-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathintel_asm.asm
1794 lines (1721 loc) · 90.3 KB
/
intel_asm.asm
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
bomb: file format elf32-i386
Disassembly of section .init:
080486f4 <_init>:
80486f4: 53 push ebx
80486f5: 83 ec 08 sub esp,0x8
80486f8: e8 13 02 00 00 call 8048910 <__x86.get_pc_thunk.bx>
80486fd: 81 c3 03 39 00 00 add ebx,0x3903
8048703: 8b 83 fc ff ff ff mov eax,DWORD PTR [ebx-0x4]
8048709: 85 c0 test eax,eax
804870b: 74 05 je 8048712 <_init+0x1e>
804870d: e8 be 01 00 00 call 80488d0 <__gmon_start__@plt>
8048712: 83 c4 08 add esp,0x8
8048715: 5b pop ebx
8048716: c3 ret
Disassembly of section .plt:
08048720 <.plt>:
8048720: ff 35 04 c0 04 08 push DWORD PTR ds:0x804c004
8048726: ff 25 08 c0 04 08 jmp DWORD PTR ds:0x804c008
804872c: 00 00 add BYTE PTR [eax],al
...
08048730 <read@plt>:
8048730: ff 25 0c c0 04 08 jmp DWORD PTR ds:0x804c00c
8048736: 68 00 00 00 00 push 0x0
804873b: e9 e0 ff ff ff jmp 8048720 <.plt>
08048740 <fflush@plt>:
8048740: ff 25 10 c0 04 08 jmp DWORD PTR ds:0x804c010
8048746: 68 08 00 00 00 push 0x8
804874b: e9 d0 ff ff ff jmp 8048720 <.plt>
08048750 <fgets@plt>:
8048750: ff 25 14 c0 04 08 jmp DWORD PTR ds:0x804c014
8048756: 68 10 00 00 00 push 0x10
804875b: e9 c0 ff ff ff jmp 8048720 <.plt>
08048760 <signal@plt>:
8048760: ff 25 18 c0 04 08 jmp DWORD PTR ds:0x804c018
8048766: 68 18 00 00 00 push 0x18
804876b: e9 b0 ff ff ff jmp 8048720 <.plt>
08048770 <sleep@plt>:
8048770: ff 25 1c c0 04 08 jmp DWORD PTR ds:0x804c01c
8048776: 68 20 00 00 00 push 0x20
804877b: e9 a0 ff ff ff jmp 8048720 <.plt>
08048780 <alarm@plt>:
8048780: ff 25 20 c0 04 08 jmp DWORD PTR ds:0x804c020
8048786: 68 28 00 00 00 push 0x28
804878b: e9 90 ff ff ff jmp 8048720 <.plt>
08048790 <__stack_chk_fail@plt>:
8048790: ff 25 24 c0 04 08 jmp DWORD PTR ds:0x804c024
8048796: 68 30 00 00 00 push 0x30
804879b: e9 80 ff ff ff jmp 8048720 <.plt>
080487a0 <strcpy@plt>:
80487a0: ff 25 28 c0 04 08 jmp DWORD PTR ds:0x804c028
80487a6: 68 38 00 00 00 push 0x38
80487ab: e9 70 ff ff ff jmp 8048720 <.plt>
080487b0 <getenv@plt>:
80487b0: ff 25 2c c0 04 08 jmp DWORD PTR ds:0x804c02c
80487b6: 68 40 00 00 00 push 0x40
80487bb: e9 60 ff ff ff jmp 8048720 <.plt>
080487c0 <puts@plt>:
80487c0: ff 25 30 c0 04 08 jmp DWORD PTR ds:0x804c030
80487c6: 68 48 00 00 00 push 0x48
80487cb: e9 50 ff ff ff jmp 8048720 <.plt>
080487d0 <__memmove_chk@plt>:
80487d0: ff 25 34 c0 04 08 jmp DWORD PTR ds:0x804c034
80487d6: 68 50 00 00 00 push 0x50
80487db: e9 40 ff ff ff jmp 8048720 <.plt>
080487e0 <exit@plt>:
80487e0: ff 25 38 c0 04 08 jmp DWORD PTR ds:0x804c038
80487e6: 68 58 00 00 00 push 0x58
80487eb: e9 30 ff ff ff jmp 8048720 <.plt>
080487f0 <__libc_start_main@plt>:
80487f0: ff 25 3c c0 04 08 jmp DWORD PTR ds:0x804c03c
80487f6: 68 60 00 00 00 push 0x60
80487fb: e9 20 ff ff ff jmp 8048720 <.plt>
08048800 <write@plt>:
8048800: ff 25 40 c0 04 08 jmp DWORD PTR ds:0x804c040
8048806: 68 68 00 00 00 push 0x68
804880b: e9 10 ff ff ff jmp 8048720 <.plt>
08048810 <__isoc99_sscanf@plt>:
8048810: ff 25 44 c0 04 08 jmp DWORD PTR ds:0x804c044
8048816: 68 70 00 00 00 push 0x70
804881b: e9 00 ff ff ff jmp 8048720 <.plt>
08048820 <fopen@plt>:
8048820: ff 25 48 c0 04 08 jmp DWORD PTR ds:0x804c048
8048826: 68 78 00 00 00 push 0x78
804882b: e9 f0 fe ff ff jmp 8048720 <.plt>
08048830 <__errno_location@plt>:
8048830: ff 25 4c c0 04 08 jmp DWORD PTR ds:0x804c04c
8048836: 68 80 00 00 00 push 0x80
804883b: e9 e0 fe ff ff jmp 8048720 <.plt>
08048840 <__printf_chk@plt>:
8048840: ff 25 50 c0 04 08 jmp DWORD PTR ds:0x804c050
8048846: 68 88 00 00 00 push 0x88
804884b: e9 d0 fe ff ff jmp 8048720 <.plt>
08048850 <socket@plt>:
8048850: ff 25 54 c0 04 08 jmp DWORD PTR ds:0x804c054
8048856: 68 90 00 00 00 push 0x90
804885b: e9 c0 fe ff ff jmp 8048720 <.plt>
08048860 <__fprintf_chk@plt>:
8048860: ff 25 58 c0 04 08 jmp DWORD PTR ds:0x804c058
8048866: 68 98 00 00 00 push 0x98
804886b: e9 b0 fe ff ff jmp 8048720 <.plt>
08048870 <gethostbyname@plt>:
8048870: ff 25 5c c0 04 08 jmp DWORD PTR ds:0x804c05c
8048876: 68 a0 00 00 00 push 0xa0
804887b: e9 a0 fe ff ff jmp 8048720 <.plt>
08048880 <strtol@plt>:
8048880: ff 25 60 c0 04 08 jmp DWORD PTR ds:0x804c060
8048886: 68 a8 00 00 00 push 0xa8
804888b: e9 90 fe ff ff jmp 8048720 <.plt>
08048890 <connect@plt>:
8048890: ff 25 64 c0 04 08 jmp DWORD PTR ds:0x804c064
8048896: 68 b0 00 00 00 push 0xb0
