225 lines
10 KiB
Plaintext
225 lines
10 KiB
Plaintext
|
|
intro-fmt: file format elf64-x86-64
|
|
|
|
|
|
Disassembly of section .init:
|
|
|
|
0000000000401000 <_init>:
|
|
401000: 48 83 ec 08 sub rsp,0x8
|
|
401004: 48 8b 05 d5 2f 00 00 mov rax,QWORD PTR [rip+0x2fd5] # 403fe0 <__gmon_start__@Base>
|
|
40100b: 48 85 c0 test rax,rax
|
|
40100e: 74 02 je 401012 <_init+0x12>
|
|
401010: ff d0 call rax
|
|
401012: 48 83 c4 08 add rsp,0x8
|
|
401016: c3 ret
|
|
|
|
Disassembly of section .plt:
|
|
|
|
0000000000401020 <puts@plt-0x10>:
|
|
401020: ff 35 ca 2f 00 00 push QWORD PTR [rip+0x2fca] # 403ff0 <_GLOBAL_OFFSET_TABLE_+0x8>
|
|
401026: ff 25 cc 2f 00 00 jmp QWORD PTR [rip+0x2fcc] # 403ff8 <_GLOBAL_OFFSET_TABLE_+0x10>
|
|
40102c: 0f 1f 40 00 nop DWORD PTR [rax+0x0]
|
|
|
|
0000000000401030 <puts@plt>:
|
|
401030: ff 25 ca 2f 00 00 jmp QWORD PTR [rip+0x2fca] # 404000 <puts@GLIBC_2.2.5>
|
|
401036: 68 00 00 00 00 push 0x0
|
|
40103b: e9 e0 ff ff ff jmp 401020 <_init+0x20>
|
|
|
|
0000000000401040 <system@plt>:
|
|
401040: ff 25 c2 2f 00 00 jmp QWORD PTR [rip+0x2fc2] # 404008 <system@GLIBC_2.2.5>
|
|
401046: 68 01 00 00 00 push 0x1
|
|
40104b: e9 d0 ff ff ff jmp 401020 <_init+0x20>
|
|
|
|
0000000000401050 <printf@plt>:
|
|
401050: ff 25 ba 2f 00 00 jmp QWORD PTR [rip+0x2fba] # 404010 <printf@GLIBC_2.2.5>
|
|
401056: 68 02 00 00 00 push 0x2
|
|
40105b: e9 c0 ff ff ff jmp 401020 <_init+0x20>
|
|
|
|
0000000000401060 <read@plt>:
|
|
401060: ff 25 b2 2f 00 00 jmp QWORD PTR [rip+0x2fb2] # 404018 <read@GLIBC_2.2.5>
|
|
401066: 68 03 00 00 00 push 0x3
|
|
40106b: e9 b0 ff ff ff jmp 401020 <_init+0x20>
|
|
|
|
0000000000401070 <setvbuf@plt>:
|
|
401070: ff 25 aa 2f 00 00 jmp QWORD PTR [rip+0x2faa] # 404020 <setvbuf@GLIBC_2.2.5>
|
|
401076: 68 04 00 00 00 push 0x4
|
|
40107b: e9 a0 ff ff ff jmp 401020 <_init+0x20>
|
|
|
|
0000000000401080 <exit@plt>:
|
|
401080: ff 25 a2 2f 00 00 jmp QWORD PTR [rip+0x2fa2] # 404028 <exit@GLIBC_2.2.5>
|
|
401086: 68 05 00 00 00 push 0x5
|
|
40108b: e9 90 ff ff ff jmp 401020 <_init+0x20>
|
|
|
|
Disassembly of section .text:
|
|
|
|
0000000000401090 <_start>:
|
|
401090: 31 ed xor ebp,ebp
|
|
401092: 49 89 d1 mov r9,rdx
|
|
401095: 5e pop rsi
|
|
