Binary Bomb Phase 2

I've been looking it over and I think that the actual change in the numbers takes place in read_six_numbers.
from read_six_numbers+3 to read_six_numbers+56
Here is the code...am I correct?

Dump of assembler code for function read_six_numbers:
0x08048f56 <read_six_numbers+0>:        push   %ebp
0x08048f57 <read_six_numbers+1>:        mov    %esp,%ebp
0x08048f59 <read_six_numbers+3>:        sub    $0x28,%esp
0x08048f5c <read_six_numbers+6>:        mov    0xc(%ebp),%edx
0x08048f5f <read_six_numbers+9>:        lea    0x14(%edx),%eax
0x08048f62 <read_six_numbers+12>:       mov    %eax,0x1c(%esp)
0x08048f66 <read_six_numbers+16>:       lea    0x10(%edx),%eax
0x08048f69 <read_six_numbers+19>:       mov    %eax,0x18(%esp)
0x08048f6d <read_six_numbers+23>:       lea    0xc(%edx),%eax
0x08048f70 <read_six_numbers+26>:       mov    %eax,0x14(%esp)
0x08048f74 <read_six_numbers+30>:       lea    0x8(%edx),%eax
0x08048f77 <read_six_numbers+33>:       mov    %eax,0x10(%esp)
0x08048f7b <read_six_numbers+37>:       lea    0x4(%edx),%eax
0x08048f7e <read_six_numbers+40>:       mov    %eax,0xc(%esp)
0x08048f82 <read_six_numbers+44>:       mov    %edx,0x8(%esp)
0x08048f86 <read_six_numbers+48>:       movl   $0x80497af,0x4(%esp)
0x08048f8e <read_six_numbers+56>:       mov    0x8(%ebp),%eax
0x08048f91 <read_six_numbers+59>:       mov    %eax,(%esp)
0x08048f94 <read_six_numbers+62>:       call   0x8048828 <sscanf@plt>
0x08048f99 <read_six_numbers+67>:       cmp    $0x5,%eax
0x08048f9c <read_six_numbers+70>:       jg     0x8048fa3 <read_six_numbers+77>
0x08048f9e <read_six_numbers+72>:       call   0x8048f2c <explode_bomb>
0x08048fa3 <read_six_numbers+77>:       leave  
0x08048fa4 <read_six_numbers+78>:       ret    
End of assembler dump.

                                              

1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:
16:
17:
18:
19:
20:
21:
22:
23:
24:
25:
26:

Could still use some help on this....

Here is what I have determine the instructions in phase_2 to do. Correct me if I'm wrong. I need help figuring out determining what exactly the increment the numbers are increased by for each iteration to get the correct input.

