Breakpoint 8, 0x08048ef8 in phase_3 () 3: /x $esp = 0xbfb58080 2: /x $ebp = 0xbfb580a8 1: x/i $eip 0x8048ef8 : cmp $0x1,%eax (gdb) si 0x08048efb in phase_3 () 3: /x $esp = 0xbfb58080 2: /x $ebp = 0xbfb580a8 1: x/i $eip 0x8048efb : jg 0x8048f02 (gdb) si 0x08048f02 in phase_3 () 3: /x $esp = 0xbfb58080 2: /x $ebp = 0xbfb580a8 1: x/i $eip 0x8048f02 : cmpl $0x7,0xfffffffc(%ebp) (gdb) si 0x08048f06 in phase_3 () 3: /x $esp = 0xbfb58080 2: /x $ebp = 0xbfb580a8 1: x/i $eip 0x8048f06 : ja 0x8048f73 (gdb) si 0x08048f08 in phase_3 () 3: /x $esp = 0xbfb58080 2: /x $ebp = 0xbfb580a8 1: x/i $eip 0x8048f08 : mov 0xfffffffc(%ebp),%eax (gdb) si 0x08048f0b in phase_3 () 3: /x $esp = 0xbfb58080 2: /x $ebp = 0xbfb580a8 1: x/i $eip 0x8048f0b : jmp *0x80499c0(,%eax,4) (gdb) si 0x08048f29 in phase_3 () 3: /x $esp = 0xbfb58080 2: /x $ebp = 0xbfb580a8 1: x/i $eip 0x8048f29 : mov $0x0,%eax (gdb) si 0x08048f2e in phase_3 () 3: /x $esp = 0xbfb58080 2: /x $ebp = 0xbfb580a8 1: x/i $eip 0x8048f2e : data16 (gdb) si 0x08048f30 in phase_3 () 3: /x $esp = 0xbfb58080 2: /x $ebp = 0xbfb580a8 1: x/i $eip 0x8048f30 : jmp 0x8048f5d (gdb) si 0x08048f5d in phase_3 () 3: /x $esp = 0xbfb58080 2: /x $ebp = 0xbfb580a8 1: x/i $eip 0x8048f5d : add $0xdb,%eax (gdb) si 0x08048f62 in phase_3 () 3: /x $esp = 0xbfb58080 2: /x $ebp = 0xbfb580a8 1: x/i $eip 0x8048f62 : sub $0xe8,%eax (gdb) si 0x08048f67 in phase_3 () 3: /x $esp = 0xbfb58080 2: /x $ebp = 0xbfb580a8 1: x/i $eip 0x8048f67 : add $0xe8,%eax (gdb) si 0x08048f6c in phase_3 () 3: /x $esp = 0xbfb58080 2: /x $ebp = 0xbfb580a8 1: x/i $eip 0x8048f6c : sub $0xba,%eax (gdb) si 0x08048f71 in phase_3 () 3: /x $esp = 0xbfb58080 2: /x $ebp = 0xbfb580a8 1: x/i $eip 0x8048f71 : jmp 0x8048f7d (gdb) si 0x08048f7d in phase_3 () 3: /x $esp = 0xbfb58080 2: /x $ebp = 0xbfb580a8 1: x/i $eip 0x8048f7d : cmpl $0x5,0xfffffffc(%ebp) (gdb) si 0x08048f81 in phase_3 () 3: /x $esp = 0xbfb58080 2: /x $ebp = 0xbfb580a8 1: x/i $eip 0x8048f81 : jg 0x8048f88 (gdb) print/a %eax A syntax error in expression, near `%eax'. (gdb) print/a eax No symbol "eax" in current context. (gdb) print/a *eax No symbol "eax" in current context. (gdb) print/a $eax $1 = 0x21 (gdb) quit The program is running. Exit anyway? (y or n) y Desktop/bomb5> gdb bomb GNU gdb 6.5 Copyright (C) 2006 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type "show copying" to see the conditions. There is absolutely no warranty for GDB. Type "show warranty" for details. This GDB was configured as "i586-suse-linux"...Using host libthread_db library "/lib/libthread_db.so.1". Breakpoint 1 at 0x8048a7b: file bomb.c, line 45. Breakpoint 2 at 0x8049317 Breakpoint 3 at 0x8049311 Breakpoint 4 at 0x8049312 Breakpoint 5 at 0x8049313 Breakpoint 6 at 0x8049314 Breakpoint 7 at 0x8049315 (gdb) break *0x8048ef8 Breakpoint 8 at 0x8048ef8 (gdb) r phrases.txt Starting program: /home/f85/mxbusu/Desktop/bomb5/bomb phrases.txt Failed to read a valid object file image from memory. Breakpoint 1, main (argc=2, argv=0xbfd1e324) at bomb.c:45 45 if (argc == 1) { 3: /x $esp = 