solved lake ctf
This commit is contained in:
1
2025/lake/crypto/sage_shit/.python-version
Normal file
1
2025/lake/crypto/sage_shit/.python-version
Normal file
@@ -0,0 +1 @@
|
||||
3.12
|
||||
1
2025/lake/crypto/sage_shit/keys.json
Normal file
1
2025/lake/crypto/sage_shit/keys.json
Normal file
File diff suppressed because one or more lines are too long
7
2025/lake/crypto/sage_shit/pyproject.toml
Normal file
7
2025/lake/crypto/sage_shit/pyproject.toml
Normal file
@@ -0,0 +1,7 @@
|
||||
[project]
|
||||
name = "sage-shit"
|
||||
version = "0.1.0"
|
||||
description = "Add your description here"
|
||||
readme = "README.md"
|
||||
requires-python = ">=3.12"
|
||||
dependencies = []
|
||||
206
2025/lake/crypto/sage_shit/solve.sage
Normal file
206
2025/lake/crypto/sage_shit/solve.sage
Normal file
@@ -0,0 +1,206 @@
|
||||
import json
|
||||
import numpy as np
|
||||
|
||||
# --- 1. Setup Parameters ---
|
||||
q = 251
|
||||
n = 16
|
||||
k = 2
|
||||
|
||||
# --- 2. Helper Functions ---
|
||||
|
||||
def negacyclic_matrix(poly_coeffs):
|
||||
"""Converts a polynomial to a negacyclic matrix."""
|
||||
mat = []
|
||||
# In the challenge, polynomial mult involves convolution and subtraction
|
||||
# This corresponds to standard negacyclic structure for x^n + 1
|
||||
p = list(poly_coeffs)
|
||||
for i in range(n):
|
||||
row = [0] * n
|
||||
for j in range(n):
|
||||
if i - j >= 0:
|
||||
row[j] = p[i - j]
|
||||
else:
|
||||
row[j] = -p[i - j + n] # Negate wrap-around
|
||||
mat.append(row)
|
||||
# The challenge uses numpy convolve which results in a specific layout.
|
||||
# Let's verify orientation.
|
||||
# v0 * v1 in challenge is sum(convolve(a,b)...)
|
||||
# We want Matrix * Vector = Result.
|
||||
# The matrix constructed above represents multiplication BY poly_coeffs
|
||||
return Matrix(ZZ, mat)
|
||||
|
||||
def get_secret_key(A_polys, t_polys):
|
||||
# Construct the large A matrix (Block matrix)
|
||||
# A has shape 2x2. Each element is a polynomial.
|
||||
# We convert each polynomial to a 16x16 matrix.
|
||||
# A_big will be 32x32.
|
||||
|
||||
# A_polys structure: [[poly00, poly01], [poly10, poly11]]
|
||||
M00 = negacyclic_matrix(A_polys[0][0])
|
||||
M01 = negacyclic_matrix(A_polys[0][1])
|
||||
M10 = negacyclic_matrix(A_polys[1][0])
|
||||
M11 = negacyclic_matrix(A_polys[1][1])
|
||||
|
||||
# Block matrix construction
|
||||
A_big = block_matrix([[M00, M01], [M10, M11]])
|
||||
|
||||
# Flatten t into a single vector of size 32
|
||||
t_vec = vector(ZZ, A_polys[0][0]).parent().zero_vector() # dummy init
|
||||
t_flat = []
|
||||
for row in t_polys:
|
||||
t_flat.extend(row)
|
||||
t_vec = vector(ZZ, t_flat)
|
||||
|
||||
# --- Lattice Embedding ---
|
||||
# We want to solve s * A_big = t (approx)
|
||||
# Note: In the challenge code: t = A * s + e
|
||||
# So A_big * s_vec = t_vec (mod q)
|
||||
|
||||
# Lattice Basis Construction (Kannad Embedding)
|
||||
# Rows:
|
||||
# [ I_32 | A_big^T | 0 ]
|
||||
# [ 0 | q*I_32 | 0 ]
|
||||
# [ 0 | -t | 1 ]
|
||||
|
||||
dim = 2 * n
|
||||
# Identity
|
||||
B0 = identity_matrix(dim)
|
||||
# A Transpose (because A*s = t, we put columns of A into rows of lattice basis part)
|
||||
# Wait, if we use row vectors v*M, we need appropriate orientation.
|
||||
# Let's stick to: we want vector (s, e, 1)
|
||||
# A_big * s - t = -e (mod q)
|
||||
# => A_big * s + q*k - t = -e
|
||||
|
||||
L = matrix(ZZ, 2*dim + 1, 2*dim + 1)
|
||||
|
||||
# Top Left: Identity for s
|
||||
L.set_block(0, 0, identity_matrix(dim))
|
||||
|
||||
# Top Middle: A_big Transpose (mapping s to A*s)
|
||||
# We use Transpose because Sage lattices are row-span.
|
||||
# A row (s) * (A^T) = (A*s)^T
|
||||
L.set_block(0, dim, A_big.transpose())
|
||||
|
||||
# Middle Middle: q * Identity (modulus reduction)
|
||||
L.set_block(dim, dim, q * identity_matrix(dim))
|
||||
|
||||
# Bottom Middle: -t vector
|
||||
L.set_block(2*dim, dim, matrix(ZZ, 1, dim, [-x for x in t_flat]))
|
||||
|
||||
# Bottom Right: 1 (constant for embedding)
|
||||
L[2*dim, 2*dim] = 1
|
||||
|
||||
print("Running LLL...")
|
||||
L_reduced = L.LLL()
|
||||
|
||||
# Search for the short vector. It should look like (s, -e, 1) or -(s, -e, 1)
|
||||
for row in L_reduced:
|
||||
if row[2*dim] == 1: # Check the embedding constant
|
||||
s_recovered = row[:dim]
|
||||
print("Found candidate secret key!")
|
||||
return s_recovered
|
||||
elif row[2*dim] == -1:
|
||||
s_recovered = [-x for x in row[:dim]]
|
||||
print("Found candidate secret key (inverted)!")
|
||||
return s_recovered
|
||||
|
||||
return None
|
||||
|
||||
# --- 3. Decryption Routine ---
|
||||
|
||||
def poly_mul_mod(p1, p2):
|
||||
"""Re-implementation of the challenge multiplication for decryption"""
|
||||
res = [0] * (2 * n)
|
||||
for i in range(n):
|
||||
for j in range(n):
|
||||
res[i+j] += p1[i] * p2[j]
|
||||
|
||||
# Reduction mod x^16 + 1
|
||||
out = [0] * n
|
||||
for i in range(len(res)):
|
||||
if i < n:
|
||||
out[i] = (out[i] + res[i])
|
||||
else:
|
||||
out[i - n] = (out[i - n] - res[i]) # x^16 = -1
|
||||
return [x % q for x in out]
|
||||
|
||||
def decrypt(u, v, s):
|
||||
# u is a list of lists (k x n)
|
||||
# v is a list (n)
|
||||
# s is the recovered secret (k x n flattened)
|
||||
|
||||
# Reconstruct s into polys
|
||||
s_polys = [list(s[i*n : (i+1)*n]) for i in range(k)]
|
||||
|
||||
# Calculate s^T * u
|
||||
# u is shape (k, n). s is shape (k, n).
|
||||
# Dot product = sum(poly_mul(s[i], u[i]))
|
||||
|
||||
dot_prod = [0]*n
|
||||
for i in range(k):
|
||||
prod = poly_mul_mod(s_polys[i], u[i])
|
||||
dot_prod = [(x + y) % q for x, y in zip(dot_prod, prod)]
|
||||
|
||||
# m_noisy = v - s*u
|
||||
m_noisy = [(v_val - d_val) % q for v_val, d_val in zip(v, dot_prod)]
|
||||
|
||||
# Rounding
|
||||
# Center is roughly q/2 = 126.
|
||||
# If close to 0 -> 0. If close to 126 -> 1.
|
||||
bits = []
|
||||
limit = q // 4
|
||||
for val in m_noisy:
|
||||
# Distance to 0
|
||||
d0 = min(val, q - val)
|
||||
# Distance to q/2
|
||||
target = (q + 1) // 2
|
||||
d1 = min(abs(val - target), q - abs(val - target))
|
||||
|
||||
if d1 < d0:
|
||||
bits.append(1)
|
||||
else:
|
||||
bits.append(0)
|
||||
return bits
|
||||
|
||||
# --- 4. Main Execution ---
|
||||
|
||||
# Load Data
|
||||
with open("keys.json", "r") as f:
|
||||
data = json.load(f)
|
||||
|
||||
A = data['A']
|
||||
t = data['t']
|
||||
u_list = data['u']
|
||||
v_list = data['v']
|
||||
|
||||
# Recover S
|
||||
s_vec = get_secret_key(A, t)
|
||||
|
||||
# Decrypt all batches
|
||||
all_bits = []
|
||||
for u_batch, v_batch in zip(u_list, v_list):
|
||||
# u_batch is shape (k, n). v_batch is shape (n) (actually it's list of lists in json?)
|
||||
# Wait, check JSON structure.
|
||||
# v is list of lists. u is list of lists of lists.
|
||||
# But decrypt function inputs: u_list is list of u. v_list is list of v.
|
||||
# In encrypt: u_list.append(u), u is numpy array.
|
||||
|
||||
# Let's handle the specific JSON structure provided in the prompt
|
||||
# u in json is [ [row1, row2], [row1, row2] ... ]
|
||||
# v in json is [ poly, poly ... ]
|
||||
|
||||
decrypted_bits = decrypt(u_batch, v_batch, s_vec)
|
||||
all_bits.extend(decrypted_bits)