Dump of assembler code for function phase_2:
0x08048d91 <phase_2+0>: push   %ebp
pushes ebp on the stack ebp = input
0x08048d92 <phase_2+1>: mov    %esp,%ebp
ebp = esp    (esp =*input)
0x08048d94 <phase_2+3>: push   %esi
pushes esi onto the stack
0x08048d95 <phase_2+4>: push   %ebx
pushes ebx onto the stack
0x08048d96 <phase_2+5>: sub    $0x30,%esp
esp = esp - 48
0x08048d99 <phase_2+8>: lea    -0x20(%ebp),%eax
eax = ebp - 32
0x08048d9c <phase_2+11>:        mov    %eax,0x4(%esp)
eax = esp + 4
0x08048da0 <phase_2+15>:        mov    0x8(%ebp),%eax
eax = ebp + 8
0x08048da3 <phase_2+18>:        mov    %eax,(%esp)
esp = eax
0x08048da6 <phase_2+21>:        call   0x8048f56 <read_six_numbers>
calls read_six_numbers with eax as parameter
0x08048dab <phase_2+26>:        cmpl   $0x1,-0x20(%ebp)
compares ebp  32 to see if its equal to 1
0x08048daf <phase_2+30>:        je     0x8048db6 <phase_2+37>
if ebp  32 is = 1 jump to ,phase_2+37
0x08048db1 <phase_2+32>:        call   0x8048f2c <explode_bomb>
calls explode_bomb() if ebp  32 != 1
0x08048db6 <phase_2+37>:        mov    $0x2,%ebx
ebx = 2
0x08048dbb <phase_2+42>:        lea    -0x20(%ebp),%esi
esi = edp - 32
0x08048dbe <phase_2+45>:        mov    %ebx,%eax
eax = ebx
0x08048dc0 <phase_2+47>:        imul   -0x8(%esi,%ebx,4),%eax
eax = (esi + ebx * 4  8) * (esi + ebx * 4  8)
0x08048dc5 <phase_2+52>:        cmp    %eax,-0x4(%esi,%ebx,4)
compares if (esi + ebx * 4  4) == eax
0x08048dc9 <phase_2+56>:        je     0x8048dd0 <phase_2+63>
jumps to <phase_2> if (esi + ebx * 4  8) == eax
0x08048dcb <phase_2+58>:        call   0x8048f2c <explode_bomb>
if (esi + ebx * 4  8) != eax 	exploded_bomb() is called
0x08048dd0 <phase_2+63>:        add    $0x1,%ebx
ebx = ebx + 1
0x08048dd3 <phase_2+66>:        cmp    $0x7,%ebx
checks if ebx != 7
0x08048dd6 <phase_2+69>:        jne    0x8048dbe <phase_2+45>
if ebx is != 7	then jump to phase_2+45
0x08048dd8 <phase_2+71>:        add    $0x30,%esp
esp = esp + 30
0x08048ddb <phase_2+74>:        pop    %ebx
0x08048ddc <phase_2+75>:        pop    %esi
0x08048ddd <phase_2+76>:        pop    %ebp
0x08048dde <phase_2+77>:        ret    
End of assembler dump.
                                              

1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:
16:
17:
18:
19:
20:
21:
22:
23:
24:
25:
26:
27:
28:
29:
30:
31:
32:
33:
34:
35:
36:
37:
38:
39:
40:
41:
42:
43:
44:
45:
46:
47:
48:
49:
50:
51:
52:
53:
54:

Could reallly use some help with this...I've looked at the other solutions posted and they aren't very helpful for me....

I see you've made some progress.


>> I'm not sure what I'm not doing correctly any thoughts?

The bomb explodes because the input you gave is not correct. In order to continue, you'll have to pass the right input. More directly, you'll have to make that it never calls explode_bomb :) The loop won't continue when the bomb explodes.


>> I've been looking it over and I think that the actual change in the numbers takes place in read_six_numbers.

All the read_six_numbers function does, is exactly what it says ... It reads 6 numbers from the provided string, and places them on the stack.


>> Here is what I have determine the instructions in phase_2 to do. Correct me if I'm wrong.

>> 0x08048d91 <phase_2+0>: push   %ebp
>> pushes ebp on the stack ebp = input
>> 0x08048d92 <phase_2+1>: mov    %esp,%ebp
>> ebp = esp    (esp =*input)

%ebp is the base pointer ... This is just the standard way to start a new stack frame at the start of a function. It is not your input, although some of the input might be found relative to the (new) base pointer.


>> 0x08048d9c <phase_2+11>:        mov    %eax,0x4(%esp)
>> eax = esp + 4

The mov instruction moves the value of the left argument to the location specified in the right argument. Not the other way around.


>> 0x08048da0 <phase_2+15>:        mov    0x8(%ebp),%eax
>> eax = ebp + 8
>> 0x08048da3 <phase_2+18>:        mov    %eax,(%esp)
>> esp = eax

There is a dereferencing operation that you missed. With C-like syntax :

        eax = *(ebp + 8)
        *(esp) = eax

(ebp + 8) is an address, but we're not interested in the address - we're interested in the value that is located at that address. Hence the dereference operation. Similarly for (esp).


>> 0x08048da6 <phase_2+21>:        call   0x8048f56 <read_six_numbers>
>> calls read_six_numbers with eax as parameter

The parameter is passed on the stack, not in eax.


>> 0x08048dab <phase_2+26>:        cmpl   $0x1,-0x20(%ebp)
>> compares ebp  32 to see if its equal to 1

Don't forget the dereference operation again ...


