| // WARNING in xt_cluster_mt |
| // https://syzkaller.appspot.com/bug?id=7da50094325f0a296fb481c5b85ec519dd13f4de |
| // status:fixed |
| // autogenerated by syzkaller (http://github.com/google/syzkaller) |
| |
| #define _GNU_SOURCE |
| #include <endian.h> |
| #include <stdint.h> |
| #include <string.h> |
| #include <sys/syscall.h> |
| #include <unistd.h> |
| |
| uint64_t r[3] = {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff}; |
| void loop() |
| { |
| long res; |
| res = syscall(__NR_socket, 2, 3, 0x10); |
| if (res != -1) |
| r[0] = res; |
| memcpy((void*)0x20000000, "F", 1); |
| syscall(__NR_setsockopt, r[0], 0, 3, 0x20000000, 1); |
| res = syscall(__NR_socket, 2, 3, 1); |
| if (res != -1) |
| r[1] = res; |
| memcpy((void*)0x203b3cf8, "\x72\x61\x77\x00\x00\x00\x00\x00\x00\x00\x00\x00" |
| "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" |
| "\x00\x00\x00\x00\x00\x00\x00\x00", |
| 32); |
| *(uint32_t*)0x203b3d18 = 9; |
| *(uint32_t*)0x203b3d1c = 3; |
| *(uint32_t*)0x203b3d20 = 0x2a8; |
| *(uint32_t*)0x203b3d24 = 0x158; |
| *(uint32_t*)0x203b3d28 = -1; |
| *(uint32_t*)0x203b3d2c = -1; |
| *(uint32_t*)0x203b3d30 = 0; |
| *(uint32_t*)0x203b3d34 = -1; |
| *(uint32_t*)0x203b3d38 = 0x210; |
| *(uint32_t*)0x203b3d3c = -1; |
| *(uint32_t*)0x203b3d40 = -1; |
| *(uint32_t*)0x203b3d44 = 0x210; |
| *(uint32_t*)0x203b3d48 = -1; |
| *(uint32_t*)0x203b3d4c = 3; |
| *(uint64_t*)0x203b3d50 = 0x200a5000; |
| *(uint8_t*)0x203b3d58 = 0; |
| *(uint8_t*)0x203b3d59 = 0; |
| *(uint8_t*)0x203b3d5a = 0; |
| *(uint8_t*)0x203b3d5b = 0; |
| *(uint8_t*)0x203b3d5c = 0; |
| *(uint8_t*)0x203b3d5d = 0; |
| *(uint8_t*)0x203b3d5e = 0; |
| *(uint8_t*)0x203b3d5f = 0; |
| *(uint8_t*)0x203b3d60 = 0; |
| *(uint8_t*)0x203b3d61 = 0; |
| *(uint8_t*)0x203b3d62 = 0; |
| *(uint8_t*)0x203b3d63 = 0; |
| *(uint8_t*)0x203b3d64 = 0; |
| *(uint8_t*)0x203b3d65 = 0; |
| *(uint8_t*)0x203b3d66 = 0; |
| *(uint8_t*)0x203b3d67 = 0; |
| *(uint8_t*)0x203b3d68 = 0; |
| *(uint8_t*)0x203b3d69 = 0; |
| *(uint8_t*)0x203b3d6a = 0; |
| *(uint8_t*)0x203b3d6b = 0; |
| *(uint8_t*)0x203b3d6c = 0; |
| *(uint8_t*)0x203b3d6d = 0; |
| *(uint8_t*)0x203b3d6e = 0; |
| *(uint8_t*)0x203b3d6f = 0; |
| *(uint8_t*)0x203b3d70 = 0; |
| *(uint8_t*)0x203b3d71 = 0; |
| *(uint8_t*)0x203b3d72 = 0; |
| *(uint8_t*)0x203b3d73 = 0; |
| *(uint8_t*)0x203b3d74 = 0; |
| *(uint8_t*)0x203b3d75 = 0; |
| *(uint8_t*)0x203b3d76 = 0; |
| *(uint8_t*)0x203b3d77 = 0; |
| *(uint8_t*)0x203b3d78 = 0; |
| *(uint8_t*)0x203b3d79 = 0; |
| *(uint8_t*)0x203b3d7a = 0; |
| *(uint8_t*)0x203b3d7b = 0; |
| *(uint8_t*)0x203b3d7c = 0; |
| *(uint8_t*)0x203b3d7d = 0; |
| *(uint8_t*)0x203b3d7e = 0; |
| *(uint8_t*)0x203b3d7f = 0; |
| *(uint8_t*)0x203b3d80 = 0; |
| *(uint8_t*)0x203b3d81 = 0; |
| *(uint8_t*)0x203b3d82 = 0; |
| *(uint8_t*)0x203b3d83 = 0; |
| *(uint8_t*)0x203b3d84 = 0; |
| *(uint8_t*)0x203b3d85 = 0; |
| *(uint8_t*)0x203b3d86 = 0; |
| *(uint8_t*)0x203b3d87 = 0; |
| *(uint8_t*)0x203b3d88 = 0; |
| *(uint8_t*)0x203b3d89 = 0; |
| *(uint8_t*)0x203b3d8a = 0; |
| *(uint8_t*)0x203b3d8b = 0; |
| *(uint8_t*)0x203b3d8c = 0; |
| *(uint8_t*)0x203b3d8d = 0; |
| *(uint8_t*)0x203b3d8e = 0; |
| *(uint8_t*)0x203b3d8f = 0; |
| *(uint8_t*)0x203b3d90 = 0; |
| *(uint8_t*)0x203b3d91 = 0; |
| *(uint8_t*)0x203b3d92 = 0; |
| *(uint8_t*)0x203b3d93 = 0; |
| *(uint8_t*)0x203b3d94 = 0; |
| *(uint8_t*)0x203b3d95 = 0; |
| *(uint8_t*)0x203b3d96 = 0; |
| *(uint8_t*)0x203b3d97 = 0; |
| *(uint8_t*)0x203b3d98 = 0; |
| *(uint8_t*)0x203b3d99 = 0; |
| *(uint8_t*)0x203b3d9a = 0; |