|
||||
|
||||
# --- 5. Bits to Flag ---
|
||||
# The challenge code: [int(c) for char in flag for c in format(ord(char), '08b')]
|
||||
# This groups 8 bits per char.
|
||||
flag = ""
|
||||
for i in range(0, len(all_bits), 8):
|
||||
byte = all_bits[i:i+8]
|
||||
if len(byte) < 8: break
|
||||
# Convert list of 0/1 to integer
|
||||
char_code = int("".join(map(str, byte)), 2)
|
||||
flag += chr(char_code)
|
||||
|
||||
print(f"Flag: {flag}")
|
||||
85
2025/lake/pwn/stackception/chall.py
Normal file
85
2025/lake/pwn/stackception/chall.py
Normal file
@@ -0,0 +1,85 @@
|
||||
#!/usr/bin/env -S python3 -u
|
||||
|
||||
import os
|
||||
import subprocess as sp
|
||||
from textwrap import dedent
|
||||
|
||||
|
||||
def main():
|
||||
msg = dedent(
|
||||
"""
|
||||
Enter assembly code
|
||||
Note: replace spaces with underscores, newlines with '|', e.g.,
|
||||
main:
|
||||
push 5
|
||||
call main
|
||||
becomes 'main:|push_5|call_main'
|
||||
"""
|
||||
).strip()
|
||||
print(msg)
|
||||
|
||||
asm_code = input()
|
||||
|
||||
input_path = "/tmp/input.asm"
|
||||
with open(input_path, "w") as f:
|
||||
f.write(asm_code.replace("_", " ").replace("|", "\n"))
|
||||
|
||||
output_path = "/tmp/out.bin"
|
||||
|
||||
p = sp.Popen(
|
||||
# Adjust path if running locally
|
||||
["/app/stackception-asm", input_path, output_path],
|
||||
stdin=sp.DEVNULL,
|
||||
stdout=sp.DEVNULL,
|
||||
stderr=sp.PIPE,
|
||||
)
|
||||
|
||||
p.wait(timeout=5)
|
||||
if p.returncode != 0:
|
||||
print("Assembly failed:")
|
||||
_, stderr = p.communicate()
|
||||
print(stderr.decode())
|
||||
exit(1)
|
||||
|
||||
# Adjust path if running locally
|
||||
os.execve(
|
||||
"/app/stackception",
|
||||
["/app/stackception", output_path],
|
||||
{
|
||||
"GLIBC_TUNABLES": "glibc.cpu.hwcaps=-ACPI,-ADX,AES,AESKLE,-AMD_IBPB,"
|
||||
+ "-AMD_IBRS,-AMD_SSBD,-AMD_STIBP,-AMD_VIRT_SSBD,-AMX_BF16,"
|
||||
+ "-AMX_COMPLEX,-AMX_FP16,-AMX_INT8,-AMX_TILE,-APIC,-APX_F,"
|
||||
+ "-ARCH_CAPABILITIES,-AVX,-AVX10,-AVX10_XMM,-AVX10_YMM,-AVX10_ZMM,"
|
||||
+ "-AVX2,-AVX512BW,-AVX512CD,-AVX512DQ,-AVX512ER,-AVX512F,-AVX512PF,"
|
||||
+ "-AVX512VL,-AVX512_4FMAPS,-AVX512_4VNNIW,-AVX512_BF16,-AVX512_BITALG,"
|
||||
+ "-AVX512_FP16,-AVX512_IFMA,-AVX512_VBMI,-AVX512_VBMI2,-AVX512_VNNI,"
|
||||
+ "-AVX512_VP2INTERSECT,-AVX512_VPOPCNTDQ,-AVX_IFMA,-AVX_NE_CONVERT,"
|
||||
+ "-AVX_VNNI,-AVX_VNNI_INT8,-BMI1,-BMI2,-CLDEMOTE,-CLFLUSHOPT,-CLFSH,"
|
||||
+ "-CLWB,CMOV,CMPCCXADD,CMPXCHG16B,-CNXT_ID,-CORE_CAPABILITIES,-CX8,"
|
||||
+ "-DCA,-DE,-DEPR_FPU_CS_DS,-DS,-DS_CPL,-DTES64,-EIST,-ENQCMD,-ERMS,"
|
||||
+ "-F16C,-FMA,-FMA4,-FPU,-FSGSBASE,-FSRCS,-FSRM,-FSRS,-FXSR,-FZLRM,"
|
||||
+ "-GFNI,-HLE,-HRESET,-HTT,-HYBRID,-IBRS_IBPB,IBT,-INDEX_1_ECX_16,"
|
||||
+ "-INDEX_1_ECX_31,-INDEX_1_EDX_10,-INDEX_1_EDX_20,-INDEX_1_EDX_30,"
|
||||
+ "-INDEX_7_EBX_22,-INDEX_7_EBX_6,-INDEX_7_ECX_13,-INDEX_7_ECX_15,"
|
||||
+ "-INDEX_7_ECX_16,-INDEX_7_ECX_24,-INDEX_7_ECX_26,-INDEX_7_EDX_0,"
|
||||
+ "-INDEX_7_EDX_1,-INDEX_7_EDX_12,-INDEX_7_EDX_13,-INDEX_7_EDX_17,"
|
||||
+ "-INDEX_7_EDX_19,-INDEX_7_EDX_21,-INDEX_7_EDX_6,-INDEX_7_EDX_7,"
|
||||
+ "-INDEX_7_EDX_9,-INVARIANT_TSC,-INVPCID,-KL,-L1D_FLUSH,-LAHF64_SAHF64,"
|
||||
+ "-LAM,-LM,-LWP,-LZCNT,-MCA,-MCE,-MD_CLEAR,-MMX,-MONITOR,MOVBE,"
|
||||
+ "-MOVDIR64B,-MOVDIRI,-MPX,-MSR,-MTRR,NX,-OSPKE,-OSXSAVE,-PAE,"
|
||||
+ "-PAGE1GB,-PAT,-PBE,-PCID,-PCLMULQDQ,-PCONFIG,-PDCM,-PGE,-PKS,"
|
||||
+ "-PKU,-POPCNT,-PREFETCHI,-PREFETCHW,-PREFETCHWT1,-PSE,-PSE_36,"
|
||||
+ "-PSN,-PTWRITE,-RAO_INT,-RDPID,RDRAND,RDSEED,-RDTSCP,-RDT_A,"
|
||||
+ "-RDT_M,-RTM,-RTM_ALWAYS_ABORT,SDBG,-SEP,SERIALIZE,-SGX,-SGX_LC,"
|
||||
+ "SHA,SHSTK,SMAP,SMEP,-SMX,-SS,-SSBD,-SSE,-SSE2,-SSE3,-SSE4A,"
|
||||
+ "-SSE4_1,-SSE4_2,-SSSE3,-STIBP,-SVM,-SYSCALL_SYSRET,-TBM,-TM,-TM2,"
|
||||
+ "-TRACE,-TSC,-TSC_ADJUST,-TSC_DEADLINE,-TSXLDTRK,-UINTR,-UMIP,"
|
||||
+ "-VAES,-VME,-VMX,-VPCLMULQDQ,-WAITPKG,-WBNOINVD,-WIDE_KL,-X2APIC,"
|
||||
+ "-XFD,-XGETBV_ECX_1,-XOP,XSAVE,XSAVEC,-XSAVEOPT,-XSAVES,"
|
||||
+ "-XTPRUPDCTRL:glibc.cpu.hwcaps_mask=all"
|
||||
},
|
||||
)
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
main()
|
||||
889
2025/lake/pwn/stackception/ob_dump.asm
Normal file
889
2025/lake/pwn/stackception/ob_dump.asm
Normal file
@@ -0,0 +1,889 @@
|
||||
|
||||
stackception-asm: file format elf64-x86-64
|
||||
|
||||
|
||||
Disassembly of section .text:
|
||||
|
||||
0000000000001c30 <.text>:
|
||||
1c30: f3 0f 1e fa endbr64
|
||||
1c34: 31 ed xor ebp,ebp
|
||||
1c36: 49 89 d1 mov r9,rdx
|
||||
1c39: 5e pop rsi
|
||||
1c3a: 48 89 e2 mov rdx,rsp
|
||||
1c3d: 48 83 e4 f0 and rsp,0xfffffffffffffff0
|
||||
1c41: 50 push rax
|
||||
1c42: 54 push rsp
|
||||
1c43: 45 31 c0 xor r8d,r8d
|
||||
1c46: 31 c9 xor ecx,ecx
|
||||
1c48: 48 8d 3d d1 00 00 00 lea rdi,[rip+0xd1] # 1d20 <__cxa_finalize@plt-0xc40>
|
||||
1c4f: ff 15 cb 1f 00 00 call QWORD PTR [rip+0x1fcb] # 3c20 <strcasecmp@plt+0x11c0>
|
||||
1c55: f4 hlt
|
||||
1c56: cc int3
|
||||
1c57: cc int3
|
||||
1c58: cc int3
|
||||
1c59: cc int3
|
||||
1c5a: cc int3
|
||||
1c5b: cc int3
|
||||
1c5c: cc int3
|
||||
1c5d: cc int3
|
||||
1c5e: cc int3
|
||||
1c5f: cc int3
|
||||
1c60: 48 8d 3d f9 2f 00 00 lea rdi,[rip+0x2ff9] # 4c60 <strcasecmp@plt+0x2200>
|
||||
1c67: 48 8d 05 f2 2f 00 00 lea rax,[rip+0x2ff2] # 4c60 <strcasecmp@plt+0x2200>
|
||||
1c6e: 48 39 f8 cmp rax,rdi
|
||||
1c71: 74 15 je 1c88 <__cxa_finalize@plt-0xcd8>
|
||||
1c73: 48 8b 05 b6 1f 00 00 mov rax,QWORD PTR [rip+0x1fb6] # 3c30 <strcasecmp@plt+0x11d0>
|
||||
1c7a: 48 85 c0 test rax,rax
|
||||
1c7d: 74 09 je 1c88 <__cxa_finalize@plt-0xcd8>
|
||||
1c7f: ff e0 jmp rax
|
||||
1c81: 0f 1f 80 00 00 00 00 nop DWORD PTR [rax+0x0]
|
||||
1c88: c3 ret
|
||||
1c89: 0f 1f 80 00 00 00 00 nop DWORD PTR [rax+0x0]
|
||||
1c90: 48 8d 3d c9 2f 00 00 lea rdi,[rip+0x2fc9] # 4c60 <strcasecmp@plt+0x2200>
|
||||
1c97: 48 8d 35 c2 2f 00 00 lea rsi,[rip+0x2fc2] # 4c60 <strcasecmp@plt+0x2200>
|
||||
1c9e: 48 29 fe sub rsi,rdi
|
||||
1ca1: 48 89 f0 mov rax,rsi
|
||||
1ca4: 48 c1 ee 3f shr rsi,0x3f
|
||||
1ca8: 48 c1 f8 03 sar rax,0x3
|
||||
1cac: 48 01 c6 add rsi,rax
|
||||
1caf: 48 d1 fe sar rsi,1
|
||||
1cb2: 74 14 je 1cc8 <__cxa_finalize@plt-0xc98>
|
||||
1cb4: 48 8b 05 7d 1f 00 00 mov rax,QWORD PTR [rip+0x1f7d] # 3c38 <strcasecmp@plt+0x11d8>
|
||||
1cbb: 48 85 c0 test rax,rax
|
||||
1cbe: 74 08 je 1cc8 <__cxa_finalize@plt-0xc98>
|
||||
1cc0: ff e0 jmp rax
|
||||
1cc2: 66 0f 1f 44 00 00 nop WORD PTR [rax+rax*1+0x0]
|
||||
1cc8: c3 ret
|
||||
1cc9: 0f 1f 80 00 00 00 00 nop DWORD PTR [rax+0x0]
|
||||
1cd0: f3 0f 1e fa endbr64
|
||||
1cd4: 80 3d 25 30 00 00 00 cmp BYTE PTR [rip+0x3025],0x0 # 4d00 <strcasecmp@plt+0x22a0>
|
||||
1cdb: 75 2b jne 1d08 <__cxa_finalize@plt-0xc58>
|
||||
1cdd: 55 push rbp
|
||||
1cde: 48 83 3d 5a 1f 00 00 cmp QWORD PTR [rip+0x1f5a],0x0 # 3c40 <strcasecmp@plt+0x11e0>
|
||||
1ce5: 00
|
||||
1ce6: 48 89 e5 mov rbp,rsp
|
||||
1ce9: 74 0c je 1cf7 <__cxa_finalize@plt-0xc69>
|
||||
1ceb: 48 8b 3d 66 2f 00 00 mov rdi,QWORD PTR [rip+0x2f66] # 4c58 <strcasecmp@plt+0x21f8>
|
||||
1cf2: e8 69 0c 00 00 call 2960 <__cxa_finalize@plt>
|
||||
1cf7: e8 64 ff ff ff call 1c60 <__cxa_finalize@plt-0xd00>
|
||||
1cfc: c6 05 fd 2f 00 00 01 mov BYTE PTR [rip+0x2ffd],0x1 # 4d00 <strcasecmp@plt+0x22a0>
|
||||
1d03: 5d pop rbp
|
||||
1d04: c3 ret
|
||||
1d05: 0f 1f 00 nop DWORD PTR [rax]
|
||||
1d08: c3 ret
|
||||
1d09: 0f 1f 80 00 00 00 00 nop DWORD PTR [rax+0x0]
|
||||
1d10: f3 0f 1e fa endbr64
|
||||
1d14: e9 77 ff ff ff jmp 1c90 <__cxa_finalize@plt-0xcd0>
|
||||
1d19: cc int3
|
||||
1d1a: cc int3
|
||||
1d1b: cc int3
|
||||
1d1c: cc int3
|
||||
1d1d: cc int3
|
||||
1d1e: cc int3
|
||||
1d1f: cc int3
|
||||
1d20: 55 push rbp
|
||||
1d21: 48 89 e5 mov rbp,rsp
|
||||
1d24: 41 57 push r15
|
||||
1d26: 41 56 push r14
|
||||
1d28: 41 55 push r13
|
||||
1d2a: 41 54 push r12
|
||||
1d2c: 53 push rbx
|
||||
1d2d: 48 81 ec 68 22 00 00 sub rsp,0x2268
|
||||
1d34: 48 89 f3 mov rbx,rsi
|
||||
1d37: 64 48 8b 04 25 28 00 mov rax,QWORD PTR fs:0x28
|
||||
1d3e: 00 00
|
||||
1d40: 48 89 45 d0 mov QWORD PTR [rbp-0x30],rax
|
||||
