• Help with IA32 (intel) assembly language!
    6 replies, posted
So I have this project in my computing class to "dismantle" a "bomb". The bomb is made of 6 phases. To defuse each phase a correct string must be entered based on decrypting ia32 code. The code is going to be listed below. This is quite a large bit of code and I don't expect anyone to decrypt the entire project for me. But rather just a point in the correct direction. Any hints on how to tackle this or possibly even answers would be greatly appreciated. Thanks! [code] bomb: file format elf32-i386 Disassembly of section .init: 080487bc <_init>: 80487bc: 55 push %ebp 80487bd: 89 e5 mov %esp,%ebp 80487bf: 83 ec 08 sub $0x8,%esp 80487c2: e8 31 02 00 00 call 80489f8 <call_gmon_start> 80487c7: e8 84 02 00 00 call 8048a50 <frame_dummy> 80487cc: e8 3b 0f 00 00 call 804970c <__do_global_ctors_aux> 80487d1: c9 leave 80487d2: c3 ret Disassembly of section .plt: 080487d4 <close@plt-0x10>: 80487d4: ff 35 e4 a0 04 08 pushl 0x804a0e4 80487da: ff 25 e8 a0 04 08 jmp *0x804a0e8 80487e0: 00 00 add %al,(%eax) ... 080487e4 <close@plt>: 80487e4: ff 25 ec a0 04 08 jmp *0x804a0ec 80487ea: 68 00 00 00 00 push $0x0 80487ef: e9 e0 ff ff ff jmp 80487d4 <_init+0x18> 080487f4 <fprintf@plt>: 80487f4: ff 25 f0 a0 04 08 jmp *0x804a0f0 80487fa: 68 08 00 00 00 push $0x8 80487ff: e9 d0 ff ff ff jmp 80487d4 <_init+0x18> 08048804 <tmpfile@plt>: 8048804: ff 25 f4 a0 04 08 jmp *0x804a0f4 804880a: 68 10 00 00 00 push $0x10 804880f: e9 c0 ff ff ff jmp 80487d4 <_init+0x18> 08048814 <getenv@plt>: 8048814: ff 25 f8 a0 04 08 jmp *0x804a0f8 804881a: 68 18 00 00 00 push $0x18 804881f: e9 b0 ff ff ff jmp 80487d4 <_init+0x18> 08048824 <signal@plt>: 8048824: ff 25 fc a0 04 08 jmp *0x804a0fc 804882a: 68 20 00 00 00 push $0x20 804882f: e9 a0 ff ff ff jmp 80487d4 <_init+0x18> 08048834 <fflush@plt>: 8048834: ff 25 00 a1 04 08 jmp *0x804a100 804883a: 68 28 00 00 00 push $0x28 804883f: e9 90 ff ff ff jmp 80487d4 <_init+0x18> 08048844 <bcopy@plt>: 8048844: ff 25 04 a1 04 08 jmp *0x804a104 804884a: 68 30 00 00 00 push $0x30 804884f: e9 80 ff ff ff jmp 80487d4 <_init+0x18> 08048854 <rewind@plt>: 8048854: ff 25 08 a1 04 08 jmp *0x804a108 804885a: 68 38 00 00 00 push $0x38 804885f: e9 70 ff ff ff jmp 80487d4 <_init+0x18> 08048864 <system@plt>: 8048864: ff 25 0c a1 04 08 jmp *0x804a10c 804886a: 68 40 00 00 00 push $0x40 804886f: e9 60 ff ff ff jmp 80487d4 <_init+0x18> 08048874 <puts@plt>: 8048874: ff 25 10 a1 04 08 jmp *0x804a110 804887a: 68 48 00 00 00 push $0x48 804887f: e9 50 ff ff ff jmp 80487d4 <_init+0x18> 08048884 <fgets@plt>: 8048884: ff 25 14 a1 04 08 jmp *0x804a114 804888a: 68 50 00 00 00 push $0x50 804888f: e9 40 ff ff ff jmp 80487d4 <_init+0x18> 08048894 <sleep@plt>: 8048894: ff 25 18 a1 04 08 jmp *0x804a118 804889a: 68 58 00 00 00 push $0x58 804889f: e9 30 ff ff ff jmp 80487d4 <_init+0x18> 080488a4 <__strtol_internal@plt>: 80488a4: ff 25 1c a1 04 08 jmp *0x804a11c 80488aa: 68 60 00 00 00 push $0x60 80488af: e9 20 ff ff ff jmp 80487d4 <_init+0x18> 080488b4 <fputc@plt>: 80488b4: ff 25 20 a1 04 08 jmp *0x804a120 80488ba: 68 68 00 00 00 push $0x68 80488bf: e9 10 ff ff ff jmp 80487d4 <_init+0x18> 080488c4 <__libc_start_main@plt>: 80488c4: ff 25 24 a1 04 08 jmp *0x804a124 80488ca: 68 70 00 00 00 push $0x70 80488cf: e9 00 ff ff ff jmp 80487d4 <_init+0x18> 080488d4 <printf@plt>: 80488d4: ff 25 28 a1 04 08 jmp *0x804a128 80488da: 68 78 00 00 00 push $0x78 80488df: e9 f0 fe ff ff jmp 80487d4 <_init+0x18> 080488e4 <fclose@plt>: 80488e4: ff 25 2c a1 04 08 jmp *0x804a12c 80488ea: 68 80 00 00 00 push $0x80 80488ef: e9 e0 fe ff ff jmp 80487d4 <_init+0x18> 080488f4 <gethostname@plt>: 80488f4: ff 25 30 a1 04 08 jmp *0x804a130 80488fa: 68 88 00 00 00 push $0x88 80488ff: e9 d0 fe ff ff jmp 80487d4 <_init+0x18> 08048904 <gethostbyname@plt>: 8048904: ff 25 34 a1 04 08 jmp *0x804a134 804890a: 68 90 00 00 00 push $0x90 804890f: e9 c0 fe ff ff jmp 80487d4 <_init+0x18> 08048914 <strcasecmp@plt>: 8048914: ff 25 38 a1 04 08 jmp *0x804a138 804891a: 68 98 00 00 00 push $0x98 804891f: e9 b0 fe ff ff jmp 80487d4 <_init+0x18> 08048924 <exit@plt>: 8048924: ff 25 3c a1 04 08 jmp *0x804a13c 804892a: 68 a0 00 00 00 push $0xa0 804892f: e9 a0 fe ff ff jmp 80487d4 <_init+0x18> 08048934 <sscanf@plt>: 8048934: ff 25 40 a1 04 08 jmp *0x804a140 804893a: 68 a8 00 00 00 push $0xa8 804893f: e9 90 fe ff ff jmp 80487d4 <_init+0x18> 08048944 <connect@plt>: 8048944: ff 25 44 a1 04 08 jmp *0x804a144 804894a: 68 b0 00 00 00 push $0xb0 804894f: e9 80 fe ff ff jmp 80487d4 <_init+0x18> 08048954 <fopen@plt>: 8048954: ff 25 48 a1 04 08 jmp *0x804a148 804895a: 68 b8 00 00 00 push $0xb8 804895f: e9 70 fe ff ff jmp 80487d4 <_init+0x18> 08048964 <dup@plt>: 8048964: ff 25 4c a1 04 08 jmp *0x804a14c 804896a: 68 c0 00 00 00 push $0xc0 804896f: e9 60 fe ff ff jmp 80487d4 <_init+0x18> 08048974 <sprintf@plt>: 8048974: ff 25 50 a1 04 08 jmp *0x804a150 804897a: 68 c8 00 00 00 push $0xc8 804897f: e9 50 fe ff ff jmp 80487d4 <_init+0x18> 08048984 <fwrite@plt>: 8048984: ff 25 54 a1 04 08 jmp *0x804a154 804898a: 68 d0 00 00 00 push $0xd0 804898f: e9 40 fe ff ff jmp 80487d4 <_init+0x18> 08048994 <socket@plt>: 8048994: ff 25 58 a1 04 08 jmp *0x804a158 804899a: 68 d8 00 00 00 push $0xd8 804899f: e9 30 fe ff ff jmp 80487d4 <_init+0x18> 080489a4 <__ctype_b_loc@plt>: 80489a4: ff 25 5c a1 04 08 jmp *0x804a15c 80489aa: 68 e0 00 00 00 push $0xe0 80489af: e9 20 fe ff ff jmp 80487d4 <_init+0x18> 080489b4 <cuserid@plt>: 80489b4: ff 25 60 a1 04 08 jmp *0x804a160 80489ba: 68 e8 00 00 00 push $0xe8 80489bf: e9 10 fe ff ff jmp 80487d4 <_init+0x18> 080489c4 <strcpy@plt>: 80489c4: ff 25 64 a1 04 08 jmp *0x804a164 80489ca: 68 f0 00 00 00 push $0xf0 80489cf: e9 00 fe ff ff jmp 80487d4 <_init+0x18> Disassembly of section .text: 080489d4 <_start>: 80489d4: 31 ed xor %ebp,%ebp 80489d6: 5e pop %esi 80489d7: 89 e1 mov %esp,%ecx 80489d9: 83 e4 f0 and $0xfffffff0,%esp 80489dc: 50 push %eax 80489dd: 54 push %esp 80489de: 52 push %edx 80489df: 68 c8 96 04 08 push $0x80496c8 80489e4: 68 74 96 04 08 push $0x8049674 80489e9: 51 push %ecx 80489ea: 56 push %esi 80489eb: 68 7c 8a 04 08 push $0x8048a7c 80489f0: e8 cf fe ff ff call 80488c4 <__libc_start_main@plt> 80489f5: f4 hlt 80489f6: 90 nop 80489f7: 90 nop 080489f8 <call_gmon_start>: 80489f8: 55 push %ebp 80489f9: 89 e5 mov %esp,%ebp 80489fb: 53 push %ebx 80489fc: e8 00 00 00 00 call 8048a01 <call_gmon_start+0x9> 8048a01: 5b pop %ebx 8048a02: 81 c3 df 16 00 00 add $0x16df,%ebx 8048a08: 52 push %edx 8048a09: 8b 83 fc ff ff ff mov -0x4(%ebx),%eax 8048a0f: 85 c0 test %eax,%eax 8048a11: 74 02 je 8048a15 <call_gmon_start+0x1d> 8048a13: ff d0 call *%eax 8048a15: 58 pop %eax 8048a16: 5b pop %ebx 8048a17: c9 leave 8048a18: c3 ret 8048a19: 90 nop 8048a1a: 90 nop 8048a1b: 90 nop 08048a1c <__do_global_dtors_aux>: 8048a1c: 55 push %ebp 8048a1d: 89 e5 mov %esp,%ebp 8048a1f: 83 ec 08 sub $0x8,%esp 8048a22: 80 3d 48 a8 04 08 00 cmpb $0x0,0x804a848 8048a29: 74 0f je 8048a3a <__do_global_dtors_aux+0x1e> 8048a2b: eb 1f jmp 8048a4c <__do_global_dtors_aux+0x30> 8048a2d: 8d 76 00 lea 0x0(%esi),%esi 8048a30: 83 c0 04 add $0x4,%eax 8048a33: a3 88 a1 04 08 mov %eax,0x804a188 8048a38: ff d2 call *%edx 8048a3a: a1 88 a1 04 08 mov 0x804a188,%eax 8048a3f: 8b 10 mov (%eax),%edx 8048a41: 85 d2 test %edx,%edx 8048a43: 75 eb jne 8048a30 <__do_global_dtors_aux+0x14> 8048a45: c6 05 48 a8 04 08 01 movb $0x1,0x804a848 8048a4c: c9 leave 8048a4d: c3 ret 8048a4e: 89 f6 mov %esi,%esi 08048a50 <frame_dummy>: 8048a50: 55 push %ebp 8048a51: 89 e5 mov %esp,%ebp 8048a53: 83 ec 08 sub $0x8,%esp 8048a56: a1 10 a0 04 08 mov 0x804a010,%eax 8048a5b: 85 c0 test %eax,%eax 8048a5d: 74 19 je 8048a78 <frame_dummy+0x28> 8048a5f: b8 00 00 00 00 mov $0x0,%eax 8048a64: 85 c0 test %eax,%eax 8048a66: 74 10 je 8048a78 <frame_dummy+0x28> 8048a68: 83 ec 0c sub $0xc,%esp 8048a6b: 68 10 a0 04 08 push $0x804a010 8048a70: ff d0 call *%eax 8048a72: 83 c4 10 add $0x10,%esp 8048a75: 8d 76 00 lea 0x0(%esi),%esi 8048a78: c9 leave 8048a79: c3 ret 8048a7a: 90 nop 8048a7b: 90 nop 08048a7c <main>: 8048a7c: 55 push %ebp 8048a7d: 89 e5 mov %esp,%ebp 8048a7f: 53 push %ebx 8048a80: 83 ec 04 sub $0x4,%esp 8048a83: 8b 45 08 mov 0x8(%ebp),%eax 8048a86: 8b 5d 0c mov 0xc(%ebp),%ebx 8048a89: 83 e4 f0 and $0xfffffff0,%esp 8048a8c: 83 ec 10 sub $0x10,%esp 8048a8f: 83 f8 01 cmp $0x1,%eax 8048a92: 75 0c jne 8048aa0 <main+0x24> 8048a94: a1 44 a8 04 08 mov 0x804a844,%eax 8048a99: a3 50 a8 04 08 mov %eax,0x804a850 8048a9e: eb 5a jmp 8048afa <main+0x7e> 8048aa0: 83 f8 02 cmp $0x2,%eax 8048aa3: 75 3a jne 8048adf <main+0x63> 8048aa5: 83 ec 08 sub $0x8,%esp 8048aa8: 68 09 9a 04 08 push $0x8049a09 8048aad: ff 73 04 pushl 0x4(%ebx) 8048ab0: e8 9f fe ff ff call 8048954 <fopen@plt> 8048ab5: a3 50 a8 04 08 mov %eax,0x804a850 8048aba: 83 c4 10 add $0x10,%esp 8048abd: 85 c0 test %eax,%eax 8048abf: 75 39 jne 8048afa <main+0x7e> 8048ac1: 83 ec 04 sub $0x4,%esp 8048ac4: ff 73 04 pushl 0x4(%ebx) 8048ac7: ff 33 pushl (%ebx) 8048ac9: 68 54 97 04 08 push $0x8049754 8048ace: e8 01 fe ff ff call 80488d4 <printf@plt> 8048ad3: c7 04 24 08 00 00 00 movl $0x8,(%esp) 8048ada: e8 45 fe ff ff call 8048924 <exit@plt> 8048adf: 83 ec 08 sub $0x8,%esp 8048ae2: ff 33 pushl (%ebx) 8048ae4: 68 71 97 04 08 push $0x8049771 8048ae9: e8 e6 fd ff ff call 80488d4 <printf@plt> 8048aee: c7 04 24 08 00 00 00 movl $0x8,(%esp) 8048af5: e8 2a fe ff ff call 8048924 <exit@plt> 8048afa: e8 4c 06 00 00 call 804914b <initialize_bomb> 8048aff: 83 ec 0c sub $0xc,%esp 8048b02: 68 d8 97 04 08 push $0x80497d8 8048b07: e8 68 fd ff ff call 8048874 <puts@plt> 8048b0c: c7 04 24 14 98 04 08 movl $0x8049814,(%esp) 8048b13: e8 5c fd ff ff call 8048874 <puts@plt> 8048b18: e8 74 07 00 00 call 8049291 <read_line> 8048b1d: 89 04 24 mov %eax,(%esp) 8048b20: e8 a7 00 00 00 call 8048bcc <phase_1> 8048b25: e8 ba 0a 00 00 call 80495e4 <phase_defused> 8048b2a: c7 04 24 40 98 04 08 movl $0x8049840,(%esp) 8048b31: e8 3e fd ff ff call 8048874 <puts@plt> 8048b36: e8 56 07 00 00 call 8049291 <read_line> 8048b3b: 89 04 24 mov %eax,(%esp) 8048b3e: e8 aa 00 00 00 call 8048bed <phase_2> 8048b43: e8 9c 0a 00 00 call 80495e4 <phase_defused> 8048b48: c7 04 24 8b 97 04 08 movl $0x804978b,(%esp) 8048b4f: e8 20 fd ff ff call 8048874 <puts@plt> 8048b54: e8 38 07 00 00 call 8049291 <read_line> 8048b59: 89 04 24 mov %eax,(%esp) 8048b5c: e8 c4 00 00 00 call 8048c25 <phase_3> 8048b61: e8 7e 0a 00 00 call 80495e4 <phase_defused> 8048b66: c7 04 24 a9 97 04 08 movl $0x80497a9,(%esp) 8048b6d: e8 02 fd ff ff call 8048874 <puts@plt> 8048b72: e8 1a 07 00 00 call 8049291 <read_line> 8048b77: 89 04 24 mov %eax,(%esp) 8048b7a: e8 c9 01 00 00 call 8048d48 <phase_4> 8048b7f: e8 60 0a 00 00 call 80495e4 <phase_defused> 8048b84: c7 04 24 6c 98 04 08 movl $0x804986c,(%esp) 8048b8b: e8 e4 fc ff ff call 8048874 <puts@plt> 8048b90: e8 fc 06 00 00 call 8049291 <read_line> 8048b95: 89 04 24 mov %eax,(%esp) 8048b98: e8 ec 01 00 00 call 8048d89 <phase_5> 8048b9d: e8 42 0a 00 00 call 80495e4 <phase_defused> 8048ba2: c7 04 24 b8 97 04 08 movl $0x80497b8,(%esp) 8048ba9: e8 c6 fc ff ff call 8048874 <puts@plt> 8048bae: e8 de 06 00 00 call 8049291 <read_line> 8048bb3: 89 04 24 mov %eax,(%esp) 8048bb6: e8 36 02 00 00 call 8048df1 <phase_6> 8048bbb: e8 24 0a 00 00 call 80495e4 <phase_defused> 8048bc0: b8 00 00 00 00 mov $0x0,%eax 8048bc5: 8b 5d fc mov -0x4(%ebp),%ebx 8048bc8: c9 leave 8048bc9: c3 ret 8048bca: 90 nop 8048bcb: 90 nop 08048bcc <phase_1>: 8048bcc: 55 push %ebp 8048bcd: 89 e5 mov %esp,%ebp 8048bcf: 83 ec 10 sub $0x10,%esp 8048bd2: 68 90 98 04 08 push $0x8049890 8048bd7: ff 75 08 pushl 0x8(%ebp) 8048bda: e8 45 04 00 00 call 8049024 <strings_not_equal> 8048bdf: 83 c4 10 add $0x10,%esp 8048be2: 85 c0 test %eax,%eax 8048be4: 74 05 je 8048beb <phase_1+0x1f> 8048be6: e8 b9 09 00 00 call 80495a4 <explode_bomb> 8048beb: c9 leave 8048bec: c3 ret 08048bed <phase_2>: 8048bed: 55 push %ebp 8048bee: 89 e5 mov %esp,%ebp 8048bf0: 53 push %ebx 8048bf1: 83 ec 2c sub $0x2c,%esp 8048bf4: 8d 45 d8 lea -0x28(%ebp),%eax 8048bf7: 50 push %eax 8048bf8: ff 75 08 pushl 0x8(%ebp) 8048bfb: e8 d1 03 00 00 call 8048fd1 <read_six_numbers> 8048c00: bb 01 00 00 00 mov $0x1,%ebx 8048c05: 83 c4 10 add $0x10,%esp 8048c08: 8b 44 9d d4 mov -0x2c(%ebp,%ebx,4),%eax 8048c0c: 83 c0 05 add $0x5,%eax 8048c0f: 39 44 9d d8 cmp %eax,-0x28(%ebp,%ebx,4) 8048c13: 74 05 je 8048c1a <phase_2+0x2d> 8048c15: e8 8a 09 00 00 call 80495a4 <explode_bomb> 8048c1a: 43 inc %ebx 8048c1b: 83 fb 05 cmp $0x5,%ebx 8048c1e: 7e e8 jle 8048c08 <phase_2+0x1b> 8048c20: 8b 5d fc mov -0x4(%ebp),%ebx 8048c23: c9 leave 8048c24: c3 ret 08048c25 <phase_3>: 8048c25: 55 push %ebp 8048c26: 89 e5 mov %esp,%ebp 8048c28: 53 push %ebx 8048c29: 83 ec 20 sub $0x20,%esp 8048c2c: 8d 45 f8 lea -0x8(%ebp),%eax 8048c2f: 50 push %eax 8048c30: 8d 45 f7 lea -0x9(%ebp),%eax 8048c33: 50 push %eax 8048c34: 8d 45 f0 lea -0x10(%ebp),%eax 8048c37: 50 push %eax 8048c38: 68 ea 98 04 08 push $0x80498ea 8048c3d: ff 75 08 pushl 0x8(%ebp) 8048c40: e8 ef fc ff ff call 8048934 <sscanf@plt> 8048c45: 83 c4 20 add $0x20,%esp 8048c48: 83 f8 02 cmp $0x2,%eax 8048c4b: 7f 05 jg 8048c52 <phase_3+0x2d> 8048c4d: e8 52 09 00 00 call 80495a4 <explode_bomb> 8048c52: 83 7d f0 07 cmpl $0x7,-0x10(%ebp) 8048c56: 0f 87 a1 00 00 00 ja 8048cfd <phase_3+0xd8> 8048c5c: 8b 45 f0 mov -0x10(%ebp),%eax 8048c5f: ff 24 85 f4 98 04 08 jmp *0x80498f4(,%eax,4) 8048c66: b3 6b mov $0x6b,%bl 8048c68: 81 7d f8 d9 00 00 00 cmpl $0xd9,-0x8(%ebp) 8048c6f: 0f 84 8f 00 00 00 je 8048d04 <phase_3+0xdf> 8048c75: e8 2a 09 00 00 call 80495a4 <explode_bomb> 8048c7a: e9 85 00 00 00 jmp 8048d04 <phase_3+0xdf> 8048c7f: b3 65 mov $0x65,%bl 8048c81: 81 7d f8 a6 03 00 00 cmpl $0x3a6,-0x8(%ebp) 8048c88: 74 7a je 8048d04 <phase_3+0xdf> 8048c8a: e8 15 09 00 00 call 80495a4 <explode_bomb> 8048c8f: eb 73 jmp 8048d04 <phase_3+0xdf> 8048c91: b3 72 mov $0x72,%bl 8048c93: 81 7d f8 94 01 00 00 cmpl $0x194,-0x8(%ebp) 8048c9a: 74 68 je 8048d04 <phase_3+0xdf> 8048c9c: e8 03 09 00 00 call 80495a4 <explode_bomb> 8048ca1: eb 61 jmp 8048d04 <phase_3+0xdf> 8048ca3: b3 72 mov $0x72,%bl 8048ca5: 81 7d f8 d8 00 00 00 cmpl $0xd8,-0x8(%ebp) 8048cac: 74 56 je 8048d04 <phase_3+0xdf> 8048cae: e8 f1 08 00 00 call 80495a4 <explode_bomb> 8048cb3: eb 4f jmp 8048d04 <phase_3+0xdf> 8048cb5: b3 75 mov $0x75,%bl 8048cb7: 81 7d f8 c0 03 00 00 cmpl $0x3c0,-0x8(%ebp) 8048cbe: 74 44 je 8048d04 <phase_3+0xdf> 8048cc0: e8 df 08 00 00 call 80495a4 <explode_bomb> 8048cc5: eb 3d jmp 8048d04 <phase_3+0xdf> 8048cc7: b3 72 mov $0x72,%bl 8048cc9: 81 7d f8 00 02 00 00 cmpl $0x200,-0x8(%ebp) 8048cd0: 74 32 je 8048d04 <phase_3+0xdf> 8048cd2: e8 cd 08 00 00 call 80495a4 <explode_bomb> 8048cd7: eb 2b jmp 8048d04 <phase_3+0xdf> 8048cd9: b3 78 mov $0x78,%bl 8048cdb: 81 7d f8 60 01 00 00 cmpl $0x160,-0x8(%ebp) 8048ce2: 74 20 je 8048d04 <phase_3+0xdf> 8048ce4: e8 bb 08 00 00 call 80495a4 <explode_bomb> 8048ce9: eb 19 jmp 8048d04 <phase_3+0xdf> 8048ceb: b3 71 mov $0x71,%bl 8048ced: 81 7d f8 b8 00 00 00 cmpl $0xb8,-0x8(%ebp) 8048cf4: 74 0e je 8048d04 <phase_3+0xdf> 8048cf6: e8 a9 08 00 00 call 80495a4 <explode_bomb> 8048cfb: eb 07 jmp 8048d04 <phase_3+0xdf> 8048cfd: b3 6b mov $0x6b,%bl 8048cff: e8 a0 08 00 00 call 80495a4 <explode_bomb> 8048d04: 3a 5d f7 cmp -0x9(%ebp),%bl 8048d07: 74 05 je 8048d0e <phase_3+0xe9> 8048d09: e8 96 08 00 00 call 80495a4 <explode_bomb> 8048d0e: 8b 5d fc mov -0x4(%ebp),%ebx 8048d11: c9 leave 8048d12: c3 ret 08048d13 <func4>: 8048d13: 55 push %ebp 8048d14: 89 e5 mov %esp,%ebp 8048d16: 56 push %esi 8048d17: 53 push %ebx 8048d18: 8b 75 08 mov 0x8(%ebp),%esi 8048d1b: b8 01 00 00 00 mov $0x1,%eax 8048d20: 83 fe 01 cmp $0x1,%esi 8048d23: 7e 1c jle 8048d41 <func4+0x2e> 8048d25: 83 ec 0c sub $0xc,%esp 8048d28: 8d 46 ff lea -0x1(%esi),%eax 8048d2b: 50 push %eax 8048d2c: e8 e2 ff ff ff call 8048d13 <func4> 8048d31: 89 c3 mov %eax,%ebx 8048d33: 8d 46 fe lea -0x2(%esi),%eax 8048d36: 89 04 24 mov %eax,(%esp) 8048d39: e8 d5 ff ff ff call 8048d13 <func4> 8048d3e: 8d 04 03 lea (%ebx,%eax,1),%eax 8048d41: 8d 65 f8 lea -0x8(%ebp),%esp 8048d44: 5b pop %ebx 8048d45: 5e pop %esi 8048d46: c9 leave 8048d47: c3 ret 08048d48 <phase_4>: 8048d48: 55 push %ebp 8048d49: 89 e5 mov %esp,%ebp 8048d4b: 83 ec 0c sub $0xc,%esp 8048d4e: 8d 45 fc lea -0x4(%ebp),%eax 8048d51: 50 push %eax 8048d52: 68 f0 98 04 08 push $0x80498f0 8048d57: ff 75 08 pushl 0x8(%ebp) 8048d5a: e8 d5 fb ff ff call 8048934 <sscanf@plt> 8048d5f: 83 c4 10 add $0x10,%esp 8048d62: 83 f8 01 cmp $0x1,%eax 8048d65: 75 06 jne 8048d6d <phase_4+0x25> 8048d67: 83 7d fc 00 cmpl $0x0,-0x4(%ebp) 8048d6b: 7f 05 jg 8048d72 <phase_4+0x2a> 8048d6d: e8 32 08 00 00 call 80495a4 <explode_bomb> 8048d72: ff 75 fc pushl -0x4(%ebp) 8048d75: e8 99 ff ff ff call 8048d13 <func4> 8048d7a: 83 c4 04 add $0x4,%esp 8048d7d: 83 f8 59 cmp $0x59,%eax 8048d80: 74 05 je 8048d87 <phase_4+0x3f> 8048d82: e8 1d 08 00 00 call 80495a4 <explode_bomb> 8048d87: c9 leave 8048d88: c3 ret 08048d89 <phase_5>: 8048d89: 55 push %ebp 8048d8a: 89 e5 mov %esp,%ebp 8048d8c: 53 push %ebx 8048d8d: 83 ec 14 sub $0x14,%esp 8048d90: 8d 45 f8 lea -0x8(%ebp),%eax 8048d93: 50 push %eax 8048d94: 8d 45 f4 lea -0xc(%ebp),%eax 8048d97: 50 push %eax 8048d98: 68 5c 99 04 08 push $0x804995c 8048d9d: ff 75 08 pushl 0x8(%ebp) 8048da0: e8 8f fb ff ff call 8048934 <sscanf@plt> 8048da5: 83 c4 10 add $0x10,%esp 8048da8: 83 f8 01 cmp $0x1,%eax 8048dab: 7f 05 jg 8048db2 <phase_5+0x29> 8048dad: e8 f2 07 00 00 call 80495a4 <explode_bomb> 8048db2: 8b 45 f4 mov -0xc(%ebp),%eax 8048db5: 83 e0 0f and $0xf,%eax 8048db8: 89 45 f4 mov %eax,-0xc(%ebp) 8048dbb: ba 00 00 00 00 mov $0x0,%edx 8048dc0: b9 00 00 00 00 mov $0x0,%ecx 8048dc5: 83 f8 0f cmp $0xf,%eax 8048dc8: 74 13 je 8048ddd <phase_5+0x54> 8048dca: bb c0 a5 04 08 mov $0x804a5c0,%ebx 8048dcf: 42 inc %edx 8048dd0: 8b 04 83 mov (%ebx,%eax,4),%eax 8048dd3: 01 c1 add %eax,%ecx 8048dd5: 83 f8 0f cmp $0xf,%eax 8048dd8: 75 f5 jne 8048dcf <phase_5+0x46> 8048dda: 89 45 f4 mov %eax,-0xc(%ebp) 8048ddd: 83 fa 09 cmp $0x9,%edx 8048de0: 75 05 jne 8048de7 <phase_5+0x5e> 8048de2: 3b 4d f8 cmp -0x8(%ebp),%ecx 8048de5: 74 05 je 8048dec <phase_5+0x63> 8048de7: e8 b8 07 00 00 call 80495a4 <explode_bomb> 8048dec: 8b 5d fc mov -0x4(%ebp),%ebx 8048def: c9 leave 8048df0: c3 ret 08048df1 <phase_6>: 8048df1: 55 push %ebp 8048df2: 89 e5 mov %esp,%ebp 8048df4: 57 push %edi 8048df5: 56 push %esi 8048df6: 53 push %ebx 8048df7: 83 ec 64 sub $0x64,%esp 8048dfa: c7 45 a4 3c a6 04 08 movl $0x804a63c,-0x5c(%ebp) 8048e01: 8d 45 c8 lea -0x38(%ebp),%eax 8048e04: 50 push %eax 8048e05: ff 75 08 pushl 0x8(%ebp) 8048e08: e8 c4 01 00 00 call 8048fd1 <read_six_numbers> 8048e0d: bf 00 00 00 00 mov $0x0,%edi 8048e12: 83 c4 10 add $0x10,%esp 8048e15: 8b 44 bd c8 mov -0x38(%ebp,%edi,4),%eax 8048e19: 48 dec %eax 8048e1a: 83 f8 05 cmp $0x5,%eax 8048e1d: 76 05 jbe 8048e24 <phase_6+0x33> 8048e1f: e8 80 07 00 00 call 80495a4 <explode_bomb> 8048e24: 8d 5f 01 lea 0x1(%edi),%ebx 8048e27: 83 fb 05 cmp $0x5,%ebx 8048e2a: 7f 15 jg 8048e41 <phase_6+0x50> 8048e2c: 8b 44 bd c8 mov -0x38(%ebp,%edi,4),%eax 8048e30: 3b 44 9d c8 cmp -0x38(%ebp,%ebx,4),%eax 8048e34: 75 05 jne 8048e3b <phase_6+0x4a> 8048e36: e8 69 07 00 00 call 80495a4 <explode_bomb> 8048e3b: 43 inc %ebx 8048e3c: 83 fb 05 cmp $0x5,%ebx 8048e3f: 7e eb jle 8048e2c <phase_6+0x3b> 8048e41: 47 inc %edi 8048e42: 83 ff 05 cmp $0x5,%edi 8048e45: 7e ce jle 8048e15 <phase_6+0x24> 8048e47: bf 00 00 00 00 mov $0x0,%edi 8048e4c: 8b 75 a4 mov -0x5c(%ebp),%esi 8048e4f: bb 01 00 00 00 mov $0x1,%ebx 8048e54: 83 7c bd c8 01 cmpl $0x1,-0x38(%ebp,%edi,4) 8048e59: 7e 0c jle 8048e67 <phase_6+0x76> 8048e5b: 8b 44 bd c8 mov -0x38(%ebp,%edi,4),%eax 8048e5f: 8b 76 08 mov 0x8(%esi),%esi 8048e62: 43 inc %ebx 8048e63: 39 d8 cmp %ebx,%eax 8048e65: 7f f8 jg 8048e5f <phase_6+0x6e> 8048e67: 89 74 bd a8 mov %esi,-0x58(%ebp,%edi,4) 8048e6b: 47 inc %edi 8048e6c: 83 ff 05 cmp $0x5,%edi 8048e6f: 7e db jle 8048e4c <phase_6+0x5b> 8048e71: 8b 75 a8 mov -0x58(%ebp),%esi 8048e74: 89 75 a4 mov %esi,-0x5c(%ebp) 8048e77: bf 01 00 00 00 mov $0x1,%edi 8048e7c: 8b 44 bd a8 mov -0x58(%ebp,%edi,4),%eax 8048e80: 89 46 08 mov %eax,0x8(%esi) 8048e83: 89 c6 mov %eax,%esi 8048e85: 47 inc %edi 8048e86: 83 ff 05 cmp $0x5,%edi 8048e89: 7e f1 jle 8048e7c <phase_6+0x8b> 8048e8b: c7 40 08 00 00 00 00 movl $0x0,0x8(%eax) 8048e92: 8b 75 a4 mov -0x5c(%ebp),%esi 8048e95: bf 00 00 00 00 mov $0x0,%edi 8048e9a: 8b 56 08 mov 0x8(%esi),%edx 8048e9d: 8b 06 mov (%esi),%eax 8048e9f: 3b 02 cmp (%edx),%eax 8048ea1: 7d 05 jge 8048ea8 <phase_6+0xb7> 8048ea3: e8 fc 06 00 00 call 80495a4 <explode_bomb> 8048ea8: 8b 76 08 mov 0x8(%esi),%esi 8048eab: 47 inc %edi 8048eac: 83 ff 04 cmp $0x4,%edi 8048eaf: 7e e9 jle 8048e9a <phase_6+0xa9> 8048eb1: 8d 65 f4 lea -0xc(%ebp),%esp 8048eb4: 5b pop %ebx 8048eb5: 5e pop %esi 8048eb6: 5f pop %edi 8048eb7: c9 leave 8048eb8: c3 ret 08048eb9 <fun7>: 8048eb9: 55 push %ebp 8048eba: 89 e5 mov %esp,%ebp 8048ebc: 8b 55 08 mov 0x8(%ebp),%edx 8048ebf: 8b 4d 0c mov 0xc(%ebp),%ecx 8048ec2: b8 ff ff ff ff mov $0xffffffff,%eax 8048ec7: 85 d2 test %edx,%edx 8048ec9: 74 2d je 8048ef8 <fun7+0x3f> 8048ecb: 39 0a cmp %ecx,(%edx) 8048ecd: 7e 10 jle 8048edf <fun7+0x26> 8048ecf: 83 ec 08 sub $0x8,%esp 8048ed2: 51 push %ecx 8048ed3: ff 72 04 pushl 0x4(%edx) 8048ed6: e8 de ff ff ff call 8048eb9 <fun7> 8048edb: d1 e0 shl %eax 8048edd: eb 19 jmp 8048ef8 <fun7+0x3f> 8048edf: b8 00 00 00 00 mov $0x0,%eax 8048ee4: 39 0a cmp %ecx,(%edx) 