| *(uint8_t*)0x203b3d9b = 0; |
| *(uint8_t*)0x203b3d9c = 0; |
| *(uint8_t*)0x203b3d9d = 0; |
| *(uint8_t*)0x203b3d9e = 0; |
| *(uint8_t*)0x203b3d9f = 0; |
| *(uint8_t*)0x203b3da0 = 0; |
| *(uint8_t*)0x203b3da1 = 0; |
| *(uint8_t*)0x203b3da2 = 0; |
| *(uint8_t*)0x203b3da3 = 0; |
| *(uint8_t*)0x203b3da4 = 0; |
| *(uint8_t*)0x203b3da5 = 0; |
| *(uint8_t*)0x203b3da6 = 0; |
| *(uint8_t*)0x203b3da7 = 0; |
| *(uint8_t*)0x203b3da8 = 0; |
| *(uint8_t*)0x203b3da9 = 0; |
| *(uint8_t*)0x203b3daa = 0; |
| *(uint8_t*)0x203b3dab = 0; |
| *(uint32_t*)0x203b3dac = 0; |
| *(uint16_t*)0x203b3db0 = 0x130; |
| *(uint16_t*)0x203b3db2 = 0x158; |
| *(uint32_t*)0x203b3db4 = 0; |
| *(uint64_t*)0x203b3db8 = 0; |
| *(uint64_t*)0x203b3dc0 = 0; |
| *(uint16_t*)0x203b3dc8 = 0xc0; |
| memcpy((void*)0x203b3dca, "\x73\x74\x72\x69\x6e\x67\x00\x00\x00\x00\x00\x00" |
| "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" |
| "\x00\x00\x00\x00\x00", |
| 29); |
| *(uint8_t*)0x203b3de7 = 1; |
| *(uint16_t*)0x203b3de8 = 0; |
| *(uint16_t*)0x203b3dea = 0; |
| memcpy((void*)0x203b3dec, |
| "\x6b\x6d\x70\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", |
| 16); |
| memcpy((void*)0x203b3dfc, |
| "\xec\xfd\x00\x37\xdc\xd3\x40\xe5\xa6\x17\x7a\x67\x97\xbe\xa2\x12\x74" |
| "\x43\xe4\x63\x69\xbd\x74\x86\x27\x29\xee\x03\x4a\x86\x42\x05\x44\xc7" |
| "\x24\xa4\x52\xdb\x12\xa4\xc2\x04\x50\x00\x24\x4d\xb8\x7c\x09\x8f\xf4" |
| "\xf4\x1d\x4b\xbb\x35\xf9\x45\xf2\x8a\x03\x06\xbe\x53\x61\x77\x77\x8b" |
| "\x12\x16\x49\xcf\x15\x1f\x11\xf7\xba\x76\xd0\x4e\xe6\xc2\xca\x95\xef" |
| "\xdf\x78\x02\xc1\x08\x16\xbf\xf1\x76\x3b\xac\x09\x73\xae\x3a\x20\x08" |
| "\xb0\xf9\xa4\xed\x3b\x32\x94\xf0\x68\x7f\x31\xc8\xb1\xcf\x4f\xde\x5a" |
| "\xcc\x3a\x19\x0f\xfc\x19\xa9\x35\x87", |
| 128); |
| *(uint8_t*)0x203b3e7c = 0x69; |
| *(uint8_t*)0x203b3e7d = 0; |
| *(uint64_t*)0x203b3e80 = 0; |
| *(uint16_t*)0x203b3e88 = 0x28; |
| memcpy((void*)0x203b3e8a, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" |
| "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" |
| "\x00\x00\x00\x00\x00", |
| 29); |
| *(uint8_t*)0x203b3ea7 = 0; |
| *(uint32_t*)0x203b3ea8 = 0xfffffffb; |
| *(uint8_t*)0x203b3eb0 = 0; |
| *(uint8_t*)0x203b3eb1 = 0; |
| *(uint8_t*)0x203b3eb2 = 0; |
| *(uint8_t*)0x203b3eb3 = 0; |
| *(uint8_t*)0x203b3eb4 = 0; |
| *(uint8_t*)0x203b3eb5 = 0; |
| *(uint8_t*)0x203b3eb6 = 0; |
| *(uint8_t*)0x203b3eb7 = 0; |
| *(uint8_t*)0x203b3eb8 = 0; |
| *(uint8_t*)0x203b3eb9 = 0; |
| *(uint8_t*)0x203b3eba = 0; |
| *(uint8_t*)0x203b3ebb = 0; |
| *(uint8_t*)0x203b3ebc = 0; |
| *(uint8_t*)0x203b3ebd = 0; |
| *(uint8_t*)0x203b3ebe = 0; |
| *(uint8_t*)0x203b3ebf = 0; |
| *(uint8_t*)0x203b3ec0 = 0; |
| *(uint8_t*)0x203b3ec1 = 0; |
| *(uint8_t*)0x203b3ec2 = 0; |
| *(uint8_t*)0x203b3ec3 = 0; |
| *(uint8_t*)0x203b3ec4 = 0; |
| *(uint8_t*)0x203b3ec5 = 0; |
| *(uint8_t*)0x203b3ec6 = 0; |
| *(uint8_t*)0x203b3ec7 = 0; |
| *(uint8_t*)0x203b3ec8 = 0; |
| *(uint8_t*)0x203b3ec9 = 0; |
| *(uint8_t*)0x203b3eca = 0; |
| *(uint8_t*)0x203b3ecb = 0; |
| *(uint8_t*)0x203b3ecc = 0; |
| *(uint8_t*)0x203b3ecd = 0; |
| *(uint8_t*)0x203b3ece = 0; |
| *(uint8_t*)0x203b3ecf = 0; |
| *(uint8_t*)0x203b3ed0 = 0; |
| *(uint8_t*)0x203b3ed1 = 0; |
| *(uint8_t*)0x203b3ed2 = 0; |
| *(uint8_t*)0x203b3ed3 = 0; |
| *(uint8_t*)0x203b3ed4 = 0; |
| *(uint8_t*)0x203b3ed5 = 0; |
| *(uint8_t*)0x203b3ed6 = 0; |
| *(uint8_t*)0x203b3ed7 = 0; |
| *(uint8_t*)0x203b3ed8 = 0; |
| *(uint8_t*)0x203b3ed9 = 0; |
| *(uint8_t*)0x203b3eda = 0; |
| *(uint8_t*)0x203b3edb = 0; |