804889b: e9 80 fe ff ff jmp 8048720 <.plt>
080488a0 <close@plt>:
80488a0: ff 25 68 c0 04 08 jmp DWORD PTR ds:0x804c068
80488a6: 68 b8 00 00 00 push 0xb8
80488ab: e9 70 fe ff ff jmp 8048720 <.plt>
080488b0 <__ctype_b_loc@plt>:
80488b0: ff 25 6c c0 04 08 jmp DWORD PTR ds:0x804c06c
80488b6: 68 c0 00 00 00 push 0xc0
80488bb: e9 60 fe ff ff jmp 8048720 <.plt>
080488c0 <__sprintf_chk@plt>:
80488c0: ff 25 70 c0 04 08 jmp DWORD PTR ds:0x804c070
80488c6: 68 c8 00 00 00 push 0xc8
80488cb: e9 50 fe ff ff jmp 8048720 <.plt>
Disassembly of section .plt.got:
080488d0 <__gmon_start__@plt>:
80488d0: ff 25 fc bf 04 08 jmp DWORD PTR ds:0x804bffc
80488d6: 66 90 xchg ax,ax
Disassembly of section .text:
080488e0 <_start>:
80488e0: 31 ed xor ebp,ebp
80488e2: 5e pop esi
80488e3: 89 e1 mov ecx,esp
80488e5: 83 e4 f0 and esp,0xfffffff0
80488e8: 50 push eax
80488e9: 54 push esp
80488ea: 52 push edx
80488eb: 68 90 9e 04 08 push 0x8049e90
80488f0: 68 30 9e 04 08 push 0x8049e30
80488f5: 51 push ecx
80488f6: 56 push esi
80488f7: 68 db 89 04 08 push 0x80489db
80488fc: e8 ef fe ff ff call 80487f0 <__libc_start_main@plt>
8048901: f4 hlt
8048902: 66 90 xchg ax,ax
8048904: 66 90 xchg ax,ax
8048906: 66 90 xchg ax,ax
8048908: 66 90 xchg ax,ax
804890a: 66 90 xchg ax,ax
804890c: 66 90 xchg ax,ax
804890e: 66 90 xchg ax,ax
08048910 <__x86.get_pc_thunk.bx>:
8048910: 8b 1c 24 mov ebx,DWORD PTR [esp]
8048913: c3 ret
8048914: 66 90 xchg ax,ax
8048916: 66 90 xchg ax,ax
8048918: 66 90 xchg ax,ax
804891a: 66 90 xchg ax,ax
804891c: 66 90 xchg ax,ax
804891e: 66 90 xchg ax,ax
08048920 <deregister_tm_clones>:
8048920: b8 a3 c3 04 08 mov eax,0x804c3a3
8048925: 2d a0 c3 04 08 sub eax,0x804c3a0
804892a: 83 f8 06 cmp eax,0x6
804892d: 76 1a jbe 8048949 <deregister_tm_clones+0x29>
804892f: b8 00 00 00 00 mov eax,0x0
8048934: 85 c0 test eax,eax
8048936: 74 11 je 8048949 <deregister_tm_clones+0x29>
8048938: 55 push ebp
8048939: 89 e5 mov ebp,esp
804893b: 83 ec 14 sub esp,0x14
804893e: 68 a0 c3 04 08 push 0x804c3a0
8048943: ff d0 call eax
8048945: 83 c4 10 add esp,0x10
8048948: c9 leave
8048949: f3 c3 repz ret
804894b: 90 nop
804894c: 8d 74 26 00 lea esi,[esi+eiz*1+0x0]
08048950 <register_tm_clones>:
8048950: b8 a0 c3 04 08 mov eax,0x804c3a0
8048955: 2d a0 c3 04 08 sub eax,0x804c3a0
804895a: c1 f8 02 sar eax,0x2
804895d: 89 c2 mov edx,eax
804895f: c1 ea 1f shr edx,0x1f
8048962: 01 d0 add eax,edx
8048964: d1 f8 sar eax,1
8048966: 74 1b je 8048983 <register_tm_clones+0x33>
8048968: ba 00 00 00 00 mov edx,0x0
804896d: 85 d2 test edx,edx
804896f: 74 12 je 8048983 <register_tm_clones+0x33>
8048971: 55 push ebp
8048972: 89 e5 mov ebp,esp
8048974: 83 ec 10 sub esp,0x10
8048977: 50 push eax
8048978: 68 a0 c3 04 08 push 0x804c3a0
804897d: ff d2 call edx
804897f: 83 c4 10 add esp,0x10
8048982: c9 leave
8048983: f3 c3 repz ret
8048985: 8d 74 26 00 lea esi,[esi+eiz*1+0x0]
8048989: 8d bc 27 00 00 00 00 lea edi,[edi+eiz*1+0x0]
08048990 <__do_global_dtors_aux>:
8048990: 80 3d c8 c3 04 08 00 cmp BYTE PTR ds:0x804c3c8,0x0
8048997: 75 13 jne 80489ac <__do_global_dtors_aux+0x1c>
8048999: 55 push ebp
804899a: 89 e5 mov ebp,esp
804899c: 83 ec 08 sub esp,0x8
804899f: e8 7c ff ff ff call 8048920 <deregister_tm_clones>
80489a4: c6 05 c8 c3 04 08 01 mov BYTE PTR ds:0x804c3c8,0x1
80489ab: c9 leave
80489ac: f3 c3 repz ret
80489ae: 66 90 xchg ax,ax
080489b0 <frame_dummy>:
80489b0: b8 10 bf 04 08 mov eax,0x804bf10
80489b5: 8b 10 mov edx,DWORD PTR [eax]
80489b7: 85 d2 test edx,edx
80489b9: 75 05 jne 80489c0 <frame_dummy+0x10>
80489bb: eb 93 jmp 8048950 <register_tm_clones>
80489bd: 8d 76 00 lea esi,[esi+0x0]
80489c0: ba 00 00 00 00 mov edx,0x0
80489c5: 85 d2 test edx,edx
80489c7: 74 f2 je 80489bb <frame_dummy+0xb>
80489c9: 55 push ebp
80489ca: 89 e5 mov ebp,esp
80489cc: 83 ec 14 sub esp,0x14
80489cf: 50 push eax
80489d0: ff d2 call edx
80489d2: 83 c4 10 add esp,0x10
80489d5: c9 leave
80489d6: e9 75 ff ff ff jmp 8048950 <register_tm_clones>
080489db <main>:
80489db: 8d 4c 24 04 lea ecx,[esp+0x4]
80489df: 83 e4 f0 and esp,0xfffffff0
80489e2: ff 71 fc push DWORD PTR [ecx-0x4]
80489e5: 55 push ebp
80489e6: 89 e5 mov ebp,esp
80489e8: 53 push ebx
80489e9: 51 push ecx
80489ea: 8b 01 mov eax,DWORD PTR [ecx]
80489ec: 8b 59 04 mov ebx,DWORD PTR [ecx+0x4]
80489ef: 83 f8 01 cmp eax,0x1
80489f2: 75 0c jne 8048a00 <main+0x25>
80489f4: a1 c0 c3 04 08 mov eax,ds:0x804c3c0
80489f9: a3 d0 c3 04 08 mov ds:0x804c3d0,eax
80489fe: eb 5b jmp 8048a5b <main+0x80>
