Check out my first novel, midnight's simulacra!
Libcudest
From dankwiki
Reverse engineering of CUDA ioctls in the 3.0 SDK (195.36.15 driver, GTS 360M, amd64). CUDA primarily communicates with the NVIDIA closed-source driver via several hundred undocumented ioctl()s. My open source implementation is located at GitHub.
Maps
Ordered from highest to lowest locations in x86 memory. These are architecture-, and to a lesser degree driver- and kernel version-specific. Applications and libraries can of course create many more maps than these.
- vsyscalls. read-execute-private, very few pages, topmost area of memory, usually highest mapping
- VDSO. read-execute-private, one page, high in memory (SYSENTER/SYSEXIT)
- Userspace stack. read-write-private, many pages, high in memory
- Anonymous map, 3 read-write-private pages, high in memory.
- Possibly associated with nvidia driver's NV_STACK_SIZE stack. read-write-private, (3 * 4096 on amd64, 2 * 4096 on i686)
- Two sets of /dev/nvidiaX maps for each bound device. Sets are usually continguous, and contain:
- an anonymous page, read-write-private
- several mappings of the device, having variable number of pages, all read-write-shared
- Libraries. variable, middle of memory.
- Userspace heap. read-write-private, many pages, low in memory
- Application (data region). read-write-private, variable, low in memory
- Application (text region). read-execute-private, variable, usually lowest mapping
ioctls
An ioctl (on x86) is 32 bits. The following definition comes from linux/asm-generic/ioctl.h in a 2.6.34 kernel:
- Bit 31: Read?
- Bit 30: Write?
- Bits 29-16: Parameter size
- Bits 15-8: Type (module)
- Bits 7-0: Number (command)
Looking at the source of the 195.36.15 kernel driver's OS interface, we see that NVIDIA uses the standard ioctl-creation macros from ioctl.h, and can be expected to adhere to this format. The type code used (NV_IOCTL_MAGIC) is 'F' (0x46), which overlaps with the framebuffer ioctl range as registered in 2.6.34. We further see that only _IOWR() is used to declare ioctls, implying that the first two bits will always be '11'. Both of these deductions are borne out observing strace output of a CUDA process.
| Code | Param size | Param location(s) | Driver API call sites | Notes |
|---|---|---|---|---|
| 0xd2 | 0x048 | stack | cuInit |
|
| 0xca | 0x004 | anonymous page | cuInit |
|
| 0xc8 | 0x600 | anonymous page | cuInit | Largest parameter by far. Possibly scaled? Shifted 3 bits left, this is 0x3000, the size of the amd64 anonymous mapping. |
| 0x22 | 0x00c | stack | cuInit | |
| 0x2a | 0x020 | stack | cuInit | |
| 0x4d | 0x048 | stack | cuInit | Performed following opening of nvidiaX device |
| 0x2d | 0x014 | stack | cuInit | Performed following read of /proc/interrupts |
| 0x32 | 0x014 | stack | cuInit | Performed several times in succession |
raw data
edi == ebp
esi == 0xc04846d2
rdx == r12
call(edi,esi,rdx)
eax == 0
ebp == file descriptor
rsp(0x4c7) = 0
rsp(0x488) = rax
rsp(0x484) = 0
rsp(0x480) = 0
r12 = rsp + 0x480 (0x7ffff78b3c41)
rbx(0x30) = 0
rbx(0x28) = 0
rbx(0x20) = 0
rbx(0x18) = 0
rbx(0x10) = 0
rbx(0x8) = 0x35
rbx(0x38) = 0
cuInit:
0x7ffff78b3031: mov 0x8(%rsp),%ecx
0x7ffff78b3035: mov $0x14,%r8d
0x7ffff78b303b: mov $0xa02,%edx
0x7ffff78b3040: mov %ebp,%esi
0x7ffff78b3042: mov %ebp,%edi
0x7ffff78b3044: callq 0x7ffff78b1a60
0x7ffff78b3049: test %eax,%eax
0x7ffff78b304b: jne 0x7ffff78b2b84
0x7ffff78b3051: mov 0x1c(%rsp),%eax
0x7ffff78b3055: cmp 0x6c(%rsp),%eax
0x7ffff78b3059: jne 0x7ffff78b2b84
0x7ffff78b305f: nop
0x7ffff78b3060: jmpq 0x7ffff78b2c70
0x7ffff78b3065: mov 0x704944(%rip),%r9 # 0x7ffff7fb79b0
0x7ffff78b306c: mov (%r9),%rdi
0x7ffff78b306f: mov 0x10(%rdi),%rdx
0x7ffff78b3073: test %rdx,%rdx
0x7ffff78b3076: je 0x7ffff78b3094
0x7ffff78b3078: cmp %r8d,(%rdx)
0x7ffff78b307b: jne 0x7ffff78b308b
0x7ffff78b307d: jmpq 0x7ffff78b2f82
0x7ffff78b3082: cmp (%rdx),%r8d
0x7ffff78b3085: je 0x7ffff78b2f82
0x7ffff78b308b: mov 0x10(%rdx),%rdx
0x7ffff78b308f: test %rdx,%rdx
0x7ffff78b3092: jne 0x7ffff78b3082
0x7ffff78b3094: mov $0x1d,%r12d
0x7ffff78b309a: movl $0x0,0x708768(%rip) # 0x7ffff7fbb80c
0x7ffff78b30a4: jmpq 0x7ffff78b29e5
