binary bomb

first, i don't know where to break point... and where to check...oTL

>> first, i don't know where to break point...

You set a break point wherever you want to watch/monitor something.
Setting it at the start of the phase_2 function could be a good idea ...

I can't express my mind to english, because i'm not the american...
...
i did break point to phase_2  end checked register %ebp value...

i saw %ebp value is 0xbffff5d8..

at this time , i checked this line.
8048b8f:       39 44 9d d8             cmp    %eax,0xffffffd8(%ebp,%ebx,4)

this line is 0xffffffd8 + 0xbffff5d8 + 0x1 * 4 ?
= 0xffffffd8 + 0xbffff5dc
= 0x400009fc
if it;s right, first number of six number is 0x400009fc

is that right??

next number is 0x40000a00 ???

if it is wrong , how can check these value??

can i have some hint?

i hope for you to understand my question..because i can't engilsh write ``

>> i did break point to phase_2  end checked register %ebp value...

ebp is the base pointer. It points to the start of the current stack frame. A stack frame is set up at the start of each function call, and contains all local variables etc. for that function.

For example in phase_2, the stack frame is set up by these two lines :

>>  8048b6a:       55                      push   %ebp
>>  8048b6b:       89 e5                   mov    %esp,%ebp

ie. first the previous base pointer is saved onto the stack, so it can be restored later. Then, the new base pointer is set as a copy of the stack pointer.

At the end of the function, the stack frame is destroyed again :

>>  8048f5b:       5d                      pop    %ebp
>>  8048f5c:       c3                      ret

ie. the previous base pointer is restored, and then the code jumps to the return address (the next instruction in the calling code).


>> i saw %ebp value is 0xbffff5d8..

The actual value of ebp doesn't really matter. As long as you see ebp as the reference address for the current function's stack frame, you're ok.


>> this line is 0xffffffd8 + 0xbffff5d8 + 0x1 * 4 ?
>> = 0xffffffd8 + 0xbffff5dc
>> = 0x400009fc

The calculation looks wrong. It's easier to look at the value 0xffffffd8 as a negative value ... Read up on two's complement if you need to :

        http://en.wikipedia.org/wiki/Two%27s_complement

Plus, as I just explained, don't use the actual value for ebp. Simply perform all calculations relative to ebp.

probably you dont need an answer anymore, but well your code looks the same with the one here:
http://www.experts-exchange.com/Programming/Languages/Assembly/Q_24355820.html

08048cb3 <phase_5>:
 8048cb3:       55                      push   %ebp
 8048cb4:       89 e5                   mov    %esp,%ebp
 8048cb6:       53                      push   %ebx
 8048cb7:       83 ec 24                sub    $0x24,%esp
 8048cba:       8d 45 f8                lea    0xfffffff8(%ebp),%eax
 8048cbd:       89 44 24 0c             mov    %eax,0xc(%esp,1)
 8048cc1:       8d 45 f4                lea    0xfffffff4(%ebp),%eax
 8048cc4:       89 44 24 08             mov    %eax,0x8(%esp,1)
 8048cc8:       c7 44 24 04 a4 98 04    movl   $0x80498a4,0x4(%esp,1)
 8048ccf:       08
 8048cd0:       8b 45 08                mov    0x8(%ebp),%eax
 8048cd3:       89 04 24                mov    %eax,(%esp,1)
 8048cd6:       e8 c1 fb ff ff          call   804889c <_init+0x178>
 8048cdb:       83 f8 01                cmp    $0x1,%eax
 8048cde:       7f 05                   jg     8048ce5 <phase_5+0x32>
 8048ce0:       e8 cb 07 00 00          call   80494b0 <explode_bomb>
 8048ce5:       8b 45 f4                mov    0xfffffff4(%ebp),%eax
 8048ce8:       83 e0 0f                and    $0xf,%eax
 8048ceb:       89 45 f4                mov    %eax,0xfffffff4(%ebp)
 8048cee:       ba 00 00 00 00          mov    $0x0,%edx
 8048cf3:       b9 00 00 00 00          mov    $0x0,%ecx
 8048cf8:       83 f8 0f                cmp    $0xf,%eax
 8048cfb:       74 13                   je     8048d10 <phase_5+0x5d>
 8048cfd:       bb 40 a4 04 08          mov    $0x804a440,%ebx
 8048d02:       42                      inc    %edx
 8048d03:       8b 04 83                mov    (%ebx,%eax,4),%eax
 8048d06:       01 c1                   add    %eax,%ecx
 8048d08:       83 f8 0f                cmp    $0xf,%eax
 8048d0b:       75 f5                   jne    8048d02 <phase_5+0x4f>
 8048d0d:       89 45 f4                mov    %eax,0xfffffff4(%ebp)
 8048d10:       83 fa 09                cmp    $0x9,%edx
 8048d13:       75 05                   jne    8048d1a <phase_5+0x67>
 8048d15:       3b 4d f8                cmp    0xfffffff8(%ebp),%ecx
 8048d18:       74 05                   je     8048d1f <phase_5+0x6c>
 8048d1a:       e8 91 07 00 00          call   80494b0 <explode_bomb>
 8048d1f:       83 c4 24                add    $0x24,%esp
 8048d22:       5b                      pop    %ebx
 8048d23:       5d                      pop    %ebp
 8048d24:       c3                      ret