401096: 48 89 e2 mov rdx,rsp
|
|
401099: 48 83 e4 f0 and rsp,0xfffffffffffffff0
|
|
40109d: 50 push rax
|
|
40109e: 54 push rsp
|
|
40109f: 45 31 c0 xor r8d,r8d
|
|
4010a2: 31 c9 xor ecx,ecx
|
|
4010a4: 48 c7 c7 9d 12 40 00 mov rdi,0x40129d
|
|
4010ab: ff 15 27 2f 00 00 call QWORD PTR [rip+0x2f27] # 403fd8 <__libc_start_main@GLIBC_2.34>
|
|
4010b1: f4 hlt
|
|
4010b2: 66 2e 0f 1f 84 00 00 cs nop WORD PTR [rax+rax*1+0x0]
|
|
4010b9: 00 00 00
|
|
4010bc: 0f 1f 40 00 nop DWORD PTR [rax+0x0]
|
|
|
|
00000000004010c0 <_dl_relocate_static_pie>:
|
|
4010c0: c3 ret
|
|
4010c1: 66 2e 0f 1f 84 00 00 cs nop WORD PTR [rax+rax*1+0x0]
|
|
4010c8: 00 00 00
|
|
4010cb: 0f 1f 44 00 00 nop DWORD PTR [rax+rax*1+0x0]
|
|
|
|
00000000004010d0 <deregister_tm_clones>:
|
|
4010d0: b8 40 40 40 00 mov eax,0x404040
|
|
4010d5: 48 3d 40 40 40 00 cmp rax,0x404040
|
|
4010db: 74 13 je 4010f0 <deregister_tm_clones+0x20>
|
|
4010dd: b8 00 00 00 00 mov eax,0x0
|
|
4010e2: 48 85 c0 test rax,rax
|
|
4010e5: 74 09 je 4010f0 <deregister_tm_clones+0x20>
|
|
4010e7: bf 40 40 40 00 mov edi,0x404040
|
|
4010ec: ff e0 jmp rax
|
|
4010ee: 66 90 xchg ax,ax
|
|
4010f0: c3 ret
|
|
4010f1: 66 66 2e 0f 1f 84 00 data16 cs nop WORD PTR [rax+rax*1+0x0]
|
|
4010f8: 00 00 00 00
|
|
4010fc: 0f 1f 40 00 nop DWORD PTR [rax+0x0]
|
|
|
|
0000000000401100 <register_tm_clones>:
|
|
401100: be 40 40 40 00 mov esi,0x404040
|
|
401105: 48 81 ee 40 40 40 00 sub rsi,0x404040
|
|
40110c: 48 89 f0 mov rax,rsi
|
|
40110f: 48 c1 ee 3f shr rsi,0x3f
|
|
401113: 48 c1 f8 03 sar rax,0x3
|
|
401117: 48 01 c6 add rsi,rax
|
|
40111a: 48 d1 fe sar rsi,1
|
|
40111d: 74 11 je 401130 <register_tm_clones+0x30>
|
|
40111f: b8 00 00 00 00 mov eax,0x0
|
|
401124: 48 85 c0 test rax,rax
|
|
401127: 74 07 je 401130 <register_tm_clones+0x30>
|
|
401129: bf 40 40 40 00 mov edi,0x404040
|
|
40112e: ff e0 jmp rax
|
|
401130: c3 ret
|
|
401131: 66 66 2e 0f 1f 84 00 data16 cs nop WORD PTR [rax+rax*1+0x0]
|
|
401138: 00 00 00 00
|
|
40113c: 0f 1f 40 00 nop DWORD PTR [rax+0x0]
|
|
|
|
0000000000401140 <__do_global_dtors_aux>:
|
|
401140: f3 0f 1e fa endbr64
|
|
401144: 80 3d 1d 2f 00 00 00 cmp BYTE PTR [rip+0x2f1d],0x0 # 404068 <completed.0>
|
|
40114b: 75 13 jne 401160 <__do_global_dtors_aux+0x20>