0x7ffff78b30a9: mov 0x58(%rsp),%edi
0x7ffff78b30ad: test %edi,%edi
0x7ffff78b30af: je 0x7ffff78b29e5
0x7ffff78b30b5: mov %rbx,%rdi
0x7ffff78b30b8: callq 0x7ffff78b22d0
0x7ffff78b30bd: mov 0x58(%rsp),%r12d
0x7ffff78b30c2: jmpq 0x7ffff78b29e5
0x7ffff78b30c7: mov 0x70551a(%rip),%r15 # 0x7ffff7fb85e8
0x7ffff78b30ce: mov (%r15),%rbx
0x7ffff78b30d1: test %rbx,%rbx
0x7ffff78b30d4: je 0x7ffff78b2f9e
0x7ffff78b30da: lea 0x20(%rsp),%rdx
0x7ffff78b30df: jmp 0x7ffff78b30ee
0x7ffff78b30e1: mov 0x30(%rbx),%rbx
0x7ffff78b30e5: test %rbx,%rbx
0x7ffff78b30e8: je 0x7ffff78b2f9e
0x7ffff78b30ee: cmp (%rbx),%ebp
0x7ffff78b30f0: jne 0x7ffff78b30e1
0x7ffff78b30f2: cmp 0x4(%rbx),%r14d
0x7ffff78b30f6: jne 0x7ffff78b30e1
0x7ffff78b30f8: movq $0x0,0x20(%rsp)
0x7ffff78b3101: movq $0x0,0x28(%rsp)
0x7ffff78b310a: xor %eax,%eax
0x7ffff78b310c: mov %ebp,0x20(%rsp)
0x7ffff78b3110: mov %r14d,0x28(%rsp)
0x7ffff78b3115: mov $0xc020462b,%esi
0x7ffff78b311a: mov 0x18(%rsp),%ebp
0x7ffff78b311e: mov 0x10(%rsp),%r14
0x7ffff78b3123: mov 0x676f57(%rip),%edi # 0x7ffff7f2a080
0x7ffff78b3129: movl $0x0,0x7086d9(%rip) # 0x7ffff7fbb80c
0x7ffff78b3133: movq $0x0,0x38(%rsp)
0x7ffff78b313c: movl $0x83f3,0x2c(%rsp)
0x7ffff78b3144: mov %ebp,0x24(%rsp)
0x7ffff78b3148: mov %r14,0x30(%rsp)
0x7ffff78b314d: callq 0x7ffff782ab20 <ioctl@plt>
0x7ffff78b3152: test %eax,%eax
0x7ffff78b3154: js 0x7ffff78b2f2a
0x7ffff78b315a: mov 0x38(%rsp),%r9d
0x7ffff78b315f: test %r9d,%r9d
0x7ffff78b3162: je 0x7ffff78b29e5
0x7ffff78b3168: mov %rbx,%rdi
0x7ffff78b316b: callq 0x7ffff78b22d0
0x7ffff78b3170: mov 0x38(%rsp),%r12d
0x7ffff78b3175: jmpq 0x7ffff78b29e5
0x7ffff78b317a: data32 xchg %ax,%ax
0x7ffff78b317d: data32 xchg %ax,%ax
0x7ffff78b3180: mov %r12,-0x20(%rsp)
0x7ffff78b3185: mov %r13,-0x18(%rsp)
0x7ffff78b318a: mov %edi,%r12d
0x7ffff78b318d: mov %r14,-0x10(%rsp)
0x7ffff78b3192: mov %r15,-0x8(%rsp)
0x7ffff78b3197: mov %esi,%r14d
0x7ffff78b319a: mov %rbx,-0x30(%rsp)
0x7ffff78b319f: mov %rbp,-0x28(%rsp)
0x7ffff78b31a4: sub $0x68,%rsp
0x7ffff78b31a8: cmp $0x80,%edx
0x7ffff78b31ae: mov %edx,%r13d
0x7ffff78b31b1: mov %rcx,%r15
0x7ffff78b31b4: jb 0x7ffff78b327a
0x7ffff78b31ba: cmp $0x87,%edx
0x7ffff78b31c0: ja 0x7ffff78b3272
0x7ffff78b31c6: lea -0x80(%r13),%esi
0x7ffff78b31ca: xor %edx,%edx
0x7ffff78b31cc: callq 0x7ffff78b2160
0x7ffff78b31d1: mov %eax,%edx
0x7ffff78b31d3: mov %eax,%edi
0x7ffff78b31d5: shr $0x1f,%edx
0x7ffff78b31d8: cmp $0x20,%eax
0x7ffff78b31db: sete %bl
0x7ffff78b31de: or %dl,%bl
0x7ffff78b31e0: jne 0x7ffff78b327a
0x7ffff78b31e6: mov %edi,%ecx
0x7ffff78b31e8: mov %r14d,%esi
0x7ffff78b31eb: mov %r14d,%edx
0x7ffff78b31ee: mov %r12d,%edi
0x7ffff78b31f1: callq 0x7ffff78b2400
0x7ffff78b31f6: xor %esi,%esi
0x7ffff78b31f8: test %eax,%eax
0x7ffff78b31fa: mov %eax,%ebp
0x7ffff78b31fc: mov $0x1,%ecx
0x7ffff78b3201: jne 0x7ffff78b327f
0x7ffff78b3203: mov %esi,%eax
0x7ffff78b3205:
lock cmpxchg %ecx,0x7085ff(%rip) # 0x7ffff7fbb80c
0x7ffff78b320d: setne %dl
0x7ffff78b3210: test %dl,%dl
0x7ffff78b3212: je 0x7ffff78b3400
0x7ffff78b3218: mov 0x7085ee(%rip),%edi # 0x7ffff7fbb80c
0x7ffff78b321e: test %edi,%edi
0x7ffff78b3220: je 0x7ffff78b3203
0x7ffff78b3222: mov 0x7085e3(%rip),%r8d # 0x7ffff7fbb80c
0x7ffff78b3229: test %r8d,%r8d
0x7ffff78b322c: je 0x7ffff78b3203
0x7ffff78b322e: mov 0x7085d7(%rip),%r9d # 0x7ffff7fbb80c
0x7ffff78b3235: test %r9d,%r9d
0x7ffff78b3238: je 0x7ffff78b3203
0x7ffff78b323a: mov 0x7085cb(%rip),%r10d # 0x7ffff7fbb80c
0x7ffff78b3241: test %r10d,%r10d
0x7ffff78b3244: je 0x7ffff78b3203
0x7ffff78b3246: mov 0x7085bf(%rip),%r11d # 0x7ffff7fbb80c
0x7ffff78b324d: test %r11d,%r11d
0x7ffff78b3250: je 0x7ffff78b3203
0x7ffff78b3252: mov 0x7085b4(%rip),%ebx # 0x7ffff7fbb80c
0x7ffff78b3258: test %ebx,%ebx
0x7ffff78b325a: je 0x7ffff78b3203
0x7ffff78b325c: mov 0x7085aa(%rip),%edx # 0x7ffff7fbb80c
0x7ffff78b3262: test %edx,%edx
0x7ffff78b3264: je 0x7ffff78b3203
0x7ffff78b3266: mov 0x7085a0(%rip),%eax # 0x7ffff7fbb80c
0x7ffff78b326c: test %eax,%eax
0x7ffff78b326e: jne 0x7ffff78b3218
0x7ffff78b3270: jmp 0x7ffff78b3203
0x7ffff78b3272: cmp $0xff,%edx
0x7ffff78b3278: je 0x7ffff78b32a4
0x7ffff78b327a: mov $0x2a,%ebp
0x7ffff78b327f: mov %ebp,%eax
0x7ffff78b3281: mov 0x38(%rsp),%rbx
