Skip to content

Instantly share code, notes, and snippets.

@jordan-wright
Created Dec 20, 2016
Embed
What would you like to do?
(gdb) disassemble game_
Dump of assembler code for function game_:
0x0000000000404931 <+0>: push rbp
0x0000000000404932 <+1>: mov rbp,rsp
0x0000000000404935 <+4>: sub rsp,0x10
0x0000000000404939 <+8>: mov edi,0x1
0x000000000040493e <+13>: call 0x408010 <rspeak_>
0x0000000000404943 <+18>: mov edi,0x3
0x0000000000404948 <+23>: call 0x40865e <rmdesc_>
0x000000000040494d <+28>: mov DWORD PTR [rbp-0x8],eax
0x0000000000404950 <+31>: mov eax,DWORD PTR [rip+0x15a0e] # 0x41a364 <aindex_>
0x0000000000404956 <+37>: mov DWORD PTR [rip+0x21ede8],eax # 0x623744 <play_>
0x000000000040495c <+43>: mov DWORD PTR [rip+0x21ede6],0x0 # 0x62374c <play_+8>
0x0000000000404966 <+53>: mov eax,DWORD PTR [rip+0x21fdd4] # 0x624740 <prsvec_+16>
0x000000000040496c <+59>: cmp eax,0x1
0x000000000040496f <+62>: jg 0x404980 <game_+79>
0x0000000000404971 <+64>: mov esi,0x1
0x0000000000404976 <+69>: mov edi,0x625a84
0x000000000040497b <+74>: call 0x40ddb0 <rdline_>
0x0000000000404980 <+79>: mov eax,DWORD PTR [rip+0x21fdba] # 0x624740 <prsvec_+16>
0x0000000000404986 <+85>: cdqe
0x0000000000404988 <+87>: sub rax,0x1
0x000000000040498c <+91>: add rax,0x625a80
0x0000000000404992 <+97>: add rax,0x4
0x0000000000404996 <+101>: mov esi,0x419a34
0x000000000040499b <+106>: mov rdi,rax
0x000000000040499e <+109>: call 0x400d00 <strcmp@plt>
0x00000000004049a3 <+114>: test eax,eax
0x00000000004049a5 <+116>: jne 0x4049ae <game_+125>
0x00000000004049a7 <+118>: call 0x40a1df <gdt_>
0x00000000004049ac <+123>: jmp 0x404950 <game_+31>
0x00000000004049ae <+125>: mov eax,DWORD PTR [rip+0x21fd4c] # 0x624700 <state_>
0x00000000004049b4 <+131>: add eax,0x1
0x00000000004049b7 <+134>: mov DWORD PTR [rip+0x21fd43],eax # 0x624700 <state_>
0x00000000004049bd <+140>: mov esi,0x1
0x00000000004049c2 <+145>: mov edi,0x625a84
0x00000000004049c7 <+150>: call 0x40dee5 <parse_>
0x00000000004049cc <+155>: mov DWORD PTR [rip+0x21fd6a],eax # 0x62473c <prsvec_+12>
0x00000000004049d2 <+161>: mov eax,DWORD PTR [rip+0x21fd64] # 0x62473c <prsvec_+12>
0x00000000004049d8 <+167>: test eax,eax
0x00000000004049da <+169>: jne 0x4049e1 <game_+176>
0x00000000004049dc <+171>: jmp 0x404aa4 <game_+371>
0x00000000004049e1 <+176>: mov edi,0x1
0x00000000004049e6 <+181>: call 0x404dab <xvehic_>
0x00000000004049eb <+186>: test eax,eax
0x00000000004049ed <+188>: je 0x4049f4 <game_+195>
0x00000000004049ef <+190>: jmp 0x404aa4 <game_+371>
0x00000000004049f4 <+195>: mov edx,DWORD PTR [rip+0x21fd36] # 0x624730 <prsvec_>
0x00000000004049fa <+201>: mov eax,DWORD PTR [rip+0x15a4c] # 0x41a44c <vindex_+204>
0x0000000000404a00 <+207>: cmp edx,eax
0x0000000000404a02 <+209>: jne 0x404a2f <game_+254>
0x0000000000404a04 <+211>: nop
<snip>
(gdb) break *0x000000000040499e
Breakpoint 2 at 0x40499e
(gdb) run
Starting program: ~/sans/dungeon/dungeon
Welcome to Dungeon. This version created 11-MAR-78.
You are in an open field west of a big white house with a boarded
front door.
There is a small wrapped mailbox here.
>n
Breakpoint 2, 0x000000000040499e in game_ ()
(gdb) x/s 0x419a34
0x419a34: "GDT"
(gdb) disassemble main
Dump of assembler code for function main:
0x00000000004060a3 <+0>: push %rbp
0x00000000004060a4 <+1>: mov %rsp,%rbp
0x00000000004060a7 <+4>: sub $0x10,%rsp
0x00000000004060ab <+8>: mov %edi,-0x4(%rbp)
0x00000000004060ae <+11>: mov %rsi,-0x10(%rbp)
0x00000000004060b2 <+15>: callq 0x404fa4 <init_>
0x00000000004060b7 <+20>: test %eax,%eax
0x00000000004060b9 <+22>: je 0x406100 <main+93>
0x00000000004060bb <+24>: mov $0x41a524,%edi
0x00000000004060c0 <+29>: mov $0x0,%eax
0x00000000004060c5 <+34>: callq 0x400c60 <chroot@plt>
0x00000000004060ca <+39>: test %eax,%eax
0x00000000004060cc <+41>: je 0x4060dd <main+58>
0x00000000004060ce <+43>: mov $0x41a531,%edi
0x00000000004060d3 <+48>: mov $0x0,%eax
0x00000000004060d8 <+53>: callq 0x400db0 <perror@plt>
0x00000000004060dd <+58>: mov $0x3e8,%edi
0x00000000004060e2 <+63>: mov $0x0,%eax
0x00000000004060e7 <+68>: callq 0x400de0 <setuid@plt>
0x00000000004060ec <+73>: mov $0x3e8,%edi
0x00000000004060f1 <+78>: mov $0x0,%eax
0x00000000004060f6 <+83>: callq 0x400d90 <setgid@plt>
0x00000000004060fb <+88>: callq 0x404931 <game_>
0x0000000000406100 <+93>: callq 0x41544f <exit_>
0x0000000000406105 <+98>: leaveq
0x0000000000406106 <+99>: retq
End of assembler dump.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment