346 lines
15 KiB
Plaintext
346 lines
15 KiB
Plaintext
|
|
pwn1: file format elf64-x86-64
|
|
|
|
|
|
Disassembly of section .init:
|
|
|
|
0000000000000768 <_init>:
|
|
768: 48 83 ec 08 sub rsp,0x8
|
|
76c: 48 8b 05 75 18 20 00 mov rax,QWORD PTR [rip+0x201875] # 201fe8 <__gmon_start__>
|
|
773: 48 85 c0 test rax,rax
|
|
776: 74 02 je 77a <_init+0x12>
|
|
778: ff d0 call rax
|
|
77a: 48 83 c4 08 add rsp,0x8
|
|
77e: c3 ret
|
|
|
|
Disassembly of section .plt:
|
|
|
|
0000000000000780 <.plt>:
|
|
780: ff 35 fa 17 20 00 push QWORD PTR [rip+0x2017fa] # 201f80 <_GLOBAL_OFFSET_TABLE_+0x8>
|
|
786: ff 25 fc 17 20 00 jmp QWORD PTR [rip+0x2017fc] # 201f88 <_GLOBAL_OFFSET_TABLE_+0x10>
|
|
78c: 0f 1f 40 00 nop DWORD PTR [rax+0x0]
|
|
|
|
0000000000000790 <_exit@plt>:
|
|
790: ff 25 fa 17 20 00 jmp QWORD PTR [rip+0x2017fa] # 201f90 <_exit@GLIBC_2.2.5>
|
|
796: 68 00 00 00 00 push 0x0
|
|
79b: e9 e0 ff ff ff jmp 780 <.plt>
|
|
|
|
00000000000007a0 <puts@plt>:
|
|
7a0: ff 25 f2 17 20 00 jmp QWORD PTR [rip+0x2017f2] # 201f98 <puts@GLIBC_2.2.5>
|
|
7a6: 68 01 00 00 00 push 0x1
|
|
7ab: e9 d0 ff ff ff jmp 780 <.plt>
|
|
|
|
00000000000007b0 <system@plt>:
|
|
7b0: ff 25 ea 17 20 00 jmp QWORD PTR [rip+0x2017ea] # 201fa0 <system@GLIBC_2.2.5>
|
|
7b6: 68 02 00 00 00 push 0x2
|
|
7bb: e9 c0 ff ff ff jmp 780 <.plt>
|
|
|
|
00000000000007c0 <printf@plt>:
|
|
7c0: ff 25 e2 17 20 00 jmp QWORD PTR [rip+0x2017e2] # 201fa8 <printf@GLIBC_2.2.5>
|
|
7c6: 68 03 00 00 00 push 0x3
|
|
7cb: e9 b0 ff ff ff jmp 780 <.plt>
|
|
|
|
00000000000007d0 <alarm@plt>:
|
|
7d0: ff 25 da 17 20 00 jmp QWORD PTR [rip+0x2017da] # 201fb0 <alarm@GLIBC_2.2.5>
|
|
7d6: 68 04 00 00 00 push 0x4
|
|
7db: e9 a0 ff ff ff jmp 780 <.plt>
|
|
|
|
00000000000007e0 <strcmp@plt>:
|
|
7e0: ff 25 d2 17 20 00 jmp QWORD PTR [rip+0x2017d2] # 201fb8 <strcmp@GLIBC_2.2.5>
|
|
7e6: 68 05 00 00 00 push 0x5
|
|
7eb: e9 90 ff ff ff jmp 780 <.plt>
|
|
|
|
00000000000007f0 <signal@plt>:
|
|
7f0: ff 25 ca 17 20 00 jmp QWORD PTR [rip+0x2017ca] # 201fc0 <signal@GLIBC_2.2.5>
|
|
7f6: 68 06 00 00 00 push 0x6
|
|
7fb: e9 80 ff ff ff jmp 780 <.plt>
|
|
|
|
0000000000000800 <gets@plt>:
|
|
