------------------------------------------------------------------------------
Problem 4:

Part 1:
Key:
 _ unshaded
 = shaded

bb==xxxx
ss==zzzz
ccccc===
aaaaaaaa
q===____


Part 2:
ms.b = 0x00bb
ms.x = 0x0001d9f9
ms.s = 0x3b6d
ms.z = 0xbeefbabe
ms.c = 0x68, 0x6c, 0x70, 0x6d, 0x65
ms.a = 0xdeafelffledfable
ms.q = 0x21

Part 3:
(many possible solutions)
One example:

struct my_compressed_struct {
  long long a;
  long z;
  int x;
  short b;
  short s;
  char[5] c;
  char q;
}

Part 4:
Depends on previous solution.

From our example above:
aaaaaaaa
xxxxzzzz
bbsscccc
cq==____

size = 28

-------------------------------------------------------------------------------
Problem 5:


c
b
a
ret Addr to caller
old ebp
eax (c)
ecx (b)
edx (a)
0xde
old ebp
eax (c)
ecx (b)
edx (a)
0xde
old ebp <- %ebp
blank
blank
black <- %esp

-------------------------------------------------------------------------------
Problem 6:

Step 0: User coulde enter a string long enough to overflow the buffer
and overwrite mains return address to the address of the exploit.

Step 1:
 Part 1: 0xf7e263a0
 Part 2: 0xff89d95d

Step 2:

garbage | old ebp | system addr | 4 byte garbage | /bin/bash addr

Step 3:

Main will return to the system function with the argument
"/bin/bash". This will open a new shell for the attacker to input
commands.

-------------------------------------------------------------------------------
Problem 7:

void mystery(int (*funcP) (int), int a[], int n) {
     int q;
     for (q = 0; q < n; q++) {
	 a[q] = funcP(a[q]);
     }
}