如何调用未被main触发的GDB secret_phase函数以获取额外学分

Great job knocking out all 6 phases—solid work! That secret_phase is a classic extra credit Easter egg in these reverse-engineering style labs (like the well-known bomb lab). Here are the most reliable ways to trigger it, tailored to your scenario:

1. Check for Hidden Input in an Existing Phase #

Most often, the secret phase unlocks when you provide an extra input value right after solving one of the earlier phases (usually phase 4 or 6). For example:

• After entering the correct password for phase 4, don’t hit enter immediately—type an additional number or keyword (like 100 or a specific string) and press enter.
• Some labs expect you to append the trigger value to your existing phase input (e.g., if phase 6’s correct sequence is 3 1 4 2 6 5, try 3 1 4 2 6 5 secret).

To confirm this logic, set a breakpoint in the phase_defused function (if it exists) in GDB:

break phase_defused
run
# Solve all 6 phases normally
# When the program hits phase_defused, disassemble to inspect the logic
disassemble

Look for conditional checks (like cmp or test instructions) that lead to a call secret_phase—this will show you exactly what condition needs to be met.

2. Manually Call secret_phase Directly in GDB #

If you want to jump straight to the secret phase (after ensuring the program is properly initialized), you can force GDB to invoke it:

# First, run the program until main has finished initializing core variables
run
# Or solve all 6 phases, then when the program pauses, run:
call secret_phase()

Note: Some labs require global flags (like markers that all phases are solved) to be set before secret_phase runs without crashing. If you hit errors, try calling it from the phase_defused breakpoint after completing all 6 phases.

3. Reverse-Engineer the Trigger Logic #

If the above methods don’t work, dig into the assembly to find where secret_phase is referenced:

1. Use objdump to locate all code related to secret_phase:

   objdump -d your_program | grep -B5 -A5 secret_phase
   

2. Look for any function that contains a call secret_phase instruction. This function (almost always phase_defused) will have logic checking for the trigger—maybe a hidden input, a specific register value, or a flag set by solving a phase in a particular way.

For example, many labs have phase_defused check if you entered an extra argument in phase 4; if yes, it calls secret_phase. Disassembling this function will spell out the exact requirement.

内容的提问来源于stack exchange，提问作者Kamserv45