>> 0x08048dc0 <phase_2+47>:        imul   -0x8(%esi,%ebx,4),%eax
>> eax = (esi + ebx * 4  8) * (esi + ebx * 4  8)

imul multiplies its both arguments, ie. :

        imul a, b

means :

        b = b * a

Also don't forget to dereference ...

>> 0x08048dc5 <phase_2+52>:        cmp    %eax,-0x4(%esi,%ebx,4)
>> compares if (esi + ebx * 4  4) == eax

dereference ...


>> 0x08048dd8 <phase_2+71>:        add    $0x30,%esp
>> esp = esp + 30

hex vs. decimal mistake here ...

I think you need to use si (step one instruction exactly) rather than s (step) which steps a 3GL instruction (where assembler is a 2GL).

The bomb explodes because the input you gave is not correct. In order to continue, you'll have to pass the right input. More directly, you'll have to make that it never calls explode_bomb :) The loop won't continue when the bomb explodes.

>>>Right I understand that.

All the read_six_numbers function does, is exactly what it says ... It reads 6 numbers from the provided string, and places them on the stack.

>>Right I understand this.

>> Here is what I have determine the instructions in phase_2 to do. Correct me if I'm wrong.

>> 0x08048d91 <phase_2+0>: push   %ebp
>> pushes ebp on the stack ebp = input
>> 0x08048d92 <phase_2+1>: mov    %esp,%ebp
>> ebp = esp    (esp =*input)

%ebp is the base pointer ... This is just the standard way to start a new stack frame at the start of a function. It is not your input, although some of the input might be found relative to the (new) base pointer.

0x08048d91 <phase_2+0>: push   %ebp
puashes ebp onto the stack
 0x08048d92 <phase_2+1>: mov    %esp,%ebp
ebp = *esp  esp pointer is being pointed at ebp on the stack

>> 0x08048d9c <phase_2+11>:        mov    %eax,0x4(%esp)
>> eax = esp + 4

The mov instruction moves the value of the left argument to the location specified in the right argument. Not the other way around.
0x08048d9c <phase_2+11>:        mov    %eax,0x4(%esp)
eax = (%esp+4)  moves eax to the position (%esp+4) on the stack

>> 0x08048da0 <phase_2+15>:        mov    0x8(%ebp),%eax
>> eax = ebp + 8
>> 0x08048da3 <phase_2+18>:        mov    %eax,(%esp)
>> esp = eax

There is a dereferencing operation that you missed. With C-like syntax :
0x08048da0 <phase_2+15>:        mov    0x8(%ebp),%eax
move the value of (ebp+8) to = eax
0x08048da3 <phase_2+18>:        mov    %eax,(%esp)
*(esp) = eax  sets stack pointer esp to eax

        eax = *(ebp + 8)
        *(esp) = eax

(ebp + 8) is an address, but we're not interested in the address - we're interested in the value that is located at that address. Hence the dereference operation. Similarly for (esp).


>> 0x08048dab <phase_2+26>:        cmpl   $0x1,-0x20(%ebp)
>> compares ebp  32 to see if its equal to 1

Don't forget the dereference operation again ...
Not sure about the dereference here...Should this be
0x08048dab <phase_2+26>:        cmpl   $0x1,-0x20(%ebp)
(ebp - 32) : : 1?? Not sure where the dereferencign comes in...


>> 0x08048dc0 <phase_2+47>:        imul   -0x8(%esi,%ebx,4),%eax
>> eax = *(esi + ebx * 4 - 8) *  *(esi + ebx * 4 - 8)

imul multiplies its both arguments, ie. :

        imul a, b

means :

        b = b * a

Also don't forget to dereference ...
eax = *(esi + ebx * 4 - 8) *  *(esi + ebx * 4 - 8)

>> 0x08048dc5 <phase_2+52>:        cmp    %eax,-0x4(%esi,%ebx,4)
>> compares if (esi + ebx * 4  4) == eax

dereference ...


>> 0x08048dd8 <phase_2+71>:        add    $0x30,%esp
 esp = esp + 48

hex vs. decimal mistake here ...
esp = esp +48


Could you explain dereferencing? Maybe with an example? This is probably not clicking for me because I am learning C and Assembly at the same time...thanks.