| *(uint8_t*)0x203b3edc = 0; |
| *(uint8_t*)0x203b3edd = 0; |
| *(uint8_t*)0x203b3ede = 0; |
| *(uint8_t*)0x203b3edf = 0; |
| *(uint8_t*)0x203b3ee0 = 0; |
| *(uint8_t*)0x203b3ee1 = 0; |
| *(uint8_t*)0x203b3ee2 = 0; |
| *(uint8_t*)0x203b3ee3 = 0; |
| *(uint8_t*)0x203b3ee4 = 0; |
| *(uint8_t*)0x203b3ee5 = 0; |
| *(uint8_t*)0x203b3ee6 = 0; |
| *(uint8_t*)0x203b3ee7 = 0; |
| *(uint8_t*)0x203b3ee8 = 0; |
| *(uint8_t*)0x203b3ee9 = 0; |
| *(uint8_t*)0x203b3eea = 0; |
| *(uint8_t*)0x203b3eeb = 0; |
| *(uint8_t*)0x203b3eec = 0; |
| *(uint8_t*)0x203b3eed = 0; |
| *(uint8_t*)0x203b3eee = 0; |
| *(uint8_t*)0x203b3eef = 0; |
| *(uint8_t*)0x203b3ef0 = 0; |
| *(uint8_t*)0x203b3ef1 = 0; |
| *(uint8_t*)0x203b3ef2 = 0; |
| *(uint8_t*)0x203b3ef3 = 0; |
| *(uint8_t*)0x203b3ef4 = 0; |
| *(uint8_t*)0x203b3ef5 = 0; |
| *(uint8_t*)0x203b3ef6 = 0; |
| *(uint8_t*)0x203b3ef7 = 0; |
| *(uint8_t*)0x203b3ef8 = 0; |
| *(uint8_t*)0x203b3ef9 = 0; |
| *(uint8_t*)0x203b3efa = 0; |
| *(uint8_t*)0x203b3efb = 0; |
| *(uint8_t*)0x203b3efc = 0; |
| *(uint8_t*)0x203b3efd = 0; |
| *(uint8_t*)0x203b3efe = 0; |
| *(uint8_t*)0x203b3eff = 0; |
| *(uint8_t*)0x203b3f00 = 0; |
| *(uint8_t*)0x203b3f01 = 0; |
| *(uint8_t*)0x203b3f02 = 0; |
| *(uint8_t*)0x203b3f03 = 0; |
| *(uint32_t*)0x203b3f04 = 0; |
| *(uint16_t*)0x203b3f08 = 0x70; |
| *(uint16_t*)0x203b3f0a = 0xb8; |
| *(uint32_t*)0x203b3f0c = 0; |
| *(uint64_t*)0x203b3f10 = 0; |
| *(uint64_t*)0x203b3f18 = 0; |
| *(uint16_t*)0x203b3f20 = 0x48; |
| memcpy((void*)0x203b3f22, "\x43\x54\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" |
| "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" |
| "\x00\x00\x00\x00\x00", |
| 29); |
| *(uint8_t*)0x203b3f3f = 0; |
| *(uint16_t*)0x203b3f40 = 0; |
| *(uint16_t*)0x203b3f42 = 0; |
| *(uint32_t*)0x203b3f44 = 0; |
| *(uint32_t*)0x203b3f48 = 0; |
| memcpy((void*)0x203b3f4c, |
| "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", |
| 16); |
| *(uint64_t*)0x203b3f60 = 0; |
| *(uint8_t*)0x203b3f68 = 0; |
| *(uint8_t*)0x203b3f69 = 0; |
| *(uint8_t*)0x203b3f6a = 0; |
| *(uint8_t*)0x203b3f6b = 0; |
| *(uint8_t*)0x203b3f6c = 0; |
| *(uint8_t*)0x203b3f6d = 0; |
| *(uint8_t*)0x203b3f6e = 0; |
| *(uint8_t*)0x203b3f6f = 0; |
| *(uint8_t*)0x203b3f70 = 0; |
| *(uint8_t*)0x203b3f71 = 0; |
| *(uint8_t*)0x203b3f72 = 0; |
| *(uint8_t*)0x203b3f73 = 0; |
| *(uint8_t*)0x203b3f74 = 0; |
| *(uint8_t*)0x203b3f75 = 0; |
| *(uint8_t*)0x203b3f76 = 0; |
| *(uint8_t*)0x203b3f77 = 0; |
| *(uint8_t*)0x203b3f78 = 0; |
| *(uint8_t*)0x203b3f79 = 0; |
| *(uint8_t*)0x203b3f7a = 0; |
| *(uint8_t*)0x203b3f7b = 0; |
| *(uint8_t*)0x203b3f7c = 0; |
| *(uint8_t*)0x203b3f7d = 0; |
| *(uint8_t*)0x203b3f7e = 0; |
| *(uint8_t*)0x203b3f7f = 0; |
| *(uint8_t*)0x203b3f80 = 0; |
| *(uint8_t*)0x203b3f81 = 0; |
| *(uint8_t*)0x203b3f82 = 0; |
| *(uint8_t*)0x203b3f83 = 0; |
| *(uint8_t*)0x203b3f84 = 0; |
| *(uint8_t*)0x203b3f85 = 0; |
| *(uint8_t*)0x203b3f86 = 0; |
| *(uint8_t*)0x203b3f87 = 0; |
| *(uint8_t*)0x203b3f88 = 0; |
| *(uint8_t*)0x203b3f89 = 0; |
| *(uint8_t*)0x203b3f8a = 0; |
| *(uint8_t*)0x203b3f8b = 0; |
| *(uint8_t*)0x203b3f8c = 0; |
| *(uint8_t*)0x203b3f8d = 0; |
| *(uint8_t*)0x203b3f8e = 0; |
| *(uint8_t*)0x203b3f8f = 0; |
| *(uint8_t*)0x203b3f90 = 0; |
| *(uint8_t*)0x203b3f91 = 0; |
| *(uint8_t*)0x203b3f92 = 0; |
| *(uint8_t*)0x203b3f93 = 0; |
| *(uint8_t*)0x203b3f94 = 0; |
| *(uint8_t*)0x203b3f95 = 0; |
| *(uint8_t*)0x203b3f96 = 0; |
| *(uint8_t*)0x203b3f97 = 0; |
| *(uint8_t*)0x203b3f98 = 0; |
| *(uint8_t*)0x203b3f99 = 0; |
