	.file	"1172488.c"
	.intel_syntax noprefix
	.text
	.globl	main
	.type	main, @function
main:
.LFB6:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	sub	rsp, 16
	mov	DWORD PTR -4[rbp], edi
	mov	QWORD PTR -16[rbp], rsi
	cmp	DWORD PTR -4[rbp], 2
	jne	.L2
	mov	rax, QWORD PTR -16[rbp]
	add	rax, 8
	mov	rax, QWORD PTR [rax]
	mov	rdi, rax
	call	vulnFileCopy
	jmp	.L1
.L2:
	mov	eax, 0
	call	usage
	nop
.L1:
	leave
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE6:
	.size	main, .-main
	.section	.rodata
.LC0:
	.string	"\nAddress of data buffer: %p\n"
.LC1:
	.string	"\nFile to copy: "
	.align 8
.LC2:
	.string	"\nPress enter to begin copying..."
.LC3:
	.string	"r"
	.align 8
.LC4:
	.string	"\nERROR Opening file. Exiting...\n"
.LC5:
	.string	"\nDone copying."
	.text
	.globl	vulnFileCopy
	.type	vulnFileCopy, @function
vulnFileCopy:
.LFB7:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	sub	rsp, 240
	mov	QWORD PTR -232[rbp], rdi
	mov	rax, QWORD PTR fs:40
	mov	QWORD PTR -8[rbp], rax
	xor	eax, eax
	mov	DWORD PTR -224[rbp], 34
	mov	DWORD PTR -220[rbp], 51
	mov	DWORD PTR -224[rbp], 0
	jmp	.L6
.L7:
	mov	eax, DWORD PTR -224[rbp]
	mov	BYTE PTR -208[rbp+rax], 65
	add	DWORD PTR -224[rbp], 1
.L6:
	cmp	DWORD PTR -224[rbp], 199
	jbe	.L7
	lea	rax, -208[rbp]
	mov	rsi, rax
	lea	rdi, .LC0[rip]
	mov	eax, 0
	call	printf@PLT
	mov	DWORD PTR -224[rbp], 0
	lea	rdi, .LC1[rip]
	mov	eax, 0
	call	printf@PLT
	mov	rax, QWORD PTR -232[rbp]
	mov	rdi, rax
	mov	eax, 0
	call	printf@PLT
	mov	edi, 10
	call	putchar@PLT
	lea	rdi, .LC2[rip]
	mov	eax, 0
	call	printf@PLT
	call	getchar@PLT
	mov	rax, QWORD PTR -232[rbp]
	lea	rsi, .LC3[rip]
	mov	rdi, rax
	call	fopen@PLT
	mov	QWORD PTR -216[rbp], rax
	cmp	QWORD PTR -216[rbp], 0
	jne	.L8
	lea	rdi, .LC4[rip]
	call	perror@PLT
	mov	edi, 0
	call	exit@PLT
.L8:
	mov	rax, QWORD PTR -216[rbp]
	mov	edx, 2
	mov	esi, 0
	mov	rdi, rax
	call	fseek@PLT
	mov	rax, QWORD PTR -216[rbp]
	mov	rdi, rax
	call	ftell@PLT
	mov	DWORD PTR -220[rbp], eax
	mov	rax, QWORD PTR -216[rbp]
	mov	rdi, rax
	call	rewind@PLT
	mov	DWORD PTR -224[rbp], 0
	jmp	.L9
.L10:
	mov	rax, QWORD PTR -216[rbp]
	mov	rdi, rax
	call	fgetc@PLT
	mov	edx, eax
	mov	eax, DWORD PTR -224[rbp]
	mov	BYTE PTR -208[rbp+rax], dl
	add	DWORD PTR -224[rbp], 1
.L9:
	mov	eax, DWORD PTR -224[rbp]
	cmp	eax, DWORD PTR -220[rbp]
	jb	.L10
	mov	rax, QWORD PTR -216[rbp]
	mov	rdi, rax
	call	fclose@PLT
	lea	rdi, .LC5[rip]
	call	puts@PLT
	nop
	mov	rax, QWORD PTR -8[rbp]
	sub	rax, QWORD PTR fs:40
	je	.L12
	call	__stack_chk_fail@PLT
.L12:
	leave
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE7:
	.size	vulnFileCopy, .-vulnFileCopy
	.section	.rodata
	.align 8
.LC6:
	.string	"\nUsage: ./vulnFileCopy2 [file_name]"
	.text
	.globl	usage
	.type	usage, @function
usage:
.LFB8:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	lea	rdi, .LC6[rip]
	call	puts@PLT
	nop
	pop	rbp
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE8:
	.size	usage, .-usage
	.section	.rodata
.LC7:
	.string	"system"
.LC8:
	.string	"exit"
.LC9:
	.string	"Address of 'system': 0x%08x\n"
.LC10:
	.string	"Address of 'exit':   0x%08x\n"
.LC11:
	.string	"Offset system-exit:  0x%08x\n"
	.text
	.globl	getSystem
	.type	getSystem, @function
getSystem:
.LFB9:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	sub	rsp, 32
	mov	esi, 1
	mov	edi, 0
	call	dlopen@PLT
	mov	QWORD PTR -24[rbp], rax
	mov	rax, QWORD PTR -24[rbp]
	lea	rsi, .LC7[rip]
	mov	rdi, rax
	call	dlsym@PLT
	mov	QWORD PTR -16[rbp], rax
	mov	rax, QWORD PTR -24[rbp]
	lea	rsi, .LC8[rip]
	mov	rdi, rax
	call	dlsym@PLT
	mov	QWORD PTR -8[rbp], rax
	mov	rax, QWORD PTR -16[rbp]
	mov	rsi, rax
	lea	rdi, .LC9[rip]
	mov	eax, 0
	call	printf@PLT
	mov	rax, QWORD PTR -8[rbp]
	mov	rsi, rax
	lea	rdi, .LC10[rip]
	mov	eax, 0
	call	printf@PLT
	mov	rax, QWORD PTR -16[rbp]
	sub	rax, QWORD PTR -8[rbp]
	mov	rsi, rax
	lea	rdi, .LC11[rip]
	mov	eax, 0
	call	printf@PLT
	nop
	leave
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE9:
	.size	getSystem, .-getSystem
	.ident	"GCC: (Ubuntu 10.5.0-1ubuntu1~20.04) 10.5.0"
	.section	.note.GNU-stack,"",@progbits
	.section	.note.gnu.property,"a"
	.align 8
	.long	 1f - 0f
	.long	 4f - 1f
	.long	 5
0:
	.string	 "GNU"
1:
	.align 8
	.long	 0xc0000002
	.long	 3f - 2f
2:
	.long	 0x3
3:
	.align 8
4:

	.arch armv5t
	.eabi_attribute 20, 1
	.eabi_attribute 21, 1
	.eabi_attribute 23, 3
	.eabi_attribute 24, 1
	.eabi_attribute 25, 1
	.eabi_attribute 26, 2
	.eabi_attribute 30, 6
	.eabi_attribute 34, 0
	.eabi_attribute 18, 4
	.file	"1172488.c"
	.text
	.align	2
	.global	main
	.syntax unified
	.arm
	.fpu softvfp
	.type	main, %function
main:
	@ args = 0, pretend = 0, frame = 8
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{fp, lr}
	add	fp, sp, #4
	sub	sp, sp, #8
	str	r0, [fp, #-8]
	str	r1, [fp, #-12]
	ldr	r3, [fp, #-8]
	cmp	r3, #2
	bne	.L2
	ldr	r3, [fp, #-12]
	add	r3, r3, #4
	ldr	r3, [r3]
	mov	r0, r3
	bl	vulnFileCopy
	b	.L1
.L2:
	bl	usage
	nop
.L1:
	sub	sp, fp, #4
	@ sp needed
	pop	{fp, pc}
	.size	main, .-main
	.section	.rodata
	.align	2
.LC0:
	.ascii	"\012Address of data buffer: %p\012\000"
	.align	2
.LC1:
	.ascii	"\012File to copy: \000"
	.align	2
.LC2:
	.ascii	"\012Press enter to begin copying...\000"
	.align	2
.LC3:
	.ascii	"r\000"
	.align	2
.LC4:
	.ascii	"\012ERROR Opening file. Exiting...\012\000"
	.align	2
.LC5:
	.ascii	"\012Done copying.\000"
	.align	2
.LC6:
	.word	__stack_chk_guard
	.text
	.align	2
	.global	vulnFileCopy
	.syntax unified
	.arm
	.fpu softvfp
	.type	vulnFileCopy, %function
vulnFileCopy:
	@ args = 0, pretend = 0, frame = 224
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{fp, lr}
	add	fp, sp, #4
	sub	sp, sp, #224
	str	r0, [fp, #-224]
	ldr	r3, .L13
	ldr	r3, [r3]
	str	r3, [fp, #-8]
	mov	r3,#0
	mov	r3, #34
	str	r3, [fp, #-220]
	mov	r3, #51
	str	r3, [fp, #-216]
	mov	r3, #0
	str	r3, [fp, #-220]
	b	.L6
.L7:
	sub	r2, fp, #208
	ldr	r3, [fp, #-220]
