.file "vulnerable.c" .version "01.01" gcc2_compiled.: .text .align 4 .globl get_sp .type get_sp,@function get_sp: pushl %ebp movl %esp, %ebp #APP movl %esp,%eax #NO_APP popl %ebp ret .Lfe1: .size get_sp,.Lfe1-get_sp .section .rodata .LC0: .string "sp is %x\n" .LC1: .string "Name is %s\n" .text .align 4 .globl foo .type foo,@function foo: pushl %ebp movl %esp, %ebp subl $216, %esp subl $8, %esp subl $8, %esp call get_sp addl $8, %esp movl %eax, %eax pushl %eax pushl $.LC0 call printf addl $16, %esp subl $8, %esp pushl 8(%ebp) leal -216(%ebp), %eax pushl %eax call strcpy addl $16, %esp subl $8, %esp leal -216(%ebp), %eax pushl %eax pushl $.LC1 call printf addl $16, %esp leave ret .Lfe2: .size foo,.Lfe2-foo .section .rodata .LC2: .string "read in %d bytes\n" .LC3: .string "Strlen is %d\n" .LC4: .string "Done\n" .text .align 4 .globl main .type main,@function main: pushl %ebp movl %esp, %ebp subl $10024, %esp subl $4, %esp pushl $2000 leal -10008(%ebp), %eax pushl %eax pushl $0 call read addl $16, %esp movl %eax, %eax movl %eax, -10012(%ebp) subl $8, %esp pushl -10012(%ebp) pushl $.LC2 call printf addl $16, %esp subl $8, %esp leal -10008(%ebp), %eax subl $4, %esp pushl %eax call strlen addl $8, %esp movl %eax, %eax movl %eax, %eax pushl %eax pushl $.LC3 call printf addl $16, %esp subl $12, %esp leal -10008(%ebp), %eax pushl %eax call foo addl $16, %esp subl $12, %esp pushl $.LC4 call printf addl $16, %esp leave ret .Lfe3: .size main,.Lfe3-main .ident "GCC: (GNU) 2.96 20000731 (Red Hat Linux 7.3 2.96-110)"