0x7ffff78b3286: mov 0x40(%rsp),%rbp
0x7ffff78b328b: mov 0x48(%rsp),%r12
0x7ffff78b3290: mov 0x50(%rsp),%r13
0x7ffff78b3295: mov 0x58(%rsp),%r14
0x7ffff78b329a: mov 0x60(%rsp),%r15
0x7ffff78b329f: add $0x68,%rsp
0x7ffff78b32a3: retq
0x7ffff78b32a4: test %rcx,%rcx
0x7ffff78b32a7: je 0x7ffff78b327a
0x7ffff78b32a9: mov $0x3a,%esi
0x7ffff78b32ae: mov %rcx,%rdi
0x7ffff78b32b1: callq 0x7ffff782a980 <strchr@plt>
0x7ffff78b32b6: test %rax,%rax
0x7ffff78b32b9: je 0x7ffff78b327a
0x7ffff78b32bb: cmpb $0x2a,(%r15)
0x7ffff78b32bf: je 0x7ffff78b327a
0x7ffff78b32c1: lea 0x28(%rsp),%rsi
0x7ffff78b32c6: xor %ecx,%ecx
0x7ffff78b32c8: xor %edx,%edx
0x7ffff78b32ca: mov %r15,%rdi
0x7ffff78b32cd: callq 0x7ffff782a930 <__strtol_internal@plt>
0x7ffff78b32d2: mov 0x28(%rsp),%rdi
0x7ffff78b32d7: xor %edx,%edx
0x7ffff78b32d9: xor %ecx,%ecx
0x7ffff78b32db: xor %esi,%esi
0x7ffff78b32dd: mov %eax,%ebx
0x7ffff78b32df: inc %rdi
0x7ffff78b32e2: callq 0x7ffff782a930 <__strtol_internal@plt>
0x7ffff78b32e7: mov 0x705012(%rip),%rdx # 0x7ffff7fb8300
0x7ffff78b32ee: mov %eax,%r8d
0x7ffff78b32f1: xor %edi,%edi
0x7ffff78b32f3: add $0x30,%rdx
0x7ffff78b32f7: jmpq 0x7ffff78b33d4
0x7ffff78b32fc: lea 0x30(%rdx),%rcx
0x7ffff78b3300: lea 0x1(%rdi),%esi
0x7ffff78b3303: testb $0x1,-0x30(%rcx)
0x7ffff78b3307: mov %esi,%edi
0x7ffff78b3309: je 0x7ffff78b3317
0x7ffff78b330b: movzbl -0x2e(%rcx),%ebp
0x7ffff78b330f: cmp %ebp,%ebx
0x7ffff78b3311: je 0x7ffff78b34a2
0x7ffff78b3317: lea 0x30(%rcx),%rdx
0x7ffff78b331b: lea 0x1(%rsi),%edi
0x7ffff78b331e: testb $0x1,-0x30(%rdx)
0x7ffff78b3322: je 0x7ffff78b3332
0x7ffff78b3324: movzbl -0x2e(%rdx),%r10d
0x7ffff78b3329: cmp %r10d,%ebx
0x7ffff78b332c: je 0x7ffff78b34b5
0x7ffff78b3332: lea 0x60(%rcx),%rdx
0x7ffff78b3336: lea 0x2(%rsi),%edi
0x7ffff78b3339: testb $0x1,-0x30(%rdx)
0x7ffff78b333d: je 0x7ffff78b334b
0x7ffff78b333f: movzbl -0x2e(%rdx),%eax
0x7ffff78b3343: cmp %eax,%ebx
0x7ffff78b3345: je 0x7ffff78b34e5
0x7ffff78b334b: lea 0x90(%rcx),%rdx
0x7ffff78b3352: lea 0x3(%rsi),%edi
0x7ffff78b3355: testb $0x1,-0x30(%rdx)
0x7ffff78b3359: je 0x7ffff78b3369
0x7ffff78b335b: movzbl -0x2e(%rdx),%r9d
0x7ffff78b3360: cmp %r9d,%ebx
0x7ffff78b3363: je 0x7ffff78b34f7
0x7ffff78b3369: lea 0xc0(%rcx),%rdx
0x7ffff78b3370: lea 0x4(%rsi),%edi
0x7ffff78b3373: testb $0x1,-0x30(%rdx)
0x7ffff78b3377: je 0x7ffff78b3387
0x7ffff78b3379: movzbl -0x2e(%rdx),%r11d
0x7ffff78b337e: cmp %r11d,%ebx
0x7ffff78b3381: je 0x7ffff78b3510
0x7ffff78b3387: lea 0xf0(%rcx),%rdx
0x7ffff78b338e: lea 0x5(%rsi),%edi
0x7ffff78b3391: testb $0x1,-0x30(%rdx)
0x7ffff78b3395: je 0x7ffff78b33a3
0x7ffff78b3397: movzbl -0x2e(%rdx),%ebp
0x7ffff78b339b: cmp %ebp,%ebx
0x7ffff78b339d: je 0x7ffff78b3525
0x7ffff78b33a3: lea 0x120(%rcx),%rdx
0x7ffff78b33aa: lea 0x6(%rsi),%edi
0x7ffff78b33ad: testb $0x1,-0x30(%rdx)
0x7ffff78b33b1: je 0x7ffff78b33c1
0x7ffff78b33b3: movzbl -0x2e(%rdx),%r10d
0x7ffff78b33b8: cmp %r10d,%ebx
0x7ffff78b33bb: je 0x7ffff78b34d0
0x7ffff78b33c1: lea 0x7(%rsi),%edi
0x7ffff78b33c4: lea 0x150(%rcx),%rdx
0x7ffff78b33cb: cmp $0x20,%edi
0x7ffff78b33ce: je 0x7ffff78b327a
0x7ffff78b33d4: testb $0x1,-0x30(%rdx)
0x7ffff78b33d8: je 0x7ffff78b32fc
0x7ffff78b33de: movzbl -0x2e(%rdx),%eax
0x7ffff78b33e2: cmp %eax,%ebx
0x7ffff78b33e4: jne 0x7ffff78b32fc
0x7ffff78b33ea: movzbl -0x2d(%rdx),%ecx
0x7ffff78b33ee: cmp %ecx,%r8d
0x7ffff78b33f1: jne 0x7ffff78b32fc
0x7ffff78b33f7: jmpq 0x7ffff78b31e6
0x7ffff78b33fc: data32 data32 xchg %ax,%ax
0x7ffff78b3400: mov 0x7051e1(%rip),%rsi # 0x7ffff7fb85e8
0x7ffff78b3407: mov (%rsi),%rbx
0x7ffff78b340a: test %rbx,%rbx
0x7ffff78b340d: jne 0x7ffff78b341b
0x7ffff78b340f: nop
0x7ffff78b3410: jmp 0x7ffff78b348e
0x7ffff78b3412: mov 0x30(%rbx),%rbx
0x7ffff78b3416: test %rbx,%rbx
0x7ffff78b3419: je 0x7ffff78b348e
0x7ffff78b341b: cmp (%rbx),%r12d
0x7ffff78b341e: xchg %ax,%ax
0x7ffff78b3420: jne 0x7ffff78b3412
0x7ffff78b3422: cmp 0x4(%rbx),%r14d
0x7ffff78b3426: jne 0x7ffff78b3412
0x7ffff78b3428: mov 0x676c52(%rip),%edi # 0x7ffff7f2a080
0x7ffff78b342e: xor %eax,%eax
0x7ffff78b3430: mov %rsp,%rdx
0x7ffff78b3433: mov $0xc0204623,%esi
0x7ffff78b3438: movq $0x0,(%rsp)
0x7ffff78b3440: movq $0x0,0x8(%rsp)
