title: Defusing a Binary Bomb: phase_5
body: <p>Here is my understanding of what the code is doing, and how I'd like to solve it: First I need to find a string, and then reverse engineer that string, based on the 16-byte lookup table that I have found. I do know that the values of these "offsets" must add up to 60, see line &lt;+53>. </p>
  
  <p>I have tried to find this 6 character string by using x/s 0x4011fe, and other examine commands (x/6c etc), yet I am not getting anything close to correct. Is there something I can change to get the correct output so that I can continue defusing this phase?</p>
  
  <p>Once I find this string, my idea is to look at this required output string, then figure out the input string required to get to the expected output. I am thinking- look at the hex value of each char, compare those to my table (lowest order), and then find a corresponding char using the ascii table. I'm only wondering if this is the correct approach, thanks. </p>
  
  <p><strong>Lookup table:</strong></p>
  
  <pre><code>(gdb) x/16xw 0x402780
  &lt;array.3600&gt;: 0x00000002    0x0000000a    0x00000006    0x00000001
  &lt;array.3600&gt;: 0x0000000c    0x00000010    0x00000009    0x00000003
  &lt;array.3600&gt;: 0x00000004    0x00000007    0x0000000e    0x00000005
  &lt;array.3600&gt;: 0x0000000b    0x00000008    0x0000000f    0x0000000d
  </code></pre>
  
  <p><strong>Disassembly of phase_5:</strong>      </p>
  
  <pre><code>0x00000000004011bf &lt;+0&gt;:    push   %rbx
  0x00000000004011c0 &lt;+1&gt;:    mov    %rdi,%rbx
  0x00000000004011c3 &lt;+4&gt;:    callq  0x401414 &lt;string_length&gt;
  0x00000000004011c8 &lt;+9&gt;:    cmp    $0x6,%eax //6 letter string!
  0x00000000004011cb &lt;+12&gt;:   je     0x4011d2 &lt;phase_5+19&gt; //if 6, jump over the explode
  0x00000000004011cd &lt;+14&gt;:   callq  0x401706 &lt;explode_bomb&gt;
  0x00000000004011d2 &lt;+19&gt;:   mov    %rbx,%rax 
  0x00000000004011d5 &lt;+22&gt;:   lea    0x6(%rbx),%rdi
  0x00000000004011d9 &lt;+26&gt;:   mov    $0x0,%ecx
  0x00000000004011de &lt;+31&gt;:   movzbl (%rax),%edx
  0x00000000004011e1 &lt;+34&gt;:   and    $0xf,%edx //”and” each letter
  0x00000000004011e4 &lt;+37&gt;:   add    0x402780(,%rdx,4),%ecx
  0x00000000004011eb &lt;+44&gt;:   add   $0x1,%rax
  0x00000000004011ef &lt;+48&gt;:   cmp    %rdi,%rax //compare, and then loop again. 
  0x00000000004011f2 &lt;+51&gt;:   jne    0x4011de &lt;phase_5+31&gt; //loop!
  0x00000000004011f4 &lt;+53&gt;:   cmp    $0x3c,%ecx //final compare, and then done! (0x3c = 60)
  0x00000000004011f7 &lt;+56&gt;:   je     0x4011fe &lt;phase_5+63&gt; //jump over explode, and finish! 
  0x00000000004011f9 &lt;+58&gt;:   callq  0x401706 &lt;explode_bomb&gt;
  0x00000000004011fe &lt;+63&gt;:   pop    %rbx
  0x00000000004011ff &lt;+64&gt;:   retq   
  End of assembler dump.
  </code></pre>