Am I wrong in thinking that this is the loop for the phase?

0x08048db6 <phase_2+37>:        mov    $0x2,%ebx
0x08048dbb <phase_2+42>:        lea    -0x20(%ebp),%esi
0x08048dbe <phase_2+45>:        mov    %ebx,%eax
0x08048dc0 <phase_2+47>:        imul   -0x8(%esi,%ebx,4),%eax
0x08048dc5 <phase_2+52>:        cmp    %eax,-0x4(%esi,%ebx,4)
0x08048dc9 <phase_2+56>:        je     0x8048dd0 <phase_2+63>
0x08048dcb <phase_2+58>:        call   0x8048f2c <explode_bomb>
0x08048dd0 <phase_2+63>:        add    $0x1,%ebx
0x08048dd3 <phase_2+66>:        cmp    $0x7,%ebx
0x08048dd6 <phase_2+69>:        jne    0x8048dbe <phase_2+45>
0x08048dd8 <phase_2+71>:        add    $0x30,%esp

And that the after the input is put through the read_six_numbers function each of the values will be incremented by some amount. Which I need to find and then applying to the first input number to find the next number and so on?

>>  0x08048d92 <phase_2+1>: mov    %esp,%ebp
>> ebp = *esp  esp pointer is being pointed at ebp on the stack

What this means is that the current base pointer (ebp) is set to the top of the stack (esp), so a new stack frame can be started for the function.

If you're not sure about what a stack frame is, take a look here :

        http://en.wikipedia.org/wiki/Call_stack


>> 0x08048d9c <phase_2+11>:        mov    %eax,0x4(%esp)
>> eax = (%esp+4)  moves eax to the position (%esp+4) on the stack

Although your pseudo code is misleading (the assignment is still the wrong way around, and the dereference operation is still not there), your explanation in words sounds correct.


>> 0x08048da0 <phase_2+15>:        mov    0x8(%ebp),%eax
>> move the value of (ebp+8) to = eax

Not the value of (ebp+8), but the value that is located at address (ebp+8). There's an important distinction there.


>> 0x08048da3 <phase_2+18>:        mov    %eax,(%esp)
>> *(esp) = eax  sets stack pointer esp to eax

No, you're missing the dereference operation again. This instruction places the value in eax at the top of the stack. It does not modify the stack pointer (esp), but rather the memory that it's pointing to.


>> 0x08048dab <phase_2+26>:        cmpl   $0x1,-0x20(%ebp)
>> (ebp - 32) : : 1?? Not sure where the dereferencign comes in...

Always the same ... It's not (ebp-32), but it's *(ebp-32). Do you understand what the * means ? Do you know the C language, and what the dereference operator (*) does there ?


>> eax = *(esi + ebx * 4 - 8) *  *(esi + ebx * 4 - 8)

That's only one half of my remark. Did you understand what I said about how the imul instruction works, and which values it multiplies ?



>> Could you explain dereferencing? Maybe with an example? This is probably not clicking for me because I am learning C and Assembly at the same time...thanks.

Dereferencing means that you have a pointer (a memory address), and instead of using that address, you get the value that is located at that address in memory. You follow the pointer to get to the value it's pointing to - ie. you're dereferencing the pointer.

>> Am I wrong in thinking that this is the loop for the phase?

That's a loop indeed, which performs some calculations and checks based on the six numbers that were entered by the user.


>> And that the after the input is put through the read_six_numbers function each of the values will be incremented by some amount.

Not really. What is happening is that each of the numbers is compared to a specific (calculated) value, and if one of them has the wrong value, the bomb explodes. It's your job to figure out those values.

Okay so I need to look at the value of the memory addresses when the pointer is being dereferenced?

>>Always the same ... It's not (ebp-32), but it's *(ebp-32). Do you understand what the * means ? Do you >>know the C language, and what the dereference operator (*) does there ?
Does this mean *(ebp-32) is a memory location? Or does it mean that I would find the value at that memory location and then subtract 32 from it?

