I read most of the explanation that infinity08 gave to others and it helped me a lot to figure out the previous phases. thanks a lot for your effort and willingness.
Now I'm trying to figure out how i can get the secret phase.
1) here i couldn't figure out where the %eax value coming from.
2)how can make it not jump here
804923a: 83 f8 02 cmp $0x2,%eax
804923d: 75 31 jne 8049270 <phase_defused+0x74>
3) there is also another jump that should not be made, i couldn't figure out where the sscanf gets its inputs
804924f: 85 c0 test %eax,%eax
8049251: 75 1d jne 8049270 <phase_defused+0x74>
4)where should i enter the input string, i tried at the end after after the 6th phase is diffused, didn't work and also how would that be read
5)or is it next to the answer in another phase, if so where would i to try ?
Here is the defused_phase code
080491fc <phase_defused>:
80491fc: 55 push %ebp
80491fd: 89 e5 mov %esp,%ebp
80491ff: 53 push %ebx
8049200: 83 ec 74 sub $0x74,%esp
8049203: c7 04 24 01 00 00 00 movl $0x1,(%esp)
804920a: e8 a0 fd ff ff call 8048faf <send_msg>
804920f: 83 3d 2c a8 04 08 06 cmpl $0x6,0x804a82c
8049216: 75 70 jne 8049288 <phase_defused+0x8c>
8049218: 8d 5d ac lea 0xffffffac(%ebp),%ebx
804921b: 89 5c 24 0c mov %ebx,0xc(%esp)
804921f: 8d 45 a8 lea 0xffffffa8(%ebp),%eax
8049222: 89 44 24 08 mov %eax,0x8(%esp)
8049226: c7 44 24 04 86 9a 04 movl $0x8049a86,0x4(%esp)
804922d: 08
804922e: c7 04 24 30 a9 04 08 movl $0x804a930,(%esp)
8049235: e8 b2 f6 ff ff call 80488ec <sscanf@plt>
804923a: 83 f8 02 cmp $0x2,%eax
804923d: 75 31 jne 8049270 <phase_defused+0x74>
804923f: c7 44 24 04 8c 9a 04 movl $0x8049a8c,0x4(%esp)
8049246: 08
8049247: 89 1c 24 mov %ebx,(%esp)
804924a: e8 ff fc ff ff call 8048f4e <strings_not_equal>
804924f: 85 c0 test %eax,%eax
8049251: 75 1d jne 8049270 <phase_defused+0x74>
8049253: c7 04 24 08 9c 04 08 movl $0x8049c08,(%esp)
804925a: e8 cd f5 ff ff call 804882c <puts@plt>
804925f: c7 04 24 30 9c 04 08 movl $0x8049c30,(%esp)
8049266: e8 c1 f5 ff ff call 804882c <puts@plt>
804926b: e8 29 fa ff ff call 8048c99 <secret_phase>
8049270: c7 04 24 68 9c 04 08 movl $0x8049c68,(%esp)
8049277: e8 b0 f5 ff ff call 804882c <puts@plt>
804927c: c7 04 24 94 9c 04 08 movl $0x8049c94,(%esp)
8049283: e8 a4 f5 ff ff call 804882c <puts@plt>
8049288: 83 c4 74 add $0x74,%esp
804928b: 5b pop %ebx
804928c: 5d pop %ebp
804928d: c3 ret
