title: Binary Bomb phase 6 no nodes
body: <p>This question is based on the same project as the other Binary Bomb Phase 6 questions (most likely will be related links), but for some reason I can't find the nodes themselves, to check their increasing/decreasing values. When I try to use the function: x/3x $eax, it returns: Cannot access memory at 0x4, which makes me think that it actually isn't a node. It is, however, what is in the end being compared to check for equality.</p>
  
  <pre><code>(gdb) x/3x $eax
  0x4:    Cannot access memory at address 0x4
  </code></pre>
  
  <p>Here is the function phase_6: </p>
  
  <pre><code>   0x08048dea &lt;+0&gt;:     push   %esi
     0x08048deb &lt;+1&gt;:     push   %ebx
     0x08048dec &lt;+2&gt;:     sub    $0x44,%esp
     0x08048def &lt;+5&gt;:     lea    0x10(%esp),%eax
     0x08048df3 &lt;+9&gt;:     mov    %eax,0x4(%esp)
     0x08048df7 &lt;+13&gt;:    mov    0x50(%esp),%eax
     0x08048dfb &lt;+17&gt;:    mov    %eax,(%esp)
     0x08048dfe &lt;+20&gt;:    call   0x8049479 &lt;read_six_numbers&gt;
     0x08048e03 &lt;+25&gt;:    mov    $0x0,%esi
     0x08048e08 &lt;+30&gt;:    mov    0x10(%esp,%esi,4),%eax
     0x08048e0c &lt;+34&gt;:    sub    $0x1,%eax
     0x08048e0f &lt;+37&gt;:    cmp    $0x5,%eax
     0x08048e12 &lt;+40&gt;:    jbe    0x8048e19 &lt;phase_6+47&gt;
     0x08048e14 &lt;+42&gt;:    call   0x804932c &lt;explode_bomb&gt;
     0x08048e19 &lt;+47&gt;:    add    $0x1,%esi
     0x08048e1c &lt;+50&gt;:    cmp    $0x6,%esi
     0x08048e1f &lt;+53&gt;:    je     0x8048e54 &lt;phase_6+106&gt;
     0x08048e21 &lt;+55&gt;:    mov    %esi,%ebx
     0x08048e23 &lt;+57&gt;:    mov    0x10(%esp,%ebx,4),%eax
     0x08048e27 &lt;+61&gt;:    cmp    %eax,0xc(%esp,%esi,4)
     0x08048e2b &lt;+65&gt;:    jne    0x8048e32 &lt;phase_6+72&gt;
     0x08048e2d &lt;+67&gt;:    call   0x804932c &lt;explode_bomb&gt;
     0x08048e32 &lt;+72&gt;:    add    $0x1,%ebx
     0x08048e35 &lt;+75&gt;:    cmp    $0x5,%ebx
     0x08048e38 &lt;+78&gt;:    jle    0x8048e23 &lt;phase_6+57&gt;
     0x08048e3a &lt;+80&gt;:    jmp    0x8048e08 &lt;phase_6+30&gt;
     0x08048e3c &lt;+82&gt;:    mov    0x8(%edx),%edx
     0x08048e3f &lt;+85&gt;:    add    $0x1,%eax
     0x08048e42 &lt;+88&gt;:    cmp    %ecx,%eax
     0x08048e44 &lt;+90&gt;:    jne    0x8048e3c &lt;phase_6+82&gt;
     0x08048e46 &lt;+92&gt;:    mov    %edx,0x28(%esp,%esi,4)
     0x08048e4a &lt;+96&gt;:    add    $0x1,%ebx
     0x08048e4d &lt;+99&gt;:    cmp    $0x6,%ebx
     0x08048e50 &lt;+102&gt;:   jne    0x8048e59 &lt;phase_6+111&gt;
     0x08048e52 &lt;+104&gt;:   jmp    0x8048e70 &lt;phase_6+134&gt;
     0x08048e54 &lt;+106&gt;:   mov    $0x0,%ebx
     0x08048e59 &lt;+111&gt;:   mov    %ebx,%esi
     0x08048e5b &lt;+113&gt;:   mov    0x10(%esp,%ebx,4),%ecx
     0x08048e5f &lt;+117&gt;:   mov    $0x1,%eax
     0x08048e64 &lt;+122&gt;:   mov    $0x804d154,%edx
     0x08048e69 &lt;+127&gt;:   cmp    $0x1,%ecx
     0x08048e6c &lt;+130&gt;:   jg     0x8048e3c &lt;phase_6+82&gt;
     0x08048e6e &lt;+132&gt;:   jmp    0x8048e46 &lt;phase_6+92&gt;
     0x08048e70 &lt;+134&gt;:   mov    0x28(%esp),%ebx
     0x08048e74 &lt;+138&gt;:   mov    0x2c(%esp),%eax
     0x08048e78 &lt;+142&gt;:   mov    %eax,0x8(%ebx)
     0x08048e7b &lt;+145&gt;:   mov    0x30(%esp),%edx
     0x08048e7f &lt;+149&gt;:   mov    %edx,0x8(%eax)
     0x08048e82 &lt;+152&gt;:   mov    0x34(%esp),%eax
     0x08048e86 &lt;+156&gt;:   mov    %eax,0x8(%edx)
     0x08048e89 &lt;+159&gt;:   mov    0x38(%esp),%edx
     0x08048e8d &lt;+163&gt;:   mov    %edx,0x8(%eax)
     0x08048e90 &lt;+166&gt;:   mov    0x3c(%esp),%eax
     0x08048e94 &lt;+170&gt;:   mov    %eax,0x8(%edx)
     0x08048e97 &lt;+173&gt;:   movl   $0x0,0x8(%eax)
     0x08048e9e &lt;+180&gt;:   mov    $0x5,%esi
     0x08048ea3 &lt;+185&gt;:   mov    0x8(%ebx),%eax
  *   0x08048ea6 &lt;+188&gt;:   mov    (%eax),%edx
  *   0x08048ea8 &lt;+190&gt;:   cmp    %edx,(%ebx)
     0x08048eaa &lt;+192&gt;:   jge    0x8048eb1 &lt;phase_6+199&gt;
     0x08048eac &lt;+194&gt;:   call   0x804932c &lt;explode_bomb&gt;
     0x08048eb1 &lt;+199&gt;:   mov    0x8(%ebx),%ebx
     0x08048eb4 &lt;+202&gt;:   sub    $0x1,%esi
     0x08048eb7 &lt;+205&gt;:   jne    0x8048ea3 &lt;phase_6+185&gt;
     0x08048eb9 &lt;+207&gt;:   add    $0x44,%esp
     0x08048ebc &lt;+210&gt;:   pop    %ebx
     0x08048ebd &lt;+211&gt;:   pop    %esi
     0x08048ebe &lt;+212&gt;:   ret
  </code></pre>
  
