title: Translating assembly to pseudocode
body: <p>I'm working on a homework project involving a "bomb" written in compiled c which I have to reverse-engineer to come up with 5 strings which will disarm each of five "phases" of the bomb. I'm stuck on phase 3 right now, trying to translate the assembly (x86, AT&amp;T syntax I believe) produced by gdb for that function. What I've been able to figure out so far is that it is trying to take a string of six numbers as user input and judge them on some criteria, but that's where I'm losing it. The function is as follows (with my attempted pseudocode translation next to it).</p>
  
  <pre><code>0x08048816 &lt;phase_3+0&gt;: push   %ebp
  0x08048817 &lt;phase_3+1&gt;: mov    %esp,%ebp
  0x08048819 &lt;phase_3+3&gt;: push   %edi
  0x0804881a &lt;phase_3+4&gt;: push   %ebx
  0x0804881b &lt;phase_3+5&gt;: sub    $0x30,%esp
  0x0804881e &lt;phase_3+8&gt;: lea    -0x24(%ebp),%eax                             
  0x08048821 &lt;phase_3+11&gt;:    mov    %eax,0x4(%esp)                           
  0x08048825 &lt;phase_3+15&gt;:    mov    0x8(%ebp),%eax                           
  0x08048828 &lt;phase_3+18&gt;:    mov    %eax,(%esp)                              
  0x0804882b &lt;phase_3+21&gt;:    call   0x8048d2c &lt;read_six_numbers&gt;
  0x08048830 &lt;phase_3+26&gt;:    mov    -0x24(%ebp),%eax                     eax = p1
  0x08048833 &lt;phase_3+29&gt;:    cmp    $0x1,%eax                             if eax != 1
  0x08048836 &lt;phase_3+32&gt;:    je     0x804883d &lt;phase_3+39&gt;                   explode bomb
  0x08048838 &lt;phase_3+34&gt;:    call   0x8048fec &lt;explode_bomb&gt;             else
  0x0804883d &lt;phase_3+39&gt;:    movl   $0x1,-0xc(%ebp)                       ebp[-12] = 1
  0x08048844 &lt;phase_3+46&gt;:    jmp    0x804888a &lt;phase_3+116&gt;              while ebp[-12] &lt; 5 {
  0x08048846 &lt;phase_3+48&gt;:    mov    -0xc(%ebp),%eax                          eax = ebp[-12]
  0x08048849 &lt;phase_3+51&gt;:    mov    -0x24(%ebp,%eax,4),%eax                  {magic}
  0x0804884d &lt;phase_3+55&gt;:    mov    %eax,%ebx                                ebx = eax
  0x0804884f &lt;phase_3+57&gt;:    mov    -0xc(%ebp),%eax                          eax = ebp[-12]
  0x08048852 &lt;phase_3+60&gt;:    sub    $0x1,%eax                                 eax -= 1
  0x08048855 &lt;phase_3+63&gt;:    mov    -0x24(%ebp,%eax,4),%eax                  {magic}
  0x08048859 &lt;phase_3+67&gt;:    mov    %eax,%edx                                edx = eax
  0x0804885b &lt;phase_3+69&gt;:    mov    0x804a6d8,%eax                           eax = 0x804a6d8
  0x08048860 &lt;phase_3+74&gt;:    mov    $0xffffffff,%ecx                      ecx = 255
  0x08048865 &lt;phase_3+79&gt;:    mov    %eax,-0x2c(%ebp)                         ebp[-12] = eax
  0x08048868 &lt;phase_3+82&gt;:    mov    $0x0,%eax                                 eax = 0
  0x0804886d &lt;phase_3+87&gt;:    cld                         
  0x0804886e &lt;phase_3+88&gt;:    mov    -0x2c(%ebp),%edi                         edi = ebp[-12]
  0x08048871 &lt;phase_3+91&gt;:    repnz scas %es:(%edi),%al                       {deep magic}
  0x08048873 &lt;phase_3+93&gt;:    mov    %ecx,%eax                                eax = ecx
  0x08048875 &lt;phase_3+95&gt;:    not    %eax                                     eax = -eax
  0x08048877 &lt;phase_3+97&gt;:    sub    $0x1,%eax                                 eax -= 1
  0x0804887a &lt;phase_3+100&gt;:   imul   %edx,%eax                                eax *= edx
  0x0804887d &lt;phase_3+103&gt;:   cmp    %eax,%ebx                                if (eax != ebx)
  0x0804887f &lt;phase_3+105&gt;:   je     0x8048886 &lt;phase_3+112&gt;                      explode_bomb
  0x08048881 &lt;phase_3+107&gt;:   call   0x8048fec &lt;explode_bomb&gt;                 else
  0x08048886 &lt;phase_3+112&gt;:   addl   $0x1,-0xc(%ebp)                           ebp[-12] += 1
  0x0804888a &lt;phase_3+116&gt;:   cmpl   $0x5,-0xc(%ebp)
  0x0804888e &lt;phase_3+120&gt;:   jle    0x8048846 &lt;phase_3+48&gt;               }
  0x08048890 &lt;phase_3+122&gt;:   add    $0x30,%esp
  0x08048893 &lt;phase_3+125&gt;:   pop    %ebx
  0x08048894 &lt;phase_3+126&gt;:   pop    %edi
  0x08048895 &lt;phase_3+127&gt;:   pop    %ebp
  0x08048896 &lt;phase_3+128&gt;:   ret
  </code></pre>
  