| *(uint8_t*)0x203b3f9a = 0; |
| *(uint8_t*)0x203b3f9b = 0; |
| *(uint8_t*)0x203b3f9c = 0; |
| *(uint8_t*)0x203b3f9d = 0; |
| *(uint8_t*)0x203b3f9e = 0; |
| *(uint8_t*)0x203b3f9f = 0; |
| *(uint8_t*)0x203b3fa0 = 0; |
| *(uint8_t*)0x203b3fa1 = 0; |
| *(uint8_t*)0x203b3fa2 = 0; |
| *(uint8_t*)0x203b3fa3 = 0; |
| *(uint8_t*)0x203b3fa4 = 0; |
| *(uint8_t*)0x203b3fa5 = 0; |
| *(uint8_t*)0x203b3fa6 = 0; |
| *(uint8_t*)0x203b3fa7 = 0; |
| *(uint8_t*)0x203b3fa8 = 0; |
| *(uint8_t*)0x203b3fa9 = 0; |
| *(uint8_t*)0x203b3faa = 0; |
| *(uint8_t*)0x203b3fab = 0; |
| *(uint8_t*)0x203b3fac = 0; |
| *(uint8_t*)0x203b3fad = 0; |
| *(uint8_t*)0x203b3fae = 0; |
| *(uint8_t*)0x203b3faf = 0; |
| *(uint8_t*)0x203b3fb0 = 0; |
| *(uint8_t*)0x203b3fb1 = 0; |
| *(uint8_t*)0x203b3fb2 = 0; |
| *(uint8_t*)0x203b3fb3 = 0; |
| *(uint8_t*)0x203b3fb4 = 0; |
| *(uint8_t*)0x203b3fb5 = 0; |
| *(uint8_t*)0x203b3fb6 = 0; |
| *(uint8_t*)0x203b3fb7 = 0; |
| *(uint8_t*)0x203b3fb8 = 0; |
| *(uint8_t*)0x203b3fb9 = 0; |
| *(uint8_t*)0x203b3fba = 0; |
| *(uint8_t*)0x203b3fbb = 0; |
| *(uint32_t*)0x203b3fbc = 0; |
| *(uint16_t*)0x203b3fc0 = 0x70; |
| *(uint16_t*)0x203b3fc2 = 0x98; |
| *(uint32_t*)0x203b3fc4 = 0; |
| *(uint64_t*)0x203b3fc8 = 0; |
| *(uint64_t*)0x203b3fd0 = 0; |
| *(uint16_t*)0x203b3fd8 = 0x28; |
| memcpy((void*)0x203b3fda, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" |
| "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" |
| "\x00\x00\x00\x00\x00", |
| 29); |
| *(uint8_t*)0x203b3ff7 = 0; |
| *(uint32_t*)0x203b3ff8 = 0xfffffffe; |
| syscall(__NR_setsockopt, r[1], 0, 0x40, 0x203b3cf8, 0x308); |
| res = syscall(__NR_socket, 2, 2, 0); |
| if (res != -1) |
| r[2] = res; |
| memcpy((void*)0x20000000, "\x66\x69\x6c\x74\x65\x72\x00\x00\x00\x00\x00\x00" |
| "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" |
| "\x00\x00\x00\x00\x00\x00\x00\x00", |
| 32); |
| *(uint32_t*)0x20000020 = 0xe; |
| *(uint32_t*)0x20000024 = 4; |
| *(uint32_t*)0x20000028 = 0x358; |
| *(uint32_t*)0x2000002c = -1; |
| *(uint32_t*)0x20000030 = 0; |
| *(uint32_t*)0x20000034 = 0x1d0; |
| *(uint32_t*)0x20000038 = 0; |
| *(uint32_t*)0x2000003c = -1; |
| *(uint32_t*)0x20000040 = -1; |
| *(uint32_t*)0x20000044 = 0x2c0; |
| *(uint32_t*)0x20000048 = 0x2c0; |
| *(uint32_t*)0x2000004c = 0x2c0; |
| *(uint32_t*)0x20000050 = -1; |
| *(uint32_t*)0x20000054 = 4; |
| *(uint64_t*)0x20000058 = 0x20001fc0; |
| *(uint8_t*)0x20000060 = 0; |
| *(uint8_t*)0x20000061 = 0; |
| *(uint8_t*)0x20000062 = 0; |
| *(uint8_t*)0x20000063 = 0; |
| *(uint8_t*)0x20000064 = 0; |
| *(uint8_t*)0x20000065 = 0; |
| *(uint8_t*)0x20000066 = 0; |
| *(uint8_t*)0x20000067 = 0; |
| *(uint8_t*)0x20000068 = 0; |
| *(uint8_t*)0x20000069 = 0; |
| *(uint8_t*)0x2000006a = 0; |
| *(uint8_t*)0x2000006b = 0; |
| *(uint8_t*)0x2000006c = 0; |
| *(uint8_t*)0x2000006d = 0; |
| *(uint8_t*)0x2000006e = 0; |
| *(uint8_t*)0x2000006f = 0; |
| *(uint8_t*)0x20000070 = 0; |
| *(uint8_t*)0x20000071 = 0; |
| *(uint8_t*)0x20000072 = 0; |
| *(uint8_t*)0x20000073 = 0; |
| *(uint8_t*)0x20000074 = 0; |
| *(uint8_t*)0x20000075 = 0; |
| *(uint8_t*)0x20000076 = 0; |
| *(uint8_t*)0x20000077 = 0; |
| *(uint8_t*)0x20000078 = 0; |
| *(uint8_t*)0x20000079 = 0; |
| *(uint8_t*)0x2000007a = 0; |
| *(uint8_t*)0x2000007b = 0; |
| *(uint8_t*)0x2000007c = 0; |
| *(uint8_t*)0x2000007d = 0; |
| *(uint8_t*)0x2000007e = 0; |
| *(uint8_t*)0x2000007f = 0; |
| *(uint8_t*)0x20000080 = 0; |
| *(uint8_t*)0x20000081 = 0; |
| *(uint8_t*)0x20000082 = 0; |
| *(uint8_t*)0x20000083 = 0; |