1d44: 83 ff 03 cmp edi,0x3
|
||||
1d47: 0f 85 dd 08 00 00 jne 262a <__cxa_finalize@plt-0x336>
|
||||
1d4d: 48 8b 7b 08 mov rdi,QWORD PTR [rbx+0x8]
|
||||
1d51: 48 8d 35 6a ed ff ff lea rsi,[rip+0xffffffffffffed6a] # ac2 <__cxa_finalize@plt-0x1e9e>
|
||||
1d58: e8 13 0c 00 00 call 2970 <fopen64@plt>
|
||||
1d5d: 48 85 c0 test rax,rax
|
||||
1d60: 0f 84 da 08 00 00 je 2640 <__cxa_finalize@plt-0x320>
|
||||
1d66: 49 89 c4 mov r12,rax
|
||||
1d69: 48 89 9d 70 dd ff ff mov QWORD PTR [rbp-0x2290],rbx
|
||||
1d70: 48 8d 9d d0 df ff ff lea rbx,[rbp-0x2030]
|
||||
1d77: ba 00 20 00 00 mov edx,0x2000
|
||||
1d7c: 48 89 df mov rdi,rbx
|
||||
1d7f: 31 f6 xor esi,esi
|
||||
1d81: e8 fa 0b 00 00 call 2980 <memset@plt>
|
||||
1d86: 0f 57 c0 xorps xmm0,xmm0
|
||||
1d89: 0f 29 85 c0 df ff ff movaps XMMWORD PTR [rbp-0x2040],xmm0
|
||||
1d90: 0f 29 85 b0 df ff ff movaps XMMWORD PTR [rbp-0x2050],xmm0
|
||||
1d97: 0f 29 85 a0 df ff ff movaps XMMWORD PTR [rbp-0x2060],xmm0
|
||||
1d9e: 0f 29 85 90 df ff ff movaps XMMWORD PTR [rbp-0x2070],xmm0
|
||||
1da5: 0f 29 85 80 df ff ff movaps XMMWORD PTR [rbp-0x2080],xmm0
|
||||
1dac: 0f 29 85 70 df ff ff movaps XMMWORD PTR [rbp-0x2090],xmm0
|
||||
1db3: 0f 29 85 60 df ff ff movaps XMMWORD PTR [rbp-0x20a0],xmm0
|
||||
1dba: 0f 29 85 50 df ff ff movaps XMMWORD PTR [rbp-0x20b0],xmm0
|
||||
1dc1: 0f 29 85 40 df ff ff movaps XMMWORD PTR [rbp-0x20c0],xmm0
|
||||
1dc8: 0f 29 85 30 df ff ff movaps XMMWORD PTR [rbp-0x20d0],xmm0
|
||||
1dcf: 0f 29 85 20 df ff ff movaps XMMWORD PTR [rbp-0x20e0],xmm0
|
||||
1dd6: 0f 29 85 10 df ff ff movaps XMMWORD PTR [rbp-0x20f0],xmm0
|
||||
1ddd: 0f 29 85 00 df ff ff movaps XMMWORD PTR [rbp-0x2100],xmm0
|
||||
1de4: 0f 29 85 f0 de ff ff movaps XMMWORD PTR [rbp-0x2110],xmm0
|
||||
1deb: 0f 29 85 e0 de ff ff movaps XMMWORD PTR [rbp-0x2120],xmm0
|
||||
1df2: 0f 29 85 d0 de ff ff movaps XMMWORD PTR [rbp-0x2130],xmm0
|
||||
1df9: 48 8d bd d0 de ff ff lea rdi,[rbp-0x2130]
|
||||
1e00: be 00 01 00 00 mov esi,0x100
|
||||
1e05: 4c 89 e2 mov rdx,r12
|
||||
1e08: e8 83 0b 00 00 call 2990 <fgets@plt>
|
||||
1e0d: 48 85 c0 test rax,rax
|
||||
1e10: 4c 89 a5 90 dd ff ff mov QWORD PTR [rbp-0x2270],r12
|
||||
1e17: 0f 84 ff 01 00 00 je 201c <__cxa_finalize@plt-0x944>
|
||||
1e1d: e8 7e 0b 00 00 call 29a0 <__ctype_b_loc@plt>
|
||||
1e22: 49 89 c7 mov r15,rax
|
||||
1e25: 31 c0 xor eax,eax
|
||||
1e27: 48 89 85 98 dd ff ff mov QWORD PTR [rbp-0x2268],rax
|
||||
1e2e: e9 01 01 00 00 jmp 1f34 <__cxa_finalize@plt-0xa2c>
|
||||
1e33: 0f 57 c0 xorps xmm0,xmm0
|
||||
1e36: 0f 29 85 c0 de ff ff movaps XMMWORD PTR [rbp-0x2140],xmm0
|
||||
1e3d: 0f 29 85 b0 de ff ff movaps XMMWORD PTR [rbp-0x2150],xmm0
|
||||
1e44: 0f 29 85 a0 de ff ff movaps XMMWORD PTR [rbp-0x2160],xmm0
|
||||
1e4b: 0f 29 85 90 de ff ff movaps XMMWORD PTR [rbp-0x2170],xmm0
|
||||
1e52: 0f 29 85 80 de ff ff movaps XMMWORD PTR [rbp-0x2180],xmm0
|
||||
1e59: 0f 29 85 70 de ff ff movaps XMMWORD PTR [rbp-0x2190],xmm0
|
||||
1e60: 0f 29 85 60 de ff ff movaps XMMWORD PTR [rbp-0x21a0],xmm0
|
||||
1e67: 0f 29 85 50 de ff ff movaps XMMWORD PTR [rbp-0x21b0],xmm0
|
||||
1e6e: 0f 29 85 40 de ff ff movaps XMMWORD PTR [rbp-0x21c0],xmm0
|
||||
1e75: 0f 29 85 30 de ff ff movaps XMMWORD PTR [rbp-0x21d0],xmm0
|
||||
1e7c: 0f 29 85 20 de ff ff movaps XMMWORD PTR [rbp-0x21e0],xmm0
|
||||
1e83: 0f 29 85 10 de ff ff movaps XMMWORD PTR [rbp-0x21f0],xmm0
|
||||
1e8a: 0f 29 85 00 de ff ff movaps XMMWORD PTR [rbp-0x2200],xmm0
|
||||
1e91: 0f 29 85 f0 dd ff ff movaps XMMWORD PTR [rbp-0x2210],xmm0
|
||||
1e98: 0f 29 85 e0 dd ff ff movaps XMMWORD PTR [rbp-0x2220],xmm0
|
||||
1e9f: 0f 29 85 d0 dd ff ff movaps XMMWORD PTR [rbp-0x2230],xmm0
|
||||
1ea6: 0f 29 85 c0 dd ff ff movaps XMMWORD PTR [rbp-0x2240],xmm0
|
||||
1ead: 0f 29 85 b0 dd ff ff movaps XMMWORD PTR [rbp-0x2250],xmm0
|
||||
1eb4: 4c 89 e7 mov rdi,r12
|
||||
1eb7: 48 8d 35 f6 eb ff ff lea rsi,[rip+0xffffffffffffebf6] # ab4 <__cxa_finalize@plt-0x1eac>
|
||||
1ebe: 4c 8d b5 b0 de ff ff lea r14,[rbp-0x2150]
|
||||
1ec5: 4c 89 f2 mov rdx,r14
|
||||
1ec8: 48 8d 8d b0 dd ff ff lea rcx,[rbp-0x2250]
|
||||
1ecf: 31 c0 xor eax,eax
|
||||
1ed1: e8 da 0a 00 00 call 29b0 <__isoc23_sscanf@plt>
|
||||
1ed6: 4c 89 f7 mov rdi,r14
|
||||
1ed9: e8 a2 08 00 00 call 2780 <__cxa_finalize@plt-0x1e0>
|
||||
1ede: 83 c0 fb add eax,0xfffffffb
|
||||
1ee1: 83 f8 02 cmp eax,0x2
|
||||
1ee4: 0f 92 c0 setb al
|
||||
1ee7: 80 bd b0 dd ff ff 00 cmp BYTE PTR [rbp-0x2250],0x0
|
||||
1eee: 0f 95 c1 setne cl
|
||||
1ef1: 20 c1 and cl,al
|
||||
1ef3: 0f b6 c1 movzx eax,cl
|
||||
1ef6: 48 8b 8d 98 dd ff ff mov rcx,QWORD PTR [rbp-0x2268]
|
||||
1efd: 48 01 c1 add rcx,rax
|
||||
1f00: 48 ff c1 inc rcx
|
||||
1f03: 48 89 8d 98 dd ff ff mov QWORD PTR [rbp-0x2268],rcx
|
||||
1f0a: 66 0f 1f 44 00 00 nop WORD PTR [rax+rax*1+0x0]
|
||||
1f10: 48 8d bd d0 de ff ff lea rdi,[rbp-0x2130]
|
||||
1f17: be 00 01 00 00 mov esi,0x100
|
||||
1f1c: 4c 8b a5 90 dd ff ff mov r12,QWORD PTR [rbp-0x2270]
|
||||
1f23: 4c 89 e2 mov rdx,r12
|
||||
1f26: e8 65 0a 00 00 call 2990 <fgets@plt>
|
||||
1f2b: 48 85 c0 test rax,rax
|
||||
1f2e: 0f 84 e8 00 00 00 je 201c <__cxa_finalize@plt-0x944>
|
||||
1f34: 4d 8b 37 mov r14,QWORD PTR [r15]
|
||||
1f37: 4c 8d a5 cf de ff ff lea r12,[rbp-0x2131]
|
||||
1f3e: 66 90 xchg ax,ax
|
||||
1f40: 4d 89 e5 mov r13,r12
|
||||
1f43: 49 ff c4 inc r12
|
||||
1f46: 41 0f b6 45 01 movzx eax,BYTE PTR [r13+0x1]
|
||||
1f4b: 41 f6 44 46 01 20 test BYTE PTR [r14+rax*2+0x1],0x20
|
||||
1f51: 75 ed jne 1f40 <__cxa_finalize@plt-0xa20>
|
||||
1f53: 84 c0 test al,al
|
||||
1f55: 74 b9 je 1f10 <__cxa_finalize@plt-0xa50>
|
||||
1f57: 4c 89 e7 mov rdi,r12
|
||||
1f5a: e8 61 0a 00 00 call 29c0 <strlen@plt>
|
||||
1f5f: 49 01 c5 add r13,rax
|
||||
1f62: 66 66 66 66 66 2e 0f data16 data16 data16 data16 cs nop WORD PTR [rax+rax*1+0x0]
|
||||
1f69: 1f 84 00 00 00 00 00
|
||||
1f70: 4c 89 e8 mov rax,r13
|
||||
1f73: 4d 39 e5 cmp r13,r12
|
||||
1f76: 76 0f jbe 1f87 <__cxa_finalize@plt-0x9d9>
|
||||
1f78: 0f b6 08 movzx ecx,BYTE PTR [rax]
|
||||
1f7b: 4c 8d 68 ff lea r13,[rax-0x1]
|
||||
1f7f: 41 f6 44 4e 01 20 test BYTE PTR [r14+rcx*2+0x1],0x20
|
||||
1f85: 75 e9 jne 1f70 <__cxa_finalize@plt-0x9f0>
|
||||
1f87: c6 40 01 00 mov BYTE PTR [rax+0x1],0x0
|
||||
1f8b: 41 0f b6 04 24 movzx eax,BYTE PTR [r12]
|
||||
1f90: 48 83 f8 3b cmp rax,0x3b
|
||||
1f94: 77 14 ja 1faa <__cxa_finalize@plt-0x9b6>
|
||||
1f96: 48 b9 01 00 00 00 08 movabs rcx,0x800000800000001
|
||||
1f9d: 00 00 08
|
||||
1fa0: 48 0f a3 c1 bt rcx,rax
|
||||
1fa4: 0f 82 66 ff ff ff jb 1f10 <__cxa_finalize@plt-0xa50>
|
||||
1faa: 4c 89 e7 mov rdi,r12
|
||||
1fad: e8 0e 0a 00 00 call 29c0 <strlen@plt>
|
||||
1fb2: 41 80 7c 04 ff 3a cmp BYTE PTR [r12+rax*1-0x1],0x3a
|
||||
1fb8: 0f 85 75 fe ff ff jne 1e33 <__cxa_finalize@plt-0xb2d>
|
||||
1fbe: 41 c6 44 04 ff 00 mov BYTE PTR [r12+rax*1-0x1],0x0
|
||||
1fc4: 4c 8b 35 45 2d 00 00 mov r14,QWORD PTR [rip+0x2d45] # 4d10 <strcasecmp@plt+0x22b0>
|
||||
1fcb: 49 81 fe 00 01 00 00 cmp r14,0x100
|
||||
1fd2: 0f 83 52 07 00 00 jae 272a <__cxa_finalize@plt-0x236>
|
||||
1fd8: 4f 8d 2c f6 lea r13,[r14+r14*8]
|
||||
1fdc: 48 8d 05 3d 2d 00 00 lea rax,[rip+0x2d3d] # 4d20 <strcasecmp@plt+0x22c0>
|
||||
1fe3: 4a 8d 3c e8 lea rdi,[rax+r13*8]
|
||||
1fe7: ba 3f 00 00 00 mov edx,0x3f
|
||||
1fec: 4c 89 e6 mov rsi,r12
|
||||
1fef: e8 dc 09 00 00 call 29d0 <strncpy@plt>
|
||||
1ff4: 48 8d 0d 25 2d 00 00 lea rcx,[rip+0x2d25] # 4d20 <strcasecmp@plt+0x22c0>
|
||||
1ffb: 42 c6 44 e9 3f 00 mov BYTE PTR [rcx+r13*8+0x3f],0x0
|
||||
2001: 48 8b 85 98 dd ff ff mov rax,QWORD PTR [rbp-0x2268]
|
||||
2008: 4a 89 44 e9 40 mov QWORD PTR [rcx+r13*8+0x40],rax
|
||||
200d: 49 ff c6 inc r14
|
||||
2010: 4c 89 35 f9 2c 00 00 mov QWORD PTR [rip+0x2cf9],r14 # 4d10 <strcasecmp@plt+0x22b0>
|
||||
2017: e9 f4 fe ff ff jmp 1f10 <__cxa_finalize@plt-0xa50>
|
||||
201c: 4c 89 e7 mov rdi,r12
|
||||
201f: e8 bc 09 00 00 call 29e0 <rewind@plt>
|
||||
2024: 48 8d bd d0 de ff ff lea rdi,[rbp-0x2130]
|
||||
202b: be 00 01 00 00 mov esi,0x100
|
||||
2030: 4c 89 e2 mov rdx,r12
|
||||
2033: e8 58 09 00 00 call 2990 <fgets@plt>