>>Although your pseudo code is misleading (the assignment is still the wrong way around, and the >>dereference operation is still not there), your explanation in words sounds correct

Yea sorry about that not really sure how to express most of what I want to say via assembly code...

>>No, you're missing the dereference operation again. This instruction places the value in eax at the top >>of the stack. It does not modify the stack pointer (esp), but rather the memory that it's pointing to.

That is what I was trying to say...because esp points to the top of the stack. So setting the pointer of esp to the value of eax would put that value at the top of the stack i.e. that memory location.

What command would I use to look up the value at a particular location?

>>Not really. What is happening is that each of the numbers is compared to a specific (calculated) value, >>and if one of them has the wrong value, the bomb explodes. It's your job to figure out those values.

If the calculation isn't done in the loop and it isn't done in the read_six_numbers function there doesn't seem to be anywhere else it could be done.

>> Does this mean *(ebp-32) is a memory location? Or does it mean that I would find the value at that memory location and then subtract 32 from it?

It means that (ebp-32) is a memory location (address), and that you get the value at that memory location.


>> So setting the pointer of esp to the value of eax

You seem to understand what happens, but this phrase is still wrong ... You don't actually set the stack pointer (esp), since that would imply modifying esp. But you set the value that esp points to.


>> What command would I use to look up the value at a particular location?

What do you mean ? In the debugger ? You can use the examine (x) command :

        http://sourceware.org/gdb/download/onlinedocs/gdb_11.html#SEC72


>> If the calculation isn't done in the loop

I never said it wasn't done in the loop.

So for example:
0x08048dbb <phase_2+42>:        lea    -0x20(%ebp),%esi
the value of esi would be found in memory location 0x08048dbb?

I feel like that's not right now...

So I know what I need to find is in the loop.
0x08048dc0 <phase_2+47>:        imul   -0x8(%esi,%ebx,4),%eax
0x08048dc5 <phase_2+52>:        cmp    %eax,-0x4(%esi,%ebx,4)
this is the only part that I see that different values are calculated and compared. But in order for me to figure out eax(the numbers I need) I would have to find the values of esi and ebx. Am I understanding this correctly?

>> 0x08048dbb <phase_2+42>:        lea    -0x20(%ebp),%esi
>> the value of esi would be found in memory location 0x08048dbb?

The lea (load effective address) instruction is an exception. It skips the dereference operation, and just works with the address.

>> this is the only part that I see that different values are calculated and compared. But in order for me to figure out eax(the numbers I need) I would have to find the values of esi and ebx. Am I understanding this correctly?

You are :)

ebx would be found here correct?
0x08048db6 <phase_2+37>:        mov    $0x2,%ebx
Which ebx would be equal to 2.But, it would be incremented by one each time the loop iterates by this
0x08048dd0 <phase_2+63>:        add    $0x1,%ebx

As for esi
0x08048dbb <phase_2+42>:        lea    -0x20(%ebp),%esi
The value of esi would be found in the memory location 0x08048dbb correct? Or is the address (%ebp - 20) the value of esi. I'm thinking the later...

EDIT:
As for esi
0x08048dbb <phase_2+42>:        lea    -0x20(%ebp),%esi
The value of esi would be found in the memory location 0x08048dbb correct? Or is the address (%ebp - 32) the value of esi. I'm thinking the later...
Forgot to convert from hex.

Mmmm I'm not able to find the correct values, here is a copy of what I was doing, I kept getting really large negative numbers that just don't seem right. Any thoughts?