| *(uint8_t*)0x20000084 = 0; |
| *(uint8_t*)0x20000085 = 0; |
| *(uint8_t*)0x20000086 = 0; |
| *(uint8_t*)0x20000087 = 0; |
| *(uint8_t*)0x20000088 = 0; |
| *(uint8_t*)0x20000089 = 0; |
| *(uint8_t*)0x2000008a = 0; |
| *(uint8_t*)0x2000008b = 0; |
| *(uint8_t*)0x2000008c = 0; |
| *(uint8_t*)0x2000008d = 0; |
| *(uint8_t*)0x2000008e = 0; |
| *(uint8_t*)0x2000008f = 0; |
| *(uint8_t*)0x20000090 = 0; |
| *(uint8_t*)0x20000091 = 0; |
| *(uint8_t*)0x20000092 = 0; |
| *(uint8_t*)0x20000093 = 0; |
| *(uint8_t*)0x20000094 = 0; |
| *(uint8_t*)0x20000095 = 0; |
| *(uint8_t*)0x20000096 = 0; |
| *(uint8_t*)0x20000097 = 0; |
| *(uint8_t*)0x20000098 = 0; |
| *(uint8_t*)0x20000099 = 0; |
| *(uint8_t*)0x2000009a = 0; |
| *(uint8_t*)0x2000009b = 0; |
| *(uint8_t*)0x2000009c = 0; |
| *(uint8_t*)0x2000009d = 0; |
| *(uint8_t*)0x2000009e = 0; |
| *(uint8_t*)0x2000009f = 0; |
| *(uint8_t*)0x200000a0 = 0; |
| *(uint8_t*)0x200000a1 = 0; |
| *(uint8_t*)0x200000a2 = 0; |
| *(uint8_t*)0x200000a3 = 0; |
| *(uint8_t*)0x200000a4 = 0; |
| *(uint8_t*)0x200000a5 = 0; |
| *(uint8_t*)0x200000a6 = 0; |
| *(uint8_t*)0x200000a7 = 0; |
| *(uint8_t*)0x200000a8 = 0; |
| *(uint8_t*)0x200000a9 = 0; |
| *(uint8_t*)0x200000aa = 0; |
| *(uint8_t*)0x200000ab = 0; |
| *(uint8_t*)0x200000ac = 0; |
| *(uint8_t*)0x200000ad = 0; |
| *(uint8_t*)0x200000ae = 0; |
| *(uint8_t*)0x200000af = 0; |
| *(uint8_t*)0x200000b0 = 0; |
| *(uint8_t*)0x200000b1 = 0; |
| *(uint8_t*)0x200000b2 = 0; |
| *(uint8_t*)0x200000b3 = 0; |
| *(uint32_t*)0x200000b4 = 0; |
| *(uint16_t*)0x200000b8 = 0xe0; |
| *(uint16_t*)0x200000ba = 0x108; |
| *(uint32_t*)0x200000bc = 0; |
| *(uint64_t*)0x200000c0 = 0; |
| *(uint64_t*)0x200000c8 = 0; |
| *(uint16_t*)0x200000d0 = 0x38; |
| memcpy((void*)0x200000d2, "\x64\x65\x76\x67\x72\x6f\x75\x70\x00\x00\x00\x00" |
| "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" |
| "\x00\x00\x00\x00\x00", |
| 29); |
| *(uint8_t*)0x200000ef = 0; |
| *(uint32_t*)0x200000f0 = 0; |
| *(uint32_t*)0x200000f4 = 0; |
| *(uint32_t*)0x200000f8 = 0; |
| *(uint32_t*)0x200000fc = 0; |
| *(uint32_t*)0x20000100 = 0; |
| *(uint16_t*)0x20000108 = 0x38; |
| memcpy((void*)0x2000010a, "\x63\x6f\x6e\x6e\x62\x79\x74\x65\x73\x00\x00\x00" |
| "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" |
| "\x00\x00\x00\x00\x00", |
| 29); |
| *(uint8_t*)0x20000127 = 0; |
| *(uint64_t*)0x20000128 = 0; |
| *(uint64_t*)0x20000130 = 0; |
| *(uint8_t*)0x20000138 = 0; |
| *(uint8_t*)0x20000139 = 0; |
| *(uint16_t*)0x20000140 = 0x28; |
| memcpy((void*)0x20000142, "\x52\x45\x4a\x45\x43\x54\x00\x00\x00\x00\x00\x00" |
| "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" |
| "\x00\x00\x00\x00\x00", |
| 29); |
| *(uint8_t*)0x2000015f = 0; |
| *(uint32_t*)0x20000160 = 0; |
| *(uint8_t*)0x20000168 = 0; |
| *(uint8_t*)0x20000169 = 0; |
| *(uint8_t*)0x2000016a = 0; |
| *(uint8_t*)0x2000016b = 0; |
| *(uint8_t*)0x2000016c = 0; |
| *(uint8_t*)0x2000016d = 0; |
| *(uint8_t*)0x2000016e = 0; |
| *(uint8_t*)0x2000016f = 0; |
| *(uint8_t*)0x20000170 = 0; |
| *(uint8_t*)0x20000171 = 0; |
| *(uint8_t*)0x20000172 = 0; |
| *(uint8_t*)0x20000173 = 0; |
| *(uint8_t*)0x20000174 = 0; |
| *(uint8_t*)0x20000175 = 0; |
| *(uint8_t*)0x20000176 = 0; |
| *(uint8_t*)0x20000177 = 0; |
| *(uint8_t*)0x20000178 = 0; |
| *(uint8_t*)0x20000179 = 0; |
| *(uint8_t*)0x2000017a = 0; |
| *(uint8_t*)0x2000017b = 0; |
| *(uint8_t*)0x2000017c = 0; |
| *(uint8_t*)0x2000017d = 0; |
| *(uint8_t*)0x2000017e = 0; |
| *(uint8_t*)0x2000017f = 0; |
| *(uint8_t*)0x20000180 = 0; |
