title: understanding bomb lab phase 4
body: <p>I am really struggling on how to figure out this phase of the infamous bomb lab. I understand that we need 2 input integers and the 2nd input (x) has to be in the range 1 &lt; x &lt;= 4, but I cannot figure out the recursive method (func4). </p>
  
  <p>More specifically, I can't figure out what exactly the method func4 needs to return so that i can jump over the explode_bomb statement in &lt;+67> because %rsp is the stack pointer and it's being shifted by 8 forward (which I don't really know how to process using gdb commands). [on that note, an x/d run on %rsp gives -72]</p>
  
  <p>Please help! Thanks!</p>
  
  <p>EDIT: Ok I'm aware that the problem is similar to other bomblab qs asked on stack overflow. I'm more specifically asking how to determine what the return value of func4 is (i'm aware it's a form of fibonacci). There is no straight constant value that I can check, as I am asked to compare to stack pointer shifted by x bytes or so.</p>
  
  <p>Dump of assembler code for function phase_4:</p>
  
  <pre><code>   0x00000000004010ff &lt;+0&gt;: sub    $0x18,%rsp
     0x0000000000401103 &lt;+4&gt;: lea    0xc(%rsp),%rcx
     0x0000000000401108 &lt;+9&gt;: lea    0x8(%rsp),%rdx
     0x000000000040110d &lt;+14&gt;:    mov    $0x4024aa,%esi
     0x0000000000401112 &lt;+19&gt;:    mov    $0x0,%eax
     0x0000000000401117 &lt;+24&gt;:    callq  0x400ac8 &lt;__isoc99_sscanf@plt&gt;
     0x000000000040111c &lt;+29&gt;:    cmp    $0x2,%eax
     0x000000000040111f &lt;+32&gt;:    jne    0x40112f &lt;phase_4+48&gt;
     0x0000000000401121 &lt;+34&gt;:    mov    0xc(%rsp),%eax
     0x0000000000401125 &lt;+38&gt;:    cmp    $0x1,%eax
     0x0000000000401128 &lt;+41&gt;:    jle    0x40112f &lt;phase_4+48&gt;
     0x000000000040112a &lt;+43&gt;:    cmp    $0x4,%eax
     0x000000000040112d &lt;+46&gt;:    jle    0x401134 &lt;phase_4+53&gt;
     0x000000000040112f &lt;+48&gt;:    callq  0x4013da &lt;explode_bomb&gt;
     0x0000000000401134 &lt;+53&gt;:    mov    0xc(%rsp),%esi
     0x0000000000401138 &lt;+57&gt;:    mov    $0x8,%edi
     0x000000000040113d &lt;+62&gt;:    callq  0x400e70 &lt;func4&gt;
  =&gt; 0x0000000000401142 &lt;+67&gt;:    cmp    0x8(%rsp),%eax
     0x0000000000401146 &lt;+71&gt;:    je     0x40114d &lt;phase_4+78&gt;
     0x0000000000401148 &lt;+73&gt;:    callq  0x4013da &lt;explode_bomb&gt;
     0x000000000040114d &lt;+78&gt;:    add    $0x18,%rsp
     0x0000000000401151 &lt;+82&gt;:    retq  
  </code></pre>
  
  <p>Dump of assembler code for function func4:</p>
  
  <pre><code>   0x0000000000400e70 &lt;+0&gt;: mov    %rbx,-0x18(%rsp)
     0x0000000000400e75 &lt;+5&gt;: mov    %rbp,-0x10(%rsp)
     0x0000000000400e7a &lt;+10&gt;:    mov    %r12,-0x8(%rsp)
     0x0000000000400e7f &lt;+15&gt;:    sub    $0x18,%rsp
     0x0000000000400e83 &lt;+19&gt;:    mov    %edi,%ebx
     0x0000000000400e85 &lt;+21&gt;:    mov    %esi,%ebp
     0x0000000000400e87 &lt;+23&gt;:    test   %edi,%edi
     0x0000000000400e89 &lt;+25&gt;:    jg     0x400e92 &lt;func4+34&gt;
     0x0000000000400e8b &lt;+27&gt;:    mov    $0x0,%ebp
     0x0000000000400e90 &lt;+32&gt;:    jmp    0x400eb2 &lt;func4+66&gt;
     0x0000000000400e92 &lt;+34&gt;:    cmp    $0x1,%edi
     0x0000000000400e95 &lt;+37&gt;:    je     0x400eb2 &lt;func4+66&gt;
     0x0000000000400e97 &lt;+39&gt;:    lea    -0x1(%rbx),%edi
     0x0000000000400e9a &lt;+42&gt;:    callq  0x400e70 &lt;func4&gt;
     0x0000000000400e9f &lt;+47&gt;:    mov    %eax,%r12d
     0x0000000000400ea2 &lt;+50&gt;:    lea    -0x2(%rbx),%edi
     0x0000000000400ea5 &lt;+53&gt;:    mov    %ebp,%esi
     0x0000000000400ea7 &lt;+55&gt;:    callq  0x400e70 &lt;func4&gt;
     0x0000000000400eac &lt;+60&gt;:    add    %eax,%r12d
     0x0000000000400eaf &lt;+63&gt;:    add    %r12d,%ebp
     0x0000000000400eb2 &lt;+66&gt;:    mov    %ebp,%eax
     0x0000000000400eb4 &lt;+68&gt;:    mov    (%rsp),%rbx
     0x0000000000400eb8 &lt;+72&gt;:    mov    0x8(%rsp),%rbp
     0x0000000000400ebd &lt;+77&gt;:    mov    0x10(%rsp),%r12
     0x0000000000400ec2 &lt;+82&gt;:    add    $0x18,%rsp
     0x0000000000400ec6 &lt;+86&gt;:    retq   
  </code></pre>