203 lines
9.0 KiB
Plaintext
203 lines
9.0 KiB
Plaintext
|
|
intro-pwn: file format elf64-x86-64
|
|
|
|
|
|
Disassembly of section .init:
|
|
|
|
0000000000401000 <_init>:
|
|
401000: 48 83 ec 08 sub rsp,0x8
|
|
401004: 48 8b 05 d5 2f 00 00 mov rax,QWORD PTR [rip+0x2fd5] # 403fe0 <__gmon_start__@Base>
|
|
40100b: 48 85 c0 test rax,rax
|
|
40100e: 74 02 je 401012 <_init+0x12>
|
|
401010: ff d0 call rax
|
|
401012: 48 83 c4 08 add rsp,0x8
|
|
401016: c3 ret
|
|
|
|
Disassembly of section .plt:
|
|
|
|
0000000000401020 <puts@plt-0x10>:
|
|
401020: ff 35 ca 2f 00 00 push QWORD PTR [rip+0x2fca] # 403ff0 <_GLOBAL_OFFSET_TABLE_+0x8>
|
|
401026: ff 25 cc 2f 00 00 jmp QWORD PTR [rip+0x2fcc] # 403ff8 <_GLOBAL_OFFSET_TABLE_+0x10>
|
|
40102c: 0f 1f 40 00 nop DWORD PTR [rax+0x0]
|
|
|
|
0000000000401030 <puts@plt>:
|
|
401030: ff 25 ca 2f 00 00 jmp QWORD PTR [rip+0x2fca] # 404000 <puts@GLIBC_2.2.5>
|
|
401036: 68 00 00 00 00 push 0x0
|
|
40103b: e9 e0 ff ff ff jmp 401020 <_init+0x20>
|
|
|
|
0000000000401040 <system@plt>:
|
|
401040: ff 25 c2 2f 00 00 jmp QWORD PTR [rip+0x2fc2] # 404008 <system@GLIBC_2.2.5>
|
|
401046: 68 01 00 00 00 push 0x1
|
|
40104b: e9 d0 ff ff ff jmp 401020 <_init+0x20>
|
|
|
|
0000000000401050 <printf@plt>:
|
|
401050: ff 25 ba 2f 00 00 jmp QWORD PTR [rip+0x2fba] # 404010 <printf@GLIBC_2.2.5>
|
|
401056: 68 02 00 00 00 push 0x2
|
|
40105b: e9 c0 ff ff ff jmp 401020 <_init+0x20>
|
|
|
|
0000000000401060 <gets@plt>:
|
|
401060: ff 25 b2 2f 00 00 jmp QWORD PTR [rip+0x2fb2] # 404018 <gets@GLIBC_2.2.5>
|
|
401066: 68 03 00 00 00 push 0x3
|
|
40106b: e9 b0 ff ff ff jmp 401020 <_init+0x20>
|
|
|
|
0000000000401070 <setvbuf@plt>:
|
|
401070: ff 25 aa 2f 00 00 jmp QWORD PTR [rip+0x2faa] # 404020 <setvbuf@GLIBC_2.2.5>
|
|
401076: 68 04 00 00 00 push 0x4
|
|
40107b: e9 a0 ff ff ff jmp 401020 <_init+0x20>
|
|
|
|
Disassembly of section .text:
|
|
|
|
0000000000401080 <_start>:
|
|
401080: 31 ed xor ebp,ebp
|
|
401082: 49 89 d1 mov r9,rdx
|
|
401085: 5e pop rsi
|
|
401086: 48 89 e2 mov rdx,rsp
|
|
401089: 48 83 e4 f0 and rsp,0xfffffffffffffff0
|
|
40108d: 50 push rax
|
|
40108e: 54 push rsp
|
|
40108f: 45 31 c0 xor r8d,r8d
|
|
401092: 31 c9 xor ecx,ecx
|
|
401094: 48 c7 c7 23 12 40 00 mov rdi,0x401223
|
|
40109b: ff 15 37 2f 00 00 call QWORD PTR [rip+0x2f37] # 403fd8 <__libc_start_main@GLIBC_2.34>
|
|
4010a1: f4 hlt
|
|
4010a2: 66 2e 0f 1f 84 00 00 cs nop WORD PTR [rax+rax*1+0x0]
|
|
4010a9: 00 00 00
|
|
4010ac: 0f 1f 40 00 nop DWORD PTR [rax+0x0]
|
|
|
|
00000000004010b0 <_dl_relocate_static_pie>:
|
|
4010b0: c3 ret
|
|
4010b1: 66 2e 0f 1f 84 00 00 cs nop WORD PTR [rax+rax*1+0x0]
|
|
4010b8: 00 00 00
|
|
4010bb: 0f 1f 44 00 00 nop DWORD PTR [rax+rax*1+0x0]
|
|
|
|
00000000004010c0 <deregister_tm_clones>:
|
|
4010c0: b8 38 40 40 00 mov eax,0x404038
|
|
4010c5: 48 3d 38 40 40 00 cmp rax,0x404038
|
|
4010cb: 74 13 je 4010e0 <deregister_tm_clones+0x20>
|
|
4010cd: b8 00 00 00 00 mov eax,0x0
|
|
4010d2: 48 85 c0 test rax,rax
|
|
4010d5: 74 09 je 4010e0 <deregister_tm_clones+0x20>
|
|
4010d7: bf 38 40 40 00 mov edi,0x404038
|
|
4010dc: ff e0 jmp rax
|
|
4010de: 66 90 xchg ax,ax
|
|
4010e0: c3 ret
|
|
4010e1: 66 66 2e 0f 1f 84 00 data16 cs nop WORD PTR [rax+rax*1+0x0]
|
|
4010e8: 00 00 00 00
|
|
4010ec: 0f 1f 40 00 nop DWORD PTR [rax+0x0]
|
|
|
|
00000000004010f0 <register_tm_clones>:
|
|
4010f0: be 38 40 40 00 mov esi,0x404038
|
|
4010f5: 48 81 ee 38 40 40 00 sub rsi,0x404038
|
|
4010fc: 48 89 f0 mov rax,rsi
|
|
4010ff: 48 c1 ee 3f shr rsi,0x3f
|
|
401103: 48 c1 f8 03 sar rax,0x3
|
|
401107: 48 01 c6 add rsi,rax
|
|
40110a: 48 d1 fe sar rsi,1
|
|
40110d: 74 11 je 401120 <register_tm_clones+0x30>
|
|
40110f: b8 00 00 00 00 mov eax,0x0
|
|
401114: 48 85 c0 test rax,rax
|
|
401117: 74 07 je 401120 <register_tm_clones+0x30>
|
|
401119: bf 38 40 40 00 mov edi,0x404038
|
|
40111e: ff e0 jmp rax
|
|
401120: c3 ret
|
|
401121: 66 66 2e 0f 1f 84 00 data16 cs nop WORD PTR [rax+rax*1+0x0]
|
|
401128: 00 00 00 00
|
|
40112c: 0f 1f 40 00 nop DWORD PTR [rax+0x0]
|
|
|
|
0000000000401130 <__do_global_dtors_aux>:
|
|
401130: f3 0f 1e fa endbr64
|
|
401134: 80 3d 2d 2f 00 00 00 cmp BYTE PTR [rip+0x2f2d],0x0 # 404068 <completed.0>
|
|
40113b: 75 13 jne 401150 <__do_global_dtors_aux+0x20>
|
|
40113d: 55 push rbp
|
|
40113e: 48 89 e5 mov rbp,rsp
|
|
401141: e8 7a ff ff ff call 4010c0 <deregister_tm_clones>
|
|
401146: c6 05 1b 2f 00 00 01 mov BYTE PTR [rip+0x2f1b],0x1 # 404068 <completed.0>
|
|
40114d: 5d pop rbp
|
|
40114e: c3 ret
|
|
40114f: 90 nop
|
|
401150: c3 ret
|
|
401151: 66 66 2e 0f 1f 84 00 data16 cs nop WORD PTR [rax+rax*1+0x0]
|
|
401158: 00 00 00 00
|
|
40115c: 0f 1f 40 00 nop DWORD PTR [rax+0x0]
|
|
|
|
0000000000401160 <frame_dummy>:
|
|
401160: f3 0f 1e fa endbr64
|
|
401164: eb 8a jmp 4010f0 <register_tm_clones>
|
|
|
|
0000000000401166 <ignore_me_init_buffering>:
|
|
401166: 55 push rbp
|
|
401167: 48 89 e5 mov rbp,rsp
|
|
40116a: 48 8b 05 cf 2e 00 00 mov rax,QWORD PTR [rip+0x2ecf] # 404040 <stdout@GLIBC_2.2.5>
|
|
401171: b9 00 00 00 00 mov ecx,0x0
|
|
401176: ba 02 00 00 00 mov edx,0x2
|
|