(gdb) disas phase_2
Dump of assembler code for function phase_2:
0x08048d91 <phase_2+0>: push   %ebp
0x08048d92 <phase_2+1>: mov    %esp,%ebp
0x08048d94 <phase_2+3>: push   %esi
0x08048d95 <phase_2+4>: push   %ebx
0x08048d96 <phase_2+5>: sub    $0x30,%esp
0x08048d99 <phase_2+8>: lea    -0x20(%ebp),%eax
0x08048d9c <phase_2+11>:        mov    %eax,0x4(%esp)
0x08048da0 <phase_2+15>:        mov    0x8(%ebp),%eax
0x08048da3 <phase_2+18>:        mov    %eax,(%esp)
0x08048da6 <phase_2+21>:        call   0x8048f56 <read_six_numbers>
0x08048dab <phase_2+26>:        cmpl   $0x1,-0x20(%ebp)
0x08048daf <phase_2+30>:        je     0x8048db6 <phase_2+37>
0x08048db1 <phase_2+32>:        call   0x8048f2c <explode_bomb>
0x08048db6 <phase_2+37>:        mov    $0x2,%ebx
0x08048dbb <phase_2+42>:        lea    -0x20(%ebp),%esi
0x08048dbe <phase_2+45>:        mov    %ebx,%eax
0x08048dc0 <phase_2+47>:        imul   -0x8(%esi,%ebx,4),%eax
0x08048dc5 <phase_2+52>:        cmp    %eax,-0x4(%esi,%ebx,4)
0x08048dc9 <phase_2+56>:        je     0x8048dd0 <phase_2+63>
0x08048dcb <phase_2+58>:        call   0x8048f2c <explode_bomb>
0x08048dd0 <phase_2+63>:        add    $0x1,%ebx
0x08048dd3 <phase_2+66>:        cmp    $0x7,%ebx
0x08048dd6 <phase_2+69>:        jne    0x8048dbe <phase_2+45>
0x08048dd8 <phase_2+71>:        add    $0x30,%esp
0x08048ddb <phase_2+74>:        pop    %ebx
0x08048ddc <phase_2+75>:        pop    %esi
0x08048ddd <phase_2+76>:        pop    %ebp
0x08048dde <phase_2+77>:        ret    
End of assembler dump.
(gdb) break *0x08048dbb
Breakpoint 1 at 0x8048dbb
(gdb) break *0x08048dc0
Breakpoint 2 at 0x8048dc0
(gdb) break *0x08048dc5
Breakpoint 3 at 0x8048dc5
(gdb) break *0x08048dc9
Breakpoint 4 at 0x8048dc9
(gdb) r input.txt
Starting program: /home/jalexanb/lab1/bomb72/bomb-quiet input.txt
Welcome to my fiendish little bomb. You have 6 phases with
which to blow yourself up. Have a nice day!
Phase 1 defused. How about the next one?
1 2 3 4 5 6
 
Breakpoint 1, 0x08048dbb in phase_2 ()
(gdb) print *(int *) (%ebp-32)
A syntax error in expression, near `%ebp-32)'.
(gdb) si
0x08048dbe in phase_2 ()
(gdb) print *(int *) (%ebp-32)
A syntax error in expression, near `%ebp-32)'.
(gdb) print /x (%ebp-32)
A syntax error in expression, near `%ebp-32)'.
(gdb) info registers
eax            0x6      6
ecx            0xbff27164       -1074630300
edx            0x0      0
ebx            0x2      2
esp            0xbff27260       0xbff27260
ebp            0xbff27298       0xbff27298
esi            0xbff27278       -1074630024
edi            0x0      0
eip            0x8048dbe        0x8048dbe <phase_2+45>
eflags         0x246    [ PF ZF IF ]
cs             0x73     115
ss             0x7b     123
ds             0x7b     123
es             0x7b     123
fs             0x0      0
gs             0x33     51
(gdb) x 0x08048dbb
0x8048dbb <phase_2+42>: 0x89e0758d
(gdb) x/x 0x080488dbb
0x80488dbb:     Cannot access memory at address 0x80488dbb
(gdb) x/x 0x08048dbb
0x8048dbb <phase_2+42>: 0x89e0758d
(gdb) x/d 0x08048dbb
0x8048dbb <phase_2+42>: -1981778547
(gdb) si
 
Breakpoint 2, 0x08048dc0 in phase_2 ()
(gdb) x/d (%edi-32)
A syntax error in expression, near `%edi-32)'.
(gdb) x/d 0x08048dc0
0x8048dc0 <phase_2+47>: -1639665905
(gdb) info registers
eax            0x2      2
ecx            0xbff27164       -1074630300
edx            0x0      0
ebx            0x2      2
esp            0xbff27260       0xbff27260
ebp            0xbff27298       0xbff27298
esi            0xbff27278       -1074630024
edi            0x0      0
eip            0x8048dc0        0x8048dc0 <phase_2+47>
eflags         0x246    [ PF ZF IF ]
cs             0x73     115
ss             0x7b     123
ds             0x7b     123
es             0x7b     123
fs             0x0      0
gs             0x33     51
(gdb) si
 