8048ee6: 74 10 je 8048ef8 <fun7+0x3f> 8048ee8: 83 ec 08 sub $0x8,%esp 8048eeb: 51 push %ecx 8048eec: ff 72 08 pushl 0x8(%edx) 8048eef: e8 c5 ff ff ff call 8048eb9 <fun7> 8048ef4: 8d 44 00 01 lea 0x1(%eax,%eax,1),%eax 8048ef8: c9 leave 8048ef9: c3 ret 08048efa <secret_phase>: 8048efa: 55 push %ebp 8048efb: 89 e5 mov %esp,%ebp 8048efd: 53 push %ebx 8048efe: 83 ec 04 sub $0x4,%esp 8048f01: e8 8b 03 00 00 call 8049291 <read_line> 8048f06: 6a 00 push $0x0 8048f08: 6a 0a push $0xa 8048f0a: 6a 00 push $0x0 8048f0c: 50 push %eax 8048f0d: e8 92 f9 ff ff call 80488a4 <__strtol_internal@plt> 8048f12: 83 c4 10 add $0x10,%esp 8048f15: 89 c3 mov %eax,%ebx 8048f17: 8d 40 ff lea -0x1(%eax),%eax 8048f1a: 3d e8 03 00 00 cmp $0x3e8,%eax 8048f1f: 76 05 jbe 8048f26 <secret_phase+0x2c> 8048f21: e8 7e 06 00 00 call 80495a4 <explode_bomb> 8048f26: 53 push %ebx 8048f27: 68 f0 a6 04 08 push $0x804a6f0 8048f2c: e8 88 ff ff ff call 8048eb9 <fun7> 8048f31: 83 c4 08 add $0x8,%esp 8048f34: 83 f8 05 cmp $0x5,%eax 8048f37: 74 05 je 8048f3e <secret_phase+0x44> 8048f39: e8 66 06 00 00 call 80495a4 <explode_bomb> 8048f3e: 83 ec 0c sub $0xc,%esp 8048f41: 68 c4 98 04 08 push $0x80498c4 8048f46: e8 29 f9 ff ff call 8048874 <puts@plt> 8048f4b: e8 94 06 00 00 call 80495e4 <phase_defused> 8048f50: 8b 5d fc mov -0x4(%ebp),%ebx 8048f53: c9 leave 8048f54: c3 ret 8048f55: 90 nop 8048f56: 90 nop 8048f57: 90 nop 08048f58 <sig_handler>: 8048f58: 55 push %ebp 8048f59: 89 e5 mov %esp,%ebp 8048f5b: 83 ec 14 sub $0x14,%esp 8048f5e: 68 5c 9b 04 08 push $0x8049b5c 8048f63: e8 0c f9 ff ff call 8048874 <puts@plt> 8048f68: c7 04 24 03 00 00 00 movl $0x3,(%esp) 8048f6f: e8 20 f9 ff ff call 8048894 <sleep@plt> 8048f74: c7 04 24 2f 99 04 08 movl $0x804992f,(%esp) 8048f7b: e8 54 f9 ff ff call 80488d4 <printf@plt> 8048f80: 83 c4 04 add $0x4,%esp 8048f83: ff 35 40 a8 04 08 pushl 0x804a840 8048f89: e8 a6 f8 ff ff call 8048834 <fflush@plt> 8048f8e: c7 04 24 01 00 00 00 movl $0x1,(%esp) 8048f95: e8 fa f8 ff ff call 8048894 <sleep@plt> 8048f9a: c7 04 24 37 99 04 08 movl $0x8049937,(%esp) 8048fa1: e8 ce f8 ff ff call 8048874 <puts@plt> 8048fa6: c7 04 24 10 00 00 00 movl $0x10,(%esp) 8048fad: e8 72 f9 ff ff call 8048924 <exit@plt> 08048fb2 <invalid_phase>: 8048fb2: 55 push %ebp 8048fb3: 89 e5 mov %esp,%ebp 8048fb5: 83 ec 10 sub $0x10,%esp 8048fb8: ff 75 08 pushl 0x8(%ebp) 8048fbb: 68 3f 99 04 08 push $0x804993f 8048fc0: e8 0f f9 ff ff call 80488d4 <printf@plt> 8048fc5: c7 04 24 08 00 00 00 movl $0x8,(%esp) 8048fcc: e8 53 f9 ff ff call 8048924 <exit@plt> 08048fd1 <read_six_numbers>: 8048fd1: 55 push %ebp 8048fd2: 89 e5 mov %esp,%ebp 8048fd4: 83 ec 08 sub $0x8,%esp 8048fd7: 8b 55 0c mov 0xc(%ebp),%edx 8048fda: 8d 42 14 lea 0x14(%edx),%eax 8048fdd: 50 push %eax 8048fde: 8d 42 10 lea 0x10(%edx),%eax 8048fe1: 50 push %eax 8048fe2: 8d 42 0c lea 0xc(%edx),%eax 8048fe5: 50 push %eax 8048fe6: 8d 42 08 lea 0x8(%edx),%eax 8048fe9: 50 push %eax 8048fea: 8d 42 04 lea 0x4(%edx),%eax 8048fed: 50 push %eax 8048fee: 52 push %edx 8048fef: 68 50 99 04 08 push $0x8049950 8048ff4: ff 75 08 pushl 0x8(%ebp) 8048ff7: e8 38 f9 ff ff call 8048934 <sscanf@plt> 8048ffc: 83 c4 20 add $0x20,%esp 8048fff: 83 f8 05 cmp $0x5,%eax 8049002: 7f 05 jg 8049009 <read_six_numbers+0x38> 8049004: e8 9b 05 00 00 call 80495a4 <explode_bomb> 8049009: c9 leave 804900a: c3 ret 0804900b <string_length>: 804900b: 55 push %ebp 804900c: 89 e5 mov %esp,%ebp 804900e: 8b 55 08 mov 0x8(%ebp),%edx 8049011: b8 00 00 00 00 mov $0x0,%eax 8049016: 80 3a 00 cmpb $0x0,(%edx) 8049019: 74 07 je 8049022 <string_length+0x17> 804901b: 42 inc %edx 804901c: 40 inc %eax 804901d: 80 3a 00 cmpb $0x0,(%edx) 8049020: 75 f9 jne 804901b <string_length+0x10> 8049022: c9 leave 8049023: c3 ret 08049024 <strings_not_equal>: 8049024: 55 push %ebp 8049025: 89 e5 mov %esp,%ebp 8049027: 57 push %edi 8049028: 56 push %esi 8049029: 53 push %ebx 804902a: 8b 75 08 mov 0x8(%ebp),%esi 804902d: 8b 7d 0c mov 0xc(%ebp),%edi 8049030: 56 push %esi 8049031: e8 d5 ff ff ff call 804900b <string_length> 8049036: 89 c3 mov %eax,%ebx 8049038: 57 push %edi 8049039: e8 cd ff ff ff call 804900b <string_length> 804903e: 83 c4 08 add $0x8,%esp 8049041: ba 01 00 00 00 mov $0x1,%edx 8049046: 39 c3 cmp %eax,%ebx 8049048: 75 24 jne 804906e <strings_not_equal+0x4a> 804904a: eb 07 jmp 8049053 <strings_not_equal+0x2f> 804904c: ba 01 00 00 00 mov $0x1,%edx 8049051: eb 1b jmp 804906e <strings_not_equal+0x4a> 8049053: 89 f2 mov %esi,%edx 8049055: 89 f9 mov %edi,%ecx 8049057: 80 3e 00 cmpb $0x0,(%esi) 804905a: 74 0d je 8049069 <strings_not_equal+0x45> 804905c: 8a 02 mov (%edx),%al 804905e: 3a 01 cmp (%ecx),%al 8049060: 75 ea jne 804904c <strings_not_equal+0x28> 8049062: 42 inc %edx 8049063: 41 inc %ecx 8049064: 80 3a 00 cmpb $0x0,(%edx) 8049067: 75 f3 jne 804905c <strings_not_equal+0x38> 8049069: ba 00 00 00 00 mov $0x0,%edx 804906e: 89 d0 mov %edx,%eax 8049070: 8d 65 f4 lea -0xc(%ebp),%esp 8049073: 5b pop %ebx 8049074: 5e pop %esi 8049075: 5f pop %edi 8049076: c9 leave 8049077: c3 ret 08049078 <open_clientfd>: 8049078: 55 push %ebp 8049079: 89 e5 mov %esp,%ebp 804907b: 57 push %edi 804907c: 56 push %esi 804907d: 53 push %ebx 804907e: 83 ec 20 sub $0x20,%esp 8049081: 8b 75 0c mov 0xc(%ebp),%esi 8049084: 6a 00 push $0x0 8049086: 6a 01 push $0x1 8049088: 6a 02 push $0x2 804908a: e8 05 f9 ff ff call 8048994 <socket@plt> 