pwn1: file format elf64-x86-64 Disassembly of section .init: 0000000000000768 <_init>: 768: 48 83 ec 08 sub rsp,0x8 76c: 48 8b 05 75 18 20 00 mov rax,QWORD PTR [rip+0x201875] # 201fe8 <__gmon_start__> 773: 48 85 c0 test rax,rax 776: 74 02 je 77a <_init+0x12> 778: ff d0 call rax 77a: 48 83 c4 08 add rsp,0x8 77e: c3 ret Disassembly of section .plt: 0000000000000780 <.plt>: 780: ff 35 fa 17 20 00 push QWORD PTR [rip+0x2017fa] # 201f80 <_GLOBAL_OFFSET_TABLE_+0x8> 786: ff 25 fc 17 20 00 jmp QWORD PTR [rip+0x2017fc] # 201f88 <_GLOBAL_OFFSET_TABLE_+0x10> 78c: 0f 1f 40 00 nop DWORD PTR [rax+0x0] 0000000000000790 <_exit@plt>: 790: ff 25 fa 17 20 00 jmp QWORD PTR [rip+0x2017fa] # 201f90 <_exit@GLIBC_2.2.5> 796: 68 00 00 00 00 push 0x0 79b: e9 e0 ff ff ff jmp 780 <.plt> 00000000000007a0 : 7a0: ff 25 f2 17 20 00 jmp QWORD PTR [rip+0x2017f2] # 201f98 7a6: 68 01 00 00 00 push 0x1 7ab: e9 d0 ff ff ff jmp 780 <.plt> 00000000000007b0 : 7b0: ff 25 ea 17 20 00 jmp QWORD PTR [rip+0x2017ea] # 201fa0 7b6: 68 02 00 00 00 push 0x2 7bb: e9 c0 ff ff ff jmp 780 <.plt> 00000000000007c0 : 7c0: ff 25 e2 17 20 00 jmp QWORD PTR [rip+0x2017e2] # 201fa8 7c6: 68 03 00 00 00 push 0x3 7cb: e9 b0 ff ff ff jmp 780 <.plt> 00000000000007d0 : 7d0: ff 25 da 17 20 00 jmp QWORD PTR [rip+0x2017da] # 201fb0 7d6: 68 04 00 00 00 push 0x4 7db: e9 a0 ff ff ff jmp 780 <.plt> 00000000000007e0 : 7e0: ff 25 d2 17 20 00 jmp QWORD PTR [rip+0x2017d2] # 201fb8 7e6: 68 05 00 00 00 push 0x5 7eb: e9 90 ff ff ff jmp 780 <.plt> 00000000000007f0 : 7f0: ff 25 ca 17 20 00 jmp QWORD PTR [rip+0x2017ca] # 201fc0 7f6: 68 06 00 00 00 push 0x6 7fb: e9 80 ff ff ff jmp 780 <.plt> 0000000000000800 : 800: ff 25 c2 17 20 00 jmp QWORD PTR [rip+0x2017c2] # 201fc8 806: 68 07 00 00 00 push 0x7 80b: e9 70 ff ff ff jmp 780 <.plt> 0000000000000810 : 810: ff 25 ba 17 20 00 jmp QWORD PTR [rip+0x2017ba] # 201fd0 816: 68 08 00 00 00 push 0x8 81b: e9 60 ff ff ff jmp 780 <.plt> Disassembly of section .plt.got: 0000000000000820 <__cxa_finalize@plt>: 820: ff 25 d2 17 20 00 jmp QWORD PTR [rip+0x2017d2] # 201ff8 <__cxa_finalize@GLIBC_2.2.5> 826: 66 90 xchg ax,ax Disassembly of section .text: 0000000000000830 <_start>: 830: 31 ed xor ebp,ebp 832: 49 89 d1 mov r9,rdx 835: 5e pop rsi 836: 48 89 e2 mov rdx,rsp 839: 48 83 e4 f0 and rsp,0xfffffffffffffff0 83d: 50 push rax 83e: 54 push rsp 83f: 4c 8d 05 5a 03 00 00 lea r8,[rip+0x35a] # ba0 <__libc_csu_fini> 846: 48 8d 0d e3 02 00 00 lea rcx,[rip+0x2e3] # b30 <__libc_csu_init> 84d: 48 8d 3d a0 02 00 00 lea rdi,[rip+0x2a0] # af4
