title: bomb lab phase_3, don't know how to find the starting address for switch block
body: <p>I am taking this software security class, but I have never done c before, I have taken some computer organization class, but not confident in assembly at all. I commented all the lines in the file generated by <code>objdump</code> to help myself understand it, but several things still don't make sense to me.</p>
  
  <p>What I got from gdb is at the end, based on that, can someone explain to me:</p>
  
  <ol>
  <li><p>based on my understanding by now, the string format should be <code>%d %d</code>, the number of arguments converted by <code>sscanf</code> should be larger than 1, the first argument should be smaller than 5, so I typed <code>2 3</code>, but the arrow in <code>disas</code> by gdb shows I am still stuck in the first line of the code, I don't know where I am wrong that I just cannot proceed. </p></li>
  <li><p>which line is telling me the rule to switch? I read other people's assembly code, the pattern is like, for example, <code>*0x402470(,%rax,8)</code>, the pattern is <code>0x402470 + %rax*8</code>, then you can print out the content in the corresponding address, I don't know where to find this pattern. All I can see is that <code>*%rax</code>, but when I print it out, it's just the string I typed in.</p></li>
  <li><p>what are <code># 0x555555556cf5</code> in line <code>&lt;+28&gt;</code> and <code># 0x555555556a80</code> in line <code>&lt;+58&gt;</code>? I found they are always very useful because I read other people's post, I know what I am looking for, but I don't know what they are..</p></li>
  <li><p>I learned <code>%rax</code> and <code>(%rax)</code>, but what is <code>*%rax</code>? I can't imagine there is the case beyond just using the value directly or using the value as an address.</p></li>
  <li><p>based on what I read from gdb tutorial, <code>x</code> is to display memory content, and <code>p</code> is to print a value, but value is always stored in somewhere of memory, so if I am using an address, are they two just same? when should I use which one?</p></li>
  </ol>
  
  <p>Any suggestion or guide would be very appreciated!!! I am taking an online class on ARM assembly too, suggestions on what more specific material I should look into would be very appreciated too, thank you!!!!</p>
  