800: ff 25 c2 17 20 00 jmp QWORD PTR [rip+0x2017c2] # 201fc8 <gets@GLIBC_2.2.5>
|
|
806: 68 07 00 00 00 push 0x7
|
|
80b: e9 70 ff ff ff jmp 780 <.plt>
|
|
|
|
0000000000000810 <setvbuf@plt>:
|
|
810: ff 25 ba 17 20 00 jmp QWORD PTR [rip+0x2017ba] # 201fd0 <setvbuf@GLIBC_2.2.5>
|
|
816: 68 08 00 00 00 push 0x8
|
|
81b: e9 60 ff ff ff jmp 780 <.plt>
|
|
|
|
Disassembly of section .plt.got:
|
|
|
|
0000000000000820 <__cxa_finalize@plt>:
|
|
820: ff 25 d2 17 20 00 jmp QWORD PTR [rip+0x2017d2] # 201ff8 <__cxa_finalize@GLIBC_2.2.5>
|
|
826: 66 90 xchg ax,ax
|
|
|
|
Disassembly of section .text:
|
|
|
|
0000000000000830 <_start>:
|
|
830: 31 ed xor ebp,ebp
|
|
832: 49 89 d1 mov r9,rdx
|
|
835: 5e pop rsi
|
|
836: 48 89 e2 mov rdx,rsp
|
|
839: 48 83 e4 f0 and rsp,0xfffffffffffffff0
|
|
83d: 50 push rax
|
|
83e: 54 push rsp
|
|
83f: 4c 8d 05 5a 03 00 00 lea r8,[rip+0x35a] # ba0 <__libc_csu_fini>
|
|
846: 48 8d 0d e3 02 00 00 lea rcx,[rip+0x2e3] # b30 <__libc_csu_init>
|
|
84d: 48 8d 3d a0 02 00 00 lea rdi,[rip+0x2a0] # af4 <main>
|
|
854: ff 15 86 17 20 00 call QWORD PTR [rip+0x201786] # 201fe0 <__libc_start_main@GLIBC_2.2.5>
|
|
85a: f4 hlt
|
|
85b: 0f 1f 44 00 00 nop DWORD PTR [rax+rax*1+0x0]
|
|
|
|
0000000000000860 <deregister_tm_clones>:
|
|
860: 48 8d 3d a9 17 20 00 lea rdi,[rip+0x2017a9] # 202010 <__TMC_END__>
|
|
867: 55 push rbp
|
|
868: 48 8d 05 a1 17 20 00 lea rax,[rip+0x2017a1] # 202010 <__TMC_END__>
|
|
86f: 48 39 f8 cmp rax,rdi
|
|
872: 48 89 e5 mov rbp,rsp
|
|
875: 74 19 je 890 <deregister_tm_clones+0x30>
|
|
877: 48 8b 05 5a 17 20 00 mov rax,QWORD PTR [rip+0x20175a] # 201fd8 <_ITM_deregisterTMCloneTable>
|
|
87e: 48 85 c0 test rax,rax
|
|
881: 74 0d je 890 <deregister_tm_clones+0x30>
|
|
883: 5d pop rbp
|
|
884: ff e0 jmp rax
|
|
886: 66 2e 0f 1f 84 00 00 cs nop WORD PTR [rax+rax*1+0x0]
|
|
88d: 00 00 00
|
|
890: 5d pop rbp
|
|
891: c3 ret
|
|
892: 0f 1f 40 00 nop DWORD PTR [rax+0x0]
|
|
896: 66 2e 0f 1f 84 00 00 cs nop WORD PTR [rax+rax*1+0x0]
|
|
89d: 00 00 00
|
|
|
|
00000000000008a0 <register_tm_clones>:
|
|
8a0: 48 8d 3d 69 17 20 00 lea rdi,[rip+0x201769] # 202010 <__TMC_END__>
|
|
8a7: 48 8d 35 62 17 20 00 lea rsi,[rip+0x201762] # 202010 <__TMC_END__>
