binary bomb lab phase 6

0x000000000040106b <+0>:     push   %r12
0x000000000040106d <+2>:     push   %rbp
0x000000000040106e <+3>:     push   %rbx
0x000000000040106f <+4>:     sub    $0x50,%rsp
0x0000000000401073 <+8>:     lea    0x30(%rsp),%rsi
0x0000000000401078 <+13>:    callq  0x40159a <read_six_numbers>
0x000000000040107d <+18>:    mov    $0x0,%ebp
0x0000000000401082 <+23>:    lea    0x30(%rsp),%r12
0x0000000000401087 <+28>:    mov    (%r12,%rbp,4),%eax
0x000000000040108b <+32>:    sub    $0x1,%eax
0x000000000040108e <+35>:    cmp    $0x5,%eax 
0x0000000000401091 <+38>:    jbe    0x401098 <phase_6+45>
0x0000000000401093 <+40>:    callq  0x401564 <explode_bomb>
0x0000000000401098 <+45>:    lea    0x1(%rbp),%ebx
0x000000000040109b <+48>:    cmp    $0x5,%rbp
0x000000000040109f <+52>:    je     0x4010c2 <phase_6+87>
0x00000000004010a1 <+54>:    movslq %ebx,%rdx
0x00000000004010a4 <+57>:    mov    (%r12,%rbp,4),%eax
0x00000000004010a8 <+61>:    cmp    0x30(%rsp,%rdx,4),%eax
0x00000000004010ac <+65>:    jne    0x4010b3 <phase_6+72>
0x00000000004010ae <+67>:    callq  0x401564 <explode_bomb>
0x00000000004010b3 <+72>:    add    $0x1,%ebx
0x00000000004010b6 <+75>:    cmp    $0x5,%ebx
0x00000000004010b9 <+78>:    jle    0x4010a1 <phase_6+54>
0x00000000004010bb <+80>:    add    $0x1,%rbp
0x00000000004010bf <+84>:    nop
0x00000000004010c0 <+85>:    jmp    0x401087 <phase_6+28>

0x00000000004010c2 <+87>:    lea    0x30(%rsp),%rdx
0x00000000004010c7 <+92>:    lea    0x48(%rsp),%rcx
0x00000000004010cc <+97>:    mov    $0x7,%eax
0x00000000004010d1 <+102>:   sub    (%rdx),%eax
0x00000000004010d3 <+104>:   mov    %eax,(%rdx)
0x00000000004010d5 <+106>:   add    $0x4,%rdx
0x00000000004010d9 <+110>:   cmp    %rcx,%rdx
0x00000000004010dc <+113>:   jne    0x4010cc <phase_6+97>
0x00000000004010de <+115>:   mov    $0x1,%edx
0x00000000004010e3 <+120>:   mov    $0x603970,%esi
0x00000000004010e8 <+125>:   mov    $0x0,%ecx
0x00000000004010ed <+130>:   jmp    0x4010f6 <phase_6+139>
0x00000000004010ef <+132>:   mov    0x8(%rsi),%rsi
0x00000000004010f3 <+136>:   add    $0x1,%edx
0x00000000004010f6 <+139>:   movslq %ecx,%rax
0x00000000004010f9 <+142>:   cmp    0x30(%rsp,%rax,4),%edx
0x00000000004010fd <+146>:   jl     0x4010ef <phase_6+132>
0x00000000004010ff <+148>:   mov    %rsi,(%rsp,%rax,8)
0x0000000000401103 <+152>:   add    $0x1,%ecx
0x0000000000401106 <+155>:   cmp    $0x5,%ecx
0x0000000000401109 <+158>:   jg     0x401117 <phase_6+172>
0x000000000040110b <+160>:   mov    $0x1,%edx
0x0000000000401110 <+165>:   mov    $0x603970,%esi
0x0000000000401115 <+170>:   jmp    0x4010f6 <phase_6+139>
0x0000000000401117 <+172>:   mov    (%rsp),%rcx 