804908f: 89 c3 mov %eax,%ebx 8049091: 83 c4 10 add $0x10,%esp 8049094: 85 c0 test %eax,%eax 8049096: 79 19 jns 80490b1 <open_clientfd+0x39> 8049098: 83 ec 0c sub $0xc,%esp 804909b: 68 62 99 04 08 push $0x8049962 80490a0: e8 cf f7 ff ff call 8048874 <puts@plt> 80490a5: c7 04 24 08 00 00 00 movl $0x8,(%esp) 80490ac: e8 73 f8 ff ff call 8048924 <exit@plt> 80490b1: 83 ec 0c sub $0xc,%esp 80490b4: ff 75 08 pushl 0x8(%ebp) 80490b7: e8 48 f8 ff ff call 8048904 <gethostbyname@plt> 80490bc: 89 c2 mov %eax,%edx 80490be: 83 c4 10 add $0x10,%esp 80490c1: 85 c0 test %eax,%eax 80490c3: 75 19 jne 80490de <open_clientfd+0x66> 80490c5: 83 ec 0c sub $0xc,%esp 80490c8: 68 70 99 04 08 push $0x8049970 80490cd: e8 a2 f7 ff ff call 8048874 <puts@plt> 80490d2: c7 04 24 08 00 00 00 movl $0x8,(%esp) 80490d9: e8 46 f8 ff ff call 8048924 <exit@plt> 80490de: 8d 7d d8 lea -0x28(%ebp),%edi 80490e1: fc cld 80490e2: b9 04 00 00 00 mov $0x4,%ecx 80490e7: b8 00 00 00 00 mov $0x0,%eax 80490ec: f3 ab rep stos %eax,%es:(%edi) 80490ee: 66 c7 45 d8 02 00 movw $0x2,-0x28(%ebp) 80490f4: 83 ec 04 sub $0x4,%esp 80490f7: ff 72 0c pushl 0xc(%edx) 80490fa: 8d 45 dc lea -0x24(%ebp),%eax 80490fd: 50 push %eax 80490fe: 8b 42 10 mov 0x10(%edx),%eax 8049101: ff 30 pushl (%eax) 8049103: e8 3c f7 ff ff call 8048844 <bcopy@plt> 8049108: 83 c4 0c add $0xc,%esp 804910b: 89 f0 mov %esi,%eax 804910d: 66 c1 c8 08 ror $0x8,%ax 8049111: 66 89 45 da mov %ax,-0x26(%ebp) 8049115: 6a 10 push $0x10 8049117: 8d 45 d8 lea -0x28(%ebp),%eax 804911a: 50 push %eax 804911b: 53 push %ebx 804911c: e8 23 f8 ff ff call 8048944 <connect@plt> 8049121: 83 c4 10 add $0x10,%esp 8049124: 85 c0 test %eax,%eax 8049126: 79 19 jns 8049141 <open_clientfd+0xc9> 8049128: 83 ec 0c sub $0xc,%esp 804912b: 68 7e 99 04 08 push $0x804997e 8049130: e8 3f f7 ff ff call 8048874 <puts@plt> 8049135: c7 04 24 08 00 00 00 movl $0x8,(%esp) 804913c: e8 e3 f7 ff ff call 8048924 <exit@plt> 8049141: 89 d8 mov %ebx,%eax 8049143: 8d 65 f4 lea -0xc(%ebp),%esp 8049146: 5b pop %ebx 8049147: 5e pop %esi 8049148: 5f pop %edi 8049149: c9 leave 804914a: c3 ret 0804914b <initialize_bomb>: 804914b: 55 push %ebp 804914c: 89 e5 mov %esp,%ebp 804914e: 57 push %edi 804914f: 56 push %esi 8049150: 53 push %ebx 8049151: 83 ec 64 sub $0x64,%esp 8049154: c7 45 a4 00 00 00 00 movl $0x0,-0x5c(%ebp) 804915b: 68 58 8f 04 08 push $0x8048f58 8049160: 6a 02 push $0x2 8049162: e8 bd f6 ff ff call 8048824 <signal@plt> 8049167: 83 c4 08 add $0x8,%esp 804916a: 6a 40 push $0x40 804916c: 8d 45 a8 lea -0x58(%ebp),%eax 804916f: 50 push %eax 8049170: e8 7f f7 ff ff call 80488f4 <gethostname@plt> 8049175: 83 c4 10 add $0x10,%esp 8049178: 85 c0 test %eax,%eax 804917a: 74 22 je 804919e <initialize_bomb+0x53> 804917c: 83 ec 0c sub $0xc,%esp 804917f: 68 8c 99 04 08 push $0x804998c 8049184: e8 eb f6 ff ff call 8048874 <puts@plt> 8049189: c7 04 24 08 00 00 00 movl $0x8,(%esp) 8049190: e8 8f f7 ff ff call 8048924 <exit@plt> 8049195: c7 45 a4 01 00 00 00 movl $0x1,-0x5c(%ebp) 804919c: eb 34 jmp 80491d2 <initialize_bomb+0x87> 804919e: bb 00 00 00 00 mov $0x0,%ebx 80491a3: 83 3d 00 a7 04 08 00 cmpl $0x0,0x804a700 80491aa: 74 26 je 80491d2 <initialize_bomb+0x87> 80491ac: 8d 7d a8 lea -0x58(%ebp),%edi 80491af: be 00 a7 04 08 mov $0x804a700,%esi 80491b4: 83 ec 08 sub $0x8,%esp 80491b7: 57 push %edi 80491b8: ff 34 9e pushl (%esi,%ebx,4) 80491bb: e8 54 f7 ff ff call 8048914 <strcasecmp@plt> 80491c0: 83 c4 10 add $0x10,%esp 80491c3: 85 c0 test %eax,%eax 80491c5: 74 ce je 8049195 <initialize_bomb+0x4a> 80491c7: 43 inc %ebx 80491c8: 83 3c 9d 00 a7 04 08 cmpl $0x0,0x804a700(,%ebx,4) 80491cf: 00 80491d0: 75 e2 jne 80491b4 <initialize_bomb+0x69> 80491d2: 83 7d a4 00 cmpl $0x0,-0x5c(%ebp) 80491d6: 75 19 jne 80491f1 <initialize_bomb+0xa6> 80491d8: 83 ec 0c sub $0xc,%esp 80491db: 68 99 99 04 08 push $0x8049999 80491e0: e8 8f f6 ff ff call 8048874 <puts@plt> 80491e5: c7 04 24 08 00 00 00 movl $0x8,(%esp) 80491ec: e8 33 f7 ff ff call 8048924 <exit@plt> 80491f1: 83 ec 18 sub $0x18,%esp 80491f4: 6a 50 push $0x50 80491f6: 68 a7 99 04 08 push $0x80499a7 80491fb: e8 78 fe ff ff call 8049078 <open_clientfd> 8049200: 83 c4 14 add $0x14,%esp 8049203: 50 push %eax 8049204: e8 db f5 ff ff call 80487e4 <close@plt> 8049209: 8d 65 f4 lea -0xc(%ebp),%esp 804920c: 5b pop %ebx 804920d: 5e pop %esi 804920e: 5f pop %edi 804920f: c9 leave 8049210: c3 ret 08049211 <blank_line>: 8049211: 55 push %ebp 8049212: 89 e5 mov %esp,%ebp 8049214: 53 push %ebx 8049215: 83 ec 04 sub $0x4,%esp 8049218: 8b 5d 08 mov 0x8(%ebp),%ebx 804921b: 80 3b 00 cmpb $0x0,(%ebx) 804921e: 74 1e je 804923e <blank_line+0x2d> 8049220: e8 7f f7 ff ff call 80489a4 <__ctype_b_loc@plt> 8049225: 8b 10 mov (%eax),%edx 8049227: 0f be 03 movsbl (%ebx),%eax 804922a: 43 inc %ebx 804922b: f6 44 42 01 20 testb $0x20,0x1(%edx,%eax,2) 8049230: 75 07 jne 8049239 <blank_line+0x28> 8049232: b8 00 00 00 00 mov $0x0,%eax 8049237: eb 0a jmp 8049243 <blank_line+0x32> 8049239: 80 3b 00 cmpb $0x0,(%ebx) 804923c: 75 e9 jne 8049227 <blank_line+0x16> 804923e: b8 01 00 00 00 mov $0x1,%eax 8049243: 83 c4 04 add $0x4,%esp 8049246: 5b pop %ebx 8049247: c9 leave 8049248: c3 ret 08049249 <skip>: 8049249: 55 push %ebp 804924a: 89 e5 mov %esp,%ebp 804924c: 53 push %ebx 804924d: 83 ec 04 sub $0x4,%esp 8049250: 83 ec 04 sub $0x4,%esp 8049253: ff 35 50 a8 04 08 pushl 0x804a850 8049259: 6a 50 push $0x50 804925b: a1 4c a8 04 08 mov 0x804a84c,%eax 8049260: 8d 04 80 lea (%eax,%eax,4),%eax 8049263: c1 e0 04 shl $0x4,%eax 8049266: 05 60 a8 04 08 add $0x804a860,%eax 804926b: 50 push %eax 804926c: e8 13 f6 ff ff call 8048884 <fgets@plt> 8049271: 89 c3 mov %eax,%ebx 8049273: 83 c4 10 add $0x10,%esp 8049276: 85 c0 test %eax,%eax 8049278: 74 10 je 804928a <skip+0x41> 804927a: 83 ec 0c sub $0xc,%esp 804927d: 50 push %eax 804927e: e8 8e ff ff ff call 8049211 <blank_line> 8049283: 83 c4 10 add $0x10,%esp 8049286: 85 c0 test %eax,%eax 8049288: 75 c6 jne 8049250 <skip+0x7> 804928a: 89 d8 mov %ebx,%eax 804928c: 8b 5d fc mov -0x4(%ebp),%ebx 804928f: c9 leave 8049290: c3 ret 08049291 <read_line>: 8049291: 55 push %ebp 8049292: 89 e5 mov %esp,%ebp 8049294: 57 push %edi 8049295: 83 ec 04 sub $0x4,%esp 8049298: e8 ac ff ff ff call 8049249 <skip> 804929d: 85 c0 test %eax,%eax 804929f: 75 6a jne 804930b <read_line+0x7a> 80492a1: a1 50 a8 04 08 mov 0x804a850,%eax 80492a6: 3b 05 44 a8 04 08 cmp 0x804a844,%eax 80492ac: 75 17 jne 80492c5 <read_line+0x34> 80492ae: 83 ec 0c sub $0xc,%esp 80492b1: 68 b3 99 04 08 push $0x80499b3 80492b6: e8 b9 f5 ff ff call 8048874 <puts@plt> 80492bb: e8 e4 02 00 00 call 80495a4 <explode_bomb> 80492c0: 83 c4 10 add $0x10,%esp 80492c3: eb 46 jmp 804930b <read_line+0x7a> 80492c5: 83 ec 0c sub $0xc,%esp 80492c8: 68 d1 99 04 08 push $0x80499d1 80492cd: e8 42 f5 ff ff call 8048814 <getenv@plt> 80492d2: 83 c4 10 add $0x10,%esp 80492d5: 85 c0 test %eax,%eax 80492d7: 74 0a je 80492e3 <read_line+0x52> 80492d9: 83 ec 0c sub $0xc,%esp 80492dc: 6a 00 push $0x0 80492de: e8 41 f6 ff ff call 8048924 <exit@plt> 80492e3: a1 44 a8 04 08 mov 0x804a844,%eax 80492e8: a3 50 a8 04 08 mov %eax,0x804a850 80492ed: e8 57 ff ff ff call 8049249 <skip> 80492f2: 85 c0 test %eax,%eax 80492f4: 75 15 jne 804930b <read_line+0x7a> 80492f6: 83 ec 0c sub $0xc,%esp 80492f9: 68 b3 99 04 08 push $0x80499b3 80492fe: e8 71 f5 ff ff call 8048874 <puts@plt> 8049303: e8 9c 02 00 00 call 80495a4 <explode_bomb> 8049308: 83 c4 10 add $0x10,%esp 804930b: a1 4c a8 04 08 mov 0x804a84c,%eax 8049310: 8d 04 80 lea (%eax,%eax,4),%eax 8049313: c1 e0 04 shl $0x4,%eax 8049316: 8d b8 60 a8 04 08 lea 0x804a860(%eax),%edi 804931c: fc cld 804931d: b9 ff ff ff ff mov $0xffffffff,%ecx 8049322: b0 00 mov $0x0,%al 8049324: f2 ae repnz scas %es:(%edi),%al 8049326: f7 d1 not %ecx 8049328: 8d 79 ff lea -0x1(%ecx),%edi 804932b: 83 ff 4f cmp $0x4f,%edi 804932e: 75 15 jne 8049345 <read_line+0xb4> 8049330: 83 ec 0c sub $0xc,%esp 8049333: 68 dc 99 04 08 push $0x80499dc 8049338: e8 37 f5 ff ff call 8048874 <puts@plt> 804933d: e8 62 02 00 00 call 80495a4 <explode_bomb> 8049342: 83 c4 10 add $0x10,%esp 8049345: 8b 15 4c a8 04 08 mov 0x804a84c,%edx 804934b: 8d 04 92 lea (%edx,%edx,4),%eax 804934e: c1 e0 04 shl $0x4,%eax 8049351: 05 60 a8 04 08 add $0x804a860,%eax 8049356: c6 44 38 ff 00 movb $0x0,-0x1(%eax,%edi,1) 804935b: 42 inc %edx 804935c: 89 15 4c a8 04 08 mov %edx,0x804a84c 8049362: 8b 7d fc mov -0x4(%ebp),%edi 8049365: c9 leave 8049366: c3 ret 08049367 <send_msg>: 8049367: 55 push %ebp 8049368: 89 e5 mov %esp,%ebp 804936a: 57 push %edi 804936b: 56 push %esi 804936c: 53 push %ebx 804936d: 83 ec 78 sub $0x78,%esp 8049370: 6a 00 push $0x0 8049372: e8 ed f5 ff ff call 8048964 <dup@plt> 8049377: 89 45 90 mov %eax,-0x70(%ebp) 804937a: 83 c4 10 add $0x10,%esp 804937d: 83 f8 ff cmp $0xffffffff,%eax 8049380: 75 19 jne 804939b <send_msg+0x34> 8049382: 83 ec 0c sub $0xc,%esp 8049385: 68 f7 99 04 08 push $0x80499f7 804938a: e8 e5 f4 ff ff call 8048874 <puts@plt> 804938f: c7 04 24 08 00 00 00 movl $0x8,(%esp) 8049396: e8 89 f5 ff ff call 8048924 <exit@plt> 804939b: 83 ec 0c sub $0xc,%esp 804939e: 6a 00 push $0x0 80493a0: e8 3f f4 ff ff call 80487e4 <close@plt> 80493a5: 83 c4 10 add $0x10,%esp 80493a8: 83 f8 ff cmp $0xffffffff,%eax 80493ab: 75 19 jne 80493c6 <send_msg+0x5f> 80493ad: 83 ec 0c sub $0xc,%esp 80493b0: 68 0b 9a 04 08 push $0x8049a0b 80493b5: e8 ba f4 ff ff call 8048874 <puts@plt> 80493ba: c7 04 24 08 00 00 00 movl $0x8,(%esp) 80493c1: e8 5e f5 ff ff call 8048924 <exit@plt> 80493c6: e8 39 f4 ff ff call 8048804 <tmpfile@plt> 80493cb: 89 45 94 mov %eax,-0x6c(%ebp) 80493ce: 85 c0 test %eax,%eax 80493d0: 75 19 jne 80493eb <send_msg+0x84> 80493d2: 83 ec 0c sub $0xc,%esp 80493d5: 68 1e 9a 04 08 push $0x8049a1e 80493da: e8 95 f4 ff ff call 8048874 <puts@plt> 80493df: c7 04 24 08 00 00 00 movl $0x8,(%esp) 80493e6: e8 39 f5 ff ff call 8048924 <exit@plt> 80493eb: ff 75 94 pushl -0x6c(%ebp) 80493ee: 6a 1b push $0x1b 80493f0: 6a 01 push $0x1 80493f2: 68 33 9a 04 08 push $0x8049a33 80493f7: e8 88 f5 ff ff call 8048984 <fwrite@plt> 80493fc: 83 c4 08 add $0x8,%esp 80493ff: ff 75 94 pushl -0x6c(%ebp) 8049402: 6a 0a push $0xa 8049404: e8 ab f4 ff ff call 80488b4 <fputc@plt> 8049409: c7 04 24 00 00 00 00 movl $0x0,(%esp) 8049410: e8 9f f5 ff ff call 80489b4 <cuserid@plt> 8049415: 83 c4 10 add $0x10,%esp 8049418: 85 c0 test %eax,%eax 804941a: 75 15 jne 8049431 <send_msg+0xca> 804941c: be 4f 9a 04 08 mov $0x8049a4f,%esi 8049421: 8d 7d 98 lea -0x68(%ebp),%edi 8049424: fc cld 8049425: b9 01 00 00 00 mov $0x1,%ecx 804942a: f3 a5 rep movsl %ds:(%esi),%es:(%edi) 804942c: 66 a5 movsw %ds:(%esi),%es:(%edi) 804942e: a4 movsb %ds:(%esi),%es:(%edi) 804942f: eb 10 jmp 8049441 <send_msg+0xda> 8049431: 83 ec 08 sub $0x8,%esp 8049434: 