title: Understanding/decoding obscure assembly code
body: <p>Like my previous question, this involves an assignment where a method is called which requires a certain password, the code is hidden and we have to infer the password from the assembly code (I want to avoid hitting . I've completed a few phases so far and I'm getting better at understanding, however this phase has a few aspects I am having trouble with. So far I know the password to this phase is two integers. Backtracing has been my goto method for some of these but is not very helpful for this phase.</p>
  
  <ol>
  <li>I understand cltq expands eax(rax) to 4 words, but I'm not sure how this affects calculations, and also unsure what happens if that line is hit multiple times.</li>
  <li>the phase5+82 -> phase5+65 (a loop?) What values am I trying to start with so ecx(rcx) can pass the final comparison?</li>
  <li>mov    0x402600(,%rax,4),%eax &lt;- what does this line do exactly? The blank is throwing me off, is a blank = 0?</li>
  <li><p>Any other help understanding what is going on and how I should approach figuring out the input would be helpful, I have attempted to convert this back into C code, like previous phases</p>
  
  <pre><code>0x00000000004010b4 &lt;phase_5+0&gt;:         sub    $0x18,%rsp
  0x00000000004010b8 &lt;phase_5+4&gt;:         lea    0x10(%rsp),%rcx
  0x00000000004010bd &lt;phase_5+9&gt;:         lea    0x14(%rsp),%rdx
  0x00000000004010c2 &lt;phase_5+14&gt;:        mov    $0x4026aa,%esi
  0x00000000004010c7 &lt;phase_5+19&gt;:        mov    $0x0,%eax
  0x00000000004010cc &lt;phase_5+24&gt;:        callq  0x400b80&lt;sscanf@plt&gt;
  0x00000000004010d1 &lt;phase_5+29&gt;:        cmp    $0x1,%eax
  0x00000000004010d4 &lt;phase_5+32&gt;:        jg     0x4010db&lt;phase_5+39&gt;
  0x00000000004010d6 &lt;phase_5+34&gt;:        callq  0x401421(explode_bomb)
  0x00000000004010db &lt;phase_5+39&gt;:        mov    0x14(%rsp),%eax
  0x00000000004010df &lt;phase_5+43&gt;:        and    $0xf,%eax
  0x00000000004010e2 &lt;phase_5+46&gt;:        mov    %eax,0x14(%rsp)
  0x00000000004010e6 &lt;phase_5+50&gt;:        cmp    $0xf,%eax
  0x00000000004010e9 &lt;phase_5+53&gt;:        je     0x40111b &lt;phase_5+103&gt;
  0x00000000004010eb &lt;phase_5+55&gt;:        mov    $0x0,%edx
  0x00000000004010f0 &lt;phase_5+60&gt;:        mov    $0x0,%ecx
  0x00000000004010f5 &lt;phase_5+65&gt;:        add    $0x1,%edx
  0x00000000004010f8 &lt;phase_5+68&gt;:        cltq   
  0x00000000004010fa &lt;phase_5+70&gt;:        mov    0x402600(,%rax,4),%eax
  0x0000000000401101 &lt;phase_5+77&gt;:        add    %eax,%ecx
  0x0000000000401103 &lt;phase_5+79&gt;:        cmp    $0xf,%eax
  0x0000000000401106 &lt;phase_5+82&gt;:        jne    0x4010f5 &lt;phase_5+65&gt;
  0x0000000000401108 &lt;phase_5+84&gt;:        movl   $0xf,0x14(%rsp)
  0x0000000000401110 &lt;phase_5+92&gt;:        cmp    $0xf,%edx
  0x0000000000401113 &lt;phase_5+95&gt;:        jne    0x40111b &lt;phase_5+103&gt;
  0x0000000000401115 &lt;phase_5+97&gt;:        cmp    %ecx,0x10(%rsp)
  0x0000000000401119 &lt;phase_5+101&gt;:       je     0x401120 &lt;phase_5+108&gt;
  0x000000000040111b &lt;phase_5+103&gt;:       callq  0x401421 &lt;explode_bomb&gt;
  0x0000000000401120 &lt;phase_5+108&gt;:       add    $0x18,%rsp
  0x0000000000401124 &lt;phase_5+112&gt;:       retq   
  </code></pre></li>
  </ol>