title: Binary Bomb Phase 3 Assembly
body: <p>Yes, this is homework, and no I'm not asking you to do my homework. I need help with phase 3 of this binary bomb. I didn't have any trouble with phases 1 and 2 but phase 3 is just too much for me. I understand that there should be 3 inputs. I'm pretty sure one of them is a character input and two of them are integers, but I'm not sure in what order.
  Firstly, here is the disassembled code:</p>
  
  <pre><code>0x0000000000401163 &lt;phase_3+0&gt;: sub    $0x18,%rsp
  0x0000000000401167 &lt;phase_3+4&gt;: lea    0xf(%rsp),%rcx
  0x000000000040116c &lt;phase_3+9&gt;: lea    0x14(%rsp),%rdx
  0x0000000000401171 &lt;phase_3+14&gt;:        lea    0x10(%rsp),%r8
  0x0000000000401176 &lt;phase_3+19&gt;:        mov    $0x402650,%esi
  0x000000000040117b &lt;phase_3+24&gt;:        mov    $0x0,%eax
  0x0000000000401180 &lt;phase_3+29&gt;:        callq  0x400b80 &lt;sscanf@plt&gt;
  0x0000000000401185 &lt;phase_3+34&gt;:        cmp    $0x2,%eax
  0x0000000000401188 &lt;phase_3+37&gt;:        jg     0x40118f &lt;phase_3+44&gt;
  0x000000000040118a &lt;phase_3+39&gt;:        callq  0x4014b1 &lt;explode_bomb&gt;
  0x000000000040118f &lt;phase_3+44&gt;:        cmpl   $0x7,0x14(%rsp)
  0x0000000000401194 &lt;phase_3+49&gt;:        ja     0x401294 &lt;phase_3+305&gt;
  0x000000000040119a &lt;phase_3+55&gt;:        mov    0x14(%rsp),%eax
  0x000000000040119e &lt;phase_3+59&gt;:        xchg   %ax,%ax
  0x00000000004011a0 &lt;phase_3+61&gt;:        jmpq   *0x402660(,%rax,8)
  0x00000000004011a7 &lt;phase_3+68&gt;:        cmpl   $0x2c4,0x10(%rsp)
  0x00000000004011af &lt;phase_3+76&gt;:        nop
  0x00000000004011b0 &lt;phase_3+77&gt;:        je     0x4012a2 &lt;phase_3+319&gt;
  0x00000000004011b6 &lt;phase_3+83&gt;:        callq  0x4014b1 &lt;explode_bomb&gt;
  0x00000000004011bb &lt;phase_3+88&gt;:        mov    $0x7a,%eax
  0x00000000004011c0 &lt;phase_3+93&gt;:        jmpq   0x4012a7 &lt;phase_3+324&gt;
  0x00000000004011c5 &lt;phase_3+98&gt;:        mov    $0x6a,%eax
  ---Type &lt;return&gt; to continue, or q &lt;return&gt; to quit---
  0x00000000004011ca &lt;phase_3+103&gt;:       cmpl   $0x327,0x10(%rsp)
  0x00000000004011d2 &lt;phase_3+111&gt;:       je     0x4012a7 &lt;phase_3+324&gt;
  0x00000000004011d8 &lt;phase_3+117&gt;:       callq  0x4014b1 &lt;explode_bomb&gt;
  0x00000000004011dd &lt;phase_3+122&gt;:       mov    $0x6a,%eax
  0x00000000004011e2 &lt;phase_3+127&gt;:       jmpq   0x4012a7 &lt;phase_3+324&gt;
  0x00000000004011e7 &lt;phase_3+132&gt;:       mov    $0x66,%eax
  0x00000000004011ec &lt;phase_3+137&gt;:       cmpl   $0x136,0x10(%rsp)
  0x00000000004011f4 &lt;phase_3+145&gt;:       je     0x4012a7 &lt;phase_3+324&gt;
  0x00000000004011fa &lt;phase_3+151&gt;:       callq  0x4014b1 &lt;explode_bomb&gt;
  0x00000000004011ff &lt;phase_3+156&gt;:       mov    $0x66,%eax
  0x0000000000401204 &lt;phase_3+161&gt;:       jmpq   0x4012a7 &lt;phase_3+324&gt;
  0x0000000000401209 &lt;phase_3+166&gt;:       mov    $0x75,%eax
  0x000000000040120e &lt;phase_3+171&gt;:       cmpl   $0x252,0x10(%rsp)
  0x0000000000401216 &lt;phase_3+179&gt;:       je     0x4012a7 &lt;phase_3+324&gt;
  0x000000000040121c &lt;phase_3+185&gt;:       callq  0x4014b1 &lt;explode_bomb&gt;
  0x0000000000401221 &lt;phase_3+190&gt;:       mov    $0x75,%eax