8048a00: 83 f8 02 cmp eax,0x2
8048a03: 75 39 jne 8048a3e <main+0x63>
8048a05: 83 ec 08 sub esp,0x8
8048a08: 68 c8 9e 04 08 push 0x8049ec8
8048a0d: ff 73 04 push DWORD PTR [ebx+0x4]
8048a10: e8 0b fe ff ff call 8048820 <fopen@plt>
8048a15: a3 d0 c3 04 08 mov ds:0x804c3d0,eax
8048a1a: 83 c4 10 add esp,0x10
8048a1d: 85 c0 test eax,eax
8048a1f: 75 3a jne 8048a5b <main+0x80>
8048a21: ff 73 04 push DWORD PTR [ebx+0x4]
8048a24: ff 33 push DWORD PTR [ebx]
8048a26: 68 ca 9e 04 08 push 0x8049eca
8048a2b: 6a 01 push 0x1
8048a2d: e8 0e fe ff ff call 8048840 <__printf_chk@plt>
8048a32: c7 04 24 08 00 00 00 mov DWORD PTR [esp],0x8
8048a39: e8 a2 fd ff ff call 80487e0 <exit@plt>
8048a3e: 83 ec 04 sub esp,0x4
8048a41: ff 33 push DWORD PTR [ebx]
8048a43: 68 e7 9e 04 08 push 0x8049ee7
8048a48: 6a 01 push 0x1
8048a4a: e8 f1 fd ff ff call 8048840 <__printf_chk@plt>
8048a4f: c7 04 24 08 00 00 00 mov DWORD PTR [esp],0x8
8048a56: e8 85 fd ff ff call 80487e0 <exit@plt>
8048a5b: e8 fc 05 00 00 call 804905c <initialize_bomb>
8048a60: 83 ec 0c sub esp,0xc
8048a63: 68 4c 9f 04 08 push 0x8049f4c
8048a68: e8 53 fd ff ff call 80487c0 <puts@plt>
8048a6d: c7 04 24 88 9f 04 08 mov DWORD PTR [esp],0x8049f88
8048a74: e8 47 fd ff ff call 80487c0 <puts@plt>
8048a79: e8 d0 06 00 00 call 804914e <read_line>
8048a7e: 89 04 24 mov DWORD PTR [esp],eax
8048a81: e8 ad 00 00 00 call 8048b33 <phase_1>
8048a86: e8 bc 07 00 00 call 8049247 <phase_defused>
8048a8b: c7 04 24 b4 9f 04 08 mov DWORD PTR [esp],0x8049fb4
8048a92: e8 29 fd ff ff call 80487c0 <puts@plt>
8048a97: e8 b2 06 00 00 call 804914e <read_line>
8048a9c: 89 04 24 mov DWORD PTR [esp],eax
8048a9f: e8 b0 00 00 00 call 8048b54 <phase_2>
8048aa4: e8 9e 07 00 00 call 8049247 <phase_defused>
8048aa9: c7 04 24 01 9f 04 08 mov DWORD PTR [esp],0x8049f01
8048ab0: e8 0b fd ff ff call 80487c0 <puts@plt>
8048ab5: e8 94 06 00 00 call 804914e <read_line>
8048aba: 89 04 24 mov DWORD PTR [esp],eax
8048abd: e8 f5 00 00 00 call 8048bb7 <phase_3>
8048ac2: e8 80 07 00 00 call 8049247 <phase_defused>
8048ac7: c7 04 24 1f 9f 04 08 mov DWORD PTR [esp],0x8049f1f
8048ace: e8 ed fc ff ff call 80487c0 <puts@plt>
8048ad3: e8 76 06 00 00 call 804914e <read_line>
8048ad8: 89 04 24 mov DWORD PTR [esp],eax
8048adb: e8 ed 01 00 00 call 8048ccd <phase_4>
8048ae0: e8 62 07 00 00 call 8049247 <phase_defused>
8048ae5: c7 04 24 e0 9f 04 08 mov DWORD PTR [esp],0x8049fe0
8048aec: e8 cf fc ff ff call 80487c0 <puts@plt>
8048af1: e8 58 06 00 00 call 804914e <read_line>
8048af6: 89 04 24 mov DWORD PTR [esp],eax
8048af9: e8 41 02 00 00 call 8048d3f <phase_5>
8048afe: e8 44 07 00 00 call 8049247 <phase_defused>
8048b03: c7 04 24 2e 9f 04 08 mov DWORD PTR [esp],0x8049f2e
8048b0a: e8 b1 fc ff ff call 80487c0 <puts@plt>
8048b0f: e8 3a 06 00 00 call 804914e <read_line>
8048b14: 89 04 24 mov DWORD PTR [esp],eax
8048b17: e8 b0 02 00 00 call 8048dcc <phase_6>
8048b1c: e8 26 07 00 00 call 8049247 <phase_defused>
8048b21: 83 c4 10 add esp,0x10
8048b24: b8 00 00 00 00 mov eax,0x0
8048b29: 8d 65 f8 lea esp,[ebp-0x8]
8048b2c: 59 pop ecx
8048b2d: 5b pop ebx
8048b2e: 5d pop ebp
8048b2f: 8d 61 fc lea esp,[ecx-0x4]
8048b32: c3 ret
08048b33 <phase_1>:
8048b33: 83 ec 14 sub esp,0x14
8048b36: 68 04 a0 04 08 push 0x804a004
8048b3b: ff 74 24 1c push DWORD PTR [esp+0x1c]
8048b3f: e8 b3 04 00 00 call 8048ff7 <strings_not_equal>
8048b44: 83 c4 10 add esp,0x10
8048b47: 85 c0 test eax,eax
8048b49: 74 05 je 8048b50 <phase_1+0x1d>
8048b4b: e8 9e 05 00 00 call 80490ee <explode_bomb>
8048b50: 83 c4 0c add esp,0xc
8048b53: c3 ret
08048b54 <phase_2>:
8048b54: 56 push esi
8048b55: 53 push ebx
8048b56: 83 ec 2c sub esp,0x2c
8048b59: 65 a1 14 00 00 00 mov eax,gs:0x14 ; 全局段寄存器https://www.coisme.com/archives/805.html
8048b5f: 89 44 24 24 mov DWORD PTR [esp+0x24],eax ; 为什么中间要空8个字节？
8048b63: 31 c0 xor eax,eax
8048b65: 8d 44 24 0c lea eax,[esp+0xc]
8048b69: 50 push eax
8048b6a: ff 74 24 3c push DWORD PTR [esp+0x3c]
8048b6e: e8 a0 05 00 00 call 8049113 <read_six_numbers> ; 注意这里调用完call会有一个双字，
; 也就是这条指令的下一条指令放到ESP中，
; 等到调用的子程序ret后才将该双字弹出
8048b73: 83 c4 10 add esp,0x10
8048b76: 83 7c 24 04 01 cmp DWORD PTR [esp+0x4],0x1 ; 可以看出首先是和0x1进行比较
8048b7b: 74 05 je 8048b82 <phase_2+0x2e>
8048b7d: e8 6c 05 00 00 call 80490ee <explode_bomb>
8048b82: 8d 5c 24 04 lea ebx,[esp+0x4]
8048b86: 8d 74 24 18 lea esi,[esp+0x18]
8048b8a: 8b 03 mov eax,DWORD PTR [ebx]
8048b8c: 01 c0 add eax,eax
8048b8e: 39 43 04 cmp DWORD PTR [ebx+0x4],eax
