Here is the code for phase_3
08048dd4 <phase_3>:
8048dd4: 55 push %ebp
8048dd5: 89 e5 mov %esp,%ebp
8048dd7: 83 ec 28 sub $0x28,%esp
8048dda: 8d 45 f8 lea 0xfffffff8(%ebp),%eax
8048ddd: 89 44 24 0c mov %eax,0xc(%esp)
8048de1: 8d 45 fc lea 0xfffffffc(%ebp),%eax
8048de4: 89 44 24 08 mov %eax,0x8(%esp)
8048de8: c7 44 24 04 c5 9a 04 movl $0x8049ac5,0x4(%esp)
8048def: 08
8048df0: 8b 45 08 mov 0x8(%ebp),%eax
8048df3: 89 04 24 mov %eax,(%esp)
8048df6: e8 f1 fa ff ff call 80488ec <sscanf@plt>
8048dfb: 83 f8 01 cmp $0x1,%eax
8048dfe: 7f 05 jg 8048e05 <phase_3+0x31>
8048e00: e8 89 04 00 00 call 804928e <explode_bomb>
8048e05: 83 7d fc 07 cmpl $0x7,0xfffffffc(%ebp)
8048e09: 77 71 ja 8048e7c <phase_3+0xa8>
8048e0b: 8b 45 fc mov 0xfffffffc(%ebp),%eax
8048e0e: 89 f6 mov %esi,%esi
8048e10: ff 24 85 28 99 04 08 jmp *0x8049928(,%eax,4)
8048e17: b8 00 00 00 00 mov $0x0,%eax
8048e1c: 8d 74 26 00 lea 0x0(%esi),%esi
8048e20: eb 53 jmp 8048e75 <phase_3+0xa1>
8048e22: b8 00 00 00 00 mov $0x0,%eax
8048e27: eb 47 jmp 8048e70 <phase_3+0x9c>
8048e29: b8 00 00 00 00 mov $0x0,%eax
8048e2e: 89 f6 mov %esi,%esi
8048e30: eb 39 jmp 8048e6b <phase_3+0x97>
8048e32: b8 00 00 00 00 mov $0x0,%eax
8048e37: eb 2d jmp 8048e66 <phase_3+0x92>
8048e39: b8 00 00 00 00 mov $0x0,%eax
8048e3e: 89 f6 mov %esi,%esi
8048e40: eb 1f jmp 8048e61 <phase_3+0x8d>
8048e42: b8 00 00 00 00 mov $0x0,%eax
8048e47: eb 13 jmp 8048e5c <phase_3+0x88>
8048e49: b8 5f 01 00 00 mov $0x15f,%eax
8048e4e: 89 f6 mov %esi,%esi
8048e50: eb 05 jmp 8048e57 <phase_3+0x83>
8048e52: b8 00 00 00 00 mov $0x0,%eax
8048e57: 2d 3a 01 00 00 sub $0x13a,%eax
8048e5c: 05 c3 03 00 00 add $0x3c3,%eax
8048e61: 2d cb 03 00 00 sub $0x3cb,%eax
8048e66: 05 73 01 00 00 add $0x173,%eax
8048e6b: 2d 47 03 00 00 sub $0x347,%eax
8048e70: 05 47 03 00 00 add $0x347,%eax
8048e75: 2d 48 01 00 00 sub $0x148,%eax
8048e7a: eb 0a jmp 8048e86 <phase_3+0xb2>
8048e7c: e8 0d 04 00 00 call 804928e <explode_bomb>
8048e81: b8 00 00 00 00 mov $0x0,%eax
8048e86: 83 7d fc 05 cmpl $0x5,0xfffffffc(%ebp)
8048e8a: 7f 06 jg 8048e92 <phase_3+0xbe>
8048e8c: 3b 45 f8 cmp 0xfffffff8(%ebp),%eax
8048e8f: 90 nop
8048e90: 74 05 je 8048e97 <phase_3+0xc3>
8048e92: e8 f7 03 00 00 call 804928e <explode_bomb>
8048e97: c9 leave
8048e98: c3 ret
When I look at the the conditionals and switch codes, it seems that i should only consider the following
8048dda: 8d 45 f8 lea 0xfffffff8(%ebp),%eax # get y
8048de1: 8d 45 fc lea 0xfffffffc(%ebp),%eax #get x
1) x > 1
2) x < = 7
3) x==y
i.e i can see that these are the only conditions needed to keep the bomb from blowing up,
so,
a) does this mean than i can take any two values which could satisfy these conditions
b) if not how can i determine the inputs
c) In what order does sscanf read the inputs from the stack, is it as x y or y x
d) would the the manulation of %eax in the jump statments really matter to the inputs
e) what is the purpose of assigning %esi to itself eg 8048e0e: 89 f6 mov %esi,%esi
f) I read about indirect jump, but i didn't quite understand it
eg 8048e10: ff 24 85 28 99 04 08 jmp *0x8049928(,%eax,4)
thanks in advance
