# Help with this binary bomb hw

I am really stuck on phase 3. Since the 1st and fourth numbers (same for the 2nd & 5th and 3rd and 6th) should be the same numbers to
defuse the 1st bomb,
I confused as to where to begin looking to solve the 2nd bomb. I
assume that
(gdb) print \$ebp
\$13 = (void *) 0xbf9cd4a8
has something to do with. But as to apply it I not sure. Any you
provide any insight as to what I need to do?
[code]Dump of assembler code for function phase_3:
0x080488a6 : push %ebp
0x080488a7 : mov %esp,%ebp
0x080488a9 : sub \$0x28,%esp
0x080488ac : movl \$0x0,0xfffffffc(%ebp)
0x080488b3 : lea 0xffffffe0(%ebp),%eax
0x080488b6 : mov %eax,0x4(%esp)
0x080488ba : mov 0x8(%ebp),%eax
0x080488bd : mov %eax,(%esp)
0x080488c0 : call 0x8048dac
0x080488c5 : movl \$0x0,0xfffffff8(%ebp)
0x080488cc : jmp 0x80488f6
0x080488ce : mov 0xfffffff8(%ebp),%eax
0x080488d1 : mov 0xffffffe0(%ebp,%eax,4),%edx
0x080488d5 : mov 0xfffffff8(%ebp),%eax
0x080488db : mov 0xffffffe0(%ebp,%eax,4),%eax
0x080488df : cmp %eax,%edx
0x080488e1 : je 0x80488e8
0x080488e3 : call 0x804906c
0x080488e8 : mov 0xfffffff8(%ebp),%eax
0x080488eb : mov 0xffffffe0(%ebp,%eax,4),%eax
0x080488f6 : cmpl \$0x2,0xfffffff8(%ebp)
0x080488fa : jle 0x80488ce
0x080488fc : cmpl \$0x0,0xfffffffc(%ebp)
0x08048900 : jne 0x8048907
0x08048902 : call 0x804906c
0x08048907 : leave
0x08048908 : ret
End of assembler dump.
That's number 2. Keep going!
6 9 12 6 9 12

Breakpoint 1, 0x080488df in phase_3 ()
(gdb) cont
Continuing.

Breakpoint 1, 0x080488df in phase_3 ()
(gdb) cont
Continuing.

Breakpoint 1, 0x080488df in phase_3 ()
(gdb) cont
Continuing.
Halfway there!
cont

BOOM!!!
The bomb has blown up.

Program exited with code 010.
(gdb)

.[/code]