Breakpoint 3, 0x08048dc5 in phase_2 ()
(gdb) info registers
eax            0x2      2
ecx            0xbff27164       -1074630300
edx            0x0      0
ebx            0x2      2
esp            0xbff27260       0xbff27260
ebp            0xbff27298       0xbff27298
esi            0xbff27278       -1074630024
edi            0x0      0
eip            0x8048dc5        0x8048dc5 <phase_2+52>
eflags         0x202    [ IF ]
cs             0x73     115
ss             0x7b     123
ds             0x7b     123
es             0x7b     123
fs             0x0      0
gs             0x33     51
(gdb) x/d 0x08048dc5
0x8048dc5 <phase_2+52>: -56736711
(gdb) si
 
Breakpoint 4, 0x08048dc9 in phase_2 ()
(gdb) info registers
eax            0x2      2
ecx            0xbff27164       -1074630300
edx            0x0      0
ebx            0x2      2
esp            0xbff27260       0xbff27260
ebp            0xbff27298       0xbff27298
esi            0xbff27278       -1074630024
edi            0x0      0
eip            0x8048dc9        0x8048dc9 <phase_2+56>
eflags         0x246    [ PF ZF IF ]
cs             0x73     115
ss             0x7b     123
ds             0x7b     123
es             0x7b     123
fs             0x0      0
gs             0x33     51
(gdb) x/d 0x08048dc9
0x8048dc9 <phase_2+56>: 1558709620
(gdb) 
0x8048dcd <phase_2+60>: -2097151999
(gdb) x/d (%esi-32)
A syntax error in expression, near `%esi-32)'.
(gdb) x/d %esi-32
A syntax error in expression, near `%esi-32'.
(gdb) x/d (esi-32)
No symbol "esi" in current context.
(gdb) si
0x08048dd0 in phase_2 ()
(gdb) info registers
eax            0x2      2
ecx            0xbff27164       -1074630300
edx            0x0      0
ebx            0x2      2
esp            0xbff27260       0xbff27260
ebp            0xbff27298       0xbff27298
esi            0xbff27278       -1074630024
edi            0x0      0
eip            0x8048dd0        0x8048dd0 <phase_2+63>
eflags         0x246    [ PF ZF IF ]
cs             0x73     115
ss             0x7b     123
ds             0x7b     123
es             0x7b     123
fs             0x0      0
gs             0x33     51
(gdb) x/d 0x08048dd0
0x8048dd0 <phase_2+63>: -2097036413
                                              

1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:
16:
17:
18:
19:
20:
21:
22:
23:
24:
25:
26:
27:
28:
29:
30:
31:
32:
33:
34:
35:
36:
37:
38:
39:
40:
41:
42:
43:
44:
45:
46:
47:
48:
49:
50:
51:
52:
53:
54:
55:
56:
57:
58:
59:
60:
61:
62:
63:
64:
65:
66:
67:
68:
69:
70:
71:
72:
73:
74:
75:
76:
77:
78:
79:
80:
81:
82:
83:
84:
85:
86:
87:
88:
89:
90:
91:
92:
93:
94:
95:
96:
97:
98:
99:
100:
101:
102:
103:
104:
105:
106:
107:
108:
109:
110:
111:
112:
113:
114:
115:
116:
117:
118:
119:
120:
121:
122:
123:
124:
125:
126:
127:
128:
129:
130:
131:
132:
133:
134:
135:
136:
137:
138:
139:
140:
141:
142:
143:
144:
145:
146:
147:
148:
149:
150:
151:
152:
153:
154:
155:
156:
157:
158:
159:
160:
161:
162:
163:
164:
165:
166:
167:
168:
169:
170:
171:
172:
173:
174:
175:
176:
177:

Phase two Complete!
Thanks for the help.
Now onto phase 3. :)

Good job :) Have fun with phase 3 !