|
|
8ae: 55 push rbp
|
|
8af: 48 29 fe sub rsi,rdi
|
|
8b2: 48 89 e5 mov rbp,rsp
|
|
8b5: 48 c1 fe 03 sar rsi,0x3
|
|
8b9: 48 89 f0 mov rax,rsi
|
|
8bc: 48 c1 e8 3f shr rax,0x3f
|
|
8c0: 48 01 c6 add rsi,rax
|
|
8c3: 48 d1 fe sar rsi,1
|
|
8c6: 74 18 je 8e0 <register_tm_clones+0x40>
|
|
8c8: 48 8b 05 21 17 20 00 mov rax,QWORD PTR [rip+0x201721] # 201ff0 <_ITM_registerTMCloneTable>
|
|
8cf: 48 85 c0 test rax,rax
|
|
8d2: 74 0c je 8e0 <register_tm_clones+0x40>
|
|
8d4: 5d pop rbp
|
|
8d5: ff e0 jmp rax
|
|
8d7: 66 0f 1f 84 00 00 00 nop WORD PTR [rax+rax*1+0x0]
|
|
8de: 00 00
|
|
8e0: 5d pop rbp
|
|
8e1: c3 ret
|
|
8e2: 0f 1f 40 00 nop DWORD PTR [rax+0x0]
|
|
8e6: 66 2e 0f 1f 84 00 00 cs nop WORD PTR [rax+rax*1+0x0]
|
|
8ed: 00 00 00
|
|
|
|
00000000000008f0 <__do_global_dtors_aux>:
|
|
8f0: 80 3d 51 17 20 00 00 cmp BYTE PTR [rip+0x201751],0x0 # 202048 <completed.7698>
|
|
8f7: 75 2f jne 928 <__do_global_dtors_aux+0x38>
|
|
8f9: 48 83 3d f7 16 20 00 cmp QWORD PTR [rip+0x2016f7],0x0 # 201ff8 <__cxa_finalize@GLIBC_2.2.5>
|
|
900: 00
|
|
901: 55 push rbp
|
|
902: 48 89 e5 mov rbp,rsp
|
|
905: 74 0c je 913 <__do_global_dtors_aux+0x23>
|
|
907: 48 8b 3d fa 16 20 00 mov rdi,QWORD PTR [rip+0x2016fa] # 202008 <__dso_handle>
|
|
90e: e8 0d ff ff ff call 820 <__cxa_finalize@plt>
|
|
913: e8 48 ff ff ff call 860 <deregister_tm_clones>
|
|
918: c6 05 29 17 20 00 01 mov BYTE PTR [rip+0x201729],0x1 # 202048 <completed.7698>
|
|
91f: 5d pop rbp
|
|
920: c3 ret
|
|
921: 0f 1f 80 00 00 00 00 nop DWORD PTR [rax+0x0]
|
|
928: f3 c3 repz ret
|
|
92a: 66 0f 1f 44 00 00 nop WORD PTR [rax+rax*1+0x0]
|
|
|
|
0000000000000930 <frame_dummy>:
|
|
930: 55 push rbp
|
|
931: 48 89 e5 mov rbp,rsp
|
|
934: 5d pop rbp
|
|
935: e9 66 ff ff ff jmp 8a0 <register_tm_clones>
|
|
|
|
000000000000093a <ignore_me_init_buffering>:
|
|
93a: 55 push rbp
|
|
93b: 48 89 e5 mov rbp,rsp
|
|
93e: 48 8b 05 db 16 20 00 mov rax,QWORD PTR [rip+0x2016db] # 202020 <stdout@GLIBC_2.2.5>
|
|
945: b9 00 00 00 00 mov ecx,0x0
|
|
94a: ba 02 00 00 00 mov edx,0x2
|
|
94f: be 00 00 00 00 mov esi,0x0
|
|
954: 48 89 c7 mov rdi,rax
|
|
957: e8 b4 fe ff ff call 810 <setvbuf@plt>