854: ff 15 86 17 20 00 call QWORD PTR [rip+0x201786] # 201fe0 <__libc_start_main@GLIBC_2.2.5> 85a: f4 hlt 85b: 0f 1f 44 00 00 nop DWORD PTR [rax+rax*1+0x0] 0000000000000860 : 860: 48 8d 3d a9 17 20 00 lea rdi,[rip+0x2017a9] # 202010 <__TMC_END__> 867: 55 push rbp 868: 48 8d 05 a1 17 20 00 lea rax,[rip+0x2017a1] # 202010 <__TMC_END__> 86f: 48 39 f8 cmp rax,rdi 872: 48 89 e5 mov rbp,rsp 875: 74 19 je 890 877: 48 8b 05 5a 17 20 00 mov rax,QWORD PTR [rip+0x20175a] # 201fd8 <_ITM_deregisterTMCloneTable> 87e: 48 85 c0 test rax,rax 881: 74 0d je 890 883: 5d pop rbp 884: ff e0 jmp rax 886: 66 2e 0f 1f 84 00 00 cs nop WORD PTR [rax+rax*1+0x0] 88d: 00 00 00 890: 5d pop rbp 891: c3 ret 892: 0f 1f 40 00 nop DWORD PTR [rax+0x0] 896: 66 2e 0f 1f 84 00 00 cs nop WORD PTR [rax+rax*1+0x0] 89d: 00 00 00 00000000000008a0 : 8a0: 48 8d 3d 69 17 20 00 lea rdi,[rip+0x201769] # 202010 <__TMC_END__> 8a7: 48 8d 35 62 17 20 00 lea rsi,[rip+0x201762] # 202010 <__TMC_END__> 8ae: 55 push rbp 8af: 48 29 fe sub rsi,rdi 8b2: 48 89 e5 mov rbp,rsp 8b5: 48 c1 fe 03 sar rsi,0x3 8b9: 48 89 f0 mov rax,rsi 8bc: 48 c1 e8 3f shr rax,0x3f 8c0: 48 01 c6 add rsi,rax 8c3: 48 d1 fe sar rsi,1 8c6: 74 18 je 8e0 8c8: 48 8b 05 21 17 20 00 mov rax,QWORD PTR [rip+0x201721] # 201ff0 <_ITM_registerTMCloneTable> 8cf: 48 85 c0 test rax,rax 8d2: 74 0c je 8e0 8d4: 5d pop rbp 8d5: ff e0 jmp rax 8d7: 66 0f 1f 84 00 00 00 nop WORD PTR [rax+rax*1+0x0] 8de: 00 00 8e0: 5d pop rbp 8e1: c3 ret 8e2: 0f 1f 40 00 nop DWORD PTR [rax+0x0] 8e6: 66 2e 0f 1f 84 00 00 cs nop WORD PTR [rax+rax*1+0x0] 8ed: 00 00 00 00000000000008f0 <__do_global_dtors_aux>: 8f0: 80 3d 51 17 20 00 00 cmp BYTE PTR [rip+0x201751],0x0 # 202048 8f7: 75 2f jne 928 <__do_global_dtors_aux+0x38> 8f9: 48 83 3d f7 16 20 00 cmp QWORD PTR [rip+0x2016f7],0x0 # 201ff8 <__cxa_finalize@GLIBC_2.2.5> 900: 00 901: 55 push rbp 902: 48 89 e5 mov rbp,rsp 905: 74 0c je 913 <__do_global_dtors_aux+0x23> 907: 48 8b 3d fa 16 20 00 mov rdi,QWORD PTR [rip+0x2016fa] # 202008 <__dso_handle> 90e: e8 0d ff ff ff call 820 <__cxa_finalize@plt> 913: e8 48 ff ff ff call 860 918: c6 05 29 17 20 00 01 mov BYTE PTR [rip+0x201729],0x1 # 202048 91f: 5d pop rbp 920: c3 ret 921: 0f 1f 80 00 00 00 00 nop DWORD PTR [rax+0x0] 928: f3 c3 repz ret 92a: 66 0f 1f 44 00 00 nop WORD PTR [rax+rax*1+0x0] 0000000000000930 : 930: 55 push rbp 931: 48 89 e5 mov rbp,rsp 934: 5d pop rbp 935: e9 66 ff ff ff jmp 8a0 000000000000093a : 93a: 55 push rbp 93b: 48 89 e5 mov rbp,rsp 93e: 48 8b 05 db 16 20 00 mov rax,QWORD PTR [rip+0x2016db] # 202020 945: b9 00 00 00 00 mov ecx,0x0 94a: ba 02 00 00 00 mov edx,0x2 94f: be 00 00 00 00 mov esi,0x0 954: 48 89 c7 mov rdi,rax 957: e8 b4 fe ff ff call 810 95c: 48 8b 05 cd 