0x7ffff78b3449: movl $0x0,0x7083b9(%rip) # 0x7ffff7fbb80c
0x7ffff78b3453: movq $0x0,0x18(%rsp)
0x7ffff78b345c: mov %r12d,(%rsp)
0x7ffff78b3460: mov %r14d,0x4(%rsp)
0x7ffff78b3465: mov %r13d,0x8(%rsp)
0x7ffff78b346a: mov %r15,0x10(%rsp)
0x7ffff78b346f: callq 0x7ffff782ab20 <ioctl@plt>
0x7ffff78b3474: test %eax,%eax
0x7ffff78b3476: jns 0x7ffff78b353b
0x7ffff78b347c: mov %rbx,%rdi
0x7ffff78b347f: mov $0x2a,%ebp
0x7ffff78b3484: callq 0x7ffff78b22d0
0x7ffff78b3489: jmpq 0x7ffff78b327f
0x7ffff78b348e: mov $0xb,%ebp
0x7ffff78b3493: movl $0x0,0x70836f(%rip) # 0x7ffff7fbb80c
0x7ffff78b349d: jmpq 0x7ffff78b327f
0x7ffff78b34a2: movzbl -0x2d(%rcx),%r9d
0x7ffff78b34a7: cmp %r9d,%r8d
0x7ffff78b34aa: jne 0x7ffff78b3317
0x7ffff78b34b0: jmpq 0x7ffff78b31e6
0x7ffff78b34b5: movzbl -0x2d(%rdx),%r11d
0x7ffff78b34ba: cmp %r11d,%r8d
0x7ffff78b34bd: data32 xchg %ax,%ax
0x7ffff78b34c0: jne 0x7ffff78b3332
0x7ffff78b34c6: jmpq 0x7ffff78b31e6
0x7ffff78b34cb: data32 xchg %ax,%ax
0x7ffff78b34ce: xchg %ax,%ax
0x7ffff78b34d0: movzbl -0x2d(%rdx),%r11d
0x7ffff78b34d5: cmp %r11d,%r8d
0x7ffff78b34d8: jne 0x7ffff78b33c1
0x7ffff78b34de: xchg %ax,%ax
0x7ffff78b34e0: jmpq 0x7ffff78b31e6
0x7ffff78b34e5: movzbl -0x2d(%rdx),%ebp
0x7ffff78b34e9: cmp %ebp,%r8d
0x7ffff78b34ec: jne 0x7ffff78b334b
0x7ffff78b34f2: jmpq 0x7ffff78b31e6
0x7ffff78b34f7: movzbl -0x2d(%rdx),%r10d
0x7ffff78b34fc: cmp %r10d,%r8d
0x7ffff78b34ff: nop
0x7ffff78b3500: jne 0x7ffff78b3369
0x7ffff78b3506: jmpq 0x7ffff78b31e6
0x7ffff78b350b: data32 xchg %ax,%ax
0x7ffff78b350e: xchg %ax,%ax
0x7ffff78b3510: movzbl -0x2d(%rdx),%eax
0x7ffff78b3514: cmp %eax,%r8d
0x7ffff78b3517: jne 0x7ffff78b3387
0x7ffff78b351d: data32 xchg %ax,%ax
0x7ffff78b3520: jmpq 0x7ffff78b31e6
0x7ffff78b3525: movzbl -0x2d(%rdx),%r9d
0x7ffff78b352a: cmp %r9d,%r8d
0x7ffff78b352d: data32 xchg %ax,%ax
0x7ffff78b3530: jne 0x7ffff78b33a3
0x7ffff78b3536: jmpq 0x7ffff78b31e6
0x7ffff78b353b: mov 0x18(%rsp),%r12d
0x7ffff78b3540: test %r12d,%r12d
0x7ffff78b3543: je 0x7ffff78b327f
0x7ffff78b3549: mov %rbx,%rdi
0x7ffff78b354c: callq 0x7ffff78b22d0
0x7ffff78b3551: mov 0x18(%rsp),%ebp
0x7ffff78b3555: jmpq 0x7ffff78b327f
0x7ffff78b355a: data32 xchg %ax,%ax
0x7ffff78b355d: data32 xchg %ax,%ax
0x7ffff78b3560: push %rbx
0x7ffff78b3561: mov %rdx,%r9
0x7ffff78b3564: xor %r8d,%r8d
0x7ffff78b3567: mov %rcx,%rbx
0x7ffff78b356a: mov $0x22,%edx
0x7ffff78b356f: mov $0x1,%ecx
0x7ffff78b3574: sub $0x10,%rsp
0x7ffff78b3578: test %r9,%r9
0x7ffff78b357b: je 0x7ffff78b3681
0x7ffff78b3581: mov %r8d,%eax
0x7ffff78b3584:
lock cmpxchg %ecx,0x708280(%rip) # 0x7ffff7fbb80c
0x7ffff78b358c: setne %dl
0x7ffff78b358f: test %dl,%dl
0x7ffff78b3591: je 0x7ffff78b35ed
0x7ffff78b3593: mov 0x708272(%rip),%r10d # 0x7ffff7fbb80c
0x7ffff78b359a: test %r10d,%r10d
0x7ffff78b359d: je 0x7ffff78b3581
0x7ffff78b359f: mov 0x708266(%rip),%r11d # 0x7ffff7fbb80c
0x7ffff78b35a6: test %r11d,%r11d
0x7ffff78b35a9: je 0x7ffff78b3581
0x7ffff78b35ab: mov 0x70825b(%rip),%edx # 0x7ffff7fbb80c
0x7ffff78b35b1: test %edx,%edx
0x7ffff78b35b3: je 0x7ffff78b3581
0x7ffff78b35b5: mov 0x708251(%rip),%eax # 0x7ffff7fbb80c
0x7ffff78b35bb: test %eax,%eax
0x7ffff78b35bd: je 0x7ffff78b3581
0x7ffff78b35bf: mov 0x708246(%rip),%r10d # 0x7ffff7fbb80c
0x7ffff78b35c6: test %r10d,%r10d
0x7ffff78b35c9: je 0x7ffff78b3581
0x7ffff78b35cb: mov 0x70823a(%rip),%r11d # 0x7ffff7fbb80c
0x7ffff78b35d2: test %r11d,%r11d
0x7ffff78b35d5: je 0x7ffff78b3581
0x7ffff78b35d7: mov 0x70822f(%rip),%edx # 0x7ffff7fbb80c
0x7ffff78b35dd: test %edx,%edx
0x7ffff78b35df: je 0x7ffff78b3581
0x7ffff78b35e1: mov 0x708225(%rip),%eax # 0x7ffff7fbb80c
0x7ffff78b35e7: test %eax,%eax
0x7ffff78b35e9: jne 0x7ffff78b3593
0x7ffff78b35eb: jmp 0x7ffff78b3581
0x7ffff78b35ed: mov 0x704ff4(%rip),%rcx # 0x7ffff7fb85e8
0x7ffff78b35f4: mov (%rcx),%rax
0x7ffff78b35f7: test %rax,%rax
0x7ffff78b35fa: jne 0x7ffff78b360e
0x7ffff78b35fc: jmpq 0x7ffff78b3689
0x7ffff78b3601: mov 0x30(%rax),%rax
0x7ffff78b3605: test %rax,%rax
0x7ffff78b3608: je 0x7ffff78b3689
0x7ffff78b360e: cmp (%rax),%edi
0x7ffff78b3610: jne 0x7ffff78b3601
0x7ffff78b3612: mov 0x10(%rax),%rcx
0x7ffff78b3616: test %rcx,%rcx
0x7ffff78b3619: jne 0x7ffff78b362b
0x7ffff78b361b: data32 xchg %ax,%ax
