问题
I participate in the competition named 'Code guru - Extreme' In this competition there is safes and keys in assembly 8086. To a safe and a key there are joint data segment, and you need to make a key that break the safe. Example to safe:
L:
mov ax, [1234]
cmp ax, 5678
jne L
Example to key that break the safe
L:
mov ax, 5678
mov [1234], ax
jne L
And now I have a safe that I can not break it
and al, 0FEh
push ax
clc
mul ax
xor ax, dx
or al, 1
loc_10A:
sub [0A2h], ax
pop ax
push ax
jnz loc_10A
This simulation of a safe and key is done inside the Core Wars 8086 engine. The rules are as follows where both safe and key are survivors in the war:
The survivors cannot place a load on fixed addresses, because the game engine loads them every turn to a random address. The programs that are generated must be COM and not EXEs and contain only 8086 instructions.
Each survivor receives a set of its own complete registers (registers), which is not accessible to the other survivors. In addition, each survivor has a "personal" stack of 2048 bytes, which is also inaccessible to the other survivors.
Before running the first round of the game, the game engine initializes all the bytes in the arena to the value 0CCh (note: this byte value is an "unsupported" instruction - details below). The engine then loads each survivor to a random location in the arena memory, ie - copies the contents of the survivor file exactly as it is. The distance between two survivors, as well as the distance between the survivor and the edge of the arena, is guaranteed to be at least 1024 bytes. The code for each survivor has a maximum of 512 bytes.
Before the first round, the game engine initializes the registers (of each survivor) to the following values:
- BX, CX, DX, SI, DI, BP - Reset.
- Flags - Reset.
- AX, IP - The position of the initial survivor, the random offset in the arena to which the survivor is loaded by the game engine.
- CS, DS - The segment of the arena common to all survivors.
- ES - A segment (segment) for the memory shared by survivors of the same group (see Advanced Techniques ).
- SS - Beginning section of the personal stack of the survivor.
- SP - Offset The start of the personal stack of the survivor.
At this point the game begins in rounds, with each round running the game engine running the next instruction of each survivor, until the end of the game: after 200,000 rounds, or when a single survivor remains in the arena. The order in which the survivors will play in each round is determined at the beginning of the game at random, and does not change during it.
A survivor is disqualified in the following cases:
- Running an illegal instruction (example: byte 060h that does not translate into any assembly instruction).
- Running an "unsupported" instruction by the game engine (example: "INT 021h"). The game engine prevents running instructions that try to initiate direct communication with the operating system or computer hardware. Attempt to access memory that is not within the realm of the arena, and not within the realm of the "personal" stack of the survivor.
- Attacking other survivors is done by writing information about their code in the arena memory (in order to get them to perform one of the above three actions), and consequently to disqualify them. Earlier, therefore, one has to find where they are hiding :)
回答1:
First of all AX is unknown, calculation is meaningless but push ax;. Later, starting from the 2nd pass of the loop AX gets poped but remains unknown and constant, so you need to catch difference between 2 "memory var" values, and it will be AX value. Something like that:
mov cx, 0ah;
delay:
nop;
loop delay;
l2:
mov ax, [0A2h];
mov bx, [0A2h];
sub ax, bx
jz l2;
mov [0A2h], ax;
jmp l2
回答2:
l:
mov bx, 0a2h
mov dx, 0xffff
mov word [bx], dx
nop
nop
mov ax, word [bx]
sub dx, ax
mov word [bx], dx
mov dx, 0xffff
jmp l
来源：https://stackoverflow.com/questions/40438971/assembly-safe-competition