0xbfd1e270 2: /x $ebp = 0xbfd1e288 1: x/i $eip 0x8048a7b : cmp $0x1,%eax (gdb) u 8 Welcome to my fiendish little bomb. You have 6 phases with which to blow yourself up. Have a nice day! Phase 1 defused. How about the next one? That's number 2. Keep going! Breakpoint 8, 0x08048ef8 in phase_3 () 3: /x $esp = 0xbfd1e240 2: /x $ebp = 0xbfd1e268 1: x/i $eip 0x8048ef8 : cmp $0x1,%eax (gdb) si 0x08048efb in phase_3 () 3: /x $esp = 0xbfd1e240 2: /x $ebp = 0xbfd1e268 1: x/i $eip 0x8048efb : jg 0x8048f02 (gdb) si 0x08048f02 in phase_3 () 3: /x $esp = 0xbfd1e240 2: /x $ebp = 0xbfd1e268 1: x/i $eip 0x8048f02 : cmpl $0x7,0xfffffffc(%ebp) (gdb) si 0x08048f06 in phase_3 () 3: /x $esp = 0xbfd1e240 2: /x $ebp = 0xbfd1e268 1: x/i $eip 0x8048f06 : ja 0x8048f73 (gdb) si 0x08048f08 in phase_3 () 3: /x $esp = 0xbfd1e240 2: /x $ebp = 0xbfd1e268 1: x/i $eip 0x8048f08 : mov 0xfffffffc(%ebp),%eax (gdb) si 0x08048f0b in phase_3 () 3: /x $esp = 0xbfd1e240 2: /x $ebp = 0xbfd1e268 1: x/i $eip 0x8048f0b : jmp *0x80499c0(,%eax,4) (gdb) si 0x08048f29 in phase_3 () 3: /x $esp = 0xbfd1e240 2: /x $ebp = 0xbfd1e268 1: x/i $eip 0x8048f29 : mov $0x0,%eax (gdb) si 0x08048f2e in phase_3 () 3: /x $esp = 0xbfd1e240 2: /x $ebp = 0xbfd1e268 1: x/i $eip 0x8048f2e : data16 (gdb) si 0x08048f30 in phase_3 () 3: /x $esp = 0xbfd1e240 2: /x $ebp = 0xbfd1e268 1: x/i $eip 0x8048f30 : jmp 0x8048f5d (gdb) si 0x08048f5d in phase_3 () 3: /x $esp = 0xbfd1e240 2: /x $ebp = 0xbfd1e268 1: x/i $eip 0x8048f5d : add $0xdb,%eax (gdb) si 0x08048f62 in phase_3 () 3: /x $esp = 0xbfd1e240 2: /x $ebp = 0xbfd1e268 1: x/i $eip 0x8048f62 : sub $0xe8,%eax (gdb) si 0x08048f67 in phase_3 () 3: /x $esp = 0xbfd1e240 2: /x $ebp = 0xbfd1e268 1: x/i $eip 0x8048f67 : add $0xe8,%eax (gdb) si 0x08048f6c in phase_3 () 3: /x $esp = 0xbfd1e240 2: /x $ebp = 0xbfd1e268 1: x/i $eip 0x8048f6c : sub $0xba,%eax (gdb) si 0x08048f71 in phase_3 () 3: /x $esp = 0xbfd1e240 2: /x $ebp = 0xbfd1e268 1: x/i $eip 0x8048f71 : jmp 0x8048f7d (gdb) si 0x08048f7d in phase_3 () 3: /x $esp = 0xbfd1e240 2: /x $ebp = 0xbfd1e268 1: x/i $eip 0x8048f7d : cmpl $0x5,0xfffffffc(%ebp) (gdb) si 0x08048f81 in phase_3 () 3: /x $esp = 0xbfd1e240 2: /x $ebp = 0xbfd1e268 1: x/i $eip 0x8048f81 : jg 0x8048f88 (gdb) si 0x08048f83 in phase_3 () 3: /x $esp = 0xbfd1e240 2: /x $ebp = 0xbfd1e268 1: x/i $eip 0x8048f83 : cmp 0xfffffff8(%ebp),%eax (gdb) si 0x08048f86 in phase_3 () 3: /x $esp = 0xbfd1e240 2: /x $ebp = 0xbfd1e268 1: x/i $eip 0x8048f86 : je 0x8048f8d (gdb) si 0x08048f88 in phase_3 () 3: /x $esp = 0xbfd1e240 2: /x $ebp = 0xbfd1e268 1: x/i $eip 0x8048f88 : call 0x8049311 (gdb) si Breakpoint 3, 0x08049311 in explode_bomb () 3: /x $esp = 0xbfd1e23c 2: /x $ebp = 0xbfd1e268 1: x/i $eip 0x8049311 : push %ebp (gdb) si 0x08049312 in explode_bomb () 3: /x $esp = 0xbfd1e238 2: /x $ebp = 0xbfd1e268 1: x/i $eip 0x8049312 : mov %esp,%ebp (gdb) si 0x08049314 in explode_bomb () 3: /x $esp = 0xbfd1e238 2: /x $ebp = 0xbfd1e238 1: x/i $eip 0x8049314 : sub $0x8,%esp (gdb) quit The program is running. Exit anyway? (y or n) y Desktop/bomb5>