|
||||
2038: 48 85 c0 test rax,rax
|
||||
203b: 74 1c je 2059 <__cxa_finalize@plt-0x907>
|
||||
203d: e8 5e 09 00 00 call 29a0 <__ctype_b_loc@plt>
|
||||
2042: 48 89 85 78 dd ff ff mov QWORD PTR [rbp-0x2288],rax
|
||||
2049: 31 c0 xor eax,eax
|
||||
204b: 48 89 85 a0 dd ff ff mov QWORD PTR [rbp-0x2260],rax
|
||||
2052: 31 c9 xor ecx,ecx
|
||||
2054: e9 fb 00 00 00 jmp 2154 <__cxa_finalize@plt-0x80c>
|
||||
2059: 31 c0 xor eax,eax
|
||||
205b: 48 89 85 a0 dd ff ff mov QWORD PTR [rbp-0x2260],rax
|
||||
2062: 4c 89 e7 mov rdi,r12
|
||||
2065: e8 86 09 00 00 call 29f0 <fclose@plt>
|
||||
206a: 4c 8b bd 70 dd ff ff mov r15,QWORD PTR [rbp-0x2290]
|
||||
2071: 49 8b 7f 10 mov rdi,QWORD PTR [r15+0x10]
|
||||
2075: 48 8d 35 1d e9 ff ff lea rsi,[rip+0xffffffffffffe91d] # 999 <__cxa_finalize@plt-0x1fc7>
|
||||
207c: e8 ef 08 00 00 call 2970 <fopen64@plt>
|
||||
2081: 48 85 c0 test rax,rax
|
||||
2084: 0f 84 dc 05 00 00 je 2666 <__cxa_finalize@plt-0x2fa>
|
||||
208a: 49 89 c6 mov r14,rax
|
||||
208d: 4c 8b a5 a0 dd ff ff mov r12,QWORD PTR [rbp-0x2260]
|
||||
2094: 4d 85 e4 test r12,r12
|
||||
2097: 74 32 je 20cb <__cxa_finalize@plt-0x895>
|
||||
2099: 45 31 ff xor r15d,r15d
|
||||
209c: 0f 1f 40 00 nop DWORD PTR [rax+0x0]
|
||||
20a0: be 08 00 00 00 mov esi,0x8
|
||||
20a5: ba 01 00 00 00 mov edx,0x1
|
||||
20aa: 48 89 df mov rdi,rbx
|
||||
20ad: 4c 89 f1 mov rcx,r14
|
||||
20b0: e8 4b 09 00 00 call 2a00 <fwrite@plt>
|
||||
20b5: 48 83 f8 01 cmp rax,0x1
|
||||
20b9: 0f 85 cd 05 00 00 jne 268c <__cxa_finalize@plt-0x2d4>
|
||||
20bf: 49 ff c7 inc r15
|
||||
20c2: 48 83 c3 08 add rbx,0x8
|
||||
20c6: 4d 39 fc cmp r12,r15
|
||||
20c9: 75 d5 jne 20a0 <__cxa_finalize@plt-0x8c0>
|
||||
20cb: 4c 89 f7 mov rdi,r14
|
||||
20ce: e8 1d 09 00 00 call 29f0 <fclose@plt>
|
||||
20d3: 31 c0 xor eax,eax
|
||||
20d5: 64 48 8b 0c 25 28 00 mov rcx,QWORD PTR fs:0x28
|
||||
20dc: 00 00
|
||||
20de: 48 3b 4d d0 cmp rcx,QWORD PTR [rbp-0x30]
|
||||
20e2: 0f 85 6c 06 00 00 jne 2754 <__cxa_finalize@plt-0x20c>
|
||||
20e8: 48 81 c4 68 22 00 00 add rsp,0x2268
|
||||
20ef: 5b pop rbx
|
||||
20f0: 41 5c pop r12
|
||||
20f2: 41 5d pop r13
|
||||
20f4: 41 5e pop r14
|
||||
20f6: 41 5f pop r15
|
||||
20f8: 5d pop rbp
|
||||
20f9: c3 ret
|
||||
20fa: 4c 8b 3d 5f 2c 00 00 mov r15,QWORD PTR [rip+0x2c5f] # 4d60 <strcasecmp@plt+0x2300>
|
||||
2101: 4c 8b a5 90 dd ff ff mov r12,QWORD PTR [rbp-0x2270]
|
||||
2108: 48 8b 85 a8 dd ff ff mov rax,QWORD PTR [rbp-0x2258]
|
||||
210f: 48 8b 8d a0 dd ff ff mov rcx,QWORD PTR [rbp-0x2260]
|
||||
2116: 89 84 cd d0 df ff ff mov DWORD PTR [rbp+rcx*8-0x2030],eax
|
||||
211d: 44 89 bc cd d4 df ff mov DWORD PTR [rbp+rcx*8-0x202c],r15d
|
||||
2124: ff
|
||||
2125: 48 8d 41 01 lea rax,[rcx+0x1]
|
||||
2129: 48 89 85 a0 dd ff ff mov QWORD PTR [rbp-0x2260],rax
|
||||
2130: 48 8d bd d0 de ff ff lea rdi,[rbp-0x2130]
|
||||
2137: be 00 01 00 00 mov esi,0x100
|
||||
213c: 4c 89 e2 mov rdx,r12
|
||||
213f: e8 4c 08 00 00 call 2990 <fgets@plt>
|
||||
2144: 48 85 c0 test rax,rax
|
||||
2147: 48 8b 8d 98 dd ff ff mov rcx,QWORD PTR [rbp-0x2268]
|
||||
214e: 0f 84 0e ff ff ff je 2062 <__cxa_finalize@plt-0x8fe>
|
||||
2154: 48 8b 85 78 dd ff ff mov rax,QWORD PTR [rbp-0x2288]
|
||||
215b: 4c 8b 30 mov r14,QWORD PTR [rax]
|
||||
215e: 4c 8d bd cf de ff ff lea r15,[rbp-0x2131]
|
||||
2165: 66 66 2e 0f 1f 84 00 data16 cs nop WORD PTR [rax+rax*1+0x0]
|
||||
216c: 00 00 00 00
|
||||
2170: 4d 89 fd mov r13,r15
|
||||
2173: 49 ff c7 inc r15
|
||||
2176: 41 0f b6 45 01 movzx eax,BYTE PTR [r13+0x1]
|
||||
217b: 41 f6 44 46 01 20 test BYTE PTR [r14+rax*2+0x1],0x20
|
||||
2181: 75 ed jne 2170 <__cxa_finalize@plt-0x7f0>
|
||||
2183: 48 ff c1 inc rcx
|
||||
2186: 48 89 8d 98 dd ff ff mov QWORD PTR [rbp-0x2268],rcx
|
||||
218d: 84 c0 test al,al
|
||||
218f: 74 9f je 2130 <__cxa_finalize@plt-0x830>
|
||||
2191: 4c 89 ff mov rdi,r15
|
||||
2194: e8 27 08 00 00 call 29c0 <strlen@plt>
|
||||
2199: 49 01 c5 add r13,rax
|
||||
219c: 0f 1f 40 00 nop DWORD PTR [rax+0x0]
|
||||
21a0: 4c 89 e8 mov rax,r13
|
||||
21a3: 4d 39 fd cmp r13,r15
|
||||
21a6: 76 0f jbe 21b7 <__cxa_finalize@plt-0x7a9>
|
||||
21a8: 0f b6 08 movzx ecx,BYTE PTR [rax]
|
||||
21ab: 4c 8d 68 ff lea r13,[rax-0x1]
|
||||
21af: 41 f6 44 4e 01 20 test BYTE PTR [r14+rcx*2+0x1],0x20
|
||||
21b5: 75 e9 jne 21a0 <__cxa_finalize@plt-0x7c0>
|
||||
21b7: c6 40 01 00 mov BYTE PTR [rax+0x1],0x0
|
||||
21bb: 41 0f b6 07 movzx eax,BYTE PTR [r15]
|
||||
21bf: 48 83 f8 3b cmp rax,0x3b
|
||||
21c3: 77 14 ja 21d9 <__cxa_finalize@plt-0x787>
|
||||
21c5: 48 b9 01 00 00 00 08 movabs rcx,0x800000800000001
|
||||
21cc: 00 00 08
|
||||
21cf: 48 0f a3 c1 bt rcx,rax
|
||||
21d3: 0f 82 57 ff ff ff jb 2130 <__cxa_finalize@plt-0x830>
|
||||
21d9: 4c 89 ff mov rdi,r15
|
||||
21dc: e8 df 07 00 00 call 29c0 <strlen@plt>
|
||||
21e1: 41 80 7c 07 ff 3a cmp BYTE PTR [r15+rax*1-0x1],0x3a
|
||||
21e7: 0f 84 43 ff ff ff je 2130 <__cxa_finalize@plt-0x830>
|
||||
21ed: 48 81 bd a0 dd ff ff cmp QWORD PTR [rbp-0x2260],0x400
|
||||
21f4: 00 04 00 00
|
||||
21f8: 0f 83 e9 04 00 00 jae 26e7 <__cxa_finalize@plt-0x279>
|
||||
21fe: 0f 57 c0 xorps xmm0,xmm0
|
||||
2201: 0f 29 85 c0 de ff ff movaps XMMWORD PTR [rbp-0x2140],xmm0
|
||||
2208: 0f 29 85 b0 de ff ff movaps XMMWORD PTR [rbp-0x2150],xmm0
|
||||
220f: 0f 29 85 a0 de ff ff movaps XMMWORD PTR [rbp-0x2160],xmm0
|
||||
2216: 0f 29 85 90 de ff ff movaps XMMWORD PTR [rbp-0x2170],xmm0
|
||||
221d: 0f 29 85 80 de ff ff movaps XMMWORD PTR [rbp-0x2180],xmm0
|
||||
2224: 0f 29 85 70 de ff ff movaps XMMWORD PTR [rbp-0x2190],xmm0
|
||||
222b: 0f 29 85 60 de ff ff movaps XMMWORD PTR [rbp-0x21a0],xmm0
|
||||
2232: 0f 29 85 50 de ff ff movaps XMMWORD PTR [rbp-0x21b0],xmm0
|
||||
2239: 0f 29 85 40 de ff ff movaps XMMWORD PTR [rbp-0x21c0],xmm0
|
||||
2240: 0f 29 85 30 de ff ff movaps XMMWORD PTR [rbp-0x21d0],xmm0
|
||||
2247: 0f 29 85 20 de ff ff movaps XMMWORD PTR [rbp-0x21e0],xmm0
|
||||
224e: 0f 29 85 10 de ff ff movaps XMMWORD PTR [rbp-0x21f0],xmm0
|
||||
2255: 0f 29 85 00 de ff ff movaps XMMWORD PTR [rbp-0x2200],xmm0
|
||||
225c: 0f 29 85 f0 dd ff ff movaps XMMWORD PTR [rbp-0x2210],xmm0
|
||||
2263: 0f 29 85 e0 dd ff ff movaps XMMWORD PTR [rbp-0x2220],xmm0
|
||||
226a: 0f 29 85 d0 dd ff ff movaps XMMWORD PTR [rbp-0x2230],xmm0
|
||||
2271: 0f 29 85 c0 dd ff ff movaps XMMWORD PTR [rbp-0x2240],xmm0
|
||||
2278: 0f 29 85 b0 dd ff ff movaps XMMWORD PTR [rbp-0x2250],xmm0
|
||||
227f: 4c 89 ff mov rdi,r15
|
||||
2282: 48 8d 35 2b e8 ff ff lea rsi,[rip+0xffffffffffffe82b] # ab4 <__cxa_finalize@plt-0x1eac>
|
||||
2289: 4c 8d b5 b0 de ff ff lea r14,[rbp-0x2150]
|
||||
2290: 4c 89 f2 mov rdx,r14
|
||||
2293: 48 8d 8d b0 dd ff ff lea rcx,[rbp-0x2250]
|
||||
229a: 31 c0 xor eax,eax
|
||||
229c: e8 0f 07 00 00 call 29b0 <__isoc23_sscanf@plt>
|
||||
22a1: 4c 89 f7 mov rdi,r14
|
||||
22a4: e8 d7 04 00 00 call 2780 <__cxa_finalize@plt-0x1e0>
|
||||
22a9: 83 f8 02 cmp eax,0x2
|
||||
22ac: 0f 85 17 01 00 00 jne 23c9 <__cxa_finalize@plt-0x597>
|
||||
22b2: 0f b6 95 b0 dd ff ff movzx edx,BYTE PTR [rbp-0x2250]
|
||||
22b9: 48 85 d2 test rdx,rdx
|
||||
22bc: 0f 84 47 04 00 00 je 2709 <__cxa_finalize@plt-0x257>
|
||||
22c2: 48 89 85 a8 dd ff ff mov QWORD PTR [rbp-0x2258],rax
|
||||
22c9: 48 8b 8d 78 dd ff ff mov rcx,QWORD PTR [rbp-0x2288]
|
||||
22d0: 4c 8b 29 mov r13,QWORD PTR [rcx]
|
||||
22d3: 41 f6 44 55 01 20 test BYTE PTR [r13+rdx*2+0x1],0x20
|
||||
22d9: 4c 8d b5 b1 dd ff ff lea r14,[rbp-0x224f]
|
||||
22e0: 4c 8d bd b0 dd ff ff lea r15,[rbp-0x2250]
|
||||
22e7: 74 1e je 2307 <__cxa_finalize@plt-0x659>
|
||||
22e9: 0f 1f 80 00 00 00 00 nop DWORD PTR [rax+0x0]
|
||||
22f0: 41 0f b6 06 movzx eax,BYTE PTR [r14]
|
||||
22f4: 49 ff c6 inc r14
|
||||
22f7: 41 f6 44 45 01 20 test BYTE PTR [r13+rax*2+0x1],0x20
|
||||
22fd: 75 f1 jne 22f0 <__cxa_finalize@plt-0x670>
|
||||
22ff: 4d 8d 7e ff lea r15,[r14-0x1]
|
||||
2303: 84 c0 test al,al
|
||||
2305: 74 34 je 233b <__cxa_finalize@plt-0x625>
|
||||
2307: 4c 89 ff mov rdi,r15
|
||||
230a: e8 b1 06 00 00 call 29c0 <strlen@plt>
|
||||
230f: 49 8d 0c 07 lea rcx,[r15+rax*1]
|
||||