8048b91: 74 05 je 8048b98 <phase_2+0x44>
8048b93: e8 56 05 00 00 call 80490ee <explode_bomb>
8048b98: 83 c3 04 add ebx,0x4
8048b9b: 39 f3 cmp ebx,esi
8048b9d: 75 eb jne 8048b8a <phase_2+0x36>
8048b9f: 8b 44 24 1c mov eax,DWORD PTR [esp+0x1c]
8048ba3: 65 33 05 14 00 00 00 xor eax,DWORD PTR gs:0x14
8048baa: 74 05 je 8048bb1 <phase_2+0x5d>
8048bac: e8 df fb ff ff call 8048790 <__stack_chk_fail@plt>
8048bb1: 83 c4 24 add esp,0x24
8048bb4: 5b pop ebx
8048bb5: 5e pop esi
8048bb6: c3 ret
08048bb7 <phase_3>:
8048bb7: 83 ec 1c sub esp,0x1c
8048bba: 65 a1 14 00 00 00 mov eax,gs:0x14
8048bc0: 89 44 24 0c mov DWORD PTR [esp+0xc],eax
8048bc4: 31 c0 xor eax,eax
8048bc6: 8d 44 24 08 lea eax,[esp+0x8]
8048bca: 50 push eax
8048bcb: 8d 44 24 08 lea eax,[esp+0x8]
8048bcf: 50 push eax
8048bd0: 68 b7 a1 04 08 push 0x804a1b7
8048bd5: ff 74 24 2c push DWORD PTR [esp+0x2c]
8048bd9: e8 32 fc ff ff call 8048810 <__isoc99_sscanf@plt>
8048bde: 83 c4 10 add esp,0x10
8048be1: 83 f8 01 cmp eax,0x1
8048be4: 7f 05 jg 8048beb <phase_3+0x34>
8048be6: e8 03 05 00 00 call 80490ee <explode_bomb>
8048beb: 83 7c 24 04 07 cmp DWORD PTR [esp+0x4],0x7
8048bf0: 77 66 ja 8048c58 <phase_3+0xa1>
8048bf2: 8b 44 24 04 mov eax,DWORD PTR [esp+0x4]
8048bf6: ff 24 85 20 a0 04 08 jmp DWORD PTR [eax*4+0x804a020]
8048bfd: b8 5c 02 00 00 mov eax,0x25c
8048c02: eb 05 jmp 8048c09 <phase_3+0x52>
8048c04: b8 00 00 00 00 mov eax,0x0
8048c09: 2d e4 03 00 00 sub eax,0x3e4
8048c0e: eb 05 jmp 8048c15 <phase_3+0x5e>
8048c10: b8 00 00 00 00 mov eax,0x0
8048c15: 05 7e 03 00 00 add eax,0x37e
8048c1a: eb 05 jmp 8048c21 <phase_3+0x6a>
8048c1c: b8 00 00 00 00 mov eax,0x0
8048c21: 2d 9f 01 00 00 sub eax,0x19f
8048c26: eb 05 jmp 8048c2d <phase_3+0x76>
8048c28: b8 00 00 00 00 mov eax,0x0
8048c2d: 05 9f 01 00 00 add eax,0x19f
8048c32: eb 05 jmp 8048c39 <phase_3+0x82>
8048c34: b8 00 00 00 00 mov eax,0x0
8048c39: 2d 9f 01 00 00 sub eax,0x19f
8048c3e: eb 05 jmp 8048c45 <phase_3+0x8e>
8048c40: b8 00 00 00 00 mov eax,0x0
8048c45: 05 9f 01 00 00 add eax,0x19f
8048c4a: eb 05 jmp 8048c51 <phase_3+0x9a>
8048c4c: b8 00 00 00 00 mov eax,0x0
8048c51: 2d 9f 01 00 00 sub eax,0x19f
8048c56: eb 0a jmp 8048c62 <phase_3+0xab>
8048c58: e8 91 04 00 00 call 80490ee <explode_bomb>
8048c5d: b8 00 00 00 00 mov eax,0x0
8048c62: 83 7c 24 04 05 cmp DWORD PTR [esp+0x4],0x5
8048c67: 7f 06 jg 8048c6f <phase_3+0xb8>
8048c69: 3b 44 24 08 cmp eax,DWORD PTR [esp+0x8]
8048c6d: 74 05 je 8048c74 <phase_3+0xbd>
8048c6f: e8 7a 04 00 00 call 80490ee <explode_bomb>
8048c74: 8b 44 24 0c mov eax,DWORD PTR [esp+0xc]
8048c78: 65 33 05 14 00 00 00 xor eax,DWORD PTR gs:0x14
8048c7f: 74 05 je 8048c86 <phase_3+0xcf>
8048c81: e8 0a fb ff ff call 8048790 <__stack_chk_fail@plt>
8048c86: 83 c4 1c add esp,0x1c
8048c89: c3 ret
08048c8a <func4>:
8048c8a: 57 push edi
8048c8b: 56 push esi
8048c8c: 53 push ebx
8048c8d: 8b 5c 24 10 mov ebx,DWORD PTR [esp+0x10] ; 此时等于9
8048c91: 8b 7c 24 14 mov edi,DWORD PTR [esp+0x14]
8048c95: 85 db test ebx,ebx ;
8048c97: 7e 2b jle 8048cc4 <func4+0x3a>
8048c99: 89 f8 mov eax,edi
8048c9b: 83 fb 01 cmp ebx,0x1 ; 看下面递归了这意思是ebx最后必须是1, eax需要时0.
8048c9e: 74 29 je 8048cc9 <func4+0x3f>
8048ca0: 83 ec 08 sub esp,0x8
8048ca3: 57 push edi
8048ca4: 8d 43 ff lea eax,[ebx-0x1]
8048ca7: 50 push eax
8048ca8: e8 dd ff ff ff call 8048c8a <func4>
8048cad: 83 c4 08 add esp,0x8
8048cb0: 8d 34 07 lea esi,[edi+eax*1]
8048cb3: 57 push edi
8048cb4: 83 eb 02 sub ebx,0x2
8048cb7: 53 push ebx
8048cb8: e8 cd ff ff ff call 8048c8a <func4>
8048cbd: 83 c4 10 add esp,0x10
8048cc0: 01 f0 add eax,esi
8048cc2: eb 05 jmp 8048cc9 <func4+0x3f>
8048cc4: b8 00 00 00 00 mov eax,0x0
8048cc9: 5b pop ebx
8048cca: 5e pop esi
8048ccb: 5f pop edi
8048ccc: c3 ret
08048ccd <phase_4>:
8048ccd: 83 ec 1c sub esp,0x1c
8048cd0: 65 a1 14 00 00 00 mov eax,gs:0x14
8048cd6: 89 44 24 0c mov DWORD PTR [esp+0xc],eax
8048cda: 31 c0 xor eax,eax
8048cdc: 8d 44 24 04 lea eax,[esp+0x4]
8048ce0: 50 push eax
8048ce1: 8d 44 24 0c lea eax,[esp+0xc]
8048ce5: 50 push eax
8048ce6: 68 b7 a1 04 08 push 0x804a1b7
8048ceb: ff 74 24 2c push DWORD PTR [esp+0x2c]
8048cef: e8 1c fb ff ff call 8048810 <__isoc99_sscanf@plt>
8048cf4: 83 c4 10 add esp,0x10
8048cf7: 83 f8 02 cmp eax,0x2 ; 看样子eax和0x2必须相等, 也就是读了俩数
8048cfa: 75 0c jne 8048d08 <phase_4+0x3b>
8048cfc: 8b 44 24 04 mov eax,DWORD PTR [esp+0x4]
8048d00: 83 e8 02 sub eax,0x2 ; 先建个2
8048d03: 83 f8 02 cmp eax,0x2 ; 必须小于等于2
8048d06: 76 05 jbe 8048d0d <phase_4+0x40>