40117b: be 00 00 00 00 mov esi,0x0
|
|
401180: 48 89 c7 mov rdi,rax
|
|
401183: e8 e8 fe ff ff call 401070 <setvbuf@plt>
|
|
401188: 48 8b 05 c1 2e 00 00 mov rax,QWORD PTR [rip+0x2ec1] # 404050 <stdin@GLIBC_2.2.5>
|
|
40118f: b9 00 00 00 00 mov ecx,0x0
|
|
401194: ba 02 00 00 00 mov edx,0x2
|
|
401199: be 00 00 00 00 mov esi,0x0
|
|
40119e: 48 89 c7 mov rdi,rax
|
|
4011a1: e8 ca fe ff ff call 401070 <setvbuf@plt>
|
|
4011a6: 48 8b 05 b3 2e 00 00 mov rax,QWORD PTR [rip+0x2eb3] # 404060 <stderr@GLIBC_2.2.5>
|
|
4011ad: b9 00 00 00 00 mov ecx,0x0
|
|
4011b2: ba 02 00 00 00 mov edx,0x2
|
|
4011b7: be 00 00 00 00 mov esi,0x0
|
|
4011bc: 48 89 c7 mov rdi,rax
|
|
4011bf: e8 ac fe ff ff call 401070 <setvbuf@plt>
|
|
4011c4: 90 nop
|
|
4011c5: 5d pop rbp
|
|
4011c6: c3 ret
|
|
|
|
00000000004011c7 <win>:
|
|
4011c7: 55 push rbp
|
|
4011c8: 48 89 e5 mov rbp,rsp
|
|
4011cb: 48 8d 05 36 0e 00 00 lea rax,[rip+0xe36] # 402008 <_IO_stdin_used+0x8>
|
|
4011d2: 48 89 c7 mov rdi,rax
|
|
4011d5: e8 66 fe ff ff call 401040 <system@plt>
|
|
4011da: 90 nop
|
|
4011db: 5d pop rbp
|
|
4011dc: c3 ret
|
|
|
|
00000000004011dd <vuln>:
|
|
4011dd: 55 push rbp
|
|
4011de: 48 89 e5 mov rbp,rsp
|
|
4011e1: 48 83 ec 10 sub rsp,0x10
|
|
4011e5: 48 8d 05 36 0e 00 00 lea rax,[rip+0xe36] # 402022 <_IO_stdin_used+0x22>
|
|
4011ec: 48 89 c7 mov rdi,rax
|
|
4011ef: e8 3c fe ff ff call 401030 <puts@plt>
|
|
4011f4: 48 8d 45 f0 lea rax,[rbp-0x10]
|
|
4011f8: 48 89 c7 mov rdi,rax
|
|
4011fb: e8 60 fe ff ff call 401060 <gets@plt>
|
|
401200: 48 8d 45 f0 lea rax,[rbp-0x10]
|
|
401204: ba 5f c3 00 00 mov edx,0xc35f
|
|
401209: 48 89 c6 mov rsi,rax
|
|
40120c: 48 8d 05 25 0e 00 00 lea rax,[rip+0xe25] # 402038 <_IO_stdin_used+0x38>
|
|
401213: 48 89 c7 mov rdi,rax
|
|
401216: b8 00 00 00 00 mov eax,0x0
|
|
40121b: e8 30 fe ff ff call 401050 <printf@plt>
|
|
401220: 90 nop
|
|
401221: c9 leave
|
|
401222: c3 ret
|
|
|
|
0000000000401223 <main>:
|
|
401223: 55 push rbp
|
|
401224: 48 89 e5 mov rbp,rsp
|
|
401227: 48 83 ec 10 sub rsp,0x10
|
|
40122b: 89 7d fc mov DWORD PTR [rbp-0x4],edi
|
|
40122e: 48 89 75 f0 mov QWORD PTR [rbp-0x10],rsi
|
|
401232: b8 00 00 00 00 mov eax,0x0
|
|
401237: e8 2a ff ff ff call 401166 <ignore_me_init_buffering>
|
|
40123c: b8 00 00 00 00 mov eax,0x0
|
|
401241: e8 97 ff ff ff call 4011dd <vuln>
|
|
401246: b8 00 00 00 00 mov eax,0x0
|
|
40124b: c9 leave
|
|
40124c: c3 ret
|
|
|
|
Disassembly of section .fini:
|
|
|
|
0000000000401250 <_fini>:
|
|
401250: 48 83 ec 08 sub rsp,0x8
|
|
401254: 48 83 c4 08 add rsp,0x8
|
|
401258: c3 ret
|