0x7ffff78b361e: xchg %ax,%ax
0x7ffff78b3620: jmp 0x7ffff78b3601
0x7ffff78b3622: mov 0x10(%rcx),%rcx
0x7ffff78b3626: test %rcx,%rcx
0x7ffff78b3629: je 0x7ffff78b3601
0x7ffff78b362b: cmp (%rcx),%esi
0x7ffff78b362d: data32 xchg %ax,%ax
0x7ffff78b3630: jne 0x7ffff78b3622
0x7ffff78b3632: movl $0x0,0x4(%rsp)
0x7ffff78b363a: movl $0x0,0x7081c8(%rip) # 0x7ffff7fbb80c
0x7ffff78b3644: mov %rsp,%rdx
0x7ffff78b3647: movl $0x0,0x8(%rsp)
0x7ffff78b364f: movl $0x0,0xc(%rsp)
0x7ffff78b3657: xor %eax,%eax
0x7ffff78b3659: mov %r9,(%rsp)
0x7ffff78b365d: mov (%rcx),%edi
0x7ffff78b365f: mov $0xc0104652,%esi
0x7ffff78b3664: callq 0x7ffff782ab20 <ioctl@plt>
0x7ffff78b3669: test %eax,%eax
0x7ffff78b366b: mov $0x2a,%edx
0x7ffff78b3670: js 0x7ffff78b3681
0x7ffff78b3672: test %rbx,%rbx
0x7ffff78b3675: je 0x7ffff78b367d
0x7ffff78b3677: mov 0x8(%rsp),%esi
0x7ffff78b367b: mov %esi,(%rbx)
0x7ffff78b367d: mov 0xc(%rsp),%edx
0x7ffff78b3681: add $0x10,%rsp
0x7ffff78b3685: mov %edx,%eax
0x7ffff78b3687: pop %rbx
0x7ffff78b3688: retq
0x7ffff78b3689: mov 0x704320(%rip),%r8 # 0x7ffff7fb79b0
0x7ffff78b3690: mov (%r8),%rdi
0x7ffff78b3693: mov 0x10(%rdi),%rcx
0x7ffff78b3697: test %rcx,%rcx
0x7ffff78b369a: jne 0x7ffff78b36a9
0x7ffff78b369c: jmp 0x7ffff78b36b7
0x7ffff78b369e: xchg %ax,%ax
0x7ffff78b36a0: mov 0x10(%rcx),%rcx
0x7ffff78b36a4: test %rcx,%rcx
0x7ffff78b36a7: je 0x7ffff78b36b7
0x7ffff78b36a9: cmp (%rcx),%esi
0x7ffff78b36ab: data32 xchg %ax,%ax
0x7ffff78b36ae: xchg %ax,%ax
0x7ffff78b36b0: jne 0x7ffff78b36a0
0x7ffff78b36b2: jmpq 0x7ffff78b3632
0x7ffff78b36b7: movl $0x0,0x70814b(%rip) # 0x7ffff7fbb80c
0x7ffff78b36c1: add $0x10,%rsp
0x7ffff78b36c5: mov $0x1d,%edx
0x7ffff78b36ca: pop %rbx
0x7ffff78b36cb: mov %edx,%eax
0x7ffff78b36cd: retq
0x7ffff78b36ce: xchg %ax,%ax
0x7ffff78b36d0: push %rbp
0x7ffff78b36d1: mov $0x22,%eax
0x7ffff78b36d6: mov %ecx,%ebp
0x7ffff78b36d8: push %rbx
0x7ffff78b36d9: mov %edx,%ebx
0x7ffff78b36db: sub $0x38,%rsp
0x7ffff78b36df: test %r9,%r9
0x7ffff78b36e2: je 0x7ffff78b3820
0x7ffff78b36e8: mov (%r9),%ecx
0x7ffff78b36eb: xor %r11d,%r11d
0x7ffff78b36ee: mov $0x1,%r10d
0x7ffff78b36f4: test %ecx,%ecx
0x7ffff78b36f6: jle 0x7ffff78b381b
0x7ffff78b36fc: data32 data32 xchg %ax,%ax
0x7ffff78b3700: mov %r11d,%eax
0x7ffff78b3703:
lock cmpxchg %r10d,0x708100(%rip) # 0x7ffff7fbb80c
0x7ffff78b370c: setne %dl
0x7ffff78b370f: test %dl,%dl
0x7ffff78b3711: je 0x7ffff78b3765
0x7ffff78b3713: mov 0x7080f3(%rip),%edx # 0x7ffff7fbb80c
0x7ffff78b3719: test %edx,%edx
0x7ffff78b371b: je 0x7ffff78b3700
0x7ffff78b371d: mov 0x7080e9(%rip),%edx # 0x7ffff7fbb80c
0x7ffff78b3723: test %edx,%edx
0x7ffff78b3725: je 0x7ffff78b3700
0x7ffff78b3727: mov 0x7080df(%rip),%eax # 0x7ffff7fbb80c
0x7ffff78b372d: test %eax,%eax
0x7ffff78b372f: je 0x7ffff78b3700
0x7ffff78b3731: mov 0x7080d5(%rip),%edx # 0x7ffff7fbb80c
0x7ffff78b3737: test %edx,%edx
0x7ffff78b3739: je 0x7ffff78b3700
0x7ffff78b373b: mov 0x7080cb(%rip),%eax # 0x7ffff7fbb80c
0x7ffff78b3741: test %eax,%eax
0x7ffff78b3743: je 0x7ffff78b3700
0x7ffff78b3745: mov 0x7080c1(%rip),%edx # 0x7ffff7fbb80c
0x7ffff78b374b: test %edx,%edx
0x7ffff78b374d: je 0x7ffff78b3700
0x7ffff78b374f: mov 0x7080b7(%rip),%eax # 0x7ffff7fbb80c
0x7ffff78b3755: test %eax,%eax
0x7ffff78b3757: je 0x7ffff78b3700
0x7ffff78b3759: mov 0x7080ad(%rip),%edx # 0x7ffff7fbb80c
0x7ffff78b375f: test %edx,%edx
0x7ffff78b3761: jne 0x7ffff78b3713
0x7ffff78b3763: jmp 0x7ffff78b3700
0x7ffff78b3765: mov 0x704e7c(%rip),%r10 # 0x7ffff7fb85e8
0x7ffff78b376c: mov (%r10),%rax
0x7ffff78b376f: test %rax,%rax
0x7ffff78b3772: jne 0x7ffff78b378d
0x7ffff78b3774: jmpq 0x7ffff78b3827
0x7ffff78b3779: data32 data32 xchg %ax,%ax
0x7ffff78b377d: data32 xchg %ax,%ax
0x7ffff78b3780: mov 0x30(%rax),%rax
0x7ffff78b3784: test %rax,%rax
0x7ffff78b3787: je 0x7ffff78b3827
0x7ffff78b378d: cmp (%rax),%edi
0x7ffff78b378f: nop
0x7ffff78b3790: jne 0x7ffff78b3780
0x7ffff78b3792: mov 0x10(%rax),%r10
0x7ffff78b3796: test %r10,%r10
0x7ffff78b3799: jne 0x7ffff78b37ab
0x7ffff78b379b: data32 xchg %ax,%ax
0x7ffff78b379e: xchg %ax,%ax
0x7ffff78b37a0: jmp 0x7ffff78b3780
0x7ffff78b37a2: mov 0x10(%r10),%r10
0x7ffff78b37a6: test %r10,%r10
0x7ffff78b37a9: je 0x7ffff78b3780
0x7ffff78b37ab: cmp (%r10),%ecx