0x000000000040111b <+176>:   mov    0x8(%rsp),%rax
0x0000000000401120 <+181>:   mov    %rax,0x8(%rcx)
0x0000000000401124 <+185>:   mov    0x10(%rsp),%rdx
0x0000000000401129 <+190>:   mov    %rdx,0x8(%rax)
0x000000000040112d <+194>:   mov    0x18(%rsp),%rax
0x0000000000401132 <+199>:   mov    %rax,0x8(%rdx)
0x0000000000401136 <+203>:   mov    0x20(%rsp),%rdx
0x000000000040113b <+208>:   mov    %rdx,0x8(%rax)
0x000000000040113f <+212>:   mov    0x28(%rsp),%rax
0x0000000000401144 <+217>:   mov    %rax,0x8(%rdx)
0x0000000000401148 <+221>:   movq   $0x0,0x8(%rax)
0x0000000000401150 <+229>:   mov    %rcx,%rbx
0x0000000000401153 <+232>:   mov    $0x0,%ebp 

0x0000000000401158 <+237>:   mov    0x8(%rbx),%rdx
0x000000000040115c <+241>:   mov    (%rbx),%eax
0x000000000040115e <+243>:   cmp    (%rdx),%eax
0x0000000000401160 <+245>:   jge    0x401167 <phase_6+252>
0x0000000000401162 <+247>:   callq  0x401564 <explode_bomb>
0x0000000000401167 <+252>:   mov    0x8(%rbx),%rbx
0x000000000040116b <+256>:   add    $0x1,%ebp
0x000000000040116e <+259>:   cmp    $0x5,%ebp
0x0000000000401171 <+262>:   jne    0x401158 <phase_6+237>
0x0000000000401173 <+264>:   add    $0x50,%rsp
0x0000000000401177 <+268>:   pop    %rbx
0x0000000000401178 <+269>:   pop    %rbp
0x0000000000401179 <+270>:   pop    %r12
0x000000000040117b <+272>:   retq

What I know about this code is : 1. Input should be six numbers, and they should be different. 2. The range of numbers is 1 to 6.

And the node is :

0x603970 <node1> 0x000000f6
0x603978 <node1+8> 0x603960
0x603960 <node2> 0x00000304
0x693968 <node2+8> 0x603950
0x603950 <node3> 0x000000b7
0x603958 <node3+8> 0x603940
0x603940 <node4> 0x000000eb
0x603948 <node4+8> 0x603930
0x603930 <node5> 0x0000021f
0x603938 <node5+8> 0x603920
0x603920 <node6> 0x00000150
0x603928 <node6+8> 0x000000

So, the value of node1 to node6 are f6, 304, b7, eb, 21f, 150. I know b7 < eb < f6 < 150 < 21f < 304, so the order of nodes should be 3 0 5 4 1 2 (or 2 5 0 1 4 3 - in ascending order) and I should add +1 to all numbers. so I did. But when I put 4 1 6 5 2 3 or 3 6 1 2 5 4, it explodes.

I tried many methods of solution on internet. Some solution said that I should order these reversely like this : pos(1) (which means 5) : 4(5 is 4th number in '4 1 6 5 2 3') pos(2) (which means 4) : 1 pos(3) : 6 pos(4) : 5 pos(5) : 2 pos(6) : 3 So I tried 4 1 6 5 2 3, but it doesn't work too.

Actually I tried (3 6 1 2 5 4) (4 1 6 5 2 3) (3 4 1 6 5 2) (2 5 6 1 4 3) (4 3 6 1 2 5) (1 6 5 2 3 4) (6 1 2 5 4 3) (2 3 4 1 6 5) (3 2 5 6 1 4) (4 1 6 5 2 3) (5 6 1 4 3 2)

But there was no answer in these trials. Can you give me some help how about my code? I can't understand what is going on..

On <+97> and <+102>, notice that the code sets %eax to 7 and subtracts (%rdx). In other words you have to put each of your 6 values into function f(x) = 7-x.