50 push %eax 8049435: 8d 45 98 lea -0x68(%ebp),%eax 8049438: 50 push %eax 8049439: e8 86 f5 ff ff call 80489c4 <strcpy@plt> 804943e: 83 c4 10 add $0x10,%esp 8049441: 83 ec 04 sub $0x4,%esp 8049444: ff 35 4c a8 04 08 pushl 0x804a84c 804944a: b8 56 9a 04 08 mov $0x8049a56,%eax 804944f: 83 7d 08 00 cmpl $0x0,0x8(%ebp) 8049453: 75 05 jne 804945a <send_msg+0xf3> 8049455: b8 5e 9a 04 08 mov $0x8049a5e,%eax 804945a: 50 push %eax 804945b: 8d 45 98 lea -0x68(%ebp),%eax 804945e: 50 push %eax 804945f: ff 35 a0 a1 04 08 pushl 0x804a1a0 8049465: 68 c0 a1 04 08 push $0x804a1c0 804946a: 68 67 9a 04 08 push $0x8049a67 804946f: ff 75 94 pushl -0x6c(%ebp) 8049472: e8 7d f3 ff ff call 80487f4 <fprintf@plt> 8049477: ba 00 00 00 00 mov $0x0,%edx 804947c: 83 c4 20 add $0x20,%esp 804947f: 3b 15 4c a8 04 08 cmp 0x804a84c,%edx 8049485: 7d 3c jge 80494c3 <send_msg+0x15c> 8049487: 83 ec 04 sub $0x4,%esp 804948a: 8d 04 92 lea (%edx,%edx,4),%eax 804948d: c1 e0 04 shl $0x4,%eax 8049490: 05 60 a8 04 08 add $0x804a860,%eax 8049495: 50 push %eax 8049496: 8d 5a 01 lea 0x1(%edx),%ebx 8049499: 53 push %ebx 804949a: 8d 45 98 lea -0x68(%ebp),%eax 804949d: 50 push %eax 804949e: ff 35 a0 a1 04 08 pushl 0x804a1a0 80494a4: 68 c0 a1 04 08 push $0x804a1c0 80494a9: 68 83 9a 04 08 push $0x8049a83 80494ae: ff 75 94 pushl -0x6c(%ebp) 80494b1: e8 3e f3 ff ff call 80487f4 <fprintf@plt> 80494b6: 83 c4 20 add $0x20,%esp 80494b9: 89 da mov %ebx,%edx 80494bb: 3b 1d 4c a8 04 08 cmp 0x804a84c,%ebx 80494c1: 7c c4 jl 8049487 <send_msg+0x120> 80494c3: 83 ec 0c sub $0xc,%esp 80494c6: ff 75 94 pushl -0x6c(%ebp) 80494c9: e8 86 f3 ff ff call 8048854 <rewind@plt> 80494ce: c7 04 24 14 99 04 08 movl $0x8049914,(%esp) 80494d5: 68 9f 9a 04 08 push $0x8049a9f 80494da: 68 a4 9a 04 08 push $0x8049aa4 80494df: 68 bb 9a 04 08 push $0x8049abb 80494e4: 68 a0 ae 04 08 push $0x804aea0 80494e9: e8 86 f4 ff ff call 8048974 <sprintf@plt> 80494ee: 83 c4 14 add $0x14,%esp 80494f1: 68 a0 ae 04 08 push $0x804aea0 80494f6: e8 69 f3 ff ff call 8048864 <system@plt> 80494fb: 83 c4 10 add $0x10,%esp 80494fe: 85 c0 test %eax,%eax 8049500: 74 19 je 804951b <send_msg+0x1b4> 8049502: 83 ec 0c sub $0xc,%esp 8049505: 68 c4 9a 04 08 push $0x8049ac4 804950a: e8 65 f3 ff ff call 8048874 <puts@plt> 804950f: c7 04 24 08 00 00 00 movl $0x8,(%esp) 8049516: e8 09 f4 ff ff call 8048924 <exit@plt> 804951b: 83 ec 0c sub $0xc,%esp 804951e: ff 75 94 pushl -0x6c(%ebp) 8049521: e8 be f3 ff ff call 80488e4 <fclose@plt> 8049526: 83 c4 10 add $0x10,%esp 8049529: 85 c0 test %eax,%eax 804952b: 74 19 je 8049546 <send_msg+0x1df> 804952d: 83 ec 0c sub $0xc,%esp 8049530: 68 de 9a 04 08 push $0x8049ade 8049535: e8 3a f3 ff ff call 8048874 <puts@plt> 804953a: c7 04 24 08 00 00 00 movl $0x8,(%esp) 8049541: e8 de f3 ff ff call 8048924 <exit@plt> 8049546: 83 ec 0c sub $0xc,%esp 8049549: ff 75 90 pushl -0x70(%ebp) 804954c: e8 13 f4 ff ff call 8048964 <dup@plt> 8049551: 83 c4 10 add $0x10,%esp 8049554: 85 c0 test %eax,%eax 8049556: 74 19 je 8049571 <send_msg+0x20a> 8049558: 83 ec 0c sub $0xc,%esp 804955b: 68 f7 9a 04 08 push $0x8049af7 8049560: e8 0f f3 ff ff call 8048874 <puts@plt> 8049565: c7 04 24 08 00 00 00 movl $0x8,(%esp) 804956c: e8 b3 f3 ff ff call 8048924 <exit@plt> 8049571: 83 ec 0c sub $0xc,%esp 8049574: ff 75 90 pushl -0x70(%ebp) 8049577: e8 68 f2 ff ff call 80487e4 <close@plt> 804957c: 83 c4 10 add $0x10,%esp 804957f: 85 c0 test %eax,%eax 8049581: 74 19 je 804959c <send_msg+0x235> 8049583: 83 ec 0c sub $0xc,%esp 8049586: 68 12 9b 04 08 push $0x8049b12 804958b: e8 e4 f2 ff ff call 8048874 <puts@plt> 8049590: c7 04 24 08 00 00 00 movl $0x8,(%esp) 8049597: e8 88 f3 ff ff call 8048924 <exit@plt> 804959c: 8d 65 f4 lea -0xc(%ebp),%esp 804959f: 5b pop %ebx 80495a0: 5e pop %esi 80495a1: 5f pop %edi 80495a2: c9 leave 80495a3: c3 ret 080495a4 <explode_bomb>: 80495a4: 55 push %ebp 80495a5: 89 e5 mov %esp,%ebp 80495a7: 83 ec 14 sub $0x14,%esp 80495aa: 68 29 9b 04 08 push $0x8049b29 80495af: e8 c0 f2 ff ff call 8048874 <puts@plt> 80495b4: c7 04 24 32 9b 04 08 movl $0x8049b32,(%esp) 80495bb: e8 b4 f2 ff ff call 8048874 <puts@plt> 80495c0: c7 04 24 00 00 00 00 movl $0x0,(%esp) 80495c7: e8 9b fd ff ff call 8049367 <send_msg> 80495cc: c7 04 24 94 9b 04 08 movl $0x8049b94,(%esp) 80495d3: e8 9c f2 ff ff call 8048874 <puts@plt> 80495d8: c7 04 24 08 00 00 00 movl $0x8,(%esp) 80495df: e8 40 f3 ff ff call 8048924 <exit@plt> 080495e4 <phase_defused>: 80495e4: 55 push %ebp 80495e5: 89 e5 mov %esp,%ebp 80495e7: 53 push %ebx 80495e8: 83 ec 70 sub $0x70,%esp 80495eb: 6a 01 push $0x1 80495ed: e8 75 fd ff ff call 8049367 <send_msg> 80495f2: 83 c4 10 add $0x10,%esp 80495f5: 83 3d 4c a8 04 08 06 cmpl $0x6,0x804a84c 80495fc: 75 6e jne 804966
Jesus Christ, I have absolutely no idea how that works. Good luck.
Do you have the original binary? This program seems to rely on strings/data in the binary that don't show up in the disassembled code.
Oops double post.
I solved it. It was quite a doosey. Took about 20 hours. And for referencing purposes, this was extremely helpful. [url]http://teamterradactyl.blogspot.com/2007/10/binary-bomb.html[/url]
[QUOTE=BarryBostwic;26608181]I solved it. It was quite a doosey. Took about 20 hours.[/QUOTE] see? assembly is slow as hell to write and execute learn lua instead. you'll thank me for it
Sorry, you need to Log In to post a reply to this thread.