| *(uint8_t*)0x20000181 = 0; |
| *(uint8_t*)0x20000182 = 0; |
| *(uint8_t*)0x20000183 = 0; |
| *(uint8_t*)0x20000184 = 0; |
| *(uint8_t*)0x20000185 = 0; |
| *(uint8_t*)0x20000186 = 0; |
| *(uint8_t*)0x20000187 = 0; |
| *(uint8_t*)0x20000188 = 0; |
| *(uint8_t*)0x20000189 = 0; |
| *(uint8_t*)0x2000018a = 0; |
| *(uint8_t*)0x2000018b = 0; |
| *(uint8_t*)0x2000018c = 0; |
| *(uint8_t*)0x2000018d = 0; |
| *(uint8_t*)0x2000018e = 0; |
| *(uint8_t*)0x2000018f = 0; |
| *(uint8_t*)0x20000190 = 0; |
| *(uint8_t*)0x20000191 = 0; |
| *(uint8_t*)0x20000192 = 0; |
| *(uint8_t*)0x20000193 = 0; |
| *(uint8_t*)0x20000194 = 0; |
| *(uint8_t*)0x20000195 = 0; |
| *(uint8_t*)0x20000196 = 0; |
| *(uint8_t*)0x20000197 = 0; |
| *(uint8_t*)0x20000198 = 0; |
| *(uint8_t*)0x20000199 = 0; |
| *(uint8_t*)0x2000019a = 0; |
| *(uint8_t*)0x2000019b = 0; |
| *(uint8_t*)0x2000019c = 0; |
| *(uint8_t*)0x2000019d = 0; |
| *(uint8_t*)0x2000019e = 0; |
| *(uint8_t*)0x2000019f = 0; |
| *(uint8_t*)0x200001a0 = 0; |
| *(uint8_t*)0x200001a1 = 0; |
| *(uint8_t*)0x200001a2 = 0; |
| *(uint8_t*)0x200001a3 = 0; |
| *(uint8_t*)0x200001a4 = 0; |
| *(uint8_t*)0x200001a5 = 0; |
| *(uint8_t*)0x200001a6 = 0; |
| *(uint8_t*)0x200001a7 = 0; |
| *(uint8_t*)0x200001a8 = 0; |
| *(uint8_t*)0x200001a9 = 0; |
| *(uint8_t*)0x200001aa = 0; |
| *(uint8_t*)0x200001ab = 0; |
| *(uint8_t*)0x200001ac = 0; |
| *(uint8_t*)0x200001ad = 0; |
| *(uint8_t*)0x200001ae = 0; |
| *(uint8_t*)0x200001af = 0; |
| *(uint8_t*)0x200001b0 = 0; |
| *(uint8_t*)0x200001b1 = 0; |
| *(uint8_t*)0x200001b2 = 0; |
| *(uint8_t*)0x200001b3 = 0; |
| *(uint8_t*)0x200001b4 = 0; |
| *(uint8_t*)0x200001b5 = 0; |
| *(uint8_t*)0x200001b6 = 0; |
| *(uint8_t*)0x200001b7 = 0; |
| *(uint8_t*)0x200001b8 = 0; |
| *(uint8_t*)0x200001b9 = 0; |
| *(uint8_t*)0x200001ba = 0; |
| *(uint8_t*)0x200001bb = 0; |
| *(uint32_t*)0x200001bc = 0; |
| *(uint16_t*)0x200001c0 = 0xa0; |
| *(uint16_t*)0x200001c2 = 0xc8; |
| *(uint32_t*)0x200001c4 = 0; |
| *(uint64_t*)0x200001c8 = 0; |
| *(uint64_t*)0x200001d0 = 0; |
| *(uint16_t*)0x200001d8 = 0x30; |
| memcpy((void*)0x200001da, "\x63\x6c\x75\x73\x74\x65\x72\x00\x00\x00\x00\x00" |
| "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" |
| "\x00\x00\x00\x00\x00", |
| 29); |
| *(uint8_t*)0x200001f7 = 0; |
| *(uint32_t*)0x200001f8 = 0; |
| *(uint32_t*)0x200001fc = 0; |
| *(uint32_t*)0x20000200 = 0; |
| *(uint32_t*)0x20000204 = 0; |
| *(uint16_t*)0x20000208 = 0x28; |
| memcpy((void*)0x2000020a, "\x52\x45\x4a\x45\x43\x54\x00\x00\x00\x00\x00\x00" |
| "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" |
| "\x00\x00\x00\x00\x00", |
| 29); |
| *(uint8_t*)0x20000227 = 0; |
| *(uint32_t*)0x20000228 = 0; |
| *(uint8_t*)0x20000230 = 0; |
| *(uint8_t*)0x20000231 = 0; |
| *(uint8_t*)0x20000232 = 0; |
| *(uint8_t*)0x20000233 = 0; |
| *(uint8_t*)0x20000234 = 0; |
| *(uint8_t*)0x20000235 = 0; |
| *(uint8_t*)0x20000236 = 0; |
| *(uint8_t*)0x20000237 = 0; |
| *(uint8_t*)0x20000238 = 0; |
| *(uint8_t*)0x20000239 = 0; |
| *(uint8_t*)0x2000023a = 0; |
| *(uint8_t*)0x2000023b = 0; |
| *(uint8_t*)0x2000023c = 0; |
| *(uint8_t*)0x2000023d = 0; |
| *(uint8_t*)0x2000023e = 0; |
| *(uint8_t*)0x2000023f = 0; |
| *(uint8_t*)0x20000240 = 0; |
| *(uint8_t*)0x20000241 = 0; |
| *(uint8_t*)0x20000242 = 0; |
| *(uint8_t*)0x20000243 = 0; |
| *(uint8_t*)0x20000244 = 0; |
| *(uint8_t*)0x20000245 = 0; |
| *(uint8_t*)0x20000246 = 0; |
| *(uint8_t*)0x20000247 = 0; |
| *(uint8_t*)0x20000248 = 0; |
| *(uint8_t*)0x20000249 = 0; |