16 20 00 mov rax,QWORD PTR [rip+0x2016cd] # 202030 963: b9 00 00 00 00 mov ecx,0x0 968: ba 02 00 00 00 mov edx,0x2 96d: be 00 00 00 00 mov esi,0x0 972: 48 89 c7 mov rdi,rax 975: e8 96 fe ff ff call 810 97a: 48 8b 05 bf 16 20 00 mov rax,QWORD PTR [rip+0x2016bf] # 202040 981: b9 00 00 00 00 mov ecx,0x0 986: ba 02 00 00 00 mov edx,0x2 98b: be 00 00 00 00 mov esi,0x0 990: 48 89 c7 mov rdi,rax 993: e8 78 fe ff ff call 810 998: 90 nop 999: 5d pop rbp 99a: c3 ret 000000000000099b : 99b: 55 push rbp 99c: 48 89 e5 mov rbp,rsp 99f: 48 83 ec 10 sub rsp,0x10 9a3: 89 7d fc mov DWORD PTR [rbp-0x4],edi 9a6: 83 7d fc 0e cmp DWORD PTR [rbp-0x4],0xe 9aa: 75 1b jne 9c7 9ac: 48 8d 3d 05 02 00 00 lea rdi,[rip+0x205] # bb8 <_IO_stdin_used+0x8> 9b3: b8 00 00 00 00 mov eax,0x0 9b8: e8 03 fe ff ff call 7c0 9bd: bf 00 00 00 00 mov edi,0x0 9c2: e8 c9 fd ff ff call 790 <_exit@plt> 9c7: 90 nop 9c8: c9 leave 9c9: c3 ret 00000000000009ca : 9ca: 55 push rbp 9cb: 48 89 e5 mov rbp,rsp 9ce: 48 8d 35 c6 ff ff ff lea rsi,[rip+0xffffffffffffffc6] # 99b 9d5: bf 0e 00 00 00 mov edi,0xe 9da: e8 11 fe ff ff call 7f0 9df: bf 3c 00 00 00 mov edi,0x3c 9e4: e8 e7 fd ff ff call 7d0 9e9: 90 nop 9ea: 5d pop rbp 9eb: c3 ret 00000000000009ec : 9ec: 55 push rbp 9ed: 48 89 e5 mov rbp,rsp 9f0: 48 8d 3d f1 01 00 00 lea rdi,[rip+0x1f1] # be8 <_IO_stdin_used+0x38> 9f7: e8 a4 fd ff ff call 7a0 9fc: 48 8d 3d 31 02 00 00 lea rdi,[rip+0x231] # c34 <_IO_stdin_used+0x84> a03: e8 98 fd ff ff call 7a0 a08: 48 8d 3d 49 02 00 00 lea rdi,[rip+0x249] # c58 <_IO_stdin_used+0xa8> a0f: e8 8c fd ff ff call 7a0 a14: 48 8d 3d 89 02 00 00 lea rdi,[rip+0x289] # ca4 <_IO_stdin_used+0xf4> a1b: e8 90 fd ff ff call 7b0 a20: 90 nop a21: 5d pop rbp a22: c3 ret 0000000000000a23 : a23: 55 push rbp a24: 48 89 e5 mov rbp,rsp a27: 48 81 ec 00 01 00 00 sub rsp,0x100 a2e: 48 8d 3d 77 02 00 00 lea rdi,[rip+0x277] # cac <_IO_stdin_used+0xfc> a35: e8 66 fd ff ff call 7a0 a3a: 48 8d 85 00 ff ff ff lea rax,[rbp-0x100] a41: 48 89 c7 mov rdi,rax a44: b8 00 00 00 00 mov eax,0x0 a49: e8 b2 fd ff ff call 800 a4e: 48 8d 3d 93 01 00 00 lea rdi,[rip+0x193] # be8 <_IO_stdin_used+0x38> a55: e8 46 fd ff ff call 7a0 a5a: 48 8d 3d 62 02 00 00 lea rdi,[rip+0x262] # cc3 <_IO_stdin_used+0x113> a61: e8 3a fd ff ff call 7a0 a66: 48 8d 3d eb 01 00 00 lea rdi,[rip+0x1eb] # c58 <_IO_stdin_used+0xa8> a6d: e8 2e fd ff ff call 7a0 a72: 48 8d 85 00 ff ff ff lea rax,[rbp-0x100] a79: 48 89 c7 mov rdi,rax a7c: b8 00 00 00 00 mov eax,0x0 a81: e8 3a fd ff ff call 7c0 a86: 90 nop a87: c9 leave a88: c3 ret 0000000000000a89 : a89: 55 push rbp a8a: 48 89 e5 mov rbp,rsp a8d: 48 81 ec 00 01 00 