8048d08: e8 e1 03 00 00 call 80490ee <explode_bomb>
8048d0d: 83 ec 08 sub esp,0x8 ; 这个是留出参数空间
8048d10: ff 74 24 0c push DWORD PTR [esp+0xc]
8048d14: 6a 09 push 0x9 ; 把9也放了进去
8048d16: e8 6f ff ff ff call 8048c8a <func4>
8048d1b: 83 c4 10 add esp,0x10
8048d1e: 3b 44 24 08 cmp eax,DWORD PTR [esp+0x8]
8048d22: 74 05 je 8048d29 <phase_4+0x5c>
8048d24: e8 c5 03 00 00 call 80490ee <explode_bomb>
8048d29: 8b 44 24 0c mov eax,DWORD PTR [esp+0xc]
8048d2d: 65 33 05 14 00 00 00 xor eax,DWORD PTR gs:0x14
8048d34: 74 05 je 8048d3b <phase_4+0x6e>
8048d36: e8 55 fa ff ff call 8048790 <__stack_chk_fail@plt>
8048d3b: 83 c4 1c add esp,0x1c
8048d3e: c3 ret
08048d3f <phase_5>:
8048d3f: 83 ec 1c sub esp,0x1c
8048d42: 65 a1 14 00 00 00 mov eax,gs:0x14
8048d48: 89 44 24 0c mov DWORD PTR [esp+0xc],eax
8048d4c: 31 c0 xor eax,eax
8048d4e: 8d 44 24 08 lea eax,[esp+0x8]
8048d52: 50 push eax
8048d53: 8d 44 24 08 lea eax,[esp+0x8]
8048d57: 50 push eax
8048d58: 68 b7 a1 04 08 push 0x804a1b7
8048d5d: ff 74 24 2c push DWORD PTR [esp+0x2c]
8048d61: e8 aa fa ff ff call 8048810 <__isoc99_sscanf@plt>
8048d66: 83 c4 10 add esp,0x10
8048d69: 83 f8 01 cmp eax,0x1
8048d6c: 7f 05 jg 8048d73 <phase_5+0x34>
8048d6e: e8 7b 03 00 00 call 80490ee <explode_bomb>
8048d73: 8b 44 24 04 mov eax,DWORD PTR [esp+0x4]
8048d77: 83 e0 0f and eax,0xf
8048d7a: 89 44 24 04 mov DWORD PTR [esp+0x4],eax
8048d7e: 83 f8 0f cmp eax,0xf
8048d81: 74 2e je 8048db1 <phase_5+0x72>
8048d83: b9 00 00 00 00 mov ecx,0x0
8048d88: ba 00 00 00 00 mov edx,0x0
8048d8d: 83 c2 01 add edx,0x1
8048d90: 8b 04 85 40 a0 04 08 mov eax,DWORD PTR [eax*4+0x804a040]
8048d97: 01 c1 add ecx,eax
8048d99: 83 f8 0f cmp eax,0xf
8048d9c: 75 ef jne 8048d8d <phase_5+0x4e>
8048d9e: c7 44 24 04 0f 00 00 mov DWORD PTR [esp+0x4],0xf
8048da5: 00
8048da6: 83 fa 0f cmp edx,0xf
8048da9: 75 06 jne 8048db1 <phase_5+0x72>
8048dab: 3b 4c 24 08 cmp ecx,DWORD PTR [esp+0x8]
8048daf: 74 05 je 8048db6 <phase_5+0x77>
8048db1: e8 38 03 00 00 call 80490ee <explode_bomb>
8048db6: 8b 44 24 0c mov eax,DWORD PTR [esp+0xc]
8048dba: 65 33 05 14 00 00 00 xor eax,DWORD PTR gs:0x14
8048dc1: 74 05 je 8048dc8 <phase_5+0x89>
8048dc3: e8 c8 f9 ff ff call 8048790 <__stack_chk_fail@plt>
8048dc8: 83 c4 1c add esp,0x1c
8048dcb: c3 ret
08048dcc <phase_6>:
8048dcc: 56 push esi
8048dcd: 53 push ebx
8048dce: 83 ec 4c sub esp,0x4c
8048dd1: 65 a1 14 00 00 00 mov eax,gs:0x14
8048dd7: 89 44 24 44 mov DWORD PTR [esp+0x44],eax
8048ddb: 31 c0 xor eax,eax
8048ddd: 8d 44 24 14 lea eax,[esp+0x14]
8048de1: 50 push eax
8048de2: ff 74 24 5c push DWORD PTR [esp+0x5c]
8048de6: e8 28 03 00 00 call 8049113 <read_six_numbers>
8048deb: 83 c4 10 add esp,0x10
8048dee: be 00 00 00 00 mov esi,0x0
8048df3: 8b 44 b4 0c mov eax,DWORD PTR [esp+esi*4+0xc]
8048df7: 83 e8 01 sub eax,0x1 ; 直接比不行？
8048dfa: 83 f8 05 cmp eax,0x5 ; 这里暗示输入的每个数不能大于6
8048dfd: 76 05 jbe 8048e04 <phase_6+0x38>
8048dff: e8 ea 02 00 00 call 80490ee <explode_bomb>
8048e04: 83 c6 01 add esi,0x1
8048e07: 83 fe 06 cmp esi,0x6
8048e0a: 74 33 je 8048e3f <phase_6+0x73>
8048e0c: 89 f3 mov ebx,esi
8048e0e: 8b 44 9c 0c mov eax,DWORD PTR [esp+ebx*4+0xc]
8048e12: 39 44 b4 08 cmp DWORD PTR [esp+esi*4+0x8],eax
8048e16: 75 05 jne 8048e1d <phase_6+0x51>
8048e18: e8 d1 02 00 00 call 80490ee <explode_bomb>
8048e1d: 83 c3 01 add ebx,0x1
8048e20: 83 fb 05 cmp ebx,0x5
8048e23: 7e e9 jle 8048e0e <phase_6+0x42>
8048e25: eb cc jmp 8048df3 <phase_6+0x27> ; 到此为止都是在要求输入的6个数不能一样
8048e27: 8b 52 08 mov edx,DWORD PTR [edx+0x8]
8048e2a: 83 c0 01 add eax,0x1
8048e2d: 39 c8 cmp eax,ecx
8048e2f: 75 f6 jne 8048e27 <phase_6+0x5b> ; 这个就是序号一直往后走直到找到对应的数为止，搜寻方式就是链表从头到尾找
8048e31: 89 54 b4 24 mov DWORD PTR [esp+esi*4+0x24],edx ; 把第ecx个节点的地址放到数组第esi个位置
8048e35: 83 c3 01 add ebx,0x1
8048e38: 83 fb 06 cmp ebx,0x6
8048e3b: 75 07 jne 8048e44 <phase_6+0x78>
8048e3d: eb 1c jmp 8048e5b <phase_6+0x8f>
8048e3f: bb 00 00 00 00 mov ebx,0x0
8048e44: 89 de mov esi,ebx
8048e46: 8b 4c 9c 0c mov ecx,DWORD PTR [esp+ebx*4+0xc]
8048e4a: b8 01 00 00 00 mov eax,0x1
8048e4f: ba 3c c1 04 08 mov edx,0x804c13c
8048e54: 83 f9 01 cmp ecx,0x1
8048e57: 7f ce jg 8048e27 <phase_6+0x5b>
8048e59: eb d6 jmp 8048e31 <phase_6+0x65>
8048e5b: 8b 5c 24 24 mov ebx,DWORD PTR [esp+0x24] ; 存链表地址
8048e5f: 8d 44 24 24 lea eax,[esp+0x24]
8048e63: 8d 74 24 38 lea esi,[esp+0x38]
8048e67: 89 d9 mov ecx,ebx
8048e69: 8b 50 04 mov edx,DWORD PTR [eax+0x4] ; 得到下一条链表地址
8048e6c: 89 51 08 mov DWORD PTR [ecx+0x8],edx ; 将该链表的指向地址改变为下一条链表