| *(uint8_t*)0x2000024a = 0; |
| *(uint8_t*)0x2000024b = 0; |
| *(uint8_t*)0x2000024c = 0; |
| *(uint8_t*)0x2000024d = 0; |
| *(uint8_t*)0x2000024e = 0; |
| *(uint8_t*)0x2000024f = 0; |
| *(uint8_t*)0x20000250 = 0; |
| *(uint8_t*)0x20000251 = 0; |
| *(uint8_t*)0x20000252 = 0; |
| *(uint8_t*)0x20000253 = 0; |
| *(uint8_t*)0x20000254 = 0; |
| *(uint8_t*)0x20000255 = 0; |
| *(uint8_t*)0x20000256 = 0; |
| *(uint8_t*)0x20000257 = 0; |
| *(uint8_t*)0x20000258 = 0; |
| *(uint8_t*)0x20000259 = 0; |
| *(uint8_t*)0x2000025a = 0; |
| *(uint8_t*)0x2000025b = 0; |
| *(uint8_t*)0x2000025c = 0; |
| *(uint8_t*)0x2000025d = 0; |
| *(uint8_t*)0x2000025e = 0; |
| *(uint8_t*)0x2000025f = 0; |
| *(uint8_t*)0x20000260 = 0; |
| *(uint8_t*)0x20000261 = 0; |
| *(uint8_t*)0x20000262 = 0; |
| *(uint8_t*)0x20000263 = 0; |
| *(uint8_t*)0x20000264 = 0; |
| *(uint8_t*)0x20000265 = 0; |
| *(uint8_t*)0x20000266 = 0; |
| *(uint8_t*)0x20000267 = 0; |
| *(uint8_t*)0x20000268 = 0; |
| *(uint8_t*)0x20000269 = 0; |
| *(uint8_t*)0x2000026a = 0; |
| *(uint8_t*)0x2000026b = 0; |
| *(uint8_t*)0x2000026c = 0; |
| *(uint8_t*)0x2000026d = 0; |
| *(uint8_t*)0x2000026e = 0; |
| *(uint8_t*)0x2000026f = 0; |
| *(uint8_t*)0x20000270 = 0; |
| *(uint8_t*)0x20000271 = 0; |
| *(uint8_t*)0x20000272 = 0; |
| *(uint8_t*)0x20000273 = 0; |
| *(uint8_t*)0x20000274 = 0; |
| *(uint8_t*)0x20000275 = 0; |
| *(uint8_t*)0x20000276 = 0; |
| *(uint8_t*)0x20000277 = 0; |
| *(uint8_t*)0x20000278 = 0; |
| *(uint8_t*)0x20000279 = 0; |
| *(uint8_t*)0x2000027a = 0; |
| *(uint8_t*)0x2000027b = 0; |
| *(uint8_t*)0x2000027c = 0; |
| *(uint8_t*)0x2000027d = 0; |
| *(uint8_t*)0x2000027e = 0; |
| *(uint8_t*)0x2000027f = 0; |
| *(uint8_t*)0x20000280 = 0; |
| *(uint8_t*)0x20000281 = 0; |
| *(uint8_t*)0x20000282 = 0; |
| *(uint8_t*)0x20000283 = 0; |
| *(uint32_t*)0x20000284 = 0; |
| *(uint16_t*)0x20000288 = 0xc8; |
| *(uint16_t*)0x2000028a = 0xf0; |
| *(uint32_t*)0x2000028c = 0; |
| *(uint64_t*)0x20000290 = 0; |
| *(uint64_t*)0x20000298 = 0; |
| *(uint16_t*)0x200002a0 = 0x30; |
| memcpy((void*)0x200002a2, "\x61\x64\x64\x72\x74\x79\x70\x65\x00\x00\x00\x00" |
| "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" |
| "\x00\x00\x00\x00\x00", |
| 29); |
| *(uint8_t*)0x200002bf = 0; |
| *(uint16_t*)0x200002c0 = 0; |
| *(uint16_t*)0x200002c2 = 0; |
| *(uint32_t*)0x200002c4 = 0; |
| *(uint32_t*)0x200002c8 = 0; |
| *(uint16_t*)0x200002d0 = 0x28; |
| memcpy((void*)0x200002d2, "\x74\x74\x6c\x00\x00\x00\x00\x00\x00\x00\x00\x00" |
| "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" |
| "\x00\x00\x00\x00\x00", |
| 29); |
| *(uint8_t*)0x200002ef = 0; |
| *(uint8_t*)0x200002f0 = 0; |
| *(uint8_t*)0x200002f1 = 0; |
| *(uint16_t*)0x200002f8 = 0x28; |
| memcpy((void*)0x200002fa, "\x52\x45\x4a\x45\x43\x54\x00\x00\x00\x00\x00\x00" |
| "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" |
| "\x00\x00\x00\x00\x00", |
| 29); |
| *(uint8_t*)0x20000317 = 0; |
| *(uint32_t*)0x20000318 = 0; |
| *(uint8_t*)0x20000320 = 0; |
| *(uint8_t*)0x20000321 = 0; |
| *(uint8_t*)0x20000322 = 0; |
| *(uint8_t*)0x20000323 = 0; |
| *(uint8_t*)0x20000324 = 0; |
| *(uint8_t*)0x20000325 = 0; |
| *(uint8_t*)0x20000326 = 0; |
| *(uint8_t*)0x20000327 = 0; |
| *(uint8_t*)0x20000328 = 0; |
| *(uint8_t*)0x20000329 = 0; |
| *(uint8_t*)0x2000032a = 0; |
| *(uint8_t*)0x2000032b = 0; |
| *(uint8_t*)0x2000032c = 0; |
| *(uint8_t*)0x2000032d = 0; |
| *(uint8_t*)0x2000032e = 0; |
| *(uint8_t*)0x2000032f = 0; |
| *(uint8_t*)0x20000330 = 0; |
| *(uint8_t*)0x20000331 = 0; |
