forked from plasma-disassembler/plasma
-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathcanary_plt.rev
31 lines (30 loc) · 832 Bytes
/
canary_plt.rev
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
function main (.text) {
0x400526: push rbp
0x400527: rbp = rsp
0x40052a: rsp -= 160
0x400531: rax = *(fs + 40)
0x40053a: *(rbp - 8) = rax
0x40053e: eax = 0
0x400540: *(rbp - 148) = 0
0x40054a: jmp loop_0x40055c
loop {
loop_0x40055c:
# 0x40055c: cmp dword ptr [rbp - 0x94], 0x63
# 0x400563: jle 0x40054c
if (*(rbp - 148) > 99) goto break_0x400565
0x40054c: eax = *(rbp - 148)
0x400552: rax = eax
0x400554: *(rbp + rax - 144) = 'a'
} ; loop_0x40055c
break_0x400565:
0x400565: eax = 0
0x40056a: rdx = *(rbp - 8)
# 0x40056e: xor rdx, qword ptr fs:[0x28]
# 0x400577: je 0x40057e
if ((rdx ^= *(fs + 40)) != 0) {
0x400579: call __stack_chk_fail
}
ret_0x40057e:
0x40057e: leave
0x40057f: ret
}