8048e6f: 83 c0 04 add eax,0x4 ; 相当于链表往后循环，用于得到下一次循环的后一条应该指向的链表
8048e72: 89 d1 mov ecx,edx ; 得到下一次循环的当前链表地址
8048e74: 39 f0 cmp eax,esi ; 终止条件
8048e76: 75 f1 jne 8048e69 <phase_6+0x9d>
8048e78: c7 42 08 00 00 00 00 mov DWORD PTR [edx+0x8],0x0
8048e7f: be 05 00 00 00 mov esi,0x5
8048e84: 8b 43 08 mov eax,DWORD PTR [ebx+0x8]
8048e87: 8b 00 mov eax,DWORD PTR [eax]
8048e89: 39 03 cmp DWORD PTR [ebx],eax
8048e8b: 7d 05 jge 8048e92 <phase_6+0xc6>
8048e8d: e8 5c 02 00 00 call 80490ee <explode_bomb>
8048e92: 8b 5b 08 mov ebx,DWORD PTR [ebx+0x8]
8048e95: 83 ee 01 sub esi,0x1
8048e98: 75 ea jne 8048e84 <phase_6+0xb8>
8048e9a: 8b 44 24 3c mov eax,DWORD PTR [esp+0x3c]
8048e9e: 65 33 05 14 00 00 00 xor eax,DWORD PTR gs:0x14
8048ea5: 74 05 je 8048eac <phase_6+0xe0>
8048ea7: e8 e4 f8 ff ff call 8048790 <__stack_chk_fail@plt>
8048eac: 83 c4 44 add esp,0x44
8048eaf: 5b pop ebx
8048eb0: 5e pop esi
8048eb1: c3 ret
08048eb2 <fun7>:
8048eb2: 53 push ebx
8048eb3: 83 ec 08 sub esp,0x8
8048eb6: 8b 54 24 10 mov edx,DWORD PTR [esp+0x10]
8048eba: 8b 4c 24 14 mov ecx,DWORD PTR [esp+0x14]
8048ebe: 85 d2 test edx,edx
8048ec0: 74 37 je 8048ef9 <fun7+0x47>
8048ec2: 8b 1a mov ebx,DWORD PTR [edx]
8048ec4: 39 cb cmp ebx,ecx
8048ec6: 7e 13 jle 8048edb <fun7+0x29>
8048ec8: 83 ec 08 sub esp,0x8
8048ecb: 51 push ecx
8048ecc: ff 72 04 push DWORD PTR [edx+0x4]
8048ecf: e8 de ff ff ff call 8048eb2 <fun7>
8048ed4: 83 c4 10 add esp,0x10
8048ed7: 01 c0 add eax,eax
8048ed9: eb 23 jmp 8048efe <fun7+0x4c>
8048edb: b8 00 00 00 00 mov eax,0x0
8048ee0: 39 cb cmp ebx,ecx
8048ee2: 74 1a je 8048efe <fun7+0x4c>
8048ee4: 83 ec 08 sub esp,0x8
8048ee7: 51 push ecx
8048ee8: ff 72 08 push DWORD PTR [edx+0x8]
8048eeb: e8 c2 ff ff ff call 8048eb2 <fun7>
8048ef0: 83 c4 10 add esp,0x10
8048ef3: 8d 44 00 01 lea eax,[eax+eax*1+0x1]
8048ef7: eb 05 jmp 8048efe <fun7+0x4c>
8048ef9: b8 ff ff ff ff mov eax,0xffffffff
8048efe: 83 c4 08 add esp,0x8
8048f01: 5b pop ebx
8048f02: c3 ret
08048f03 <secret_phase>:
8048f03: 53 push ebx
8048f04: 83 ec 08 sub esp,0x8
8048f07: e8 42 02 00 00 call 804914e <read_line>
8048f0c: 83 ec 04 sub esp,0x4
8048f0f: 6a 0a push 0xa
8048f11: 6a 00 push 0x0
8048f13: 50 push eax
8048f14: e8 67 f9 ff ff call 8048880 <strtol@plt>
8048f19: 89 c3 mov ebx,eax
8048f1b: 8d 40 ff lea eax,[eax-0x1]
8048f1e: 83 c4 10 add esp,0x10
8048f21: 3d e8 03 00 00 cmp eax,0x3e8
8048f26: 76 05 jbe 8048f2d <secret_phase+0x2a>
8048f28: e8 c1 01 00 00 call 80490ee <explode_bomb>
8048f2d: 83 ec 08 sub esp,0x8
8048f30: 53 push ebx
8048f31: 68 88 c0 04 08 push 0x804c088
8048f36: e8 77 ff ff ff call 8048eb2 <fun7>
8048f3b: 83 c4 10 add esp,0x10
8048f3e: 83 f8 02 cmp eax,0x2
8048f41: 74 05 je 8048f48 <secret_phase+0x45>
8048f43: e8 a6 01 00 00 call 80490ee <explode_bomb>
8048f48: 83 ec 0c sub esp,0xc
8048f4b: 68 80 a0 04 08 push 0x804a080
8048f50: e8 6b f8 ff ff call 80487c0 <puts@plt>
8048f55: e8 ed 02 00 00 call 8049247 <phase_defused>
8048f5a: 83 c4 18 add esp,0x18
8048f5d: 5b pop ebx
8048f5e: c3 ret
08048f5f <sig_handler>:
8048f5f: 83 ec 18 sub esp,0x18
8048f62: 68 a8 a0 04 08 push 0x804a0a8
8048f67: e8 54 f8 ff ff call 80487c0 <puts@plt>
8048f6c: c7 04 24 03 00 00 00 mov DWORD PTR [esp],0x3
8048f73: e8 f8 f7 ff ff call 8048770 <sleep@plt>
8048f78: 83 c4 08 add esp,0x8
8048f7b: 68 6a a1 04 08 push 0x804a16a
8048f80: 6a 01 push 0x1
8048f82: e8 b9 f8 ff ff call 8048840 <__printf_chk@plt>
8048f87: 83 c4 04 add esp,0x4
8048f8a: ff 35 c4 c3 04 08 push DWORD PTR ds:0x804c3c4
8048f90: e8 ab f7 ff ff call 8048740 <fflush@plt>
8048f95: c7 04 24 01 00 00 00 mov DWORD PTR [esp],0x1
8048f9c: e8 cf f7 ff ff call 8048770 <sleep@plt>
8048fa1: c7 04 24 72 a1 04 08 mov DWORD PTR [esp],0x804a172
8048fa8: e8 13 f8 ff ff call 80487c0 <puts@plt>
8048fad: c7 04 24 10 00 00 00 mov DWORD PTR [esp],0x10
8048fb4: e8 27 f8 ff ff call 80487e0 <exit@plt>
08048fb9 <invalid_phase>:
8048fb9: 83 ec 10 sub esp,0x10
8048fbc: ff 74 24 14 push DWORD PTR [esp+0x14]
8048fc0: 68 7a a1 04 08 push 0x804a17a
8048fc5: 6a 01 push 0x1
8048fc7: e8 74 f8 ff ff call 8048840 <__printf_chk@plt>
8048fcc: c7 04 24 08 00 00 00 mov DWORD PTR [esp],0x8
8048fd3: e8 08 f8 ff ff call 80487e0 <exit@plt>
08048fd8 <string_length>:
8048fd8: 8b 54 24 04 mov edx,DWORD PTR [esp+0x4]
8048fdc: 80 3a 00 cmp BYTE PTR [edx],0x0
8048fdf: 74 10 je 8048ff1 <string_length+0x19>
8048fe1: b8 00 00 00 00 mov eax,0x0
8048fe6: 83 c0 01 add eax,0x1
8048fe9: 80 3c 02 00 cmp BYTE PTR [edx+eax*1],0x0