0x7ffff78b37ae: xchg %ax,%ax
0x7ffff78b37b0: jne 0x7ffff78b37a2
0x7ffff78b37b2: movq $0x0,(%rsp)
0x7ffff78b37ba: movq $0x0,0x8(%rsp)
0x7ffff78b37c3: xor %eax,%eax
0x7ffff78b37c5: movl $0x0,0x70803d(%rip) # 0x7ffff7fbb80c
0x7ffff78b37cf: movq $0x0,0x10(%rsp)
0x7ffff78b37d8: mov %rsp,%rdx
0x7ffff78b37db: movq $0x0,0x18(%rsp)
0x7ffff78b37e4: mov %edi,(%rsp)
0x7ffff78b37e7: mov %esi,0x4(%rsp)
0x7ffff78b37eb: movq $0x0,0x20(%rsp)
0x7ffff78b37f4: mov $0xc0284644,%esi
0x7ffff78b37f9: mov %ebx,0x8(%rsp)
0x7ffff78b37fd: mov %ebp,0xc(%rsp)
0x7ffff78b3801: mov %r8d,0x10(%rsp)
0x7ffff78b3806: mov 0x4(%r10),%ecx
0x7ffff78b380a: mov (%r9),%edi
0x7ffff78b380d: mov %rcx,0x18(%rsp)
0x7ffff78b3812: callq 0x7ffff782ab20 <ioctl@plt>
0x7ffff78b3817: test %eax,%eax
0x7ffff78b3819: jns 0x7ffff78b386d
0x7ffff78b381b: mov $0x2a,%eax
0x7ffff78b3820: add $0x38,%rsp
0x7ffff78b3824: pop %rbx
0x7ffff78b3825: pop %rbp
0x7ffff78b3826: retq
0x7ffff78b3827: mov 0x704182(%rip),%rax # 0x7ffff7fb79b0
0x7ffff78b382e: mov (%rax),%r11
0x7ffff78b3831: mov 0x10(%r11),%r10
0x7ffff78b3835: test %r10,%r10
0x7ffff78b3838: jne 0x7ffff78b3849
0x7ffff78b383a: jmp 0x7ffff78b3857
0x7ffff78b383c: data32 data32 xchg %ax,%ax
0x7ffff78b3840: mov 0x10(%r10),%r10
0x7ffff78b3844: test %r10,%r10
0x7ffff78b3847: je 0x7ffff78b3857
0x7ffff78b3849: cmp (%r10),%ecx
0x7ffff78b384c: data32 data32 xchg %ax,%ax
0x7ffff78b3850: jne 0x7ffff78b3840
0x7ffff78b3852: jmpq 0x7ffff78b37b2
0x7ffff78b3857: movl $0x0,0x707fab(%rip) # 0x7ffff7fbb80c
0x7ffff78b3861: add $0x38,%rsp
0x7ffff78b3865: mov $0x1d,%eax
0x7ffff78b386a: pop %rbx
0x7ffff78b386b: pop %rbp
0x7ffff78b386c: retq
0x7ffff78b386d: mov 0x20(%rsp),%eax
0x7ffff78b3871: add $0x38,%rsp
0x7ffff78b3875: pop %rbx
0x7ffff78b3876: pop %rbp
0x7ffff78b3877: retq
0x7ffff78b3878: data32 data32 xchg %ax,%ax
0x7ffff78b387c: data32 data32 xchg %ax,%ax
0x7ffff78b3880: push %r13
0x7ffff78b3882: mov $0x22,%eax
0x7ffff78b3887: mov %rdi,%r13
0x7ffff78b388a: push %r12
0x7ffff78b388c: push %rbp
0x7ffff78b388d: push %rbx
0x7ffff78b388e: sub $0x4e8,%rsp
0x7ffff78b3895: test %rdi,%rdi
0x7ffff78b3898: je 0x7ffff78b3933
0x7ffff78b389e: xchg %ax,%ax
0x7ffff78b38a0: xor %eax,%eax
0x7ffff78b38a2: mov $0x1,%ecx
0x7ffff78b38a7:
lock cmpxchg %ecx,0x707f5d(%rip) # 0x7ffff7fbb80c
0x7ffff78b38af: setne %dl
0x7ffff78b38b2: test %dl,%dl
0x7ffff78b38b4: je 0x7ffff78b3941
0x7ffff78b38ba: mov 0x707f4c(%rip),%ebx # 0x7ffff7fbb80c
0x7ffff78b38c0: test %ebx,%ebx
0x7ffff78b38c2: je 0x7ffff78b38a0
0x7ffff78b38c4: mov 0x707f42(%rip),%ecx # 0x7ffff7fbb80c
0x7ffff78b38ca: test %ecx,%ecx
0x7ffff78b38cc: je 0x7ffff78b38a0
0x7ffff78b38ce: mov 0x707f38(%rip),%esi # 0x7ffff7fbb80c
0x7ffff78b38d4: test %esi,%esi
0x7ffff78b38d6: je 0x7ffff78b38a0
0x7ffff78b38d8: mov 0x707f2d(%rip),%r12d # 0x7ffff7fbb80c
0x7ffff78b38df: test %r12d,%r12d
0x7ffff78b38e2: je 0x7ffff78b38a0
0x7ffff78b38e4: mov 0x707f22(%rip),%edx # 0x7ffff7fbb80c
0x7ffff78b38ea: test %edx,%edx
0x7ffff78b38ec: je 0x7ffff78b38a0
0x7ffff78b38ee: mov 0x707f18(%rip),%eax # 0x7ffff7fbb80c
0x7ffff78b38f4: test %eax,%eax
0x7ffff78b38f6: je 0x7ffff78b38a0
0x7ffff78b38f8: mov 0x707f0d(%rip),%r9d # 0x7ffff7fbb80c
0x7ffff78b38ff: test %r9d,%r9d
0x7ffff78b3902: je 0x7ffff78b38a0
0x7ffff78b3904: mov 0x707f01(%rip),%r10d # 0x7ffff7fbb80c
0x7ffff78b390b: test %r10d,%r10d
0x7ffff78b390e: jne 0x7ffff78b38ba
0x7ffff78b3910: jmp 0x7ffff78b38a0
0x7ffff78b3912: mov 0x4d8(%rsp),%ecx
0x7ffff78b3919: test %ecx,%ecx
0x7ffff78b391b: jne 0x7ffff78b3e97
0x7ffff78b3921: mov 0x4d0(%rsp),%ebx
0x7ffff78b3928: mov %ebx,0x0(%r13)
0x7ffff78b392c: mov 0x4d8(%rsp),%eax
0x7ffff78b3933: add $0x4e8,%rsp
0x7ffff78b393a: pop %rbx
0x7ffff78b393b: pop %rbp
0x7ffff78b393c: pop %r12
0x7ffff78b393e: pop %r13
0x7ffff78b3940: retq
0x7ffff78b3941: mov 0x707ec1(%rip),%eax # 0x7ffff7fbb808
0x7ffff78b3947: test %eax,%eax
0x7ffff78b3949: je 0x7ffff78b3a4f
0x7ffff78b394f: inc %eax
0x7ffff78b3951: movl $0x0,0x707eb1(%rip) # 0x7ffff7fbb80c
0x7ffff78b395b: mov %eax,0x707ea7(%rip) # 0x7ffff7fbb808
0x7ffff78b3961: lea 0x4d0(%rsp),%rdx
0x7ffff78b3969: movl $0x0,0x0(%r13)
0x7ffff78b3971: movl $0x0,0x4d0(%rsp)
0x7ffff78b397c: mov $0xc00c4622,%esi
