- For individual users
- Instant access to solutions
- Ask your tech questions
- Start your 30-day Free Trial
Main Topics
Browse All TopicsHere is the code for phase_3
08048dd4 <phase_3>:
8048dd4: 55 push %ebp
8048dd5: 89 e5 mov %esp,%ebp
8048dd7: 83 ec 28 sub $0x28,%esp
8048dda: 8d 45 f8 lea 0xfffffff8(%ebp),%eax
8048ddd: 89 44 24 0c mov %eax,0xc(%esp)
8048de1: 8d 45 fc lea 0xfffffffc(%ebp),%eax
8048de4: 89 44 24 08 mov %eax,0x8(%esp)
8048de8: c7 44 24 04 c5 9a 04 movl $0x8049ac5,0x4(%esp)
8048def: 08
8048df0: 8b 45 08 mov 0x8(%ebp),%eax
8048df3: 89 04 24 mov %eax,(%esp)
8048df6: e8 f1 fa ff ff call 80488ec <sscanf@plt>
8048dfb: 83 f8 01 cmp $0x1,%eax
8048dfe: 7f 05 jg 8048e05 <phase_3+0x31>
8048e00: e8 89 04 00 00 call 804928e <explode_bomb>
8048e05: 83 7d fc 07 cmpl $0x7,0xfffffffc(%ebp)
8048e09: 77 71 ja 8048e7c <phase_3+0xa8>
8048e0b: 8b 45 fc mov 0xfffffffc(%ebp),%eax
8048e0e: 89 f6 mov %esi,%esi
8048e10: ff 24 85 28 99 04 08 jmp *0x8049928(,%eax,4)
8048e17: b8 00 00 00 00 mov $0x0,%eax
8048e1c: 8d 74 26 00 lea 0x0(%esi),%esi
8048e20: eb 53 jmp 8048e75 <phase_3+0xa1>
8048e22: b8 00 00 00 00 mov $0x0,%eax
8048e27: eb 47 jmp 8048e70 <phase_3+0x9c>
8048e29: b8 00 00 00 00 mov $0x0,%eax
8048e2e: 89 f6 mov %esi,%esi
8048e30: eb 39 jmp 8048e6b <phase_3+0x97>
8048e32: b8 00 00 00 00 mov $0x0,%eax
8048e37: eb 2d jmp 8048e66 <phase_3+0x92>
8048e39: b8 00 00 00 00 mov $0x0,%eax
8048e3e: 89 f6 mov %esi,%esi
8048e40: eb 1f jmp 8048e61 <phase_3+0x8d>
8048e42: b8 00 00 00 00 mov $0x0,%eax
8048e47: eb 13 jmp 8048e5c <phase_3+0x88>
8048e49: b8 5f 01 00 00 mov $0x15f,%eax
8048e4e: 89 f6 mov %esi,%esi
8048e50: eb 05 jmp 8048e57 <phase_3+0x83>
8048e52: b8 00 00 00 00 mov $0x0,%eax
8048e57: 2d 3a 01 00 00 sub $0x13a,%eax
8048e5c: 05 c3 03 00 00 add $0x3c3,%eax
8048e61: 2d cb 03 00 00 sub $0x3cb,%eax
8048e66: 05 73 01 00 00 add $0x173,%eax
8048e6b: 2d 47 03 00 00 sub $0x347,%eax
8048e70: 05 47 03 00 00 add $0x347,%eax
8048e75: 2d 48 01 00 00 sub $0x148,%eax
8048e7a: eb 0a jmp 8048e86 <phase_3+0xb2>
8048e7c: e8 0d 04 00 00 call 804928e <explode_bomb>
8048e81: b8 00 00 00 00 mov $0x0,%eax
8048e86: 83 7d fc 05 cmpl $0x5,0xfffffffc(%ebp)
8048e8a: 7f 06 jg 8048e92 <phase_3+0xbe>
8048e8c: 3b 45 f8 cmp 0xfffffff8(%ebp),%eax
8048e8f: 90 nop
8048e90: 74 05 je 8048e97 <phase_3+0xc3>
8048e92: e8 f7 03 00 00 call 804928e <explode_bomb>
8048e97: c9 leave
8048e98: c3 ret
When I look at the the conditionals and switch codes, it seems that i should only consider the following
8048dda: 8d 45 f8 lea 0xfffffff8(%ebp),%eax # get y
8048de1: 8d 45 fc lea 0xfffffffc(%ebp),%eax #get x
1) x > 1
2) x < = 7
3) x==y
i.e i can see that these are the only conditions needed to keep the bomb from blowing up,
so,
a) does this mean than i can take any two values which could satisfy these conditions
b) if not how can i determine the inputs
c) In what order does sscanf read the inputs from the stack, is it as x y or y x
d) would the the manulation of %eax in the jump statments really matter to the inputs
e) what is the purpose of assigning %esi to itself eg 8048e0e: 89 f6 mov %esi,%esi
f) I read about indirect jump, but i didn't quite understand it
eg 8048e10: ff 24 85 28 99 04 08 jmp *0x8049928(,%eax,4)
thanks in advance
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.

Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
Business Accounts
Answer for Membership
by: Infinity08Posted on 2009-11-02 at 08:13:28ID: 25720673
>> 1) x > 1
It's not comparing with x ... Take a closer look ;)
>> 3) x==y
Again : it's not comparing it to x ... Take a closer look ;)
>> a) does this mean than i can take any two values which could satisfy these conditions
It's a bit more involved than you make it sound ... but basically, yes (assuming you take the right conditions).
>> c) In what order does sscanf read the inputs from the stack, is it as x y or y x
The arguments are passed to sscanf in reverse order. So, the first value will be placed in 0xfffffffc(%ebp), and the second in 0xfffffff8(%ebp).
>> d) would the the manulation of %eax in the jump statments really matter to the inputs
Yes.
>> e) what is the purpose of assigning %esi to itself eg 8048e0e: 89 f6 mov %esi,%esi
It's just a nop (no operation) ... probably used for code alignment. Just ignore it.
>> f) I read about indirect jump, but i didn't quite understand it
>> eg 8048e10: ff 24 85 28 99 04 08 jmp *0x8049928(,%eax,4)
It calculates the address 0x8049928(,%eax,4), gets the address value stored at that address, and then jumps to it.