8048fed: 75 f7 jne 8048fe6 <string_length+0xe>
8048fef: f3 c3 repz ret
8048ff1: b8 00 00 00 00 mov eax,0x0
8048ff6: c3 ret
08048ff7 <strings_not_equal>:
8048ff7: 57 push edi
8048ff8: 56 push esi
8048ff9: 53 push ebx
8048ffa: 8b 5c 24 10 mov ebx,DWORD PTR [esp+0x10]
8048ffe: 8b 74 24 14 mov esi,DWORD PTR [esp+0x14]
8049002: 53 push ebx
8049003: e8 d0 ff ff ff call 8048fd8 <string_length>
8049008: 89 c7 mov edi,eax
804900a: 89 34 24 mov DWORD PTR [esp],esi
804900d: e8 c6 ff ff ff call 8048fd8 <string_length>
8049012: 83 c4 04 add esp,0x4
8049015: ba 01 00 00 00 mov edx,0x1
804901a: 39 c7 cmp edi,eax
804901c: 75 38 jne 8049056 <strings_not_equal+0x5f>
804901e: 0f b6 03 movzx eax,BYTE PTR [ebx]
8049021: 84 c0 test al,al
8049023: 74 1e je 8049043 <strings_not_equal+0x4c>
8049025: 3a 06 cmp al,BYTE PTR [esi]
8049027: 74 06 je 804902f <strings_not_equal+0x38>
8049029: eb 1f jmp 804904a <strings_not_equal+0x53>
804902b: 3a 06 cmp al,BYTE PTR [esi]
804902d: 75 22 jne 8049051 <strings_not_equal+0x5a>
804902f: 83 c3 01 add ebx,0x1
8049032: 83 c6 01 add esi,0x1
8049035: 0f b6 03 movzx eax,BYTE PTR [ebx]
8049038: 84 c0 test al,al
804903a: 75 ef jne 804902b <strings_not_equal+0x34>
804903c: ba 00 00 00 00 mov edx,0x0
8049041: eb 13 jmp 8049056 <strings_not_equal+0x5f>
8049043: ba 00 00 00 00 mov edx,0x0
8049048: eb 0c jmp 8049056 <strings_not_equal+0x5f>
804904a: ba 01 00 00 00 mov edx,0x1
804904f: eb 05 jmp 8049056 <strings_not_equal+0x5f>
8049051: ba 01 00 00 00 mov edx,0x1
8049056: 89 d0 mov eax,edx
8049058: 5b pop ebx
8049059: 5e pop esi
804905a: 5f pop edi
804905b: c3 ret
0804905c <initialize_bomb>:
804905c: 83 ec 14 sub esp,0x14
804905f: 68 5f 8f 04 08 push 0x8048f5f
8049064: 6a 02 push 0x2
8049066: e8 f5 f6 ff ff call 8048760 <signal@plt>
804906b: 83 c4 1c add esp,0x1c
804906e: c3 ret
0804906f <initialize_bomb_solve>:
804906f: f3 c3 repz ret
08049071 <blank_line>:
8049071: 56 push esi
8049072: 53 push ebx
8049073: 83 ec 04 sub esp,0x4
8049076: 8b 74 24 10 mov esi,DWORD PTR [esp+0x10]
804907a: eb 14 jmp 8049090 <blank_line+0x1f>
804907c: e8 2f f8 ff ff call 80488b0 <__ctype_b_loc@plt>
8049081: 83 c6 01 add esi,0x1
8049084: 0f be db movsx ebx,bl
8049087: 8b 00 mov eax,DWORD PTR [eax]
8049089: f6 44 58 01 20 test BYTE PTR [eax+ebx*2+0x1],0x20
804908e: 74 0e je 804909e <blank_line+0x2d>
8049090: 0f b6 1e movzx ebx,BYTE PTR [esi]
8049093: 84 db test bl,bl
8049095: 75 e5 jne 804907c <blank_line+0xb>
8049097: b8 01 00 00 00 mov eax,0x1
804909c: eb 05 jmp 80490a3 <blank_line+0x32>
804909e: b8 00 00 00 00 mov eax,0x0
80490a3: 83 c4 04 add esp,0x4
80490a6: 5b pop ebx
80490a7: 5e pop esi
80490a8: c3 ret
080490a9 <skip>:
80490a9: 53 push ebx
80490aa: 83 ec 08 sub esp,0x8
80490ad: 83 ec 04 sub esp,0x4
80490b0: ff 35 d0 c3 04 08 push DWORD PTR ds:0x804c3d0
80490b6: 6a 50 push 0x50
80490b8: a1 cc c3 04 08 mov eax,ds:0x804c3cc
80490bd: 8d 04 80 lea eax,[eax+eax*4]
80490c0: c1 e0 04 shl eax,0x4
80490c3: 05 e0 c3 04 08 add eax,0x804c3e0
80490c8: 50 push eax
80490c9: e8 82 f6 ff ff call 8048750 <fgets@plt>
80490ce: 89 c3 mov ebx,eax
80490d0: 83 c4 10 add esp,0x10
80490d3: 85 c0 test eax,eax
80490d5: 74 10 je 80490e7 <skip+0x3e>
80490d7: 83 ec 0c sub esp,0xc
80490da: 50 push eax
80490db: e8 91 ff ff ff call 8049071 <blank_line>
80490e0: 83 c4 10 add esp,0x10
80490e3: 85 c0 test eax,eax
80490e5: 75 c6 jne 80490ad <skip+0x4>
80490e7: 89 d8 mov eax,ebx
80490e9: 83 c4 08 add esp,0x8
80490ec: 5b pop ebx
80490ed: c3 ret
080490ee <explode_bomb>:
80490ee: 83 ec 18 sub esp,0x18
80490f1: 68 8b a1 04 08 push 0x804a18b
80490f6: e8 c5 f6 ff ff call 80487c0 <puts@plt>
80490fb: c7 04 24 94 a1 04 08 mov DWORD PTR [esp],0x804a194
8049102: e8 b9 f6 ff ff call 80487c0 <puts@plt>
8049107: c7 04 24 08 00 00 00 mov DWORD PTR [esp],0x8
804910e: e8 cd f6 ff ff call 80487e0 <exit@plt>
08049113 <read_six_numbers>:
8049113: 83 ec 0c sub esp,0xc ; 又空出12个字节
8049116: 8b 44 24 14 mov eax,DWORD PTR [esp+0x14] ;
804911a: 8d 50 14 lea edx,[eax+0x14]
804911d: 52 push edx
804911e: 8d 50 10 lea edx,[eax+0x10]
8049121: 52 push edx
8049122: 8d 50 0c lea edx,[eax+0xc]
8049125: 52 push edx
8049126: 8d 50 08 lea edx,[eax+0x8]
8049129: 52 push edx
804912a: 8d 50 04 lea edx,[eax+0x4]
804912d: 52 push edx
804912e: 50 push eax
804912f: 68 ab a1 04 08 push 0x804a1ab
8049134: ff 74 24 2c push DWORD PTR [esp+0x2c]
8049138: e8 d3 f6 ff ff call 8048810 <__isoc99_sscanf@plt>
804913d: 83 c4 20 add esp,0x20
8049140: 83 f8 05 cmp eax,0x5