2313: 48 ff c9 dec rcx
|
||||
2316: 66 2e 0f 1f 84 00 00 cs nop WORD PTR [rax+rax*1+0x0]
|
||||
231d: 00 00 00
|
||||
2320: 48 89 c8 mov rax,rcx
|
||||
2323: 4c 39 f9 cmp rcx,r15
|
||||
2326: 76 0f jbe 2337 <__cxa_finalize@plt-0x629>
|
||||
2328: 0f b6 10 movzx edx,BYTE PTR [rax]
|
||||
232b: 48 8d 48 ff lea rcx,[rax-0x1]
|
||||
232f: 41 f6 44 55 01 20 test BYTE PTR [r13+rdx*2+0x1],0x20
|
||||
2335: 75 e9 jne 2320 <__cxa_finalize@plt-0x640>
|
||||
2337: c6 40 01 00 mov BYTE PTR [rax+0x1],0x0
|
||||
233b: 48 8b 05 ce 29 00 00 mov rax,QWORD PTR [rip+0x29ce] # 4d10 <strcasecmp@plt+0x22b0>
|
||||
2342: 48 89 85 88 dd ff ff mov QWORD PTR [rbp-0x2278],rax
|
||||
2349: 48 85 c0 test rax,rax
|
||||
234c: 0f 84 bb 01 00 00 je 250d <__cxa_finalize@plt-0x453>
|
||||
2352: 48 8d 3d c7 29 00 00 lea rdi,[rip+0x29c7] # 4d20 <strcasecmp@plt+0x22c0>
|
||||
2359: 4c 89 fe mov rsi,r15
|
||||
235c: e8 af 06 00 00 call 2a10 <strcmp@plt>
|
||||
2361: 85 c0 test eax,eax
|
||||
2363: 0f 84 91 fd ff ff je 20fa <__cxa_finalize@plt-0x866>
|
||||
2369: 48 8b 85 88 dd ff ff mov rax,QWORD PTR [rbp-0x2278]
|
||||
2370: 48 ff c8 dec rax
|
||||
2373: 48 89 85 80 dd ff ff mov QWORD PTR [rbp-0x2280],rax
|
||||
237a: 4c 8d 2d e7 29 00 00 lea r13,[rip+0x29e7] # 4d68 <strcasecmp@plt+0x2308>
|
||||
2381: 45 31 e4 xor r12d,r12d
|
||||
2384: 66 66 66 2e 0f 1f 84 data16 data16 cs nop WORD PTR [rax+rax*1+0x0]
|
||||
238b: 00 00 00 00 00
|
||||
2390: 4c 39 a5 80 dd ff ff cmp QWORD PTR [rbp-0x2280],r12
|
||||
2397: 0f 84 70 01 00 00 je 250d <__cxa_finalize@plt-0x453>
|
||||
239d: 4c 89 ef mov rdi,r13
|
||||
23a0: 4c 89 fe mov rsi,r15
|
||||
23a3: e8 68 06 00 00 call 2a10 <strcmp@plt>
|
||||
23a8: 49 83 c5 48 add r13,0x48
|
||||
23ac: 49 ff c4 inc r12
|
||||
23af: 85 c0 test eax,eax
|
||||
23b1: 75 dd jne 2390 <__cxa_finalize@plt-0x5d0>
|
||||
23b3: 4c 3b a5 88 dd ff ff cmp r12,QWORD PTR [rbp-0x2278]
|
||||
23ba: 0f 83 4d 01 00 00 jae 250d <__cxa_finalize@plt-0x453>
|
||||
23c0: 4d 8b 7d f8 mov r15,QWORD PTR [r13-0x8]
|
||||
23c4: e9 38 fd ff ff jmp 2101 <__cxa_finalize@plt-0x85f>
|
||||
23c9: 8d 48 fb lea ecx,[rax-0x5]
|
||||
23cc: 45 31 ff xor r15d,r15d
|
||||
23cf: 83 f9 01 cmp ecx,0x1
|
||||
23d2: 0f 87 37 fd ff ff ja 210f <__cxa_finalize@plt-0x851>
|
||||
23d8: 0f b6 8d b0 dd ff ff movzx ecx,BYTE PTR [rbp-0x2250]
|
||||
23df: 84 c9 test cl,cl
|
||||
23e1: 0f 84 28 fd ff ff je 210f <__cxa_finalize@plt-0x851>
|
||||
23e7: 48 89 85 a8 dd ff ff mov QWORD PTR [rbp-0x2258],rax
|
||||
23ee: 0f b6 c1 movzx eax,cl
|
||||
23f1: 48 8b 8d 78 dd ff ff mov rcx,QWORD PTR [rbp-0x2288]
|
||||
23f8: 4c 8b 31 mov r14,QWORD PTR [rcx]
|
||||
23fb: 41 f6 44 46 01 20 test BYTE PTR [r14+rax*2+0x1],0x20
|
||||
2401: 4c 8d ad b0 dd ff ff lea r13,[rbp-0x2250]
|
||||
2408: 74 1a je 2424 <__cxa_finalize@plt-0x53c>
|
||||
240a: 66 0f 1f 44 00 00 nop WORD PTR [rax+rax*1+0x0]
|
||||
2410: 41 0f b6 45 01 movzx eax,BYTE PTR [r13+0x1]
|
||||
2415: 49 ff c5 inc r13
|
||||
2418: 41 f6 44 46 01 20 test BYTE PTR [r14+rax*2+0x1],0x20
|
||||
241e: 75 f0 jne 2410 <__cxa_finalize@plt-0x550>
|
||||
2420: 84 c0 test al,al
|
||||
2422: 74 37 je 245b <__cxa_finalize@plt-0x505>
|
||||
2424: 4c 89 ef mov rdi,r13
|
||||
2427: e8 94 05 00 00 call 29c0 <strlen@plt>
|
||||
242c: 4a 8d 0c 28 lea rcx,[rax+r13*1]
|
||||
2430: 48 ff c9 dec rcx
|
||||
2433: 66 66 66 66 2e 0f 1f data16 data16 data16 cs nop WORD PTR [rax+rax*1+0x0]
|
||||
243a: 84 00 00 00 00 00
|
||||
2440: 48 89 c8 mov rax,rcx
|
||||
2443: 4c 39 e9 cmp rcx,r13
|
||||
2446: 76 0f jbe 2457 <__cxa_finalize@plt-0x509>
|
||||
2448: 0f b6 10 movzx edx,BYTE PTR [rax]
|
||||
244b: 48 8d 48 ff lea rcx,[rax-0x1]
|
||||
244f: 41 f6 44 56 01 20 test BYTE PTR [r14+rdx*2+0x1],0x20
|
||||
2455: 75 e9 jne 2440 <__cxa_finalize@plt-0x520>
|
||||
2457: c6 40 01 00 mov BYTE PTR [rax+0x1],0x0
|
||||
245b: 48 8b 05 ae 28 00 00 mov rax,QWORD PTR [rip+0x28ae] # 4d10 <strcasecmp@plt+0x22b0>
|
||||
2462: 48 89 85 88 dd ff ff mov QWORD PTR [rbp-0x2278],rax
|
||||
2469: 48 85 c0 test rax,rax
|
||||
246c: 0f 84 3a 02 00 00 je 26ac <__cxa_finalize@plt-0x2b4>
|
||||
2472: 48 8d 3d a7 28 00 00 lea rdi,[rip+0x28a7] # 4d20 <strcasecmp@plt+0x22c0>
|
||||
2479: 4c 89 ee mov rsi,r13
|
||||
247c: e8 8f 05 00 00 call 2a10 <strcmp@plt>
|
||||
2481: 4c 8d 35 d8 28 00 00 lea r14,[rip+0x28d8] # 4d60 <strcasecmp@plt+0x2300>
|
||||
2488: 85 c0 test eax,eax
|
||||
248a: 74 55 je 24e1 <__cxa_finalize@plt-0x47f>
|
||||
248c: 48 8b 85 88 dd ff ff mov rax,QWORD PTR [rbp-0x2278]
|
||||
2493: 48 ff c8 dec rax
|
||||
2496: 48 89 85 80 dd ff ff mov QWORD PTR [rbp-0x2280],rax
|
||||
249d: 4c 8d 35 bc 28 00 00 lea r14,[rip+0x28bc] # 4d60 <strcasecmp@plt+0x2300>
|
||||
24a4: 45 31 e4 xor r12d,r12d
|
||||
24a7: 66 0f 1f 84 00 00 00 nop WORD PTR [rax+rax*1+0x0]
|
||||
24ae: 00 00
|
||||
24b0: 4c 39 a5 80 dd ff ff cmp QWORD PTR [rbp-0x2280],r12
|
||||
24b7: 0f 84 ef 01 00 00 je 26ac <__cxa_finalize@plt-0x2b4>
|
||||
24bd: 49 8d 7e 08 lea rdi,[r14+0x8]
|
||||
24c1: 4c 89 ee mov rsi,r13
|
||||
24c4: e8 47 05 00 00 call 2a10 <strcmp@plt>
|
||||
24c9: 49 83 c6 48 add r14,0x48
|
||||
24cd: 49 ff c4 inc r12
|
||||
24d0: 85 c0 test eax,eax
|
||||
24d2: 75 dc jne 24b0 <__cxa_finalize@plt-0x4b0>
|
||||
24d4: 4c 3b a5 88 dd ff ff cmp r12,QWORD PTR [rbp-0x2278]
|
||||
24db: 0f 83 cb 01 00 00 jae 26ac <__cxa_finalize@plt-0x2b4>
|
||||
24e1: 49 8b 06 mov rax,QWORD PTR [r14]
|
||||
24e4: 48 8b 8d a0 dd ff ff mov rcx,QWORD PTR [rbp-0x2260]
|
||||
24eb: c7 84 cd d0 df ff ff mov DWORD PTR [rbp+rcx*8-0x2030],0x2
|
||||
24f2: 02 00 00 00
|
||||
24f6: 89 84 cd d4 df ff ff mov DWORD PTR [rbp+rcx*8-0x202c],eax
|
||||
24fd: 48 8d 41 01 lea rax,[rcx+0x1]
|
||||
2501: 48 89 85 a0 dd ff ff mov QWORD PTR [rbp-0x2260],rax
|
||||
2508: e9 f4 fb ff ff jmp 2101 <__cxa_finalize@plt-0x85f>
|
||||
250d: 41 0f b6 07 movzx eax,BYTE PTR [r15]
|
||||
2511: 83 f8 30 cmp eax,0x30
|
||||
2514: 74 4e je 2564 <__cxa_finalize@plt-0x3fc>
|
||||
2516: ba 0a 00 00 00 mov edx,0xa
|
||||
251b: 83 f8 22 cmp eax,0x22
|
||||
251e: 4c 8b a5 90 dd ff ff mov r12,QWORD PTR [rbp-0x2270]
|
||||
2525: 75 59 jne 2580 <__cxa_finalize@plt-0x3e0>
|
||||
2527: 4c 89 ff mov rdi,r15
|
||||
252a: e8 91 04 00 00 call 29c0 <strlen@plt>
|
||||
252f: 48 83 f8 02 cmp rax,0x2
|
||||
2533: 0f 82 20 02 00 00 jb 2759 <__cxa_finalize@plt-0x207>
|
||||
2539: 41 80 7c 07 ff 22 cmp BYTE PTR [r15+rax*1-0x1],0x22
|
||||
253f: 0f 85 14 02 00 00 jne 2759 <__cxa_finalize@plt-0x207>
|
||||
2545: 48 83 c0 fe add rax,0xfffffffffffffffe
|
||||
2549: 74 47 je 2592 <__cxa_finalize@plt-0x3ce>
|
||||
254b: 48 83 f8 04 cmp rax,0x4
|
||||
254f: b9 04 00 00 00 mov ecx,0x4
|
||||
2554: 48 0f 43 c1 cmovae rax,rcx
|
||||
2558: 73 40 jae 259a <__cxa_finalize@plt-0x3c6>
|
||||
255a: 31 f6 xor esi,esi
|
||||
255c: 45 31 ff xor r15d,r15d
|
||||
255f: e9 8c 00 00 00 jmp 25f0 <__cxa_finalize@plt-0x370>
|
||||
2564: 41 0f b6 06 movzx eax,BYTE PTR [r14]
|
||||
2568: 04 a8 add al,0xa8
|
||||
256a: a8 df test al,0xdf
|
||||
256c: ba 0a 00 00 00 mov edx,0xa
|
||||
2571: b8 10 00 00 00 mov eax,0x10
|
||||
2576: 0f 44 d0 cmove edx,eax
|
||||
2579: 4c 8b a5 90 dd ff ff mov r12,QWORD PTR [rbp-0x2270]
|
||||
2580: 4c 89 ff mov rdi,r15
|
||||
2583: 31 f6 xor esi,esi
|
||||
2585: e8 96 04 00 00 call 2a20 <__isoc23_strtoul@plt>
|
||||
258a: 49 89 c7 mov r15,rax
|
||||
258d: e9 76 fb ff ff jmp 2108 <__cxa_finalize@plt-0x858>
|
||||
2592: 45 31 ff xor r15d,r15d
|
||||
2595: e9 6e fb ff ff jmp 2108 <__cxa_finalize@plt-0x858>
|
||||
259a: 89 c7 mov edi,eax
|
||||
259c: 83 e7 04 and edi,0x4
|
||||
259f: 31 f6 xor esi,esi
|
||||
25a1: ba 18 00 00 00 mov edx,0x18
|
||||
25a6: 45 31 ff xor r15d,r15d
|
||||
25a9: 0f 1f 80 00 00 00 00 nop DWORD PTR [rax+0x0]
|
||||
25b0: 45 0f b6 44 36 01 movzx r8d,BYTE PTR [r14+rsi*1+0x1]
|
||||
25b6: 8d 4a f0 lea ecx,[rdx-0x10]
|
||||
25b9: 41 d3 e0 shl r8d,cl
|
||||
25bc: 45 0f b6 0c 36 movzx r9d,BYTE PTR [r14+rsi*1]
|
||||
25c1: 45 0f b6 54 36 02 movzx r10d,BYTE PTR [r14+rsi*1+0x2]
|
||||
25c7: 8d 4a f8 lea ecx,[rdx-0x8]
|
||||
25ca: 41 d3 e2 shl r10d,cl
|
||||
25cd: 45 09 f9 or r9d,r15d
|
||||