  <pre><code>That's number 2.  Keep going!
  2 3
  
  Breakpoint 1, 0x00005555555552cd in phase_3 ()
  (gdb) disas
  Dump of assembler code for function phase_3:
  =&gt; 0x00005555555552cd &lt;+0&gt;:     sub    $0x18,%rsp
     0x00005555555552d1 &lt;+4&gt;:     mov    %fs:0x28,%rax
     0x00005555555552da &lt;+13&gt;:    mov    %rax,0x8(%rsp)
     0x00005555555552df &lt;+18&gt;:    xor    %eax,%eax
     0x00005555555552e1 &lt;+20&gt;:    lea    0x4(%rsp),%rcx
     0x00005555555552e6 &lt;+25&gt;:    mov    %rsp,%rdx
     0x00005555555552e9 &lt;+28&gt;:    lea    0x1a05(%rip),%rsi        # 0x555555556cf5
     0x00005555555552f0 &lt;+35&gt;:    callq  0x555555554f20 &lt;__isoc99_sscanf@plt&gt;
     0x00005555555552f5 &lt;+40&gt;:    cmp    $0x1,%eax
     0x00005555555552f8 &lt;+43&gt;:    jle    0x555555555317 &lt;phase_3+74&gt;
     0x00005555555552fa &lt;+45&gt;:    cmpl   $0x7,(%rsp)
     0x00005555555552fe &lt;+49&gt;:    ja     0x55555555539d &lt;phase_3+208&gt;
     0x0000555555555304 &lt;+55&gt;:    mov    (%rsp),%eax
     0x0000555555555307 &lt;+58&gt;:    lea    0x1772(%rip),%rdx        # 0x555555556a80
     0x000055555555530e &lt;+65&gt;:    movslq (%rdx,%rax,4),%rax
     0x0000555555555312 &lt;+69&gt;:    add    %rdx,%rax
     0x0000555555555315 &lt;+72&gt;:    jmpq   *%rax
     0x0000555555555317 &lt;+74&gt;:    callq  0x5555555559d3 &lt;explode_bomb&gt;
     0x000055555555531c &lt;+79&gt;:    jmp    0x5555555552fa &lt;phase_3+45&gt;
     0x000055555555531e &lt;+81&gt;:    mov    $0x2ad,%eax
     0x0000555555555323 &lt;+86&gt;:    jmp    0x55555555532a &lt;phase_3+93&gt;
     0x0000555555555325 &lt;+88&gt;:    mov    $0x0,%eax
     0x000055555555532a &lt;+93&gt;:    sub    $0x228,%eax
     0x000055555555532f &lt;+98&gt;:    add    $0x29e,%eax
     0x0000555555555334 &lt;+103&gt;:   sub    $0xee,%eax
     0x0000555555555339 &lt;+108&gt;:   add    $0xee,%eax
     0x000055555555533e &lt;+113&gt;:   sub    $0xee,%eax
     0x0000555555555343 &lt;+118&gt;:   add    $0xee,%eax
     0x0000555555555348 &lt;+123&gt;:   sub    $0xee,%eax
     0x000055555555534d &lt;+128&gt;:   cmpl   $0x5,(%rsp)
     0x0000555555555351 &lt;+132&gt;:   jg     0x555555555359 &lt;phase_3+140&gt;
     0x0000555555555353 &lt;+134&gt;:   cmp    %eax,0x4(%rsp)
     0x0000555555555357 &lt;+138&gt;:   je     0x55555555535e &lt;phase_3+145&gt;
     0x0000555555555359 &lt;+140&gt;:   callq  0x5555555559d3 &lt;explode_bomb&gt;
     0x000055555555535e &lt;+145&gt;:   mov    0x8(%rsp),%rax
     0x0000555555555363 &lt;+150&gt;:   xor    %fs:0x28,%rax
     0x000055555555536c &lt;+159&gt;:   jne    0x5555555553a9 &lt;phase_3+220&gt;
     0x000055555555536e &lt;+161&gt;:   add    $0x18,%rsp
     0x0000555555555372 &lt;+165&gt;:   retq
     0x0000555555555373 &lt;+166&gt;:   mov    $0x0,%eax
     0x0000555555555378 &lt;+171&gt;:   jmp    0x55555555532f &lt;phase_3+98&gt;
     0x000055555555537a &lt;+173&gt;:   mov    $0x0,%eax
     0x000055555555537f &lt;+178&gt;:   jmp    0x555555555334 &lt;phase_3+103&gt;
     0x0000555555555381 &lt;+180&gt;:   mov    $0x0,%eax
     0x0000555555555386 &lt;+185&gt;:   jmp    0x555555555339 &lt;phase_3+108&gt;
     0x0000555555555388 &lt;+187&gt;:   mov    $0x0,%eax
     0x000055555555538d &lt;+192&gt;:   jmp    0x55555555533e &lt;phase_3+113&gt;
  ---Type &lt;return&gt; to continue, or q &lt;return&gt; to quit---q
  Quit
  (gdb) i r
  rax            0x555555758760   93824994346848
  rbx            0x0      0
  rcx            0x5      5
  rdx            0x555555758760   93824994346848
  rsi            0x3      3
  rdi            0x555555758760   93824994346848
  rbp            0x0      0x0
  rsp            0x7fffffffdf78   0x7fffffffdf78
  r8             0x7ffff7ff7006   140737354100742
  r9             0x0      0
  r10            0x5      5
  r11            0x246    582
  r12            0x555555554fe0   93824992235488
  r13            0x7fffffffe060   140737488347232
  r14            0x0      0
  r15            0x0      0
  rip            0x5555555552cd   0x5555555552cd &lt;phase_3&gt;
  eflags         0x206    [ PF IF ]
  cs             0x33     51
  ss             0x2b     43
  ds             0x0      0
  es             0x0      0
  fs             0x0      0
  gs             0x0      0
  (gdb) x/s $rdx
  0x555555758760 &lt;input_strings+160&gt;:     "2 3"
  (gdb) x/s 0x555555556cf5
  0x555555556cf5: "%d %d"
  (gdb) x/s $rsp
  0x7fffffffdf78: "\206QUUUU"
  (gdb) x 0x555555556a80
  0x555555556a80: 0xffffe89e
  (gdb) p 0x555555556a80
  $1 = 93824992242304
  (gdb) x/8a 0x555555556a80
  0x555555556a80: 0xffffe8a5ffffe89e      0xffffe8faffffe8f3
  0x555555556a90: 0xffffe908ffffe901      0xffffe916ffffe90f
  0x555555556aa0 &lt;array.3415&gt;:    0xa00000002     0x100000006
  0x555555556ab0 &lt;array.3415+16&gt;: 0x100000000c    0x300000009
  (gdb) x/s $r8
  0x7ffff7ff7006: "8 16 32\no give Tina Fey more material.\n"
  (gdb) x/s $r12
  0x555555554fe0 &lt;_start&gt;:        "1\355I\211\321^H\211\342H\203\344\360PTL\215\005\252\030"
  (gdb) x/s $r13
  0x7fffffffe060: "\001"
  (gdb) x/s $rip
  0x5555555552cd &lt;phase_3&gt;:       "H\203\354\030dH\213\004%("
  </code></pre>