secret phase for bomblab
0000000000401293 <fun7>:
401293: 48 85 ff test %rdi,%rdi
401296: 74 32 je 4012ca <fun7+0x37>
401298: 48 83 ec 08 sub $0x8,%rsp
40129c: 8b 17 mov (%rdi),%edx
40129e: 39 f2 cmp %esi,%edx
4012a0: 7f 0c jg 4012ae <fun7+0x1b>
4012a2: b8 00 00 00 00 mov $0x0,%eax
4012a7: 75 12 jne 4012bb <fun7+0x28>
4012a9: 48 83 c4 08 add $0x8,%rsp
4012ad: c3 retq
4012ae: 48 8b 7f 08 mov 0x8(%rdi),%rdi
4012b2: e8 dc ff ff ff callq 401293 <fun7>
4012b7: 01 c0 add %eax,%eax
4012b9: eb ee jmp 4012a9 <fun7+0x16>
4012bb: 48 8b 7f 10 mov 0x10(%rdi),%rdi
4012bf: e8 cf ff ff ff callq 401293 <fun7>
4012c4: 8d 44 00 01 lea 0x1(%rax,%rax,1),%eax
4012c8: eb df jmp 4012a9 <fun7+0x16>
4012ca: b8 ff ff ff ff mov $0xffffffff,%eax
4012cf: c3 retq
Dump of assembler code for function secret_phase:
0x00000000004012d0 <+0>: push %rbx
0x00000000004012d1 <+1>: callq 0x40164f <read_line>
0x00000000004012d6 <+6>: mov $0xa,%edx
0x00000000004012db <+11>: mov $0x0,%esi
0x00000000004012e0 <+16>: mov %rax,%rdi
0x00000000004012e3 <+19>: callq 0x400c10 <strtol@plt>
0x00000000004012e8 <+24>: mov %rax,%rbx
0x00000000004012eb <+27>: lea -0x1(%rax),%eax
0x00000000004012ee <+30>: cmp $0x3e8,%eax
0x00000000004012f3 <+35>: ja 0x401317 <secret_phase+71>
0x00000000004012f5 <+37>: mov %ebx,%esi
0x00000000004012f7 <+39>: mov $0x604110,%edi
0x00000000004012fc <+44>: callq 0x401293 <fun7>
0x0000000000401301 <+49>: cmp $0x2,%eax
0x0000000000401304 <+52>: jne 0x40131e <secret_phase+78>
0x0000000000401306 <+54>: mov $0x402538,%edi
0x000000000040130b <+59>: callq 0x400b70 <puts@plt>
0x0000000000401310 <+64>: callq 0x40177d <phase_defused>
0x0000000000401315 <+69>: pop %rbx
0x0000000000401316 <+70>: retq
0x0000000000401317 <+71>: callq 0x4015da <explode_bomb>
0x000000000040131c <+76>: jmp 0x4012f5 <secret_phase+37>
0x000000000040131e <+78>: callq 0x4015da <explode_bomb>
0x0000000000401323 <+83>: jmp 0x401306 <secret_phase+54>
secret_phase is located in the phase_defused below is its assembly
Dump of assembler code for function phase_defused:
=> 0x000000000040177d <+0>: sub $0x68,%rsp
0x0000000000401781 <+4>: mov $0x1,%edi
0x0000000000401786 <+9>: callq 0x40154d <send_msg>
0x000000000040178b <+14>: cmpl $0x6,0x20301a(%rip) # 0x6047ac <num_input_strings>
0x0000000000401792 <+21>: je 0x401799 <phase_defused+28>
0x0000000000401794 <+23>: add $0x68,%rsp
0x0000000000401798 <+27>: retq
0x0000000000401799 <+28>: lea 0x10(%rsp),%r8
0x000000000040179e <+33>: lea 0x8(%rsp),%rcx
0x00000000004017a3 <+38>: lea 0xc(%rsp),%rdx
0x00000000004017a8 <+43>: mov $0x40282f,%esi
0x00000000004017ad <+48>: mov $0x6048b0,%edi
0x00000000004017b2 <+53>: mov $0x0,%eax
0x00000000004017b7 <+58>: callq 0x400c30 <__isoc99_sscanf@plt>
0x00000000004017bc <+63>: cmp $0x3,%eax
0x00000000004017bf <+66>: je 0x4017d7 <phase_defused+90>
0x00000000004017c1 <+68>: mov $0x4026f0,%edi
0x00000000004017c6 <+73>: callq 0x400b70 <puts@plt>
0x00000000004017cb <+78>: mov $0x402720,%edi
0x00000000004017d0 <+83>: callq 0x400b70 <puts@plt>
0x00000000004017d5 <+88>: jmp 0x401794 <phase_defused+23>
0x00000000004017d7 <+90>: mov $0x402838,%esi
0x00000000004017dc <+95>: lea 0x10(%rsp),%rdi
0x00000000004017e1 <+100>: callq 0x4013b3 <strings_not_equal>
0x00000000004017e6 <+105>: test %eax,%eax
0x00000000004017e8 <+107>: jne 0x4017c1 <phase_defused+68>
0x00000000004017ea <+109>: mov $0x402690,%edi
0x00000000004017ef <+114>: callq 0x400b70 <puts@plt>
0x00000000004017f4 <+119>: mov $0x4026b8,%edi
0x00000000004017f9 <+124>: callq 0x400b70 <puts@plt>
0x00000000004017fe <+129>: mov $0x0,%eax
0x0000000000401803 <+134>: callq 0x4012d0 <secret_phase>
0x0000000000401808 <+139>: jmp 0x4017c1 <phase_defused+68>
–Type <RET> for more, q to quit, c to continue without paging–c
End of assembler dump.
(gdb) x/8bs 0x40282f
0x40282f: “%d %d %s”
0x402838: “DrEvil”
0x40283f: “cdmcscspprd01.dpu.depaul.edu”
0x40285c: “”
0x40285d: “”
0x40285e: “”
0x40285f: “”
0x402860: “Program timed out after %d seconds\n”
(gdb) x/8bs 0x6048b0
0x6048b0 <input_strings+240>: “”
0x6048b1 <input_strings+241>: “”
0x6048b2 <input_strings+242>: “”
0x6048b3 <input_strings+243>: “”
0x6048b4 <input_strings+244>: “”
0x6048b5 <input_strings+245>: “”
0x6048b6 <input_strings+246>: “”
0x6048b7 <input_strings+247>: “”
what am i supposed to do next inorder to defuse the secret phase