|
|
95c: 48 8b 05 cd 16 20 00 mov rax,QWORD PTR [rip+0x2016cd] # 202030 <stdin@GLIBC_2.2.5>
|
|
963: b9 00 00 00 00 mov ecx,0x0
|
|
968: ba 02 00 00 00 mov edx,0x2
|
|
96d: be 00 00 00 00 mov esi,0x0
|
|
972: 48 89 c7 mov rdi,rax
|
|
975: e8 96 fe ff ff call 810 <setvbuf@plt>
|
|
97a: 48 8b 05 bf 16 20 00 mov rax,QWORD PTR [rip+0x2016bf] # 202040 <stderr@GLIBC_2.2.5>
|
|
981: b9 00 00 00 00 mov ecx,0x0
|
|
986: ba 02 00 00 00 mov edx,0x2
|
|
98b: be 00 00 00 00 mov esi,0x0
|
|
990: 48 89 c7 mov rdi,rax
|
|
993: e8 78 fe ff ff call 810 <setvbuf@plt>
|
|
998: 90 nop
|
|
999: 5d pop rbp
|
|
99a: c3 ret
|
|
|
|
000000000000099b <kill_on_timeout>:
|
|
99b: 55 push rbp
|
|
99c: 48 89 e5 mov rbp,rsp
|
|
99f: 48 83 ec 10 sub rsp,0x10
|
|
9a3: 89 7d fc mov DWORD PTR [rbp-0x4],edi
|
|
9a6: 83 7d fc 0e cmp DWORD PTR [rbp-0x4],0xe
|
|
9aa: 75 1b jne 9c7 <kill_on_timeout+0x2c>
|
|
9ac: 48 8d 3d 05 02 00 00 lea rdi,[rip+0x205] # bb8 <_IO_stdin_used+0x8>
|
|
9b3: b8 00 00 00 00 mov eax,0x0
|
|
9b8: e8 03 fe ff ff call 7c0 <printf@plt>
|
|
9bd: bf 00 00 00 00 mov edi,0x0
|
|
9c2: e8 c9 fd ff ff call 790 <_exit@plt>
|
|
9c7: 90 nop
|
|
9c8: c9 leave
|
|
9c9: c3 ret
|
|
|
|
00000000000009ca <ignore_me_init_signal>:
|
|
9ca: 55 push rbp
|
|
9cb: 48 89 e5 mov rbp,rsp
|
|
9ce: 48 8d 35 c6 ff ff ff lea rsi,[rip+0xffffffffffffffc6] # 99b <kill_on_timeout>
|
|
9d5: bf 0e 00 00 00 mov edi,0xe
|
|
9da: e8 11 fe ff ff call 7f0 <signal@plt>
|
|
9df: bf 3c 00 00 00 mov edi,0x3c
|
|
9e4: e8 e7 fd ff ff call 7d0 <alarm@plt>
|
|
9e9: 90 nop
|
|
9ea: 5d pop rbp
|
|
9eb: c3 ret
|
|
|
|
00000000000009ec <WINgardium_leviosa>:
|
|
9ec: 55 push rbp
|
|
9ed: 48 89 e5 mov rbp,rsp
|
|
9f0: 48 8d 3d f1 01 00 00 lea rdi,[rip+0x1f1] # be8 <_IO_stdin_used+0x38>
|
|
9f7: e8 a4 fd ff ff call 7a0 <puts@plt>
|
|
9fc: 48 8d 3d 31 02 00 00 lea rdi,[rip+0x231] # c34 <_IO_stdin_used+0x84>
|
|
a03: e8 98 fd ff ff call 7a0 <puts@plt>
|
|
a08: 48 8d 3d 49 02 00 00 lea rdi,[rip+0x249] # c58 <_IO_stdin_used+0xa8>
|
|
a0f: e8 8c fd ff ff call 7a0 <puts@plt>
|
|
a14: 48 8d 3d 89 02 00 00 lea rdi,[rip+0x289] # ca4 <_IO_stdin_used+0xf4>
|
|
a1b: e8 90 fd ff ff call 7b0 <system@plt>