|
|
40114d: 55 push rbp
|
|
40114e: 48 89 e5 mov rbp,rsp
|
|
401151: e8 7a ff ff ff call 4010d0 <deregister_tm_clones>
|
|
401156: c6 05 0b 2f 00 00 01 mov BYTE PTR [rip+0x2f0b],0x1 # 404068 <completed.0>
|
|
40115d: 5d pop rbp
|
|
40115e: c3 ret
|
|
40115f: 90 nop
|
|
401160: c3 ret
|
|
401161: 66 66 2e 0f 1f 84 00 data16 cs nop WORD PTR [rax+rax*1+0x0]
|
|
401168: 00 00 00 00
|
|
40116c: 0f 1f 40 00 nop DWORD PTR [rax+0x0]
|
|
|
|
0000000000401170 <frame_dummy>:
|
|
401170: f3 0f 1e fa endbr64
|
|
401174: eb 8a jmp 401100 <register_tm_clones>
|
|
|
|
0000000000401176 <ignore_me_init_buffering>:
|
|
401176: 55 push rbp
|
|
401177: 48 89 e5 mov rbp,rsp
|
|
40117a: 48 8b 05 cf 2e 00 00 mov rax,QWORD PTR [rip+0x2ecf] # 404050 <stdin@GLIBC_2.2.5>
|
|
401181: b9 00 00 00 00 mov ecx,0x0
|
|
401186: ba 02 00 00 00 mov edx,0x2
|
|
40118b: be 00 00 00 00 mov esi,0x0
|
|
401190: 48 89 c7 mov rdi,rax
|
|
401193: e8 d8 fe ff ff call 401070 <setvbuf@plt>
|
|
401198: 48 8b 05 a1 2e 00 00 mov rax,QWORD PTR [rip+0x2ea1] # 404040 <stdout@GLIBC_2.2.5>
|
|
40119f: b9 00 00 00 00 mov ecx,0x0
|
|
4011a4: ba 02 00 00 00 mov edx,0x2
|
|
4011a9: be 00 00 00 00 mov esi,0x0
|
|
4011ae: 48 89 c7 mov rdi,rax
|
|
4011b1: e8 ba fe ff ff call 401070 <setvbuf@plt>
|
|
4011b6: 48 8b 05 a3 2e 00 00 mov rax,QWORD PTR [rip+0x2ea3] # 404060 <stderr@GLIBC_2.2.5>
|
|
4011bd: b9 00 00 00 00 mov ecx,0x0
|
|
4011c2: ba 02 00 00 00 mov edx,0x2
|
|
4011c7: be 00 00 00 00 mov esi,0x0
|
|
4011cc: 48 89 c7 mov rdi,rax
|
|
4011cf: e8 9c fe ff ff call 401070 <setvbuf@plt>
|
|
4011d4: 90 nop
|
|
4011d5: 5d pop rbp
|
|
4011d6: c3 ret
|
|
|
|
00000000004011d7 <vuln>:
|
|
4011d7: 55 push rbp
|
|
4011d8: 48 89 e5 mov rbp,rsp
|
|
4011db: 48 81 ec 10 04 00 00 sub rsp,0x410
|
|
4011e2: 48 8d 05 1f 0e 00 00 lea rax,[rip+0xe1f] # 402008 <_IO_stdin_used+0x8>
|
|
4011e9: 48 89 c7 mov rdi,rax
|
|
4011ec: e8 3f fe ff ff call 401030 <puts@plt>
|
|
4011f1: 48 8d 85 f0 fb ff ff lea rax,[rbp-0x410]
|
|
4011f8: ba ff 03 00 00 mov edx,0x3ff
|
|
4011fd: 48 89 c6 mov rsi,rax
|
|
401200: bf 00 00 00 00 mov edi,0x0
|
|
401205: e8 56 fe ff ff call 401060 <read@plt>
|
|
40120a: 89 45 fc mov DWORD PTR [rbp-0x4],eax
|
|
