/*
 * bitXnor - ~(x^y) using only ~ and |
 *   Example: bitXnor(6, -5) = 2
 *   Legal ops: ~ |
 *   Max ops: 7
 *   Rating: 1
 */
int bitXnor(int x, int y) {
    // Replace 0 to your implementation of bitXnor.
    return 0;
}

Tip

You may want to check your answer:

int bitXnor(int x, int y) {
    return  ~(x | y) | ~(~x | ~y);
}

Note

Puzzles you actually meet would be more complicated.

Your task is to defuse Phase 1.

The phase reads two signed decimal integers separated by whitespace. Analyze the assembly code and determine the only input that allows the function to return normally.

If the input is malformed or does not satisfy the required condition, the function calls explode_bomb, then you would permanently lose some points.

    .section .rodata
.Lformat:
    .string "%d %d"

    .text
    .globl phase_1
    .type phase_1, @function
    .extern explode_bomb
    .extern __isoc99_sscanf

phase_1:
    subq    $24, %rsp              

    leaq    8(%rsp), %rdx         
    leaq    12(%rsp), %rcx        
    leaq    .Lformat(%rip), %rsi  
    xorl    %eax, %eax            
    call    __isoc99_sscanf@PLT

    cmpl    $2, %eax               
    jne     .Lexplode

    cmpl    $6, 8(%rsp)            
    jne     .Lexplode

    movl    8(%rsp), %eax          
    addl    %eax, %eax             
    addl    $1, %eax               

    cmpl    %eax, 12(%rsp)         
    jne     .Lexplode

    addq    $24, %rsp              
    ret

.Lexplode:
    call    explode_bomb           
    addq    $24, %rsp
    ret

    .size phase_1, .-phase_1
    .section .note.GNU-stack,"",@progbits

Tip

You may want to check your answer:

6 13

Note

Puzzles you actually meet would be more complicated.

Your task is to construct an input file that causes the program to execute touch1.

    .section .rodata
success_msg:
    .string "Attack successful: touch1 reached."

normal_msg:
    .string "Returned normally."

    .text

    .globl main
    .type main, @function

main:
    pushq   %rbp
    movq    %rsp, %rbp

    call    getbuf                  

    leaq    normal_msg(%rip), %rdi
    call    puts@PLT                # Printed only if getbuf returns normally

    xorl    %eax, %eax
    popq    %rbp
    ret


    .globl getbuf
    .type getbuf, @function

getbuf:
    subq    $40, %rsp               

    movq    %rsp, %rsi              
    xorl    %edi, %edi              
    movl    $128, %edx              
    call    read@PLT                

    movl    $1, %eax
    addq    $40, %rsp
    ret                             


    .globl touch1
    .type touch1, @function

touch1:
    leaq    success_msg(%rip), %rdi
    call    puts@PLT

    xorl    %edi, %edi
    call    exit@PLT                # Terminate after successful exploitation

    ud2                             # Should never be reached


    .size main, .-main
    .size getbuf, .-getbuf
    .size touch1, .-touch1

    .section .note.GNU-stack,"",@progbits

Note

If you want to execute the codes above, you need some magic. Try to compile with:

gcc -fno-stack-protector -no-pie -o your-file-name your-file-name.s

Note

Puzzles you actually meet would be more complicated.