第三弹啦!继续上代码!
08048ea1<phase_3>:
8048ea1: 55 push %ebp
8048ea2: 89e5 mov %esp,%ebp
8048ea4: 83ec 28 sub $0x28,%esp //开辟了10个地址
8048ea7: 8d45 f0 lea -0x10(%ebp),%eax
8048eaa: 89 44 24 0c mov %eax,0xc(%esp)
8048eae: 8d45 f4 lea -0xc(%ebp),%eax //将第一个参数给eax
8048eb1: 8944 24 08 mov %eax,0x8(%esp)
8048eb5: c744 24 04 3e a2 04 movl $0x804a23e,0x4(%esp) //$0x804a23e应该很重要
8048ebc: 08
8048ebd: 8b45 08 mov 0x8(%ebp),%eax
8048ec0: 8904 24 mov %eax,(%esp)
8048ec3: e878 f9 ff ff call 8048840<__isoc99_sscanf@plt>
8048ec8: 83f8 01 cmp $0x1,%eax //eax大于1就不bomb
8048ecb: 7f05