	add	r3, r2, r3
	mov	r2, #65
	strb	r2, [r3]
	ldr	r3, [fp, #-220]
	add	r3, r3, #1
	str	r3, [fp, #-220]
.L6:
	ldr	r3, [fp, #-220]
	cmp	r3, #199
	bls	.L7
	sub	r3, fp, #208
	mov	r1, r3
	ldr	r0, .L13+4
	bl	printf
	mov	r3, #0
	str	r3, [fp, #-220]
	ldr	r0, .L13+8
	bl	printf
	ldr	r0, [fp, #-224]
	bl	printf
	mov	r0, #10
	bl	putchar
	ldr	r0, .L13+12
	bl	printf
	bl	getchar
	ldr	r1, .L13+16
	ldr	r0, [fp, #-224]
	bl	fopen
	str	r0, [fp, #-212]
	ldr	r3, [fp, #-212]
	cmp	r3, #0
	bne	.L8
	ldr	r0, .L13+20
	bl	perror
	mov	r0, #0
	bl	exit
.L8:
	mov	r2, #2
	mov	r1, #0
	ldr	r0, [fp, #-212]
	bl	fseek
	ldr	r0, [fp, #-212]
	bl	ftell
	mov	r3, r0
	str	r3, [fp, #-216]
	ldr	r0, [fp, #-212]
	bl	rewind
	mov	r3, #0
	str	r3, [fp, #-220]
	b	.L9
.L10:
	ldr	r0, [fp, #-212]
	bl	fgetc
	mov	r3, r0
	and	r1, r3, #255
	sub	r2, fp, #208
	ldr	r3, [fp, #-220]
	add	r3, r2, r3
	mov	r2, r1
	strb	r2, [r3]
	ldr	r3, [fp, #-220]
	add	r3, r3, #1
	str	r3, [fp, #-220]
.L9:
	ldr	r2, [fp, #-220]
	ldr	r3, [fp, #-216]
	cmp	r2, r3
	bcc	.L10
	ldr	r0, [fp, #-212]
	bl	fclose
	ldr	r0, .L13+24
	bl	puts
	nop
	ldr	r3, .L13
	ldr	r2, [r3]
	ldr	r3, [fp, #-8]
	eors	r2, r3, r2
	mov	r3, #0
	beq	.L12
	bl	__stack_chk_fail
.L12:
	sub	sp, fp, #4
	@ sp needed
	pop	{fp, pc}
.L14:
	.align	2
.L13:
	.word	.LC6
	.word	.LC0
	.word	.LC1
	.word	.LC2
	.word	.LC3
	.word	.LC4
	.word	.LC5
	.size	vulnFileCopy, .-vulnFileCopy
	.section	.rodata
	.align	2
.LC7:
	.ascii	"\012Usage: ./vulnFileCopy2 [file_name]\000"
	.text
	.align	2
	.global	usage
	.syntax unified
	.arm
	.fpu softvfp
	.type	usage, %function
usage:
	@ args = 0, pretend = 0, frame = 0
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{fp, lr}
	add	fp, sp, #4
	ldr	r0, .L16
	bl	puts
	nop
	pop	{fp, pc}
.L17:
	.align	2
.L16:
	.word	.LC7
	.size	usage, .-usage
	.section	.rodata
	.align	2
.LC8:
	.ascii	"system\000"
	.align	2
.LC9:
	.ascii	"exit\000"
	.align	2
.LC10:
	.ascii	"Address of 'system': 0x%08x\012\000"
	.align	2
.LC11:
	.ascii	"Address of 'exit':   0x%08x\012\000"
	.align	2
.LC12:
	.ascii	"Offset system-exit:  0x%08x\012\000"
	.text
	.align	2
	.global	getSystem
	.syntax unified
	.arm
	.fpu softvfp
	.type	getSystem, %function
getSystem:
	@ args = 0, pretend = 0, frame = 16
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{fp, lr}
	add	fp, sp, #4
	sub	sp, sp, #16
	mov	r1, #1
	mov	r0, #0
	bl	dlopen
	str	r0, [fp, #-16]
	ldr	r1, .L19
	ldr	r0, [fp, #-16]
	bl	dlsym
	str	r0, [fp, #-12]
	ldr	r1, .L19+4
	ldr	r0, [fp, #-16]
	bl	dlsym
	str	r0, [fp, #-8]
	ldr	r1, [fp, #-12]
	ldr	r0, .L19+8
	bl	printf
	ldr	r1, [fp, #-8]
	ldr	r0, .L19+12
	bl	printf
	ldr	r2, [fp, #-12]
	ldr	r3, [fp, #-8]
	sub	r3, r2, r3
	mov	r1, r3
	ldr	r0, .L19+16
	bl	printf
	nop
	sub	sp, fp, #4
	@ sp needed
	pop	{fp, pc}
.L20:
	.align	2
.L19:
	.word	.LC8
	.word	.LC9
	.word	.LC10
	.word	.LC11
	.word	.LC12
	.size	getSystem, .-getSystem
	.ident	"GCC: (Ubuntu 9.4.0-1ubuntu1~20.04.2) 9.4.0"
	.section	.note.GNU-stack,"",%progbits