00 sub rsp,0x100 a94: 48 8d 3d 46 02 00 00 lea rdi,[rip+0x246] # ce1 <_IO_stdin_used+0x131> a9b: e8 00 fd ff ff call 7a0 aa0: 48 8d 85 00 ff ff ff lea rax,[rbp-0x100] aa7: 48 89 c7 mov rdi,rax aaa: b8 00 00 00 00 mov eax,0x0 aaf: e8 4c fd ff ff call 800 ab4: 48 8d 85 00 ff ff ff lea rax,[rbp-0x100] abb: 48 8d 35 38 02 00 00 lea rsi,[rip+0x238] # cfa <_IO_stdin_used+0x14a> ac2: 48 89 c7 mov rdi,rax ac5: e8 16 fd ff ff call 7e0 aca: 85 c0 test eax,eax acc: 75 0e jne adc ace: 48 8d 3d 32 02 00 00 lea rdi,[rip+0x232] # d07 <_IO_stdin_used+0x157> ad5: e8 c6 fc ff ff call 7a0 ada: eb 16 jmp af2 adc: 48 8d 3d 2f 02 00 00 lea rdi,[rip+0x22f] # d12 <_IO_stdin_used+0x162> ae3: e8 b8 fc ff ff call 7a0 ae8: bf 00 00 00 00 mov edi,0x0 aed: e8 9e fc ff ff call 790 <_exit@plt> af2: c9 leave af3: c3 ret 0000000000000af4
: af4: 55 push rbp af5: 48 89 e5 mov rbp,rsp af8: 48 83 ec 10 sub rsp,0x10 afc: 89 7d fc mov DWORD PTR [rbp-0x4],edi aff: 48 89 75 f0 mov QWORD PTR [rbp-0x10],rsi b03: b8 00 00 00 00 mov eax,0x0 b08: e8 2d fe ff ff call 93a b0d: b8 00 00 00 00 mov eax,0x0 b12: e8 b3 fe ff ff call 9ca b17: b8 00 00 00 00 mov eax,0x0 b1c: e8 02 ff ff ff call a23 b21: b8 00 00 00 00 mov eax,0x0 b26: e8 5e ff ff ff call a89 b2b: 90 nop b2c: c9 leave b2d: c3 ret b2e: 66 90 xchg ax,ax 0000000000000b30 <__libc_csu_init>: b30: 41 57 push r15 b32: 41 56 push r14 b34: 49 89 d7 mov r15,rdx b37: 41 55 push r13 b39: 41 54 push r12 b3b: 4c 8d 25 36 12 20 00 lea r12,[rip+0x201236] # 201d78 <__frame_dummy_init_array_entry> b42: 55 push rbp b43: 48 8d 2d 36 12 20 00 lea rbp,[rip+0x201236] # 201d80 <__do_global_dtors_aux_fini_array_entry> b4a: 53 push rbx b4b: 41 89 fd mov r13d,edi b4e: 49 89 f6 mov r14,rsi b51: 4c 29 e5 sub rbp,r12 b54: 48 83 ec 08 sub rsp,0x8 b58: 48 c1 fd 03 sar rbp,0x3 b5c: e8 07 fc ff ff call 768 <_init> b61: 48 85 ed test rbp,rbp b64: 74 20 je b86 <__libc_csu_init+0x56> b66: 31 db xor ebx,ebx b68: 0f 1f 84 00 00 00 00 nop DWORD PTR [rax+rax*1+0x0] b6f: 00 b70: 4c 89 fa mov rdx,r15 b73: 4c 89 f6 mov rsi,r14 b76: 44 89 ef mov edi,r13d b79: 41 ff 14 dc call QWORD PTR [r12+rbx*8] b7d: 48 83 c3 01 add rbx,0x1 b81: 48 39 dd cmp rbp,rbx b84: 75 ea jne b70 <__libc_csu_init+0x40> b86: 48 83 c4 08 add rsp,0x8 b8a: 5b pop rbx b8b: 5d pop rbp b8c: 41 5c pop r12 b8e: 41 5d pop r13 b90: 41 5e pop r14 b92: 41 5f pop r15 b94: c3 ret b95: 90 nop b96: 66 2e 0f 1f 84 00 00 cs nop WORD PTR [rax+rax*1+0x0] b9d: 00 00 00 0000000000000ba0 <__libc_csu_fini>: ba0: f3 c3 repz ret Disassembly of section .fini: 0000000000000ba4 <_fini>: ba4: 48 83 ec 08 sub rsp,0x8 ba8: 48 83 c4 08 add rsp,0x8 bac: c3 ret