Bomb lab phase 4 func4
<p>I'm having trouble with the password for phase_4 of my binary bomb. </p>

<p>So far, I understand...
the inputs must be 2 integers (line 29) </p>

<p>and the second integer should &lt;= than or equal to 2 when 2 is subtracted from it (lines 38-44). Which means it should be a number 2-4</p>

<p>Then, it calls func4, and compares the output of func4 to rsp (which I've done some testing and rsp is always 0) so i need to find a number that returns 0 when inputed into func4.</p>

<p>Whats confusing me is: if the result of func4 needs to be 0, that means it's input should be 0. Taking into account line 38 in phase_4 where it subtracts 2 from my input, that should mean my second # should be 2...? However I have tried that and it makes it explode in line 46 as it doesn't satisfy the first comparison. </p>

<p>I have tried numbers like (0 2) (2 0) (0 1) (0 3) and they all failed. Any suggestions to point me in the right direction? Thanks!  </p>

<pre><code>phase_4:
   0x000000000040101e &lt;+0&gt;: sub    $0x18,%rsp
   0x0000000000401022 &lt;+4&gt;: lea    0xc(%rsp),%rcx
   0x0000000000401027 &lt;+9&gt;: lea    0x8(%rsp),%rdx
   0x000000000040102c &lt;+14&gt;:    mov    $0x4027cd,%esi
   0x0000000000401031 &lt;+19&gt;:    mov    $0x0,%eax
   0x0000000000401036 &lt;+24&gt;:    callq  0x400c30 &lt;__isoc99_sscanf@plt&gt;
   0x000000000040103b &lt;+29&gt;:    cmp    $0x2,%eax        //check if 2 inputs
   0x000000000040103e &lt;+32&gt;:    jne    0x40104c &lt;phase_4+46&gt;
   0x0000000000401040 &lt;+34&gt;:    mov    0xc(%rsp),%eax   
=&gt; 0x0000000000401044 &lt;+38&gt;:    sub    $0x2,%eax        
   0x0000000000401047 &lt;+41&gt;:    cmp    $0x2,%eax
   0x000000000040104a &lt;+44&gt;:    jbe    0x401051 &lt;phase_4+51&gt;//if unsigned eax &lt;= 2
   0x000000000040104c &lt;+46&gt;:    callq  0x401554 &lt;explode_bomb&gt;
   0x0000000000401051 &lt;+51&gt;:    mov    0xc(%rsp),%esi  
   0x0000000000401055 &lt;+55&gt;:    mov    $0x7,%edi      
   0x000000000040105a &lt;+60&gt;:    callq  0x400fe6 &lt;func4&gt;
   0x000000000040105f &lt;+65&gt;:    cmp    0x8(%rsp),%eax  //comparing eax to 0
   0x0000000000401063 &lt;+69&gt;:    je     0x40106a &lt;phase_4+76&gt; 
   0x0000000000401065 &lt;+71&gt;:    callq  0x401554 &lt;explode_bomb&gt; //explode if output != 0
   0x000000000040106a &lt;+76&gt;:    add    $0x18,%rsp
   0x000000000040106e &lt;+80&gt;:    retq 
</code></pre>

<hr>

<pre><code>Func4
   0x0000000000400fe6 &lt;+0&gt;: push   %r12
   0x0000000000400fe8 &lt;+2&gt;: push   %rbp
   0x0000000000400fe9 &lt;+3&gt;: push   %rbx
   0x0000000000400fea &lt;+4&gt;: mov    %edi,%ebx
   0x0000000000400fec &lt;+6&gt;: test   %edi,%edi
   0x0000000000400fee &lt;+8&gt;: jle    0x401014 &lt;func4+46&gt; //if input &lt;= 0
   0x0000000000400ff0 &lt;+10&gt;:    mov    %esi,%ebp
   0x0000000000400ff2 &lt;+12&gt;:    mov    %esi,%eax
   0x0000000000400ff4 &lt;+14&gt;:    cmp    $0x1,%edi
   0x0000000000400ff7 &lt;+17&gt;:    je     0x401019 &lt;func4+51&gt;
   0x0000000000400ff9 &lt;+19&gt;:    lea    -0x1(%rdi),%edi
   0x0000000000400ffc &lt;+22&gt;:    callq  0x400fe6 &lt;func4&gt;
   0x0000000000401001 &lt;+27&gt;:    lea    (%rax,%rbp,1),%r12d
   0x0000000000401005 &lt;+31&gt;:    lea    -0x2(%rbx),%edi
   0x0000000000401008 &lt;+34&gt;:    mov    %ebp,%esi
   0x000000000040100a &lt;+36&gt;:    callq  0x400fe6 &lt;func4&gt;
   0x000000000040100f &lt;+41&gt;:    add    %r12d,%eax
   0x0000000000401012 &lt;+44&gt;:    jmp    0x401019 &lt;func4+51&gt;
   0x0000000000401014 &lt;+46&gt;:    mov    $0x0,%eax  //make return val 0
   0x0000000000401019 &lt;+51&gt;:    pop    %rbx
   0x000000000040101a &lt;+52&gt;:    pop    %rbp
   0x000000000040101b &lt;+53&gt;:    pop    %r12
   0x000000000040101d &lt;+55&gt;:    retq 
</code></pre>