|
|
a20: 90 nop
|
|
a21: 5d pop rbp
|
|
a22: c3 ret
|
|
|
|
0000000000000a23 <welcome>:
|
|
a23: 55 push rbp
|
|
a24: 48 89 e5 mov rbp,rsp
|
|
a27: 48 81 ec 00 01 00 00 sub rsp,0x100
|
|
a2e: 48 8d 3d 77 02 00 00 lea rdi,[rip+0x277] # cac <_IO_stdin_used+0xfc>
|
|
a35: e8 66 fd ff ff call 7a0 <puts@plt>
|
|
a3a: 48 8d 85 00 ff ff ff lea rax,[rbp-0x100]
|
|
a41: 48 89 c7 mov rdi,rax
|
|
a44: b8 00 00 00 00 mov eax,0x0
|
|
a49: e8 b2 fd ff ff call 800 <gets@plt>
|
|
a4e: 48 8d 3d 93 01 00 00 lea rdi,[rip+0x193] # be8 <_IO_stdin_used+0x38>
|
|
a55: e8 46 fd ff ff call 7a0 <puts@plt>
|
|
a5a: 48 8d 3d 62 02 00 00 lea rdi,[rip+0x262] # cc3 <_IO_stdin_used+0x113>
|
|
a61: e8 3a fd ff ff call 7a0 <puts@plt>
|
|
a66: 48 8d 3d eb 01 00 00 lea rdi,[rip+0x1eb] # c58 <_IO_stdin_used+0xa8>
|
|
a6d: e8 2e fd ff ff call 7a0 <puts@plt>
|
|
a72: 48 8d 85 00 ff ff ff lea rax,[rbp-0x100]
|
|
a79: 48 89 c7 mov rdi,rax
|
|
a7c: b8 00 00 00 00 mov eax,0x0
|
|
a81: e8 3a fd ff ff call 7c0 <printf@plt>
|
|
a86: 90 nop
|
|
a87: c9 leave
|
|
a88: c3 ret
|
|
|
|
0000000000000a89 <AAAAAAAA>:
|
|
a89: 55 push rbp
|
|
a8a: 48 89 e5 mov rbp,rsp
|
|
a8d: 48 81 ec 00 01 00 00 sub rsp,0x100
|
|
a94: 48 8d 3d 46 02 00 00 lea rdi,[rip+0x246] # ce1 <_IO_stdin_used+0x131>
|
|
a9b: e8 00 fd ff ff call 7a0 <puts@plt>
|
|
aa0: 48 8d 85 00 ff ff ff lea rax,[rbp-0x100]
|
|
aa7: 48 89 c7 mov rdi,rax
|
|
aaa: b8 00 00 00 00 mov eax,0x0
|
|
aaf: e8 4c fd ff ff call 800 <gets@plt>
|
|
ab4: 48 8d 85 00 ff ff ff lea rax,[rbp-0x100]
|
|
abb: 48 8d 35 38 02 00 00 lea rsi,[rip+0x238] # cfa <_IO_stdin_used+0x14a>
|
|
ac2: 48 89 c7 mov rdi,rax
|
|
ac5: e8 16 fd ff ff call 7e0 <strcmp@plt>
|
|
aca: 85 c0 test eax,eax
|
|
acc: 75 0e jne adc <AAAAAAAA+0x53>
|
|
ace: 48 8d 3d 32 02 00 00 lea rdi,[rip+0x232] # d07 <_IO_stdin_used+0x157>
|
|
ad5: e8 c6 fc ff ff call 7a0 <puts@plt>
|
|
ada: eb 16 jmp af2 <AAAAAAAA+0x69>
|
|
adc: 48 8d 3d 2f 02 00 00 lea rdi,[rip+0x22f] # d12 <_IO_stdin_used+0x162>
|
|
ae3: e8 b8 fc ff ff call 7a0 <puts@plt>
|
|
ae8: bf 00 00 00 00 mov edi,0x0
|
|
aed: e8 9e fc ff ff call 790 <_exit@plt>
|
|
af2: c9 leave
|
|
af3: c3 ret
|
|
|
|
