Question

Here’s the code for reference:

 8048e3c:       55                      push   %ebp 
 8048e3d:       89 e5                   mov    %esp,%ebp
 8048e3f:       83 ec 28                sub    $0x28,%esp
 8048e42:       8d 45 f8                lea    0xfffffff8(%ebp),%eax
 8048e45:       89 44 24 0c             mov    %eax,0xc(%esp) 
 8048e49:       8d 45 fc                lea    0xfffffffc(%ebp),%eax
 8048e4c:       89 44 24 08             mov    %eax,0x8(%esp)
 8048e50:       c7 44 24 04 22 a3 04    movl   $0x804a322,0x4(%esp)
 8048e57:       08 
 8048e58:       8b 45 08                mov    0x8(%ebp),%eax
 8048e5b:       89 04 24                mov    %eax,(%esp)
 8048e5e:       e8 ad fc ff ff          call   8048b10 <sscanf@plt>
 8048e63:       83 f8 01                cmp    $0x1,%eax
 8048e66:       7f 05                   jg     8048e6d <level_2+0x31>
 8048e68:       e8 13 11 00 00          call   8049f80 <explode_bomb>
 8048e6d:       8b 45 f8                mov    0xfffffff8(%ebp),%eax
 8048e70:       8b 55 fc                mov    0xfffffffc(%ebp),%edx
 8048e73:       01 d0                   add    %edx,%eax
 8048e75:       3d 56 24 00 00          cmp    $0x2456,%eax
 8048e7a:       74 07                   je     8048e83 <level_2+0x47>
 8048e7c:       e8 ff 10 00 00          call   8049f80 <explode_bomb>
 8048e81:       eb 29                   jmp    8048eac <level_2+0x70>
 8048e83:       8b 55 fc                mov    0xfffffffc(%ebp),%edx
 8048e86:       8b 45 f8                mov    0xfffffff8(%ebp),%eax
 **8048e89:       09 d0                   or     %edx,%eax
 8048e8b:       25 00 01 00 00          and    $0x100,%eax
 8048e90:       85 c0                   test   %eax,%eax
 8048e92:       75 07                   jne    8048e9b <level_2+0x5f>**
 8048e94:       e8 e7 10 00 00          call   8049f80 <explode_bomb>
 8048e99:       eb 11                   jmp    8048eac <level_2+0x70>
 8048e9b:       8b 45 fc                mov    0xfffffffc(%ebp),%eax
 8048e9e:       8b 55 f8                mov    0xfffffff8(%ebp),%edx
 8048ea1:       31 d0                   xor    %edx,%eax
 8048ea3:       85 c0                   test   %eax,%eax
 8048ea5:       7e 05                   jle    8048eac <level_2+0x70>
 8048ea7:       e8 d4 10 00 00          call   8049f80 <explode_bomb>
 8048eac:       c9                      leave  
 8048ead:       c3                      ret    

Based on this I’ve come up with three rules for the two integers that would work in this code. I’m not sure about the last one:
x+y = 9302:
x|y != 256 & y:
x^y <= 0
I’m sure of how to combine the lines that are in bold. I converted 0x100 into 256 and because the command jne followed I used !=. The part that i’m unsure about is where the & or if i even need the conversion to 256.

Answer 1

The lines you highlighted can be read like this:

eax |= edx;
if( (eax & 256) == 0 ) {
  explode_bomb();
}