25d0: 45 09 c8 or r8d,r9d
|
||||
25d3: 45 0f b6 7c 36 03 movzx r15d,BYTE PTR [r14+rsi*1+0x3]
|
||||
25d9: 89 d1 mov ecx,edx
|
||||
25db: 41 d3 e7 shl r15d,cl
|
||||
25de: 45 09 d7 or r15d,r10d
|
||||
25e1: 45 09 c7 or r15d,r8d
|
||||
25e4: 48 83 c6 04 add rsi,0x4
|
||||
25e8: 83 c2 20 add edx,0x20
|
||||
25eb: 48 39 f7 cmp rdi,rsi
|
||||
25ee: 75 c0 jne 25b0 <__cxa_finalize@plt-0x3b0>
|
||||
25f0: 83 e0 03 and eax,0x3
|
||||
25f3: 0f 84 0f fb ff ff je 2108 <__cxa_finalize@plt-0x858>
|
||||
25f9: 8d 0c f5 00 00 00 00 lea ecx,[rsi*8+0x0]
|
||||
2600: 49 01 f6 add r14,rsi
|
||||
2603: 31 d2 xor edx,edx
|
||||
2605: 66 66 2e 0f 1f 84 00 data16 cs nop WORD PTR [rax+rax*1+0x0]
|
||||
260c: 00 00 00 00
|
||||
2610: 41 0f b6 34 16 movzx esi,BYTE PTR [r14+rdx*1]
|
||||
2615: d3 e6 shl esi,cl
|
||||
2617: 41 09 f7 or r15d,esi
|
||||
261a: 48 ff c2 inc rdx
|
||||
261d: 83 c1 08 add ecx,0x8
|
||||
2620: 48 39 d0 cmp rax,rdx
|
||||
2623: 75 eb jne 2610 <__cxa_finalize@plt-0x350>
|
||||
2625: e9 de fa ff ff jmp 2108 <__cxa_finalize@plt-0x858>
|
||||
262a: 48 8b 05 17 16 00 00 mov rax,QWORD PTR [rip+0x1617] # 3c48 <strcasecmp@plt+0x11e8>
|
||||
2631: 48 8b 38 mov rdi,QWORD PTR [rax]
|
||||
2634: 48 8b 13 mov rdx,QWORD PTR [rbx]
|
||||
2637: 48 8d 35 a9 e4 ff ff lea rsi,[rip+0xffffffffffffe4a9] # ae7 <__cxa_finalize@plt-0x1e79>
|
||||
263e: eb 15 jmp 2655 <__cxa_finalize@plt-0x30b>
|
||||
2640: 48 8b 05 01 16 00 00 mov rax,QWORD PTR [rip+0x1601] # 3c48 <strcasecmp@plt+0x11e8>
|
||||
2647: 48 8b 38 mov rdi,QWORD PTR [rax]
|
||||
264a: 48 8b 53 08 mov rdx,QWORD PTR [rbx+0x8]
|
||||
264e: 48 8d 35 3d e4 ff ff lea rsi,[rip+0xffffffffffffe43d] # a92 <__cxa_finalize@plt-0x1ece>
|
||||
2655: 31 c0 xor eax,eax
|
||||
2657: e8 d4 03 00 00 call 2a30 <fprintf@plt>
|
||||
265c: b8 01 00 00 00 mov eax,0x1
|
||||
2661: e9 6f fa ff ff jmp 20d5 <__cxa_finalize@plt-0x88b>
|
||||
2666: 48 8b 05 db 15 00 00 mov rax,QWORD PTR [rip+0x15db] # 3c48 <strcasecmp@plt+0x11e8>
|
||||
266d: 48 8b 38 mov rdi,QWORD PTR [rax]
|
||||
2670: 49 8b 57 10 mov rdx,QWORD PTR [r15+0x10]
|
||||
2674: 48 8d 35 94 e4 ff ff lea rsi,[rip+0xffffffffffffe494] # b0f <__cxa_finalize@plt-0x1e51>
|
||||
267b: 31 c0 xor eax,eax
|
||||
267d: e8 ae 03 00 00 call 2a30 <fprintf@plt>
|
||||
2682: b8 01 00 00 00 mov eax,0x1
|
||||
2687: e9 49 fa ff ff jmp 20d5 <__cxa_finalize@plt-0x88b>
|
||||
268c: 48 8b 05 b5 15 00 00 mov rax,QWORD PTR [rip+0x15b5] # 3c48 <strcasecmp@plt+0x11e8>
|
||||
2693: 48 8b 38 mov rdi,QWORD PTR [rax]
|
||||
2696: 48 8d 35 ff e2 ff ff lea rsi,[rip+0xffffffffffffe2ff] # 99c <__cxa_finalize@plt-0x1fc4>
|
||||
269d: 4c 89 fa mov rdx,r15
|
||||
26a0: 31 c0 xor eax,eax
|
||||
26a2: e8 89 03 00 00 call 2a30 <fprintf@plt>
|
||||
26a7: 4c 89 f7 mov rdi,r14
|
||||
26aa: eb 2c jmp 26d8 <__cxa_finalize@plt-0x288>
|
||||
26ac: 48 8b 05 95 15 00 00 mov rax,QWORD PTR [rip+0x1595] # 3c48 <strcasecmp@plt+0x11e8>
|
||||
26b3: 48 8b 38 mov rdi,QWORD PTR [rax]
|
||||
26b6: 48 8d 35 15 e3 ff ff lea rsi,[rip+0xffffffffffffe315] # 9d2 <__cxa_finalize@plt-0x1f8e>
|
||||
26bd: 4c 89 ea mov rdx,r13
|
||||
26c0: 48 8b 8d 98 dd ff ff mov rcx,QWORD PTR [rbp-0x2268]
|
||||
26c7: 31 c0 xor eax,eax
|
||||
26c9: e8 62 03 00 00 call 2a30 <fprintf@plt>
|
||||
26ce: 4c 8b a5 90 dd ff ff mov r12,QWORD PTR [rbp-0x2270]
|
||||
26d5: 4c 89 e7 mov rdi,r12
|
||||
26d8: e8 13 03 00 00 call 29f0 <fclose@plt>
|
||||
26dd: b8 01 00 00 00 mov eax,0x1
|
||||
26e2: e9 ee f9 ff ff jmp 20d5 <__cxa_finalize@plt-0x88b>
|
||||
26e7: 48 8b 05 5a 15 00 00 mov rax,QWORD PTR [rip+0x155a] # 3c48 <strcasecmp@plt+0x11e8>
|
||||
26ee: 48 8b 08 mov rcx,QWORD PTR [rax]
|
||||
26f1: 48 8d 3d d1 e3 ff ff lea rdi,[rip+0xffffffffffffe3d1] # ac9 <__cxa_finalize@plt-0x1e97>
|
||||
26f8: be 1d 00 00 00 mov esi,0x1d
|
||||
26fd: ba 01 00 00 00 mov edx,0x1
|
||||
2702: e8 f9 02 00 00 call 2a00 <fwrite@plt>
|
||||
2707: eb cc jmp 26d5 <__cxa_finalize@plt-0x28b>
|
||||
2709: 48 8b 05 38 15 00 00 mov rax,QWORD PTR [rip+0x1538] # 3c48 <strcasecmp@plt+0x11e8>
|
||||
2710: 48 8b 38 mov rdi,QWORD PTR [rax]
|
||||
2713: 48 8d 35 21 e3 ff ff lea rsi,[rip+0xffffffffffffe321] # a3b <__cxa_finalize@plt-0x1f25>
|
||||
271a: 48 8b 95 98 dd ff ff mov rdx,QWORD PTR [rbp-0x2268]
|
||||
2721: 31 c0 xor eax,eax
|
||||
2723: e8 08 03 00 00 call 2a30 <fprintf@plt>
|
||||
2728: eb ab jmp 26d5 <__cxa_finalize@plt-0x28b>
|
||||
272a: 48 8b 05 17 15 00 00 mov rax,QWORD PTR [rip+0x1517] # 3c48 <strcasecmp@plt+0x11e8>
|
||||
2731: 48 8b 08 mov rcx,QWORD PTR [rax]
|
||||
2734: 48 8d 3d c0 e2 ff ff lea rdi,[rip+0xffffffffffffe2c0] # 9fb <__cxa_finalize@plt-0x1f65>
|
||||
273b: be 17 00 00 00 mov esi,0x17
|
||||
2740: ba 01 00 00 00 mov edx,0x1
|
||||
2745: e8 b6 02 00 00 call 2a00 <fwrite@plt>
|
||||
274a: bf 01 00 00 00 mov edi,0x1
|
||||
274f: e8 ec 02 00 00 call 2a40 <exit@plt>
|
||||
2754: e8 f7 02 00 00 call 2a50 <__stack_chk_fail@plt>
|
||||
2759: 48 8b 05 e8 14 00 00 mov rax,QWORD PTR [rip+0x14e8] # 3c48 <strcasecmp@plt+0x11e8>
|
||||
2760: 48 8b 38 mov rdi,QWORD PTR [rax]
|
||||
2763: 48 8d 35 ff e2 ff ff lea rsi,[rip+0xffffffffffffe2ff] # a69 <__cxa_finalize@plt-0x1ef7>
|
||||
276a: 4c 89 fa mov rdx,r15
|
||||
276d: 31 c0 xor eax,eax
|
||||
276f: e8 bc 02 00 00 call 2a30 <fprintf@plt>
|
||||
2774: bf 01 00 00 00 mov edi,0x1
|
||||
2779: e8 c2 02 00 00 call 2a40 <exit@plt>
|
||||
277e: 66 90 xchg ax,ax
|
||||
2780: 55 push rbp
|
||||
2781: 48 89 e5 mov rbp,rsp
|
||||
2784: 53 push rbx
|
||||
2785: 50 push rax
|
||||
2786: 48 89 fb mov rbx,rdi
|
||||
2789: 48 8d 35 3a e2 ff ff lea rsi,[rip+0xffffffffffffe23a] # 9ca <__cxa_finalize@plt-0x1f96>
|
||||
2790: e8 cb 02 00 00 call 2a60 <strcasecmp@plt>
|
||||
2795: 85 c0 test eax,eax
|
||||
2797: 0f 84 0e 01 00 00 je 28ab <__cxa_finalize@plt-0xb5>
|
||||
279d: 48 8d 35 67 e3 ff ff lea rsi,[rip+0xffffffffffffe367] # b0b <__cxa_finalize@plt-0x1e55>
|
||||
27a4: 48 89 df mov rdi,rbx
|
||||
27a7: e8 b4 02 00 00 call 2a60 <strcasecmp@plt>
|
||||
27ac: 85 c0 test eax,eax
|
||||
27ae: 0f 84 00 01 00 00 je 28b4 <__cxa_finalize@plt-0xac>
|
||||
27b4: 48 8d 35 d9 e1 ff ff lea rsi,[rip+0xffffffffffffe1d9] # 994 <__cxa_finalize@plt-0x1fcc>
|
||||
27bb: 48 89 df mov rdi,rbx
|
||||
27be: e8 9d 02 00 00 call 2a60 <strcasecmp@plt>
|
||||
27c3: 85 c0 test eax,eax
|
||||
27c5: 0f 84 f5 00 00 00 je 28c0 <__cxa_finalize@plt-0xa0>
|
||||
27cb: 48 8d 35 bc e2 ff ff lea rsi,[rip+0xffffffffffffe2bc] # a8e <__cxa_finalize@plt-0x1ed2>
|
||||
27d2: 48 89 df mov rdi,rbx
|
||||
27d5: e8 86 02 00 00 call 2a60 <strcasecmp@plt>
|
||||
27da: 85 c0 test eax,eax
|
||||
27dc: 0f 84 ea 00 00 00 je 28cc <__cxa_finalize@plt-0x94>
|
||||
27e2: 48 8d 35 e5 e1 ff ff lea rsi,[rip+0xffffffffffffe1e5] # 9ce <__cxa_finalize@plt-0x1f92>
|
||||
27e9: 48 89 df mov rdi,rbx
|
||||
27ec: e8 6f 02 00 00 call 2a60 <strcasecmp@plt>
|
||||
27f1: 85 c0 test eax,eax
|
||||
27f3: 0f 84 df 00 00 00 je 28d8 <__cxa_finalize@plt-0x88>
|
||||
27f9: 48 8d 35 1c e2 ff ff lea rsi,[rip+0xffffffffffffe21c] # a1c <__cxa_finalize@plt-0x1f44>
|
||||
2800: 48 89 df mov rdi,rbx
|
||||
2803: e8 58 02 00 00 call 2a60 <strcasecmp@plt>
|
||||
2808: 85 c0 test eax,eax
|
||||
280a: 0f 84 d4 00 00 00 je 28e4 <__cxa_finalize@plt-0x7c>
|
||||
2810: 48 8d 35 ad e2 ff ff lea rsi,[rip+0xffffffffffffe2ad] # ac4 <__cxa_finalize@plt-0x1e9c>
|
||||
2817: 48 89 df mov rdi,rbx
|
||||
281a: e8 41 02 00 00 call 2a60 <strcasecmp@plt>
|
||||
281f: 85 c0 test eax,eax
|
||||
2821: 0f 84 c9 00 00 00 je 28f0 <__cxa_finalize@plt-0x70>
|
||||
2827: 48 8d 35 ea e1 ff ff lea rsi,[rip+0xffffffffffffe1ea] # a18 <__cxa_finalize@plt-0x1f48>
|
||||
282e: 48 89 df mov rdi,rbx
|
||||
2831: e8 2a 02 00 00 call 2a60 <strcasecmp@plt>
|
||||
2836: 85 c0 test eax,eax
|
||||
2838: 0f 84 be 00 00 00 je 28fc <__cxa_finalize@plt-0x64>
|
||||
283e: 48 8d 35 ce e1 ff ff lea rsi,[rip+0xffffffffffffe1ce] # a13 <__cxa_finalize@plt-0x1f4d>
|
||||
2845: 48 89 df mov rdi,rbx
|
||||
2848: e8 13 02 00 00 call 2a60 <strcasecmp@plt>
|
||||
284d: 85 c0 test eax,eax
|
||||
284f: 0f 84 b3 00 00 00 je 2908 <__cxa_finalize@plt-0x58>
|
||||
