title: What is happening in this Assembly code?
body: <p><strong>Background</strong>: I am doing a "binary bomb" assignment in which I must pass 6 different phases to 'defuse' the bomb. I can use a debugger to help keep track of values and step through each line of the Assembly. I am stuck on the second phase.</p>
  
  <p><strong>Goal</strong>: Find the 'password' for this phase that satisfy the following program. The correct password will move me on to the next phase</p>
  
  <p><strong>What I think I know</strong>: It looks like right away, it's trying to read in 6 numbers. When I disassembled the main() function of the entire bomb, I noticed the a line with "%d %d %d %d %d %d" so this phase must require 6 numbers. Also, it looks like there's a loop starting at 1 and ending after the counter is greater than 5. It seems to being tracked in the -0x4(%rbp) part of memory. It looks like at  line, it compares what is being tracked in %eax to what is entered by the user(earlier stored in %edx at line  to see if they're equal. If they aren't, the bomb will explode. If they are, it'll continue through the loop.</p>
  
  <pre><code>0x400ec9 &lt;phase_2&gt;:     push   %rbp
  0x400eca &lt;phase_2+1&gt;:   mov    %rsp,%rbp
  0x400ecd &lt;phase_2+4&gt;:   sub    $0x30,%rsp
  0x400ed1 &lt;phase_2+8&gt;:   mov    %rdi,-0x28(%rbp)
  0x400ed5 &lt;phase_2+12&gt;:  lea    -0x20(%rbp),%rsi
  0x400ed9 &lt;phase_2+16&gt;:  mov    -0x28(%rbp),%rdi
  0x400edd &lt;phase_2+20&gt;:  callq  0x4013e9 &lt;read_six_numbers&gt;
  0x400ee2 &lt;phase_2+25&gt;:  mov    -0x20(%rbp),%eax
  0x400ee5 &lt;phase_2+28&gt;:  test   %eax,%eax
  0x400ee7 &lt;phase_2+30&gt;:  jns    0x400eee &lt;phase_2+37&gt;
  0x400ee9 &lt;phase_2+32&gt;:  callq  0x401983 &lt;explode_bomb&gt;
  0x400eee &lt;phase_2+37&gt;:  movl   $0x1,-0x4(%rbp)
  0x400ef5 &lt;phase_2+44&gt;:  jmp    0x400f1f &lt;phase_2+86&gt;
  0x400ef7 &lt;phase_2+46&gt;:  mov    -0x4(%rbp),%eax
  0x400efa &lt;phase_2+49&gt;:  cltq
  0x400efc &lt;phase_2+51&gt;:  mov    -0x20(%rbp,%rax,4),%edx
  0x400f00 &lt;phase_2+55&gt;:  mov    -0x4(%rbp),%eax
  0x400f03 &lt;phase_2+58&gt;:  sub    $0x1,%eax
  0x400f06 &lt;phase_2+61&gt;:  cltq
  0x400f08 &lt;phase_2+63&gt;:  mov    -0x20(%rbp,%rax,4),%eax
  0x400f0c &lt;phase_2+67&gt;:  add    -0x4(%rbp),%eax
  0x400f0f &lt;phase_2+70&gt;:  add    $0x1,%eax
  0x400f12 &lt;phase_2+73&gt;:  cmp    %eax,%edx
  0x400f14 &lt;phase_2+75&gt;:  je     0x400f1b &lt;phase_2+82&gt;
  0x400f16 &lt;phase_2+77&gt;:  callq  0x401983 &lt;explode_bomb&gt;
  0x400f1b &lt;phase_2+82&gt;:  addl   $0x1,-0x4(%rbp)
  0x400f1f &lt;phase_2+86&gt;:  cmpl   $0x5,-0x4(%rbp)
  0x400f23 &lt;phase_2+90&gt;:  jle    0x400ef7 &lt;phase_2+46&gt;
  0x400f25 &lt;phase_2+92&gt;:  leaveq
  0x400f26 &lt;phase_2+93&gt;:  retq
  </code></pre>
  
  <p><strong>What I don't know</strong>: There are some new instructions here I'm not familiar with. 'cltq' apparently performs "sign-extend %eax to %rax" but I'm not really sure what that means in this case. Also, I don't understand the line 'mov -0x20(%rbp, %rax, 4), %edx' and what it does exactly. I understand it's moving what's stored in 0x20 to the %rdx register, but I don't know what should be in that spot in memory at that time. I know when doing my debugging, %rbp at -0x20 holds one of the 6 values I entered. But I'm not really sure what %rax and 4 do exactly.</p>
  
  <p>If someone can see what the 6 numbers required are, GREAT! If not, I hope someone can at least shed some light on this code and the problems I'm having to help nudge me in the right direction! Thanks</p>
  
  <p>Some wrong solutions I tested:
  1 2 3 4 5 6; 
  10 20 30 40 50 60</p>
  
  <p>(I didn't want to keep trying because each time I explode the bomb, I get a point off the assignment grade)</p>