0x7ffff78b3981: xor %eax,%eax
0x7ffff78b3983: movl $0x0,0x8(%rdx)
0x7ffff78b398a: mov 0x6766f0(%rip),%edi # 0x7ffff7f2a080
0x7ffff78b3990: movl $0x0,0x4d4(%rsp)
0x7ffff78b399b: callq 0x7ffff782ab20 <ioctl@plt>
0x7ffff78b39a0: xor %esi,%esi
0x7ffff78b39a2: test %eax,%eax
0x7ffff78b39a4: mov $0x1,%ecx
0x7ffff78b39a9: jns 0x7ffff78b3912
0x7ffff78b39af: mov %esi,%eax
0x7ffff78b39b1:
lock cmpxchg %ecx,0x707e53(%rip) # 0x7ffff7fbb80c
0x7ffff78b39b9: setne %dl
0x7ffff78b39bc: test %dl,%dl
0x7ffff78b39be: je 0x7ffff78b3a1c
0x7ffff78b39c0: mov 0x707e45(%rip),%r8d # 0x7ffff7fbb80c
0x7ffff78b39c7: test %r8d,%r8d
0x7ffff78b39ca: je 0x7ffff78b39af
0x7ffff78b39cc: mov 0x707e39(%rip),%r10d # 0x7ffff7fbb80c
0x7ffff78b39d3: test %r10d,%r10d
0x7ffff78b39d6: je 0x7ffff78b39af
0x7ffff78b39d8: mov 0x707e2d(%rip),%r11d # 0x7ffff7fbb80c
0x7ffff78b39df: test %r11d,%r11d
0x7ffff78b39e2: je 0x7ffff78b39af
0x7ffff78b39e4: mov 0x707e21(%rip),%r13d # 0x7ffff7fbb80c
0x7ffff78b39eb: test %r13d,%r13d
0x7ffff78b39ee: je 0x7ffff78b39af
0x7ffff78b39f0: mov 0x707e16(%rip),%ebx # 0x7ffff7fbb80c
0x7ffff78b39f6: test %ebx,%ebx
0x7ffff78b39f8: je 0x7ffff78b39af
0x7ffff78b39fa: mov 0x707e0c(%rip),%ebp # 0x7ffff7fbb80c
0x7ffff78b3a00: test %ebp,%ebp
0x7ffff78b3a02: je 0x7ffff78b39af
0x7ffff78b3a04: mov 0x707e02(%rip),%edi # 0x7ffff7fbb80c
0x7ffff78b3a0a: test %edi,%edi
0x7ffff78b3a0c: je 0x7ffff78b39af
0x7ffff78b3a0e: mov 0x707df7(%rip),%r8d # 0x7ffff7fbb80c
0x7ffff78b3a15: test %r8d,%r8d
0x7ffff78b3a18: jne 0x7ffff78b39c0
0x7ffff78b3a1a: jmp 0x7ffff78b39af
0x7ffff78b3a1c: mov 0x707de6(%rip),%esi # 0x7ffff7fbb808
0x7ffff78b3a22: dec %esi
0x7ffff78b3a24: test %esi,%esi
0x7ffff78b3a26: mov %esi,0x707ddc(%rip) # 0x7ffff7fbb808
0x7ffff78b3a2c: je 0x7ffff78b3dcb
0x7ffff78b3a32: movl $0x0,0x707dd0(%rip) # 0x7ffff7fbb80c
0x7ffff78b3a3c: mov $0x2a,%eax
0x7ffff78b3a41: add $0x4e8,%rsp
0x7ffff78b3a48: pop %rbx
0x7ffff78b3a49: pop %rbp
0x7ffff78b3a4a: pop %r12
0x7ffff78b3a4c: pop %r13
0x7ffff78b3a4e: retq
0x7ffff78b3a4f: mov 0x705b9a(%rip),%rbp # 0x7ffff7fb95f0
0x7ffff78b3a56: mov $0x700,%edx
0x7ffff78b3a5b: xor %esi,%esi
0x7ffff78b3a5d: mov %rbp,%rdi
0x7ffff78b3a60: callq 0x7ffff782a990 <memset@plt>
0x7ffff78b3a65: lea 0x700(%rbp),%rdx
0x7ffff78b3a6c: mov %rbp,%rax
0x7ffff78b3a6f: movl $0xffffffff,(%rax)
0x7ffff78b3a75: movl $0xffffffff,0x38(%rax)
0x7ffff78b3a7c: movl $0xffffffff,0x70(%rax)
0x7ffff78b3a83: movl $0xffffffff,0xa8(%rax)
0x7ffff78b3a8d: movl $0xffffffff,0xe0(%rax)
0x7ffff78b3a97: movl $0xffffffff,0x118(%rax)
0x7ffff78b3aa1: movl $0xffffffff,0x150(%rax)
0x7ffff78b3aab: movl $0xffffffff,0x188(%rax)
0x7ffff78b3ab5: add $0x1c0,%rax
0x7ffff78b3abb: cmp %rdx,%rax
0x7ffff78b3abe: jne 0x7ffff78b3a6f
0x7ffff78b3ac0: callq 0x7ffff782a290 <geteuid@plt>
0x7ffff78b3ac5: test %eax,%eax
0x7ffff78b3ac7: jne 0x7ffff78b3bf7
0x7ffff78b3acd: movzbl 0x4d1b06(%rip),%esi # 0x7ffff7d855da
0x7ffff78b3ad4: lea 0x1(%rsp),%rdi
0x7ffff78b3ad9: mov $0x3ff,%edx
0x7ffff78b3ade: lea 0x480(%rsp),%rbp
0x7ffff78b3ae6: mov %sil,(%rsp)
0x7ffff78b3aea: xor %esi,%esi
0x7ffff78b3aec: callq 0x7ffff782a990 <memset@plt>
0x7ffff78b3af1: lea 0x53ee73(%rip),%rsi # 0x7ffff7df296b
0x7ffff78b3af8: lea 0x4d178d(%rip),%rdi # 0x7ffff7d8528c
0x7ffff78b3aff: movl $0x1,0x4dc(%rsp)
0x7ffff78b3b0a: callq 0x7ffff782a520 <fopen64@plt>
0x7ffff78b3b0f: test %rax,%rax
0x7ffff78b3b12: mov %rax,%rbx
0x7ffff78b3b15: jne 0x7ffff78b3b40
0x7ffff78b3b17: jmp 0x7ffff78b3b60
0x7ffff78b3b19: data32 data32 xchg %ax,%ax
0x7ffff78b3b1d: data32 xchg %ax,%ax
0x7ffff78b3b20: cld
0x7ffff78b3b21: lea 0x4d1772(%rip),%rdi # 0x7ffff7d8529a
0x7ffff78b3b28: movb $0x0,0x48f(%rsp)
0x7ffff78b3b30: mov $0x7,%ecx
0x7ffff78b3b35: mov %rbp,%rsi
0x7ffff78b3b38: repz cmpsb %es:(%rdi),%ds:(%rsi)
0x7ffff78b3b3a: je 0x7ffff78b3f09
0x7ffff78b3b40: lea 0x4d175a(%rip),%rsi # 0x7ffff7d852a1
0x7ffff78b3b47: xor %eax,%eax
0x7ffff78b3b49: mov %rbp,%rdx
0x7ffff78b3b4c: mov %rbx,%rdi
0x7ffff78b3b4f: callq 0x7ffff782a400 <fscanf@plt>
0x7ffff78b3b54: dec %eax
0x7ffff78b3b56: je 0x7ffff78b3b20
0x7ffff78b3b58: mov %rbx,%rdi
0x7ffff78b3b5b: callq 0x7ffff782a5a0 <fclose@plt>
0x7ffff78b3b60: lea 0x4d1746(%rip),%rdi # 0x7ffff7d852ad