2855: 48 8d 35 68 e1 ff ff lea rsi,[rip+0xffffffffffffe168] # 9c4 <__cxa_finalize@plt-0x1f9c>
|
||||
285c: 48 89 df mov rdi,rbx
|
||||
285f: e8 fc 01 00 00 call 2a60 <strcasecmp@plt>
|
||||
2864: 85 c0 test eax,eax
|
||||
2866: 0f 84 a8 00 00 00 je 2914 <__cxa_finalize@plt-0x4c>
|
||||
286c: 48 8d 35 bf e2 ff ff lea rsi,[rip+0xffffffffffffe2bf] # b32 <__cxa_finalize@plt-0x1e2e>
|
||||
2873: 48 89 df mov rdi,rbx
|
||||
2876: e8 e5 01 00 00 call 2a60 <strcasecmp@plt>
|
||||
287b: 89 c1 mov ecx,eax
|
||||
287d: b8 0a 00 00 00 mov eax,0xa
|
||||
2882: 85 c9 test ecx,ecx
|
||||
2884: 74 27 je 28ad <__cxa_finalize@plt-0xb3>
|
||||
2886: 48 8b 05 bb 13 00 00 mov rax,QWORD PTR [rip+0x13bb] # 3c48 <strcasecmp@plt+0x11e8>
|
||||
288d: 48 8b 38 mov rdi,QWORD PTR [rax]
|
||||
2890: 48 8d 35 89 e1 ff ff lea rsi,[rip+0xffffffffffffe189] # a20 <__cxa_finalize@plt-0x1f40>
|
||||
2897: 48 89 da mov rdx,rbx
|
||||
289a: 31 c0 xor eax,eax
|
||||
289c: e8 8f 01 00 00 call 2a30 <fprintf@plt>
|
||||
28a1: bf 01 00 00 00 mov edi,0x1
|
||||
28a6: e8 95 01 00 00 call 2a40 <exit@plt>
|
||||
28ab: 31 c0 xor eax,eax
|
||||
28ad: 48 83 c4 08 add rsp,0x8
|
||||
28b1: 5b pop rbx
|
||||
28b2: 5d pop rbp
|
||||
28b3: c3 ret
|
||||
28b4: b8 01 00 00 00 mov eax,0x1
|
||||
28b9: 48 83 c4 08 add rsp,0x8
|
||||
28bd: 5b pop rbx
|
||||
28be: 5d pop rbp
|
||||
28bf: c3 ret
|
||||
28c0: b8 02 00 00 00 mov eax,0x2
|
||||
28c5: 48 83 c4 08 add rsp,0x8
|
||||
28c9: 5b pop rbx
|
||||
28ca: 5d pop rbp
|
||||
28cb: c3 ret
|
||||
28cc: b8 03 00 00 00 mov eax,0x3
|
||||
28d1: 48 83 c4 08 add rsp,0x8
|
||||
28d5: 5b pop rbx
|
||||
28d6: 5d pop rbp
|
||||
28d7: c3 ret
|
||||
28d8: b8 04 00 00 00 mov eax,0x4
|
||||
28dd: 48 83 c4 08 add rsp,0x8
|
||||
28e1: 5b pop rbx
|
||||
28e2: 5d pop rbp
|
||||
28e3: c3 ret
|
||||
28e4: b8 05 00 00 00 mov eax,0x5
|
||||
28e9: 48 83 c4 08 add rsp,0x8
|
||||
28ed: 5b pop rbx
|
||||
28ee: 5d pop rbp
|
||||
28ef: c3 ret
|
||||
28f0: b8 06 00 00 00 mov eax,0x6
|
||||
28f5: 48 83 c4 08 add rsp,0x8
|
||||
28f9: 5b pop rbx
|
||||
28fa: 5d pop rbp
|
||||
28fb: c3 ret
|
||||
28fc: b8 07 00 00 00 mov eax,0x7
|
||||
2901: 48 83 c4 08 add rsp,0x8
|
||||
2905: 5b pop rbx
|
||||
2906: 5d pop rbp
|
||||
2907: c3 ret
|
||||
2908: b8 08 00 00 00 mov eax,0x8
|
||||
290d: 48 83 c4 08 add rsp,0x8
|
||||
2911: 5b pop rbx
|
||||
2912: 5d pop rbp
|
||||
2913: c3 ret
|
||||
2914: b8 09 00 00 00 mov eax,0x9
|
||||
2919: 48 83 c4 08 add rsp,0x8
|
||||
291d: 5b pop rbx
|
||||
291e: 5d pop rbp
|
||||
291f: c3 ret
|
||||
|
||||
Disassembly of section .init:
|
||||
|
||||
0000000000002920 <.init>:
|
||||
2920: f3 0f 1e fa endbr64
|
||||
2924: 48 83 ec 08 sub rsp,0x8
|
||||
2928: 48 8b 05 f9 12 00 00 mov rax,QWORD PTR [rip+0x12f9] # 3c28 <strcasecmp@plt+0x11c8>
|
||||
292f: 48 85 c0 test rax,rax
|
||||
2932: 74 02 je 2936 <__cxa_finalize@plt-0x2a>
|
||||
2934: ff d0 call rax
|
||||
2936: 48 83 c4 08 add rsp,0x8
|
||||
293a: c3 ret
|
||||
|
||||
Disassembly of section .fini:
|
||||
|
||||
000000000000293c <.fini>:
|
||||
293c: f3 0f 1e fa endbr64
|
||||
2940: 48 83 ec 08 sub rsp,0x8
|
||||
2944: 48 83 c4 08 add rsp,0x8
|
||||
2948: c3 ret
|
||||
|
||||
Disassembly of section .plt:
|
||||
|
||||
0000000000002950 <__cxa_finalize@plt-0x10>:
|
||||
2950: ff 35 12 23 00 00 push QWORD PTR [rip+0x2312] # 4c68 <strcasecmp@plt+0x2208>
|
||||
2956: ff 25 14 23 00 00 jmp QWORD PTR [rip+0x2314] # 4c70 <strcasecmp@plt+0x2210>
|
||||
295c: 0f 1f 40 00 nop DWORD PTR [rax+0x0]
|
||||
|
||||
0000000000002960 <__cxa_finalize@plt>:
|
||||
2960: ff 25 12 23 00 00 jmp QWORD PTR [rip+0x2312] # 4c78 <strcasecmp@plt+0x2218>
|
||||
2966: 68 00 00 00 00 push 0x0
|
||||
296b: e9 e0 ff ff ff jmp 2950 <__cxa_finalize@plt-0x10>
|
||||
|
||||
0000000000002970 <fopen64@plt>:
|
||||
2970: ff 25 0a 23 00 00 jmp QWORD PTR [rip+0x230a] # 4c80 <strcasecmp@plt+0x2220>
|
||||
2976: 68 01 00 00 00 push 0x1
|
||||
297b: e9 d0 ff ff ff jmp 2950 <__cxa_finalize@plt-0x10>
|
||||
|
||||
0000000000002980 <memset@plt>:
|
||||
2980: ff 25 02 23 00 00 jmp QWORD PTR [rip+0x2302] # 4c88 <strcasecmp@plt+0x2228>
|
||||
2986: 68 02 00 00 00 push 0x2
|
||||
298b: e9 c0 ff ff ff jmp 2950 <__cxa_finalize@plt-0x10>
|
||||
|
||||
0000000000002990 <fgets@plt>:
|
||||
2990: ff 25 fa 22 00 00 jmp QWORD PTR [rip+0x22fa] # 4c90 <strcasecmp@plt+0x2230>
|
||||
2996: 68 03 00 00 00 push 0x3
|
||||
299b: e9 b0 ff ff ff jmp 2950 <__cxa_finalize@plt-0x10>
|
||||
|
||||
00000000000029a0 <__ctype_b_loc@plt>:
|
||||
29a0: ff 25 f2 22 00 00 jmp QWORD PTR [rip+0x22f2] # 4c98 <strcasecmp@plt+0x2238>
|
||||
29a6: 68 04 00 00 00 push 0x4
|
||||
29ab: e9 a0 ff ff ff jmp 2950 <__cxa_finalize@plt-0x10>
|
||||
|
||||
00000000000029b0 <__isoc23_sscanf@plt>:
|
||||
29b0: ff 25 ea 22 00 00 jmp QWORD PTR [rip+0x22ea] # 4ca0 <strcasecmp@plt+0x2240>
|
||||
29b6: 68 05 00 00 00 push 0x5
|
||||
29bb: e9 90 ff ff ff jmp 2950 <__cxa_finalize@plt-0x10>
|
||||
|
||||
00000000000029c0 <strlen@plt>:
|
||||
29c0: ff 25 e2 22 00 00 jmp QWORD PTR [rip+0x22e2] # 4ca8 <strcasecmp@plt+0x2248>
|
||||
29c6: 68 06 00 00 00 push 0x6
|
||||
29cb: e9 80 ff ff ff jmp 2950 <__cxa_finalize@plt-0x10>
|
||||
|
||||
00000000000029d0 <strncpy@plt>:
|
||||
29d0: ff 25 da 22 00 00 jmp QWORD PTR [rip+0x22da] # 4cb0 <strcasecmp@plt+0x2250>
|
||||
29d6: 68 07 00 00 00 push 0x7
|
||||
29db: e9 70 ff ff ff jmp 2950 <__cxa_finalize@plt-0x10>
|
||||
|
||||
00000000000029e0 <rewind@plt>:
|
||||
29e0: ff 25 d2 22 00 00 jmp QWORD PTR [rip+0x22d2] # 4cb8 <strcasecmp@plt+0x2258>
|
||||
29e6: 68 08 00 00 00 push 0x8
|
||||
29eb: e9 60 ff ff ff jmp 2950 <__cxa_finalize@plt-0x10>
|
||||
|
||||
00000000000029f0 <fclose@plt>:
|
||||
29f0: ff 25 ca 22 00 00 jmp QWORD PTR [rip+0x22ca] # 4cc0 <strcasecmp@plt+0x2260>
|
||||
29f6: 68 09 00 00 00 push 0x9
|
||||
29fb: e9 50 ff ff ff jmp 2950 <__cxa_finalize@plt-0x10>
|
||||
|
||||
0000000000002a00 <fwrite@plt>:
|
||||
2a00: ff 25 c2 22 00 00 jmp QWORD PTR [rip+0x22c2] # 4cc8 <strcasecmp@plt+0x2268>
|
||||
2a06: 68 0a 00 00 00 push 0xa
|
||||
2a0b: e9 40 ff ff ff jmp 2950 <__cxa_finalize@plt-0x10>
|
||||
|
||||
0000000000002a10 <strcmp@plt>:
|
||||
2a10: ff 25 ba 22 00 00 jmp QWORD PTR [rip+0x22ba] # 4cd0 <strcasecmp@plt+0x2270>
|
||||
2a16: 68 0b 00 00 00 push 0xb
|
||||
2a1b: e9 30 ff ff ff jmp 2950 <__cxa_finalize@plt-0x10>
|
||||
|
||||
0000000000002a20 <__isoc23_strtoul@plt>:
|
||||
2a20: ff 25 b2 22 00 00 jmp QWORD PTR [rip+0x22b2] # 4cd8 <strcasecmp@plt+0x2278>
|
||||
2a26: 68 0c 00 00 00 push 0xc
|
||||
2a2b: e9 20 ff ff ff jmp 2950 <__cxa_finalize@plt-0x10>
|
||||
|
||||
0000000000002a30 <fprintf@plt>:
|
||||
2a30: ff 25 aa 22 00 00 jmp QWORD PTR [rip+0x22aa] # 4ce0 <strcasecmp@plt+0x2280>
|
||||
2a36: 68 0d 00 00 00 push 0xd
|
||||
2a3b: e9 10 ff ff ff jmp 2950 <__cxa_finalize@plt-0x10>
|
||||
|
||||
0000000000002a40 <exit@plt>:
|
||||
2a40: ff 25 a2 22 00 00 jmp QWORD PTR [rip+0x22a2] # 4ce8 <strcasecmp@plt+0x2288>
|
||||
2a46: 68 0e 00 00 00 push 0xe
|
||||
2a4b: e9 00 ff ff ff jmp 2950 <__cxa_finalize@plt-0x10>
|
||||
|
||||
0000000000002a50 <__stack_chk_fail@plt>:
|
||||
2a50: ff 25 9a 22 00 00 jmp QWORD PTR [rip+0x229a] # 4cf0 <strcasecmp@plt+0x2290>
|
||||
2a56: 68 0f 00 00 00 push 0xf
|
||||
2a5b: e9 f0 fe ff ff jmp 2950 <__cxa_finalize@plt-0x10>
|
||||
|
||||
0000000000002a60 <strcasecmp@plt>:
|
||||
2a60: ff 25 92 22 00 00 jmp QWORD PTR [rip+0x2292] # 4cf8 <strcasecmp@plt+0x2298>
|
||||
2a66: 68 10 00 00 00 push 0x10
|
||||
2a6b: e9 e0 fe ff ff jmp 2950 <__cxa_finalize@plt-0x10>
|
||||
BIN
2025/lake/pwn/stackception/stackception-1
Normal file
BIN
2025/lake/pwn/stackception/stackception-1
Normal file
Binary file not shown.
BIN
2025/lake/pwn/stackception/stackception-1.i64
Normal file
BIN
2025/lake/pwn/stackception/stackception-1.i64
Normal file
Binary file not shown.
BIN
2025/lake/pwn/stackception/stackception-asm
Normal file
BIN
2025/lake/pwn/stackception/stackception-asm
Normal file
Binary file not shown.
BIN
2025/lake/pwn/stackception/stackception-asm.i64
Normal file
BIN
2025/lake/pwn/stackception/stackception-asm.i64
Normal file
Binary file not shown.