40120d: 8b 45 fc mov eax,DWORD PTR [rbp-0x4]
|
|
401210: 83 e8 01 sub eax,0x1
|
|
401213: 48 98 cdqe
|
|
401215: c6 84 05 f0 fb ff ff mov BYTE PTR [rbp+rax*1-0x410],0x0
|
|
40121c: 00
|
|
40121d: 48 8d 05 f7 0d 00 00 lea rax,[rip+0xdf7] # 40201b <_IO_stdin_used+0x1b>
|
|
401224: 48 89 c7 mov rdi,rax
|
|
401227: b8 00 00 00 00 mov eax,0x0
|
|
40122c: e8 1f fe ff ff call 401050 <printf@plt>
|
|
401231: 48 8d 85 f0 fb ff ff lea rax,[rbp-0x410]
|
|
401238: 48 89 c7 mov rdi,rax
|
|
40123b: b8 00 00 00 00 mov eax,0x0
|
|
401240: e8 0b fe ff ff call 401050 <printf@plt>
|
|
401245: 48 8d 05 da 0d 00 00 lea rax,[rip+0xdda] # 402026 <_IO_stdin_used+0x26>
|
|
40124c: 48 89 c7 mov rdi,rax
|
|
40124f: e8 dc fd ff ff call 401030 <puts@plt>
|
|
401254: 8b 05 12 2e 00 00 mov eax,DWORD PTR [rip+0x2e12] # 40406c <bug>
|
|
40125a: 85 c0 test eax,eax
|
|
40125c: 74 2d je 40128b <vuln+0xb4>
|
|
40125e: 48 8d 05 c3 0d 00 00 lea rax,[rip+0xdc3] # 402028 <_IO_stdin_used+0x28>
|
|
401265: 48 89 c7 mov rdi,rax
|
|
401268: b8 00 00 00 00 mov eax,0x0
|
|
40126d: e8 de fd ff ff call 401050 <printf@plt>
|
|
401272: 48 8d 05 fc 0d 00 00 lea rax,[rip+0xdfc] # 402075 <_IO_stdin_used+0x75>
|
|
401279: 48 89 c7 mov rdi,rax
|
|
40127c: e8 bf fd ff ff call 401040 <system@plt>
|
|
401281: bf 00 00 00 00 mov edi,0x0
|
|
401286: e8 f5 fd ff ff call 401080 <exit@plt>
|
|
40128b: 48 8d 05 ee 0d 00 00 lea rax,[rip+0xdee] # 402080 <_IO_stdin_used+0x80>
|
|
401292: 48 89 c7 mov rdi,rax
|
|
401295: e8 96 fd ff ff call 401030 <puts@plt>
|
|
40129a: 90 nop
|
|
40129b: c9 leave
|
|
40129c: c3 ret
|
|
|
|
000000000040129d <main>:
|
|
40129d: 55 push rbp
|
|
40129e: 48 89 e5 mov rbp,rsp
|
|
4012a1: 48 83 ec 10 sub rsp,0x10
|
|
4012a5: 89 7d fc mov DWORD PTR [rbp-0x4],edi
|
|
4012a8: 48 89 75 f0 mov QWORD PTR [rbp-0x10],rsi
|
|
4012ac: b8 00 00 00 00 mov eax,0x0
|
|
4012b1: e8 c0 fe ff ff call 401176 <ignore_me_init_buffering>
|
|
4012b6: b8 00 00 00 00 mov eax,0x0
|
|
4012bb: e8 17 ff ff ff call 4011d7 <vuln>
|
|
4012c0: b8 00 00 00 00 mov eax,0x0
|
|
4012c5: c9 leave
|
|
4012c6: c3 ret
|
|
|
|
Disassembly of section .fini:
|
|
|
|
00000000004012c8 <_fini>:
|
|
4012c8: 48 83 ec 08 sub rsp,0x8
|
|
4012cc: 48 83 c4 08 add rsp,0x8
|
|
4012d0: c3 ret
|