  0x0000000000401226 &lt;phase_3+195&gt;:       jmpq   0x4012a7 &lt;phase_3+324&gt;
  0x000000000040122b &lt;phase_3+200&gt;:       mov    $0x70,%eax
  0x0000000000401230 &lt;phase_3+205&gt;:       cmpl   $0x240,0x10(%rsp)
  0x0000000000401238 &lt;phase_3+213&gt;:       je     0x4012a7 &lt;phase_3+324&gt;
  0x000000000040123a &lt;phase_3+215&gt;:       callq  0x4014b1 &lt;explode_bomb&gt;
  0x000000000040123f &lt;phase_3+220&gt;:       mov    $0x70,%eax
  0x0000000000401244 &lt;phase_3+225&gt;:       jmp    0x4012a7 &lt;phase_3+324&gt;
  ---Type &lt;return&gt; to continue, or q &lt;return&gt; to quit---
  0x0000000000401246 &lt;phase_3+227&gt;:       cmpl   $0x269,0x10(%rsp)
  0x000000000040124e &lt;phase_3+235&gt;:       xchg   %ax,%ax
  0x0000000000401250 &lt;phase_3+237&gt;:       je     0x4012a2 &lt;phase_3+319&gt;
  0x0000000000401252 &lt;phase_3+239&gt;:       callq  0x4014b1 &lt;explode_bomb&gt;
  0x0000000000401257 &lt;phase_3+244&gt;:       mov    $0x7a,%eax
  0x000000000040125c &lt;phase_3+249&gt;:       jmp    0x4012a7 &lt;phase_3+324&gt;
  0x000000000040125e &lt;phase_3+251&gt;:       mov    $0x6b,%eax
  0x0000000000401263 &lt;phase_3+256&gt;:       cmpl   $0x201,0x10(%rsp)
  0x000000000040126b &lt;phase_3+264&gt;:       je     0x4012a7 &lt;phase_3+324&gt;
  0x000000000040126d &lt;phase_3+266&gt;:       callq  0x4014b1 &lt;explode_bomb&gt;
  0x0000000000401272 &lt;phase_3+271&gt;:       mov    $0x6b,%eax
  0x0000000000401277 &lt;phase_3+276&gt;:       jmp    0x4012a7 &lt;phase_3+324&gt;
  0x0000000000401279 &lt;phase_3+278&gt;:       mov    $0x74,%eax
  0x000000000040127e &lt;phase_3+283&gt;:       cmpl   $0x358,0x10(%rsp)
  0x0000000000401286 &lt;phase_3+291&gt;:       je     0x4012a7 &lt;phase_3+324&gt;
  0x0000000000401288 &lt;phase_3+293&gt;:       callq  0x4014b1 &lt;explode_bomb&gt;
  0x000000000040128d &lt;phase_3+298&gt;:       mov    $0x74,%eax
  0x0000000000401292 &lt;phase_3+303&gt;:       jmp    0x4012a7 &lt;phase_3+324&gt;
  0x0000000000401294 &lt;phase_3+305&gt;:       callq  0x4014b1 &lt;explode_bomb&gt;
  0x0000000000401299 &lt;phase_3+310&gt;:       mov    $0x75,%eax
  0x000000000040129e &lt;phase_3+315&gt;:       xchg   %ax,%ax
  0x00000000004012a0 &lt;phase_3+317&gt;:       jmp    0x4012a7 &lt;phase_3+324&gt;
  0x00000000004012a2 &lt;phase_3+319&gt;:       mov    $0x7a,%eax
  ---Type &lt;return&gt; to continue, or q &lt;return&gt; to quit---
  0x00000000004012a7 &lt;phase_3+324&gt;:       cmp    0xf(%rsp),%al
  0x00000000004012ab &lt;phase_3+328&gt;:       je     0x4012b2 &lt;phase_3+335&gt;
  0x00000000004012ad &lt;phase_3+330&gt;:       callq  0x4014b1 &lt;explode_bomb&gt;
  0x00000000004012b2 &lt;phase_3+335&gt;:       add    $0x18,%rsp
  0x00000000004012b6 &lt;phase_3+339&gt;:       retq
  </code></pre>
  
  <p>I inputted something like 4 112 z, just to try it out and run through the steps. </p>
  
  <p>The code runs up to <code>0x0000000000401230 &lt;phase_3+205&gt;:       cmpl   $0x240,0x10(%rsp)</code></p>
  
  <p>What I'm really confused about is what 0x10(%rsp) indicates. I looked at the decimal value stored in rsp and it's in the negatives. 
  It seems like the first input of 4 worked out fine, and the code kept running, but I'm wondering why it's comparing rsp to 576, and what the 0x10 in front of it indicates.
  Any sort of insight would be helpful.</p>