@@ -9,8 +9,18 @@
|
||||
"anothapk.apk"
|
||||
],
|
||||
[
|
||||
"android",
|
||||
"Source code",
|
||||
"Resources",
|
||||
"anothapk.apk"
|
||||
],
|
||||
[
|
||||
"lib",
|
||||
"Resources",
|
||||
"anothapk.apk"
|
||||
],
|
||||
[
|
||||
"x86_64",
|
||||
"lib",
|
||||
"Resources",
|
||||
"anothapk.apk"
|
||||
],
|
||||
[
|
||||
@@ -34,9 +44,14 @@
|
||||
"anothapk.apk"
|
||||
],
|
||||
[
|
||||
"com.lake.ctf.MainActivity",
|
||||
"com.lake.ctf",
|
||||
"Source code",
|
||||
"lib",
|
||||
"Resources",
|
||||
"anothapk.apk"
|
||||
],
|
||||
[
|
||||
"x86_64",
|
||||
"lib",
|
||||
"Resources",
|
||||
"anothapk.apk"
|
||||
]
|
||||
],
|
||||
@@ -49,12 +64,12 @@
|
||||
"type": "class",
|
||||
"tabPath": "com.lake.ctf.MainActivity",
|
||||
"subPath": "java",
|
||||
"caret": 4782,
|
||||
"caret": 442,
|
||||
"view": {
|
||||
"x": 0,
|
||||
"y": 1365
|
||||
"y": 0
|
||||
},
|
||||
"active": true,
|
||||
"active": false,
|
||||
"pinned": false,
|
||||
"bookmarked": false,
|
||||
"hidden": false
|
||||
@@ -136,7 +151,7 @@
|
||||
"caret": 6022,
|
||||
"view": {
|
||||
"x": 0,
|
||||
"y": 4155
|
||||
"y": 1874
|
||||
},
|
||||
"active": false,
|
||||
"pinned": false,
|
||||
@@ -156,6 +171,20 @@
|
||||
"pinned": false,
|
||||
"bookmarked": false,
|
||||
"hidden": false
|
||||
},
|
||||
{
|
||||
"type": "class",
|
||||
"tabPath": "com.lake.ctf.Check4ec9599fc203d176a301536c2e091a19bc852759b255bd6818810a42c5fed14a",
|
||||
"subPath": "java",
|
||||
"caret": 252,
|
||||
"view": {
|
||||
"x": 0,
|
||||
"y": 4968
|
||||
},
|
||||
"active": true,
|
||||
"pinned": false,
|
||||
"bookmarked": false,
|
||||
"hidden": false
|
||||
}
|
||||
],
|
||||
"cacheDir": "/home/cato/.cache/jadx/projects/anothapk-a709dee63602e12ef9bab1f45e2a8b42",
|
||||
|
||||
Binary file not shown.
@@ -1,6 +0,0 @@
|
||||
def main():
|
||||
print("Hello from android!")
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
main()
|
||||
@@ -96,27 +96,21 @@ def extract_logic(class_hash, method_hash, files_map):
|
||||
|
||||
def solve():
|
||||
files_map = load_files()
|
||||
if not files_map: return
|
||||
if not files_map:
|
||||
return
|
||||
|
||||
curr_class = START_CLASS_HASH
|
||||
curr_method = START_METHOD_HASH
|
||||
|
||||
step_count = 0
|
||||
visited = set()
|
||||
|
||||
print(f"[*] Starting traversal for exactly {MAX_STEPS} steps...")
|
||||
|
||||
# UPDATED: Loop exactly MAX_STEPS times
|
||||
for i in range(MAX_STEPS):
|
||||
if not curr_class:
|
||||
print("[!] Chain ended prematurely!")
|
||||
break
|
||||
|
||||
# Loop detection (just in case, though duplicates are mathematically fine)
|
||||
if (curr_class, curr_method) in visited:
|
||||
print(f"[i] Loop detected at step {i+1}. This is fine, just adding redundant constraints.")
|
||||
visited.add((curr_class, curr_method))
|
||||
|
||||
|
||||
step_count += 1
|
||||
|
||||
eq_str, next_class, next_method = extract_logic(curr_class, curr_method, files_map)
|
||||
@@ -126,6 +120,7 @@ def solve():
|
||||
|
||||
try:
|
||||
if "==" in eq_str:
|
||||
print(f"[*] Adding constraint {eq_str}")
|
||||
lhs, rhs = eq_str.split("==")
|
||||
ctx = {'str': MockString()}
|
||||
lhs_expr = eval(lhs.strip(), {}, ctx)
|
||||
@@ -133,7 +128,7 @@ def solve():
|
||||
solver.add(lhs_expr == rhs_val)
|
||||
else:
|
||||
print(f"[!] Warning: Equation format unknown: {eq_str}")
|
||||
except Exception as e:
|
||||
except Exception:
|
||||
print(f"[!] Error parsing equation: {eq_str}")
|
||||
break
|
||||
|
||||
|
||||
Binary file not shown.
193
2025/lake/rev/real_ctf/a_real_ctf_linux/parse_replay.py
Normal file
193
2025/lake/rev/real_ctf/a_real_ctf_linux/parse_replay.py
Normal file
@@ -0,0 +1,193 @@
|
||||
import struct
|
||||
import enum
|
||||
import os
|
||||
|
||||
# --- 1. Enumeration Equivalent ---
|
||||
# Defines the PlayerActions flags from the C# code for easy interpretation.
|
||||
@enum.unique
|
||||
class PlayerActions(enum.Flag):
|
||||
"""
|
||||
Represents the bit flags for player actions/states in a frame.
|
||||
"""
|
||||
None_ = 0
|
||||
Jump = 1
|
||||
Forward = 2
|
||||
Backward = 4
|
||||
Left = 8
|
||||
Right = 0x10
|
||||
TakeFlag = 0x20
|
||||
Collision = 0x80
|
||||
|
||||
# --- 2. Constants and Struct Formats ---
|
||||
|
||||
# The magic number used to identify the file format (72848253210177uL)
|
||||
EXPECTED_MAGIC_NUMBER = 72848253210177
|
||||
|
||||
# Structure of the file header (16 bytes):
|
||||
# < : Little-endian
|
||||
# Q : unsigned long long (8 bytes, for Magic Number)
|
||||
# H : unsigned short (2 bytes, for Version)
|
||||
# I : unsigned int (4 bytes, for Level ID)
|
||||
# H : unsigned short (2 bytes, for Frame Count)
|
||||
HEADER_FORMAT = "<Q H I H"
|
||||
HEADER_SIZE = struct.calcsize(HEADER_FORMAT) # Should be 16 bytes
|
||||
|
||||
# Structure of a single frame record (29 bytes):
|
||||
# < : Little-endian
|
||||
# 3 x f: 3 floats (Vector3 position: x, y, z) - 12 bytes
|
||||
# 4 x f: 4 floats (Quaternion rotation: x, y, z, w) - 16 bytes
|
||||
# B : unsigned char (1 byte, for PlayerActions enum)
|
||||
# Total size: 29 bytes
|
||||
FRAME_FORMAT = "<f f f f f f f B"
|
||||
FRAME_SIZE = struct.calcsize(FRAME_FORMAT) # Should be 29 bytes
|
||||
|
||||
# --- 3. Parsing Functions ---
|
||||
|
||||
def parse_replay_file(file_path):
|
||||
"""
|
||||
Reads a binary replay file, parses the header and all frame data,
|
||||
and returns the structured data.
|
||||
"""
|
||||
print(f"Attempting to parse file: {file_path}")
|
||||
|
||||
if not os.path.exists(file_path):
|
||||
print(f"Error: File not found at {file_path}")
|
||||
return None
|
||||
|
||||
with open(file_path, "rb") as f:
|
||||
# --- A. Read and Parse Header (16 bytes) ---
|
||||
header_data = f.read(HEADER_SIZE)
|
||||
if len(header_data) < HEADER_SIZE:
|
||||
print("Error: File is too short to contain a valid header.")
|
||||
return None
|
||||
|
||||
# Unpack the header data
|
||||
magic_number, version, level_id, frame_count = struct.unpack(
|
||||
HEADER_FORMAT, header_data
|
||||
)
|
||||
|
||||
# Validate Magic Number
|
||||
if magic_number != EXPECTED_MAGIC_NUMBER:
|
||||
# Note: Python interprets 72848253210177uL as a standard integer.
|
||||
# If the C# ulong was a large negative number, the interpretation might differ,
|
||||
# but for this positive constant, it should match.
|
||||
print(f"Error: Invalid magic number. Expected {EXPECTED_MAGIC_NUMBER}, got {magic_number}.")
|
||||
return None
|
||||
|
||||
# Store header information
|
||||
replay_data = {
|
||||
"magic_number": magic_number,
|
||||
"version": version,
|
||||
"level_id": level_id,
|
||||
"frame_count": frame_count,
|
||||
"frames": []
|
||||
}
|
||||
|
||||
print(f"Header successfully parsed. Version: {version}, Level ID: {level_id}, Frames: {frame_count}")
|
||||
|
||||
# --- B. Read and Parse Frames ---
|
||||
for i in range(frame_count):
|
||||
frame_bytes = f.read(FRAME_SIZE)
|
||||
|
||||
if len(frame_bytes) < FRAME_SIZE:
|
||||
print(f"Warning: Expected {frame_count} frames, but file ended after {i} frames.")
|
||||
break
|
||||
|
||||
# Unpack the frame data
|
||||
(
|
||||
pos_x, pos_y, pos_z,
|
||||
rot_x, rot_y, rot_z, rot_w,
|
||||
actions_byte
|
||||
) = struct.unpack(FRAME_FORMAT, frame_bytes)
|
||||
|
||||
# Convert the action byte into readable flag enumeration
|
||||
actions = PlayerActions(actions_byte)
|
||||
|
||||
frame_record = {
|
||||
"frame_index": i,
|
||||
"position": {"x": pos_x, "y": pos_y, "z": pos_z},
|
||||
"rotation": {"x": rot_x, "y": rot_y, "z": rot_z, "w": rot_w},
|
||||
"actions_byte": actions_byte,
|
||||
"actions": [action.name for action in actions if action is not PlayerActions.None_]
|
||||
}
|
||||
replay_data["frames"].append(frame_record)
|
||||
|
||||
print(f"Successfully parsed {len(replay_data['frames'])}/{frame_count} frames.")
|
||||
return replay_data
|
||||
|
||||
# --- 4. Example Usage and Data Simulation ---
|
||||
|
||||
def create_mock_replay_bytes(level_id, frames_to_generate):
|
||||
"""
|
||||
Simulates the C# replayToBytes function to generate a mock byte array
|
||||
for testing the parser without an actual .bin file.
|
||||
"""
|
||||
# 1. Header (Magic, Version=1, LevelID, FrameCount)
|
||||
header_data = struct.pack(
|
||||
HEADER_FORMAT,
|
||||
EXPECTED_MAGIC_NUMBER,
|
||||
1, # Version
|
||||
level_id,
|
||||
len(frames_to_generate) # Frame Count
|
||||
)
|
||||
|
||||
# 2. Frames
|
||||
frame_data = b''
|
||||
for i, frame in enumerate(frames_to_generate):
|
||||
pos = frame.get("position", (0.0, 0.0, 0.0))
|
||||
rot = frame.get("rotation", (0.0, 0.0, 0.0, 1.0))
|
||||
|
||||
# Retrieve the action value, which is a PlayerActions enum object
|
||||
actions_value = frame.get("actions_byte", 0)
|
||||
|
||||
# FIX: Explicitly convert the enum object (or the default integer 0)
|
||||
# to a standard integer, as required by struct.pack for the 'B' format.
|
||||
actions_byte = int(actions_value)
|
||||
|
||||
frame_data += struct.pack(
|
||||
FRAME_FORMAT,
|
||||
pos[0], pos[1], pos[2],
|
||||
rot[0], rot[1], rot[2], rot[3],
|
||||
actions_byte # Now guaranteed to be an integer
|
||||
)
|
||||
|
||||
return header_data + frame_data
|
||||
|
||||
if __name__ == "__main__":
|
||||
# --- Generate Mock Data ---
|
||||
MOCK_LEVEL_ID = 42
|
||||
|
||||
# Define a list of frame data (position, rotation, actions_byte)
|
||||
mock_frames = [
|
||||
# Frame 0: Start position, Idle
|
||||
{"position": (0.0, 1.0, 0.0), "actions_byte": PlayerActions.None_},
|
||||
# Frame 1: Moving Forward and Jumping
|
||||
{"position": (0.5, 1.0, 0.0), "actions_byte": PlayerActions.Forward | PlayerActions.Jump},
|
||||
# Frame 2: Moving Right
|
||||
{"position": (1.0, 1.0, 0.5), "actions_byte": PlayerActions.Right},
|
||||
# Frame 3: Collision and Taking Flag
|
||||
{"position": (10.0, 5.0, 10.0), "actions_byte": PlayerActions.Collision | PlayerActions.TakeFlag},
|
||||
]
|
||||
|
||||
#mock_binary_content = create_mock_replay_bytes(MOCK_LEVEL_ID, mock_frames)
|
||||
#MOCK_FILE_PATH = "mock_replay.bin"
|
||||
|
||||
# Write mock data to a file for the parser to read
|
||||
#print(f"Generating mock binary file: {MOCK_FILE_PATH}")
|
||||
#with open(MOCK_FILE_PATH, "wb") as f:
|
||||
#f.write(mock_binary_content)
|
||||
|
||||
# --- Run Parser on Mock File ---
|
||||
parsed_replay = parse_replay_file("./good_run_patched")
|
||||
|
||||
if parsed_replay:
|
||||
print("\n--- PARSED REPLAY DATA (SUMMARY) ---")
|
||||
print(f"File Version: {parsed_replay['version']}")
|
||||
print(f"Level ID: {parsed_replay['level_id']}")
|
||||
print(f"Total Frames: {len(parsed_replay['frames'])}")
|
||||
|
||||
print("\n--- SAMPLE FRAMES ---")
|
||||
for i in range(min(5, len(parsed_replay['frames']))):
|
||||
frame = parsed_replay['frames'][i]
|
||||
print(f"Frame {frame['frame_index']:<2} | Pos: ({frame['position']['x']:.2f}, {frame['position']['y']:.2f}, {frame['position']['z']:.2f}) | Actions: {frame['actions']}")
|
||||
|
||||
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Reference in New Issue
Block a user