我正在narnia.labs.overthewire.org玩兵棋推演。我遇到了一个叫做的关卡narnia0，它要求我将值更改0x414141414为0xdeadbeef. 到目前为止，我已经查看了源代码并对二进制文件进行了逆向工程。什么是利用中的 0xdeadbeef 以及如何将值从0x414141in更改ebp为0xdeadbeef. 我已经为这个挑战在十六进制值/转换方面做了一些研究。
0xdeadbeef一般是什么，它在开发中是如何体现的？如何将ebp值更改0x41414141为0xdeadbeef？
你可以在下面看到我的问题分析：
080484c4 <main>:
80484c4: 55 push %ebp
80484c5: 89 e5 mov %esp,%ebp
80484c7: 83 e4 f0 and $0xfffffff0,%esp
80484ca: 83 ec 30 sub $0x30,%esp
80484cd: c7 44 24 2c 41 41 41 movl $0x41414141,0x2c(%esp)
80484d4: 41
80484d5: c7 04 24 40 86 04 08 movl $0x8048640,(%esp)
80484dc: e8 cf fe ff ff call 80483b0 <puts@plt>
80484e1: b8 73 86 04 08 mov $0x8048673,%eax
80484e6: 89 04 24 mov %eax,(%esp)
80484e9: e8 b2 fe ff ff call 80483a0 <printf@plt>
80484ee: b8 89 86 04 08 mov $0x8048689,%eax
80484f3: 8d 54 24 18 lea 0x18(%esp),%edx
80484f7: 89 54 24 04 mov %edx,0x4(%esp)
80484fb: 89 04 24 mov %eax,(%esp)
80484fe: e8 fd fe ff ff call 8048400 <__isoc99_scanf@plt>
8048503: b8 8e 86 04 08 mov $0x804868e,%eax
8048508: 8d 54 24 18 lea 0x18(%esp),%edx
804850c: 89 54 24 04 mov %edx,0x4(%esp)
8048510: 89 04 24 mov %eax,(%esp)
8048513: e8 88 fe ff ff call 80483a0 <printf@plt>
8048518: b8 97 86 04 08 mov $0x8048697,%eax
804851d: 8b 54 24 2c mov 0x2c(%esp),%edx
8048521: 89 54 24 04 mov %edx,0x4(%esp)
8048525: 89 04 24 mov %eax,(%esp)
8048528: e8 73 fe ff ff call 80483a0 <printf@plt>
804852d: 81 7c 24 2c ef be ad cmpl $0xdeadbeef,0x2c(%esp)
8048534: de
8048535: 75 13 jne 804854a <main+0x86>
8048537: c7 04 24 a4 86 04 08 movl $0x80486a4,(%esp)
804853e: e8 7d fe ff ff call 80483c0 <system@plt>
8048543: b8 00 00 00 00 mov $0x0,%eax
8048548: c9 leave
8048549: c3 ret
804854a: c7 04 24 ac 86 04 08 movl $0x80486ac,(%esp)
8048551: e8 5a fe ff ff call 80483b0 <puts@plt>
8048556: c7 04 24 01 00 00 00 movl $0x1,(%esp)
804855d: e8 7e fe ff ff call 80483e0 <exit@plt>
8048562: 90 nop
8048563: 90 nop
8048564: 90 nop
8048565: 90 nop
8048566: 90 nop
8048567: 90 nop
8048568: 90 nop
8048569: 90 nop
804856a: 90 nop
804856b: 90 nop
804856c: 90 nop
804856d: 90 nop
我知道二进制文件从用户那里获取输入，然后打印一条挑战消息。而且，我还知道二进制文件中的其他地方，它确实与一个值进行了比较，并采用了获取标志或重试的两条路径。为了解决这个挑战，我已经尝试覆盖ebp寄存器，但没有。
narnia0@melinda:/games/narnia$ gdb ./narnia0
(gdb) dissasemble main
Undefined command: "dissasemble". Try "help".
(gdb) b * main
Breakpoint 1 at 0x80484c4
(gdb) b * main+105
Breakpoint 2 at 0x804852d
(gdb) r
Starting program: /games/narnia/narnia0
Breakpoint 1, 0x080484c4 in main ()
(gdb) n
Single stepping until exit from function main,
which has no line number information.
Correct val's value from 0x41414141 -> 0xdeadbeef!
Here is your chance: AAAAAAAAAAAA
buf: AAAAAAAAAAAA
val: 0x41414141
Breakpoint 2, 0x0804852d in main ()
(gdb) i r
eax 0x10 16
ecx 0x0 0
edx 0x0 0
ebx 0xf7fcdff4 -134422540
esp 0xffffd6f0 0xffffd6f0
ebp 0xffffd728 0xffffd728
esi 0x0 0
edi 0x0 0
eip 0x804852d 0x804852d <main+105>
eflags 0x286 [ PF SF IF ]
cs 0x23 35
ss 0x2b 43
ds 0x2b 43
es 0x2b 43
fs 0x0 0
gs 0x63 99