  <p>I am at least a little bit (though not a lot) confident in most of this; the lines that I'm absolutely sure are wrong are the three lines currently marked as "magic" -- phase_3+51, phase_3+63, and phase_3+91 (the two mov lines with weird syntax and the repnz). I haven't seen either syntax around much and I can't figure out what search terms to use to look them up.</p>
  
  <p>Any general (and/or scathing) critiques of my attempt at this? Obvious places where I'm going off the rails? Obviously, since this is homework I don't need someone to give me the answer; I just want to know if my interpretation is generally sound (and what those three lines mean that I'm baffled by).</p>
  
  <p>Thanks much for any help!</p>
  
  <p><em><strong></em>*EDIT***</strong></p>
  
  <p>The read_six_numbers function disassembles as follows:</p>
  
  <pre><code>0x08048d2c &lt;read_six_numbers+0&gt;:    push   %ebp
  0x08048d2d &lt;read_six_numbers+1&gt;:    mov    %esp,%ebp
  0x08048d2f &lt;read_six_numbers+3&gt;:    push   %esi
  0x08048d30 &lt;read_six_numbers+4&gt;:    push   %ebx
  0x08048d31 &lt;read_six_numbers+5&gt;:    sub    $0x30,%esp
  0x08048d34 &lt;read_six_numbers+8&gt;:    mov    0xc(%ebp),%eax
  0x08048d37 &lt;read_six_numbers+11&gt;:   add    $0x14,%eax
  0x08048d3a &lt;read_six_numbers+14&gt;:   mov    0xc(%ebp),%edx
  0x08048d3d &lt;read_six_numbers+17&gt;:   add    $0x10,%edx
  0x08048d40 &lt;read_six_numbers+20&gt;:   mov    0xc(%ebp),%ecx
  0x08048d43 &lt;read_six_numbers+23&gt;:   add    $0xc,%ecx
  0x08048d46 &lt;read_six_numbers+26&gt;:   mov    0xc(%ebp),%ebx
  0x08048d49 &lt;read_six_numbers+29&gt;:   add    $0x8,%ebx
  0x08048d4c &lt;read_six_numbers+32&gt;:   mov    0xc(%ebp),%esi
  0x08048d4f &lt;read_six_numbers+35&gt;:   add    $0x4,%esi
  0x08048d52 &lt;read_six_numbers+38&gt;:   mov    %eax,0x1c(%esp)
  0x08048d56 &lt;read_six_numbers+42&gt;:   mov    %edx,0x18(%esp)
  0x08048d5a &lt;read_six_numbers+46&gt;:   mov    %ecx,0x14(%esp)
  0x08048d5e &lt;read_six_numbers+50&gt;:   mov    %ebx,0x10(%esp)
  0x08048d62 &lt;read_six_numbers+54&gt;:   mov    %esi,0xc(%esp)
  0x08048d66 &lt;read_six_numbers+58&gt;:   mov    0xc(%ebp),%eax
  0x08048d69 &lt;read_six_numbers+61&gt;:   mov    %eax,0x8(%esp)
  0x08048d6d &lt;read_six_numbers+65&gt;:   movl   $0x804965d,0x4(%esp)
  0x08048d75 &lt;read_six_numbers+73&gt;:   mov    0x8(%ebp),%eax
  0x08048d78 &lt;read_six_numbers+76&gt;:   mov    %eax,(%esp)
  0x08048d7b &lt;read_six_numbers+79&gt;:   call   0x80485a4 &lt;sscanf@plt&gt;
  0x08048d80 &lt;read_six_numbers+84&gt;:   mov    %eax,-0xc(%ebp)
  0x08048d83 &lt;read_six_numbers+87&gt;:   cmpl   $0x5,-0xc(%ebp)
  0x08048d87 &lt;read_six_numbers+91&gt;:   jg     0x8048d8e &lt;read_six_numbers+98&gt;
  0x08048d89 &lt;read_six_numbers+93&gt;:   call   0x8048fec &lt;explode_bomb&gt;
  0x08048d8e &lt;read_six_numbers+98&gt;:   add    $0x30,%esp
  0x08048d91 &lt;read_six_numbers+101&gt;:  pop    %ebx
  0x08048d92 &lt;read_six_numbers+102&gt;:  pop    %esi
  0x08048d93 &lt;read_six_numbers+103&gt;:  pop    %ebp
  0x08048d94 &lt;read_six_numbers+104&gt;:  ret    
  </code></pre>