title: Binary Bomb - Phase 4
body: <p>I am having a very difficult time tracing the assembly code for the following binary bomb (An assignment from school where a bomb has to be defused, this bomb contains 6 phases which all have 1 correct input to proceed to the next phase). I am currently on phase_4 and it has a recursive function called func4. I have identified that the input is "%d %d" which is two integers. However, I cannot quite figure out what func4 is doing, even after getting the info on all registers throughout every step. </p>
  
  <p>Phase_4:</p>
  
  <pre><code>    (gdb) disas
  Dump of assembler code for function phase_4:
  =&gt; 0x08048e24 &lt;+0&gt;: sub    $0x2c,%esp
     0x08048e27 &lt;+3&gt;: lea    0x1c(%esp),%eax
     0x08048e2b &lt;+7&gt;: mov    %eax,0xc(%esp)
     0x08048e2f &lt;+11&gt;:    lea    0x18(%esp),%eax
     0x08048e33 &lt;+15&gt;:    mov    %eax,0x8(%esp)
     0x08048e37 &lt;+19&gt;:    movl   $0x804a7f1,0x4(%esp)
     0x08048e3f &lt;+27&gt;:    mov    0x30(%esp),%eax
     0x08048e43 &lt;+31&gt;:    mov    %eax,(%esp)
     0x08048e46 &lt;+34&gt;:    call   0x80488d0 &lt;__isoc99_sscanf@plt&gt;
     0x08048e4b &lt;+39&gt;:    cmp    $0x2,%eax
     0x08048e4e &lt;+42&gt;:    jne    0x8048e5d &lt;phase_4+57&gt;
     0x08048e50 &lt;+44&gt;:    mov    0x18(%esp),%eax
     0x08048e54 &lt;+48&gt;:    test   %eax,%eax
     0x08048e56 &lt;+50&gt;:    js     0x8048e5d &lt;phase_4+57&gt;
     0x08048e58 &lt;+52&gt;:    cmp    $0xe,%eax
     0x08048e5b &lt;+55&gt;:    jle    0x8048e62 &lt;phase_4+62&gt;
     0x08048e5d &lt;+57&gt;:    call   0x8049470 &lt;explode_bomb&gt;
     0x08048e62 &lt;+62&gt;:    movl   $0xe,0x8(%esp)
     0x08048e6a &lt;+70&gt;:    movl   $0x0,0x4(%esp)
     0x08048e72 &lt;+78&gt;:    mov    0x18(%esp),%eax
     0x08048e76 &lt;+82&gt;:    mov    %eax,(%esp)
     0x08048e79 &lt;+85&gt;:    call   0x8048dbb &lt;func4&gt;
     0x08048e7e &lt;+90&gt;:    cmp    $0x25,%eax
     0x08048e81 &lt;+93&gt;:    jne    0x8048e8a &lt;phase_4+102&gt;
     0x08048e83 &lt;+95&gt;:    cmpl   $0x25,0x1c(%esp)
     0x08048e88 &lt;+100&gt;:   je     0x8048e8f &lt;phase_4+107&gt;
     0x08048e8a &lt;+102&gt;:   call   0x8049470 &lt;explode_bomb&gt;
     0x08048e8f &lt;+107&gt;:   add    $0x2c,%esp
     0x08048e92 &lt;+110&gt;:   ret    
      End of assembler dump.
  </code></pre>
  
  <p>func4:</p>
  
  <pre><code>Breakpoint 2, 0x08048dbb in func4 ()
  (gdb) disas
  Dump of assembler code for function func4:
  =&gt; 0x08048dbb &lt;+0&gt;: sub    $0x1c,%esp
     0x08048dbe &lt;+3&gt;: mov    %ebx,0x14(%esp)
     0x08048dc2 &lt;+7&gt;: mov    %esi,0x18(%esp)
     0x08048dc6 &lt;+11&gt;:    mov    0x20(%esp),%eax
     0x08048dca &lt;+15&gt;:    mov    0x24(%esp),%edx
     0x08048dce &lt;+19&gt;:    mov    0x28(%esp),%esi
     0x08048dd2 &lt;+23&gt;:    mov    %esi,%ecx
     0x08048dd4 &lt;+25&gt;:    sub    %edx,%ecx
     0x08048dd6 &lt;+27&gt;:    mov    %ecx,%ebx
     0x08048dd8 &lt;+29&gt;:    shr    $0x1f,%ebx
     0x08048ddb &lt;+32&gt;:    add    %ebx,%ecx
     0x08048ddd &lt;+34&gt;:    sar    %ecx
     0x08048ddf &lt;+36&gt;:    lea    (%ecx,%edx,1),%ebx
     0x08048de2 &lt;+39&gt;:    cmp    %eax,%ebx
     0x08048de4 &lt;+41&gt;:    jle    0x8048dfd &lt;func4+66&gt;
     0x08048de6 &lt;+43&gt;:    lea    -0x1(%ebx),%ecx
     0x08048de9 &lt;+46&gt;:    mov    %ecx,0x8(%esp)
     0x08048ded &lt;+50&gt;:    mov    %edx,0x4(%esp)
     0x08048df1 &lt;+54&gt;:    mov    %eax,(%esp)
     0x08048df4 &lt;+57&gt;:    call   0x8048dbb &lt;func4&gt;
     0x08048df9 &lt;+62&gt;:    add    %eax,%ebx
     0x08048dfb &lt;+64&gt;:    jmp    0x8048e16 &lt;func4+91&gt;
     0x08048dfd &lt;+66&gt;:    cmp    %eax,%ebx
     0x08048dff &lt;+68&gt;:    jge    0x8048e16 &lt;func4+91&gt;
     0x08048e01 &lt;+70&gt;:    mov    %esi,0x8(%esp)
     0x08048e05 &lt;+74&gt;:    lea    0x1(%ebx),%edx
     0x08048e08 &lt;+77&gt;:    mov    %edx,0x4(%esp)
     0x08048e0c &lt;+81&gt;:    mov    %eax,(%esp)
     0x08048e0f &lt;+84&gt;:    call   0x8048dbb &lt;func4&gt;
     0x08048e14 &lt;+89&gt;:    add    %eax,%ebx
     0x08048e16 &lt;+91&gt;:    mov    %ebx,%eax
     0x08048e18 &lt;+93&gt;:    mov    0x14(%esp),%ebx
     0x08048e1c &lt;+97&gt;:    mov    0x18(%esp),%esi
     0x08048e20 &lt;+101&gt;:   add    $0x1c,%esp
     0x08048e23 &lt;+104&gt;:   ret    
  End of assembler dump.
  </code></pre>