amit.lvnzn/uaf

0 lines

113.23 KB

_ABI(SystemV_x86_64) _Noreturn
void main(generic64_t argument_0, generic64_t argument_1) {
  struct_176 stack;
  void *var_0;
  pointer_or_number64_t var_1;
  pointer_or_number64_t var_2;
  void *var_3;
  pointer_or_number64_t var_4;
  pointer_or_number64_t var_5;
  generic64_t var_6;
  artificial_struct_returned_by_rawfunction_42 var_7;
  artificial_struct_returned_by_rawfunction_42 var_8;
  stack.offset_12 = (number32_t) argument_0;
  stack.offset_0 = argument_1;
  _ZNSaIcEC1Ev_2((void *const) ((pointer_or_number64_t) &stack.offset_72 + 6));
  var_7 = _ZNSsC1EPKcRKSaIcE_2(undef(generic64_t), (pointer_or_number64_t) &stack.offset_72 + 6, (pointer_or_number64_t) "Jack", (pointer_or_number64_t) &stack.offset_12 + 4, undef(generic64_t), undef(generic64_t));
  var_5 = var_7.register_rax;
  var_4 = var_7.register_rdx;
  var_3 = _Znwm_2(24);
  _ZN3ManC1ESsi((generic64_t) var_3, (pointer_or_number64_t) &stack.offset_12 + 4, 25);
  stack.offset_40 = var_3;
  _ZNSsD1Ev_2((void *const) ((pointer_or_number64_t) &stack.offset_12 + 4));
  _ZNSaIcED1Ev_2((void *const) ((pointer_or_number64_t) &stack.offset_72 + 6));
  _ZNSaIcEC1Ev_2((void *const) ((pointer_or_number64_t) &stack.offset_72 + 7));
  var_8 = _ZNSsC1EPKcRKSaIcE_2(undef(generic64_t), (pointer_or_number64_t) &stack.offset_72 + 7, (pointer_or_number64_t) "Jill", (pointer_or_number64_t) &stack.offset_12 + 20, undef(generic64_t), undef(generic64_t));
  var_2 = var_8.register_rax;
  var_1 = var_8.register_rdx;
  var_0 = _Znwm_2(24);
  _ZN5WomanC1ESsi((generic64_t) var_0, (pointer_or_number64_t) &stack.offset_12 + 20, 21);
  stack.offset_48 = var_0;
  _ZNSsD1Ev_2((void *const) ((pointer_or_number64_t) &stack.offset_12 + 20));
  _ZNSaIcED1Ev_2((void *const) ((pointer_or_number64_t) &stack.offset_72 + 7));
  var_6 = 21;
  while (true) {
    pointer_or_number64_t var_9;
    pointer_or_number64_t var_10;
    pointer_or_number64_t var_11;
    pointer_or_number64_t var_12;
    generic64_t var_13;
    generic64_t var_14;
    generic64_t var_15;
    artificial_struct_returned_by_rawfunction_42 var_16;
    artificial_struct_returned_by_rawfunction_42 var_17;
    var_13 = var_15;
    var_16 = _ZStlsISt11char_traitsIcEERSt13basic_ostreamIcT_ES5_PKc_2(var_13, var_6, (pointer_or_number64_t) "1. use\n2. after\n3. free\n", (pointer_or_number64_t) &segment_1.bss.offset_384, undef(generic64_t), undef(generic64_t));
    var_12 = var_16.register_rax;
    var_11 = var_16.register_rdx;
    var_17 = _ZNSirsERj_2(var_13, var_11, (pointer_or_number64_t) &stack.offset_72, (pointer_or_number64_t) &segment_1.bss, undef(generic64_t), undef(generic64_t));
    var_10 = var_17.register_rax;
    var_9 = var_17.register_rdx;
    var_14 = var_9;
    switch ((number32_t) stack.offset_72) {
      case 2:
      {
        pointer_or_number64_t var_18;
        pointer_or_number64_t var_19;
        pointer_or_number64_t var_20;
        pointer_or_number64_t var_21;
        ssize_t var_22;
        int32_t var_23;
        void *var_24;
        int32_t var_25;
        artificial_struct_returned_by_rawfunction_42 var_26;
        artificial_struct_returned_by_rawfunction_42 var_27;
        var_25 = atoi_2((const int8_t *) stack.offset_0->offset_8);
        stack.offset_56 = var_25;
        var_24 = _Znam_2((size_t) var_25);
        stack.offset_64 = var_24;
        var_23 = open_2((const int8_t *) stack.offset_0->offset_16, (int32_t) 0);
        var_13 = stack.offset_64;
        var_22 = read_2(var_23, (void *) var_13, stack.offset_56);
        var_26 = _ZStlsISt11char_traitsIcEERSt13basic_ostreamIcT_ES5_PKc_2(var_13, stack.offset_56, (pointer_or_number64_t) "your data is allocated", (pointer_or_number64_t) &segment_1.bss.offset_384, undef(generic64_t), undef(generic64_t));
        var_21 = var_26.register_rax;
        var_20 = var_26.register_rdx;
        var_27 = _ZNSolsEPFRSoS_E_2(var_13, var_20, (pointer_or_number64_t) _ZSt4endlIcSt11char_traitsIcEERSt13basic_ostreamIT_T0_ES6__2, var_21, undef(generic64_t), undef(generic64_t));
        var_19 = var_27.register_rax;
        var_18 = var_27.register_rdx;
        var_14 = var_18;
      } break;
      case 3:
      {
        if (stack.offset_40) {
          _ZN5HumanD1Ev(stack.offset_40);
          _ZdlPv_2(stack.offset_40);
        }
        var_13 = var_15;
        var_14 = var_9;
        if (stack.offset_48) {
          _ZN5HumanD1Ev(stack.offset_48);
          _ZdlPv_2(stack.offset_48);
          var_13 = var_15;
          var_14 = var_9;
        }
      } break;
      case 1:
      {
        ((cabifunction_260 *) (*stack.offset_40)->offset_8)((generic64_t) stack.offset_40);
        var_14 = (*stack.offset_48)->offset_8;
        ((cabifunction_261 *) var_14)((generic64_t) stack.offset_48);
        var_13 = var_15;
      } break;
    }
  }
}