  <p>In the two lines before which I put the asterisk, that is where the nodes are being compared, I think. Essentially eax is being compared to ebx. However, when I try to find what the nodes are for eax, it gives me that error. When I try to run the same method on ebx, this is what returns:</p>
  
  <pre><code>(gdb) x/3x $ebx
  0xffffd4c4:     0xffffd625      0x00000000      0xffffd651
  (gdb) x/3x *($ebx + 8)
  0xffffd651:     0x5f474458      0x53534553      0x5f4e4f49
  (gdb) x/3x *(*($ebx+8)+8)
  0x5f4e4f49:     Cannot access memory at address 0x5f4e4f49
  </code></pre>
  
  <p>Does that mean ebx doesn't go past that memory address?</p>
  
  <p>Here is what I DO know: it is taking in 6 integers, none of them can be equal to another, they must be less than or equal to 6, and they must be put in decreasing node order.</p>
  
  <p>EDIT:</p>
  
  <p>After going to the asterisked lines, here is my issue:</p>
  
  <pre><code>(gdb) x/3x *(*(*(*($eax+8)+8)+8)+8)
  0x804d154 &lt;node1&gt;:      0x00000395      0x00000001      0x00000000
  (gdb) x/3x *(*(*($eax+8)+8)+8)
  0x804d160 &lt;node2&gt;:      0x000001e2      0x00000002      0x0804d154
  (gdb) x/3x*( *($eax+8)+8)
  0x804d16c &lt;node3&gt;:      0x00000328      0x00000003      0x0804d160
  (gdb) x/3x*($eax+8)
  0x804d178 &lt;node4&gt;:      0x000000d3      0x00000004      0x0804d16c
  (gdb) x/3x $eax
  0x804d184 &lt;node5&gt;:      0x00000273      0x00000005      0x0804d178
  </code></pre>
  
  <p>There seem to only be 5 nodes instead of the necessary 6.</p>