8049143: 7f 05 jg 804914a <read_six_numbers+0x37>
8049145: e8 a4 ff ff ff call 80490ee <explode_bomb>
804914a: 83 c4 0c add esp,0xc
804914d: c3 ret
0804914e <read_line>:
804914e: 57 push edi
804914f: 56 push esi
8049150: 53 push ebx
8049151: e8 53 ff ff ff call 80490a9 <skip>
8049156: 85 c0 test eax,eax
8049158: 75 70 jne 80491ca <read_line+0x7c>
804915a: a1 c0 c3 04 08 mov eax,ds:0x804c3c0
804915f: 39 05 d0 c3 04 08 cmp DWORD PTR ds:0x804c3d0,eax
8049165: 75 19 jne 8049180 <read_line+0x32>
8049167: 83 ec 0c sub esp,0xc
804916a: 68 bd a1 04 08 push 0x804a1bd
804916f: e8 4c f6 ff ff call 80487c0 <puts@plt>
8049174: c7 04 24 08 00 00 00 mov DWORD PTR [esp],0x8
804917b: e8 60 f6 ff ff call 80487e0 <exit@plt>
8049180: 83 ec 0c sub esp,0xc
8049183: 68 db a1 04 08 push 0x804a1db
8049188: e8 23 f6 ff ff call 80487b0 <getenv@plt>
804918d: 83 c4 10 add esp,0x10
8049190: 85 c0 test eax,eax
8049192: 74 0a je 804919e <read_line+0x50>
8049194: 83 ec 0c sub esp,0xc
8049197: 6a 00 push 0x0
8049199: e8 42 f6 ff ff call 80487e0 <exit@plt>
804919e: a1 c0 c3 04 08 mov eax,ds:0x804c3c0
80491a3: a3 d0 c3 04 08 mov ds:0x804c3d0,eax
80491a8: e8 fc fe ff ff call 80490a9 <skip>
80491ad: 85 c0 test eax,eax
80491af: 75 19 jne 80491ca <read_line+0x7c>
80491b1: 83 ec 0c sub esp,0xc
80491b4: 68 bd a1 04 08 push 0x804a1bd
80491b9: e8 02 f6 ff ff call 80487c0 <puts@plt>
80491be: c7 04 24 00 00 00 00 mov DWORD PTR [esp],0x0
80491c5: e8 16 f6 ff ff call 80487e0 <exit@plt>
80491ca: 8b 15 cc c3 04 08 mov edx,DWORD PTR ds:0x804c3cc
80491d0: 8d 1c 92 lea ebx,[edx+edx*4]
80491d3: c1 e3 04 shl ebx,0x4
80491d6: 81 c3 e0 c3 04 08 add ebx,0x804c3e0
80491dc: b8 00 00 00 00 mov eax,0x0
80491e1: b9 ff ff ff ff mov ecx,0xffffffff
80491e6: 89 df mov edi,ebx
80491e8: f2 ae repnz scas al,BYTE PTR es:[edi]
80491ea: f7 d1 not ecx
80491ec: 83 e9 01 sub ecx,0x1
80491ef: 83 f9 4e cmp ecx,0x4e
80491f2: 7e 36 jle 804922a <read_line+0xdc>
80491f4: 83 ec 0c sub esp,0xc
80491f7: 68 e6 a1 04 08 push 0x804a1e6
80491fc: e8 bf f5 ff ff call 80487c0 <puts@plt>
8049201: a1 cc c3 04 08 mov eax,ds:0x804c3cc
8049206: 8d 50 01 lea edx,[eax+0x1]
8049209: 89 15 cc c3 04 08 mov DWORD PTR ds:0x804c3cc,edx
804920f: 6b c0 50 imul eax,eax,0x50
8049212: 05 e0 c3 04 08 add eax,0x804c3e0
8049217: be 01 a2 04 08 mov esi,0x804a201
804921c: b9 04 00 00 00 mov ecx,0x4
8049221: 89 c7 mov edi,eax
8049223: f3 a5 rep movs DWORD PTR es:[edi],DWORD PTR ds:[esi]
8049225: e8 c4 fe ff ff call 80490ee <explode_bomb>
804922a: 8d 04 92 lea eax,[edx+edx*4]
804922d: c1 e0 04 shl eax,0x4
8049230: c6 84 01 df c3 04 08 mov BYTE PTR [ecx+eax*1+0x804c3df],0x0
8049237: 00
8049238: 83 c2 01 add edx,0x1
804923b: 89 15 cc c3 04 08 mov DWORD PTR ds:0x804c3cc,edx
8049241: 89 d8 mov eax,ebx
8049243: 5b pop ebx
8049244: 5e pop esi
8049245: 5f pop edi
8049246: c3 ret
08049247 <phase_defused>:
8049247: 83 ec 6c sub esp,0x6c
804924a: 65 a1 14 00 00 00 mov eax,gs:0x14
8049250: 89 44 24 5c mov DWORD PTR [esp+0x5c],eax
8049254: 31 c0 xor eax,eax
8049256: 83 3d cc c3 04 08 06 cmp DWORD PTR ds:0x804c3cc,0x6
804925d: 75 73 jne 80492d2 <phase_defused+0x8b>
804925f: 83 ec 0c sub esp,0xc
8049262: 8d 44 24 18 lea eax,[esp+0x18]
8049266: 50 push eax
8049267: 8d 44 24 18 lea eax,[esp+0x18]
804926b: 50 push eax
804926c: 8d 44 24 18 lea eax,[esp+0x18]
8049270: 50 push eax
8049271: 68 11 a2 04 08 push 0x804a211
8049276: 68 d0 c4 04 08 push 0x804c4d0
804927b: e8 90 f5 ff ff call 8048810 <__isoc99_sscanf@plt>
8049280: 83 c4 20 add esp,0x20
8049283: 83 f8 03 cmp eax,0x3
8049286: 75 3a jne 80492c2 <phase_defused+0x7b>
8049288: 83 ec 08 sub esp,0x8
804928b: 68 1a a2 04 08 push 0x804a21a
8049290: 8d 44 24 18 lea eax,[esp+0x18]
8049294: 50 push eax
8049295: e8 5d fd ff ff call 8048ff7 <strings_not_equal>
804929a: 83 c4 10 add esp,0x10
804929d: 85 c0 test eax,eax
804929f: 75 21 jne 80492c2 <phase_defused+0x7b>
80492a1: 83 ec 0c sub esp,0xc
80492a4: 68 e0 a0 04 08 push 0x804a0e0
80492a9: e8 12 f5 ff ff call 80487c0 <puts@plt>
80492ae: c7 04 24 08 a1 04 08 mov DWORD PTR [esp],0x804a108
80492b5: e8 06 f5 ff ff call 80487c0 <puts@plt>
80492ba: e8 44 fc ff ff call 8048f03 <secret_phase>
80492bf: 83 c4 10 add esp,0x10
80492c2: 83 ec 0c sub esp,0xc
80492c5: 68 40 a1 04 08 push 0x804a140
80492ca: e8 f1 f4 ff ff call 80487c0 <puts@plt>
80492cf: 83 c4 10 add esp,0x10
80492d2: 8b 44 24 5c mov eax,DWORD PTR [esp+0x5c]
80492d6: 65 33 05 14 00 00 00 xor eax,DWORD PTR gs:0x14