UsmanNadeem

._crit_edge2290.25:                               ; preds = %.lr.ph2289.25, %._crit_edge2290.24
  %.not2713 = ...
  %196 = ...
  br i1 %.not2713, label %._crit_edge2292, label %.lr.ph2291, !dbg !140

.lr.ph2291:                                       ; preds = %._crit_edge2290.25
  call void @llvm.memset.p0.i64(ptr align 8 %40, i8 0, i64 %196, i1 false), !dbg !140
  br label %._crit_edge2292, !dbg !140

UsmanNadeem

# Cleanup old alternatives
update-alternatives --remove-all cc
update-alternatives --remove-all c++

update-alternatives --remove-all gcc 
update-alternatives --remove-all g++
update-alternatives --remove-all clang
update-alternatives --remove-all clang++
update-alternatives --remove-all icc
update-alternatives --remove-all icc++

UsmanNadeem

*************CODE*************
#include <string.h>
int main(int argc, char* argv[]) {
	char* ch = "abc";
	int x = strcmp("t", ch);
	return x;
}

UsmanNadeem

Dynamic

08048a8b <dummy_function> (File Offset: 0xa8b):
08048ac5 <main> (File Offset: 0xac5):


end of gadget 3 0804ba30 <__libc_csu_init> (File Offset: 0x3a30):
2fa5

UsmanNadeem

./a.out:     file format elf64-x86-64
./a.out
architecture: i386:x86-64, flags 0x00000112:
EXEC_P, HAS_SYMS, D_PAGED
start address 0x0000000000400430

Program Header:
    PHDR off    0x0000000000000040 vaddr 0x0000000000400040 paddr 0x0000000000400040 align 2**3
         filesz 0x00000000000001f8 memsz 0x00000000000001f8 flags r-x

UsmanNadeem

#include <string.h>
int main(int argc, char* argv[]) {
	char* ch = "abc";
	int x = strcmp("t", ch);
	return x;
}
// Main 0x560 - 0x526
// Size 3a

Disassembly of section .plt:

UsmanNadeem

.  000015b8:  2d 26 05                                        TIP 0x526  // main 400526
.  000015bb:  2d 16 04 00                                     TIP 0x416  // 400410 <strcmp@plt> (File Offset: 0x410)
                                                                         // 400410:	jmpq   *0x200c0a(%rip)        # 601020 <_GLOBAL_OFFSET_TABLE_+0x20> (File Offset: 0x201020)
                                                                         // 400416:	pushq  $0x1 
.  000015bf:  6d a0 06 c6 e3 f0 7f 00                         TIP 0x7ff0e3c606a0
.  000015cd:  2d e0 5b                                        TIP 0x5be0
.  000015d2:  2d e0 5b                                        TIP 0x5be0
.  000015e1:  4d a0 92 90 e3                                  TIP 0xe39092a0
.  000015e8:  4d 40 eb 91 e3                                  TIP 0xe391eb40
.  000015f0:  4d 30 08 8a e3                                  TIP 0xe38a0830

UsmanNadeem

#include <iostream>
int foo()
{
    return 5;
}
int bar()
{
    return 5;
}

UsmanNadeem

#include <iostream>
#include <setjmp.h>
jmp_buf go;
int bar() {
    longjmp(go,1);
    return 3;
}
int foo()
{
    bool jumped = false;