The control flow of the above program goes in following order main -> f -> g -> f -> main
main calls f with 1,2,3.
Notice the push instructions and calling convention. f checks whether 1 == 0 (ebp - 8). The answer is no. So, it calls g. This is the major hint for you. I am sure you will be able to figure rest of it :-)
The I/O register names and bit layouts for processors that support them are stored in processor-specific .cfg files. For M16C, the files are m16c60.cfg and m16c80.cfg:
dm0con 0x2c DMA0 control register
dm0con.dmbit_dm0con 0 Transfer unit bit select bit
dm0con.dmasl_dm0con 1 Repeat transfer mode select bit
It was pretty easy one so I could do myself:)
We have exploit.c file where I need to debug it in order to get the flag with 'gcc'. I run the program with:
gcc -g exploit.c -o exploit and got 'exploit' which is executable exploit.c file.
Then: gdb exploit
We have bool c = false; on line 21, so put the break line on it:
Then: I changed the value of c ...