i sloved that phase_4,. and stuck in phase_5
this source mean array and pointer?
i geuss that second parameter is same the register %ecx. isn't right?
 and    $0xf,%eax << it's mean .. if %eax is 3, 1111 & 0011 = 0011 ???
also,
mov    $0x0,%edx
cmp    $0x9,%edx
roof is 9 ?
how can i check first parameter??

The original question was about phase 2. Did you find the solution for phase 2 ? If so, it's probably time to close this question. If you have another question, you can create a new question for that.

wow i slove phase_5 ,, i have to phase_6 .. time limit is 1hour.....

Dump of assembler code for function phase_6:
0x08048d75 <phase_6+0>: push   %ebp
0x08048d76 <phase_6+1>: mov    %esp,%ebp
0x08048d78 <phase_6+3>: sub    $0x18,%esp
0x08048d7b <phase_6+6>: movl   $0x0,0xc(%esp,1)
0x08048d83 <phase_6+14>:        movl   $0xa,0x8(%esp,1)
0x08048d8b <phase_6+22>:        movl   $0x0,0x4(%esp,1)
0x08048d93 <phase_6+30>:        mov    0x8(%ebp),%eax
0x08048d96 <phase_6+33>:        mov    %eax,(%esp,1)
0x08048d99 <phase_6+36>:        call   0x804880c <__strtol_internal>
0x08048d9e <phase_6+41>:        mov    %eax,0x804a4ec
0x08048da3 <phase_6+46>:        movl   $0x804a4ec,(%esp,1)
0x08048daa <phase_6+53>:        call   0x8048d25 <fun6>
0x08048daf <phase_6+58>:        mov    $0x1,%edx
0x08048db4 <phase_6+63>:        mov    0x8(%eax),%eax
0x08048db7 <phase_6+66>:        inc    %edx
0x08048db8 <phase_6+67>:        cmp    $0x5,%edx
0x08048dbb <phase_6+70>:        jle    0x8048db4 <phase_6+63>
0x08048dbd <phase_6+72>:        mov    (%eax),%eax
0x08048dbf <phase_6+74>:        cmp    0x804a4ec,%eax
0x08048dc5 <phase_6+80>:        je     0x8048dcc <phase_6+87>
0x08048dc7 <phase_6+82>:        call   0x80494b0 <explode_bomb>
0x08048dcc <phase_6+87>:        leave
0x08048dcd <phase_6+88>:        ret
End of assembler dump.

You seem to progress fine on your own :)

i pass the bomb .. all zz thank you f