- For individual users
- Instant access to solutions
- Ask your tech questions
- Start your 30-day Free Trial
Main Topics
Browse All TopicsI read most of the explanation that infinity08 gave to others and it helped me a lot to figure out the previous phases. thanks a lot for your effort and willingness.
Now I'm trying to figure out how i can get the secret phase.
1) here i couldn't figure out where the %eax value coming from.
2)how can make it not jump here
804923a: 83 f8 02 cmp $0x2,%eax
804923d: 75 31 jne 8049270 <phase_defused+0x74>
3) there is also another jump that should not be made, i couldn't figure out where the sscanf gets its inputs
804924f: 85 c0 test %eax,%eax
8049251: 75 1d jne 8049270 <phase_defused+0x74>
4)where should i enter the input string, i tried at the end after after the 6th phase is diffused, didn't work and also how would that be read
5)or is it next to the answer in another phase, if so where would i to try ?
Here is the defused_phase code
080491fc <phase_defused>:
80491fc: 55 push %ebp
80491fd: 89 e5 mov %esp,%ebp
80491ff: 53 push %ebx
8049200: 83 ec 74 sub $0x74,%esp
8049203: c7 04 24 01 00 00 00 movl $0x1,(%esp)
804920a: e8 a0 fd ff ff call 8048faf <send_msg>
804920f: 83 3d 2c a8 04 08 06 cmpl $0x6,0x804a82c
8049216: 75 70 jne 8049288 <phase_defused+0x8c>
8049218: 8d 5d ac lea 0xffffffac(%ebp),%ebx
804921b: 89 5c 24 0c mov %ebx,0xc(%esp)
804921f: 8d 45 a8 lea 0xffffffa8(%ebp),%eax
8049222: 89 44 24 08 mov %eax,0x8(%esp)
8049226: c7 44 24 04 86 9a 04 movl $0x8049a86,0x4(%esp)
804922d: 08
804922e: c7 04 24 30 a9 04 08 movl $0x804a930,(%esp)
8049235: e8 b2 f6 ff ff call 80488ec <sscanf@plt>
804923a: 83 f8 02 cmp $0x2,%eax
804923d: 75 31 jne 8049270 <phase_defused+0x74>
804923f: c7 44 24 04 8c 9a 04 movl $0x8049a8c,0x4(%esp)
8049246: 08
8049247: 89 1c 24 mov %ebx,(%esp)
804924a: e8 ff fc ff ff call 8048f4e <strings_not_equal>
804924f: 85 c0 test %eax,%eax
8049251: 75 1d jne 8049270 <phase_defused+0x74>
8049253: c7 04 24 08 9c 04 08 movl $0x8049c08,(%esp)
804925a: e8 cd f5 ff ff call 804882c <puts@plt>
804925f: c7 04 24 30 9c 04 08 movl $0x8049c30,(%esp)
8049266: e8 c1 f5 ff ff call 804882c <puts@plt>
804926b: e8 29 fa ff ff call 8048c99 <secret_phase>
8049270: c7 04 24 68 9c 04 08 movl $0x8049c68,(%esp)
8049277: e8 b0 f5 ff ff call 804882c <puts@plt>
804927c: c7 04 24 94 9c 04 08 movl $0x8049c94,(%esp)
8049283: e8 a4 f5 ff ff call 804882c <puts@plt>
8049288: 83 c4 74 add $0x74,%esp
804928b: 5b pop %ebx
804928c: 5d pop %ebp
804928d: c3 ret
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.

Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
Business Accounts
Answer for Membership
by: Infinity08Posted on 2009-11-06 at 08:12:29ID: 25760393
>> 1) here i couldn't figure out where the %eax value coming from.
eference/c library/cs tdio/sscan f/
>> 8049235: e8 b2 f6 ff ff call 80488ec <sscanf@plt>
>> 804923a: 83 f8 02 cmp $0x2,%eax
eax contains the return value of sscanf, ie. the amount of successfully read items :
http://www.cplusplus.com/r
>> 2)how can make it not jump here
The string passed to sscanf needs to be such that sscanf returns the expected value.
>> i couldn't figure out where the sscanf gets its inputs
They are put on the stack before calling sscanf :
>> 8049218: 8d 5d ac lea 0xffffffac(%ebp),%ebx
>> 804921b: 89 5c 24 0c mov %ebx,0xc(%esp)
>> 804921f: 8d 45 a8 lea 0xffffffa8(%ebp),%eax
>> 8049222: 89 44 24 08 mov %eax,0x8(%esp)
>> 8049226: c7 44 24 04 86 9a 04 movl $0x8049a86,0x4(%esp)
>> 804922d: 08
>> 804922e: c7 04 24 30 a9 04 08 movl $0x804a930,(%esp)
>> 4)where should i enter the input string, i tried at the end after after the 6th phase is diffused, didn't work and also how would that be read
The string sscanf works with is located at address 0x804a930 ... you'll have to check the rest of the code to see where that string is filled.