0000000000000af4 <main>:
|
|
af4: 55 push rbp
|
|
af5: 48 89 e5 mov rbp,rsp
|
|
af8: 48 83 ec 10 sub rsp,0x10
|
|
afc: 89 7d fc mov DWORD PTR [rbp-0x4],edi
|
|
aff: 48 89 75 f0 mov QWORD PTR [rbp-0x10],rsi
|
|
b03: b8 00 00 00 00 mov eax,0x0
|
|
b08: e8 2d fe ff ff call 93a <ignore_me_init_buffering>
|
|
b0d: b8 00 00 00 00 mov eax,0x0
|
|
b12: e8 b3 fe ff ff call 9ca <ignore_me_init_signal>
|
|
b17: b8 00 00 00 00 mov eax,0x0
|
|
b1c: e8 02 ff ff ff call a23 <welcome>
|
|
b21: b8 00 00 00 00 mov eax,0x0
|
|
b26: e8 5e ff ff ff call a89 <AAAAAAAA>
|
|
b2b: 90 nop
|
|
b2c: c9 leave
|
|
b2d: c3 ret
|
|
b2e: 66 90 xchg ax,ax
|
|
|
|
0000000000000b30 <__libc_csu_init>:
|
|
b30: 41 57 push r15
|
|
b32: 41 56 push r14
|
|
b34: 49 89 d7 mov r15,rdx
|
|
b37: 41 55 push r13
|
|
b39: 41 54 push r12
|
|
b3b: 4c 8d 25 36 12 20 00 lea r12,[rip+0x201236] # 201d78 <__frame_dummy_init_array_entry>
|
|
b42: 55 push rbp
|
|
b43: 48 8d 2d 36 12 20 00 lea rbp,[rip+0x201236] # 201d80 <__do_global_dtors_aux_fini_array_entry>
|
|
b4a: 53 push rbx
|
|
b4b: 41 89 fd mov r13d,edi
|
|
b4e: 49 89 f6 mov r14,rsi
|
|
b51: 4c 29 e5 sub rbp,r12
|
|
b54: 48 83 ec 08 sub rsp,0x8
|
|
b58: 48 c1 fd 03 sar rbp,0x3
|
|
b5c: e8 07 fc ff ff call 768 <_init>
|
|
b61: 48 85 ed test rbp,rbp
|
|
b64: 74 20 je b86 <__libc_csu_init+0x56>
|
|
b66: 31 db xor ebx,ebx
|
|
b68: 0f 1f 84 00 00 00 00 nop DWORD PTR [rax+rax*1+0x0]
|
|
b6f: 00
|
|
b70: 4c 89 fa mov rdx,r15
|
|
b73: 4c 89 f6 mov rsi,r14
|
|
b76: 44 89 ef mov edi,r13d
|
|
b79: 41 ff 14 dc call QWORD PTR [r12+rbx*8]
|
|
b7d: 48 83 c3 01 add rbx,0x1
|
|
b81: 48 39 dd cmp rbp,rbx
|
|
b84: 75 ea jne b70 <__libc_csu_init+0x40>
|
|
b86: 48 83 c4 08 add rsp,0x8
|
|
b8a: 5b pop rbx
|
|
b8b: 5d pop rbp
|
|
b8c: 41 5c pop r12
|
|
b8e: 41 5d pop r13
|
|
b90: 41 5e pop r14
|
|
b92: 41 5f pop r15
|
|
b94: c3 ret
|
|
b95: 90 nop
|
|
b96: 66 2e 0f 1f 84 00 00 cs nop WORD PTR [rax+rax*1+0x0]
|
|
b9d: 00 00 00
|
|
|
|
0000000000000ba0 <__libc_csu_fini>:
|
|
ba0: f3 c3 repz ret
|
|
|
|
Disassembly of section .fini:
|
|
|
|
0000000000000ba4 <_fini>:
|
|
ba4: 48 83 ec 08 sub rsp,0x8
|
|
ba8: 48 83 c4 08 add rsp,0x8
|
|
bac: c3 ret
|