| *(uint8_t*)0x20000332 = 0; |
| *(uint8_t*)0x20000333 = 0; |
| *(uint8_t*)0x20000334 = 0; |
| *(uint8_t*)0x20000335 = 0; |
| *(uint8_t*)0x20000336 = 0; |
| *(uint8_t*)0x20000337 = 0; |
| *(uint8_t*)0x20000338 = 0; |
| *(uint8_t*)0x20000339 = 0; |
| *(uint8_t*)0x2000033a = 0; |
| *(uint8_t*)0x2000033b = 0; |
| *(uint8_t*)0x2000033c = 0; |
| *(uint8_t*)0x2000033d = 0; |
| *(uint8_t*)0x2000033e = 0; |
| *(uint8_t*)0x2000033f = 0; |
| *(uint8_t*)0x20000340 = 0; |
| *(uint8_t*)0x20000341 = 0; |
| *(uint8_t*)0x20000342 = 0; |
| *(uint8_t*)0x20000343 = 0; |
| *(uint8_t*)0x20000344 = 0; |
| *(uint8_t*)0x20000345 = 0; |
| *(uint8_t*)0x20000346 = 0; |
| *(uint8_t*)0x20000347 = 0; |
| *(uint8_t*)0x20000348 = 0; |
| *(uint8_t*)0x20000349 = 0; |
| *(uint8_t*)0x2000034a = 0; |
| *(uint8_t*)0x2000034b = 0; |
| *(uint8_t*)0x2000034c = 0; |
| *(uint8_t*)0x2000034d = 0; |
| *(uint8_t*)0x2000034e = 0; |
| *(uint8_t*)0x2000034f = 0; |
| *(uint8_t*)0x20000350 = 0; |
| *(uint8_t*)0x20000351 = 0; |
| *(uint8_t*)0x20000352 = 0; |
| *(uint8_t*)0x20000353 = 0; |
| *(uint8_t*)0x20000354 = 0; |
| *(uint8_t*)0x20000355 = 0; |
| *(uint8_t*)0x20000356 = 0; |
| *(uint8_t*)0x20000357 = 0; |
| *(uint8_t*)0x20000358 = 0; |
| *(uint8_t*)0x20000359 = 0; |
| *(uint8_t*)0x2000035a = 0; |
| *(uint8_t*)0x2000035b = 0; |
| *(uint8_t*)0x2000035c = 0; |
| *(uint8_t*)0x2000035d = 0; |
| *(uint8_t*)0x2000035e = 0; |
| *(uint8_t*)0x2000035f = 0; |
| *(uint8_t*)0x20000360 = 0; |
| *(uint8_t*)0x20000361 = 0; |
| *(uint8_t*)0x20000362 = 0; |
| *(uint8_t*)0x20000363 = 0; |
| *(uint8_t*)0x20000364 = 0; |
| *(uint8_t*)0x20000365 = 0; |
| *(uint8_t*)0x20000366 = 0; |
| *(uint8_t*)0x20000367 = 0; |
| *(uint8_t*)0x20000368 = 0; |
| *(uint8_t*)0x20000369 = 0; |
| *(uint8_t*)0x2000036a = 0; |
| *(uint8_t*)0x2000036b = 0; |
| *(uint8_t*)0x2000036c = 0; |
| *(uint8_t*)0x2000036d = 0; |
| *(uint8_t*)0x2000036e = 0; |
| *(uint8_t*)0x2000036f = 0; |
| *(uint8_t*)0x20000370 = 0; |
| *(uint8_t*)0x20000371 = 0; |
| *(uint8_t*)0x20000372 = 0; |
| *(uint8_t*)0x20000373 = 0; |
| *(uint32_t*)0x20000374 = 0; |
| *(uint16_t*)0x20000378 = 0x70; |
| *(uint16_t*)0x2000037a = 0x98; |
| *(uint32_t*)0x2000037c = 0; |
| *(uint64_t*)0x20000380 = 0; |
| *(uint64_t*)0x20000388 = 0; |
| *(uint16_t*)0x20000390 = 0x28; |
| memcpy((void*)0x20000392, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" |
| "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" |
| "\x00\x00\x00\x00\x00", |
| 29); |
| *(uint8_t*)0x200003af = 0; |
| *(uint32_t*)0x200003b0 = 0xfffffffe; |
| syscall(__NR_setsockopt, r[2], 0, 0x40, 0x20000000, 0x3b8); |
| *(uint32_t*)0x20a19000 = 6; |
| syscall(__NR_setsockopt, r[0], 0, 0x16, 0x20a19000, 4); |
| memcpy((void*)0x20ff7000, "\x9c\xcb\x35\xcb\xbb\xa8\x6d\xdf\x42\xde\x61\x04" |
| "\x00\x00\x00\x2f\x7e\x4e\x02\xe7\x66\xcd\x8e\xcc" |
| "\xba\x56\x49\xdf\x09\x49\x6b\x50\x35\x6d\xdc\x9b" |
| "\xa7\x93\xc8\x1d\xef\x0a\x12\xcd\xa8\x90\x17\xe6", |
| 48); |
| *(uint16_t*)0x2066354c = 2; |
| *(uint16_t*)0x2066354e = htobe16(0x4e20); |
| *(uint32_t*)0x20663550 = htobe32(0); |
| *(uint8_t*)0x20663554 = 0; |
| *(uint8_t*)0x20663555 = 0; |
| *(uint8_t*)0x20663556 = 0; |
| *(uint8_t*)0x20663557 = 0; |
| *(uint8_t*)0x20663558 = 0; |
| *(uint8_t*)0x20663559 = 0; |
| *(uint8_t*)0x2066355a = 0; |
| *(uint8_t*)0x2066355b = 0; |
| syscall(__NR_sendto, r[0], 0x20ff7000, 0x30, 0, 0x2066354c, 0x10); |
| } |
| |
| int main() |
| { |
| syscall(__NR_mmap, 0x20000000, 0x1000000, 3, 0x32, -1, 0); |
| loop(); |
| return 0; |
| } |
