title: Understanding Bomb Lab Phase 5 (two integer input)
body: <p>I am currently stuck on bomb lab phase 5. My phase 5 is different from most other phase 5's I've found online, as it is the input of two integers. Here is the assembly code:</p>
  
  <pre><code>   0x0000555555555536 &lt;+0&gt;:     sub    $0x18,%rsp
     0x000055555555553a &lt;+4&gt;:     mov    %fs:0x28,%rax
     0x0000555555555543 &lt;+13&gt;:    mov    %rax,0x8(%rsp)
     0x0000555555555548 &lt;+18&gt;:    xor    %eax,%eax
     0x000055555555554a &lt;+20&gt;:    lea    0x4(%rsp),%rcx
     0x000055555555554f &lt;+25&gt;:    mov    %rsp,%rdx
     0x0000555555555552 &lt;+28&gt;:    lea    0x1914(%rip),%rsi        # 0x555555556e6d
     0x0000555555555559 &lt;+35&gt;:    callq  0x555555554f60 &lt;__isoc99_sscanf@plt&gt;
     0x000055555555555e &lt;+40&gt;:    cmp    $0x1,%eax
     0x0000555555555561 &lt;+43&gt;:    jle    0x5555555555bd &lt;phase_5+135&gt;
     0x0000555555555563 &lt;+45&gt;:    mov    (%rsp),%eax
     0x0000555555555566 &lt;+48&gt;:    and    $0xf,%eax
     0x0000555555555569 &lt;+51&gt;:    mov    %eax,(%rsp)
     0x000055555555556c &lt;+54&gt;:    cmp    $0xf,%eax
     0x000055555555556f &lt;+57&gt;:    je     0x5555555555a3 &lt;phase_5+109&gt;
     0x0000555555555571 &lt;+59&gt;:    mov    $0x0,%ecx
     0x0000555555555576 &lt;+64&gt;:    mov    $0x0,%edx
     0x000055555555557b &lt;+69&gt;:    lea    0x165e(%rip),%rsi        # 0x555555556be0 &lt;array.3418&gt;
     0x0000555555555582 &lt;+76&gt;:    add    $0x1,%edx
     0x0000555555555585 &lt;+79&gt;:    cltq   
     0x0000555555555587 &lt;+81&gt;:    mov    (%rsi,%rax,4),%eax
     0x000055555555558a &lt;+84&gt;:    add    %eax,%ecx
     0x000055555555558c &lt;+86&gt;:    cmp    $0xf,%eax
     0x000055555555558f &lt;+89&gt;:    jne    0x555555555582 &lt;phase_5+76&gt;
     0x0000555555555591 &lt;+91&gt;:    movl   $0xf,(%rsp)
     0x0000555555555598 &lt;+98&gt;:    cmp    $0xf,%edx
     0x000055555555559b &lt;+101&gt;:   jne    0x5555555555a3 &lt;phase_5+109&gt;
     0x000055555555559d &lt;+103&gt;:   cmp    %ecx,0x4(%rsp)
     0x00005555555555a1 &lt;+107&gt;:   je     0x5555555555a8 &lt;phase_5+114&gt;
     0x00005555555555a3 &lt;+109&gt;:   callq  0x555555555b25 &lt;explode_bomb&gt;
     0x00005555555555a8 &lt;+114&gt;:   mov    0x8(%rsp),%rax
     0x00005555555555ad &lt;+119&gt;:   xor    %fs:0x28,%rax
     0x00005555555555b6 &lt;+128&gt;:   jne    0x5555555555c4 &lt;phase_5+142&gt;
     0x00005555555555b8 &lt;+130&gt;:   add    $0x18,%rsp
     0x00005555555555bc &lt;+134&gt;:   retq   
     0x00005555555555bd &lt;+135&gt;:   callq  0x555555555b25 &lt;explode_bomb&gt;
     0x00005555555555c2 &lt;+140&gt;:   jmp    0x555555555563 &lt;phase_5+45&gt;
     0x00005555555555c4 &lt;+142&gt;:   callq  0x555555554ec0 &lt;__stack_chk_fail@plt&gt;
  </code></pre>
  
  <p>The list of numbers I've inputed is this:</p>
  
  <p><a href="https://i.stack.imgur.com/2IKeQ.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/2IKeQ.png" alt="enter image description here"></a></p>
  
  <p>So far from my understanding, two conditions need to be met:</p>
  
  <ol>
  <li>edx must equal 0xf, meaning the first input has to be 5, 21, 37, etc. (Add 16 each time)</li>
  <li>ecx is compared to rsp, which is 15, so we need ecx to equal to 15</li>
  </ol>
  
  <p>What I know so far:</p>
  
  <ol>
  <li>first input cannot be 15, 31, 47, etc.</li>
  <li>Changing the second input does not affect the ecx</li>
  <li>first input is directly correlated to edx</li>
  </ol>
  
  <p>Questions:</p>
  
  <ol>
  <li>Where is the second input used?</li>
  <li>Is it true that the first input has to be 5, 21, 37, etc?</li>
  </ol>