0x7ffff78b3b67: xor %esi,%esi
0x7ffff78b3b69: xor %eax,%eax
0x7ffff78b3b6b: callq 0x7ffff782a360 <open64@plt>
0x7ffff78b3b70: test %eax,%eax
0x7ffff78b3b72: mov %eax,%ebx
0x7ffff78b3b74: js 0x7ffff78b3ba2
0x7ffff78b3b76: mov %rsp,%rsi
0x7ffff78b3b79: mov $0x3ff,%edx
0x7ffff78b3b7e: mov %eax,%edi
0x7ffff78b3b80: callq 0x7ffff782a2b0 <read@plt>
0x7ffff78b3b85: test %eax,%eax
0x7ffff78b3b87: jle 0x7ffff78b4012
0x7ffff78b3b8d: dec %eax
0x7ffff78b3b8f: cltq
0x7ffff78b3b91: cmpb $0xa,(%rsp,%rax,1)
0x7ffff78b3b95: je 0x7ffff78b406a
0x7ffff78b3b9b: mov %ebx,%edi
0x7ffff78b3b9d: callq 0x7ffff782ab40 <close@plt>
0x7ffff78b3ba2: cmpb $0x0,(%rsp)
0x7ffff78b3ba6: je 0x7ffff78b401b
0x7ffff78b3bac: callq 0x7ffff782a2a0 <fork@plt>
0x7ffff78b3bb1: cmp $0xffffffffffffffff,%eax
0x7ffff78b3bb4: mov %eax,%edi
0x7ffff78b3bb6: je 0x7ffff78b3f46
0x7ffff78b3bbc: test %eax,%eax
0x7ffff78b3bbe: xchg %ax,%ax
0x7ffff78b3bc0: je 0x7ffff78b3f72
0x7ffff78b3bc6: lea 0x4dc(%rsp),%rsi
0x7ffff78b3bce: xor %edx,%edx
0x7ffff78b3bd0: callq 0x7ffff782aa70 <waitpid@plt>
0x7ffff78b3bd5: test %eax,%eax
0x7ffff78b3bd7: js 0x7ffff78b3f46
0x7ffff78b3bdd: mov 0x4dc(%rsp),%eax
0x7ffff78b3be4: test $0x7f,%al
0x7ffff78b3be6: jne 0x7ffff78b3f46
0x7ffff78b3bec: movzbl %ah,%edx
0x7ffff78b3bef: test %edx,%edx
0x7ffff78b3bf1: jne 0x7ffff78b3f46
0x7ffff78b3bf7: lea 0x400(%rsp),%rbx
0x7ffff78b3bff: lea 0x4d16c7(%rip),%rdx # 0x7ffff7d852cd
0x7ffff78b3c06: mov $0x80,%esi
0x7ffff78b3c0b: xor %eax,%eax
0x7ffff78b3c0d: mov %rbx,%rdi
0x7ffff78b3c10: callq 0x7ffff782a740 <snprintf@plt>
0x7ffff78b3c15: mov $0xff,%esi
0x7ffff78b3c1a: mov %rbx,%rdi
0x7ffff78b3c1d: callq 0x7ffff78b0050
0x7ffff78b3c22: xor %eax,%eax
0x7ffff78b3c24: mov $0x2,%esi
0x7ffff78b3c29: mov %rbx,%rdi
0x7ffff78b3c2c: callq 0x7ffff782a360 <open64@plt>
0x7ffff78b3c31: test %eax,%eax
0x7ffff78b3c33: mov %eax,%ebp
0x7ffff78b3c35: mov %eax,0x676445(%rip) # 0x7ffff7f2a080
0x7ffff78b3c3b: js 0x7ffff78b3e0c
0x7ffff78b3c41: lea 0x480(%rsp),%r12
memset 0x48 (72) bytes to 0 at %r12. rbx preserves 8 bytes into the struct.
r12 == 0x480(%rsp)
0x7ffff78b3c49: xor %esi,%esi
0x7ffff78b3c4b: mov $0x48,%edx
0x7ffff78b3c50: lea 0x8(%r12),%rbx
0x7ffff78b3c55: mov %r12,%rdi
0x7ffff78b3c58: callq 0x7ffff782a990 <memset@plt>
0x7ffff78b3c5d: lea 0x4d1678(%rip),%rdi # 0x7ffff7d852dc
0x7ffff78b3c64: movabs $0x312e36332e353931,%rax
0x7ffff78b3c6e: movq $0x0,0x38(%rbx)
*(uint64_t *)r12 + 16 = 35
0x7ffff78b3c76: movq $0x35,0x8(%rbx)
0x7ffff78b3c7e: movq $0x0,0x10(%rbx)
0x7ffff78b3c86: movq $0x0,0x18(%rbx)
0x7ffff78b3c8e: movq $0x0,0x20(%rbx)
0x7ffff78b3c96: movq $0x0,0x28(%rbx)
0x7ffff78b3c9e: movq $0x0,0x30(%rbx)
0x7ffff78b3ca6: movl $0x0,0x480(%rsp)
0x7ffff78b3cb1: movl $0x0,0x484(%rsp)
*(uint64_t *)r12 + 8 = 0x312e36332e353931
0x7ffff78b3cbc: mov %rax,0x488(%rsp)
0x7ffff78b3cc4: movb $0x0,0x4c7(%rsp)
0x7ffff78b3ccc: callq 0x7ffff782a460 <getenv@plt>
0x7ffff78b3cd1: test %rax,%rax
0x7ffff78b3cd4: je 0x7ffff78b3ce0
0x7ffff78b3cd6: movsbl (%rax),%edi
0x7ffff78b3cd9: mov %edi,0x480(%rsp)
0x7ffff78b3ce0: xor %eax,%eax
0x7ffff78b3ce2: mov %r12,%rdx
0x7ffff78b3ce5: mov $0xc04846d2,%esi
0x7ffff78b3cea: mov %ebp,%edi
0x7ffff78b3cec: callq 0x7ffff782ab20 <ioctl@plt>
0x7ffff78b3cf1: test %eax,%eax
0x7ffff78b3cf3: js 0x7ffff78b3e4a
0x7ffff78b3cf9: mov 0x704ad0(%rip),%rdx # 0x7ffff7fb87d0
0x7ffff78b3d00: xor %eax,%eax
0x7ffff78b3d02: mov $0xc00446ca,%esi
0x7ffff78b3d07: movl $0x0,(%rdx)
0x7ffff78b3d0d: mov 0x67636d(%rip),%edi # 0x7ffff7f2a080
0x7ffff78b3d13: callq 0x7ffff782ab20 <ioctl@plt>
0x7ffff78b3d18: test %eax,%eax
0x7ffff78b3d1a: js 0x7ffff78b3e78
0x7ffff78b3d20: mov 0x7045d9(%rip),%rbp # 0x7ffff7fb8300
0x7ffff78b3d27: xor %esi,%esi
0x7ffff78b3d29: mov $0x600,%edx
0x7ffff78b3d2e: mov %rbp,%rdi
0x7ffff78b3d31: callq 0x7ffff782a990 <memset@plt>
0x7ffff78b3d36: movl $0xffffffff,0x0(%rbp)
0x7ffff78b3d3d: mov 0x67633d(%rip),%edi # 0x7ffff7f2a080
0x7ffff78b3d43: xor %eax,%eax
0x7ffff78b3d45: mov %rbp,%rdx
0x7ffff78b3d48: mov $0xc60046c8,%esi
0x7ffff78b3d4d: callq 0x7ffff782ab20 <ioctl@plt>
0x7ffff78b3d52: test %eax,%eax
0x7ffff78b3d54: js 0x7ffff78b3e78
See Also
- Kernel ioctl numbering documentation
- My CUDA and CUBAR pages
