search

GrammaTech / ddisasm

A fast and accurate disassembler
https://grammatech.github.io/ddisasm/
GNU Affero General Public License v3.0
663 stars 62 forks source link

`gcc ls.s -o ls-out -l selinux -nostartfiles -O0` does not products exactly the same code signature as the original file #59

Open gogo2464 opened 1 year ago

gogo2464 commented 1 year ago 
sudo apt install selinux-utils -y libselinux1-dev
gcc -nostartfiles ls.s  -o ls-out -l selinux -O0
./ls-out

diff ls ls-out -q
Files ls and ls-out differ

for more informations with radiff2, fell free to install radare2 with: ideally:

git clone https://github.com/radareorg/radare2
cd radare2
sh sys/install.sh

#or if you can not compile, install radare2 with `sudo apt install radare2;`

$ radiff2 -U ls ls-out
File size differs 142144 vs 159320
Binary files .a and .b differ

$ radiff2 -u ls ls-out

+0x00020808:8606410e38830744 "\x86\x06A\x0e8\x83\aD\x0e@\x02\x97\n\x0e8A\x0e0A\x0e(B\x0e B\x0e\x18B\x0e\x10B\x0e\bA\vT\n\x0e8F\x0e0A\x0e(B\x0e B\x0e\x18B\x0e\x10B\x0e\bE\v" -0x00020811:18420e10420e08450b000034000000a82c00002c65ffff9a00000000460e108c02 "\x18B\x0e\x10B\x0e\bE\v" +0x00020811:4002970a0e38410e30410e28420e20420e18420e10420e08410b540a0e38460e30 "@\x02\x97\n\x0e8A\x0e0A\x0e(B\x0e B\x0e\x18B\x0e\x10B\x0e\bA\vT\n\x0e8F\x0e0A\x0e(B\x0e B\x0e\x18B\x0e\x10B\x0e\bE\v" -0x00020834:188603410e208304025f0a "\x18\x86\x03A\x0e \x83\x04\x02_\n\x0e\x18A\x0e\x10B\x0e\bF\vf\x0e\x18A\x0e\x10B\x0e\b" +0x00020834:28420e20420e18420e1042 "(B\x0e B\x0e\x18B\x0e\x10B\x0e\bE\v" -0x00020840:18410e10420e08460b660e18410e10420e08 "\x18A\x0e\x10B\x0e\bF\vf\x0e\x18A\x0e\x10B\x0e\b" +0x00020840:08450b004c000000e0290000f466ffffb500 "\bE\v" -0x00020854:60000000e02c00009465ffff5501000000420e108f02420e188e03420e208d04420e288c05410e30860641 "" -0x00020880:388307440e4002970a0e38410e30410e28420e20420e18420e10420e08410b540a0e38460e30410e28420e20420e18420e10420e08450b "8\x83\aD\x0e@\x02\x97\n\x0e8A\x0e0A\x0e(B\x0e B\x0e\x18B\x0e\x10B\x0e\bA\vT\n\x0e8F\x0e0A\x0e(B\x0e B\x0e\x18B\x0e\x10B\x0e\bE\v" +0x00020880:18410e10420e08450b490e18410e10420e08000010000000302a00006467ffff110000000000000058000000442a00007067ffffa60000 "\x18A\x0e\x10B\x0e\bE\vI\x0e\x18A\x0e\x10B\x0e\b" -0x000208b8:4c000000442d00009066ffffb500000000420e108c02410e188603410e20830402630a "L" -0x000208dc:1841 "\x18A\x0e\x10B\x0e\bF\vZ\n\x0e\x18A\x0e\x10B\x0e\bC\vP\n\x0e\x18A\x0e\x10B\x0e\bE\vI\x0e\x18A\x0e\x10B\x0e\b" +0x000208dc:1042 "\x10B\x0e\bC\vR\n\x0e(C\x0e B\x0e\x18B\x0e\x10B\x0e\bE\vT\x0e(G\x0e B\x0e\x18B\x0e\x10B\x0e\b" -0x000208df:10420e08460b5a0a "\x10B\x0e\bF\vZ\n\x0e\x18A\x0e\x10B\x0e\bC\vP\n\x0e\x18A\x0e\x10B\x0e\bE\vI\x0e\x18A\x0e\x10B\x0e\b" +0x000208df:08430b520a0e2843 "\bC\vR\n\x0e(C\x0e B\x0e\x18B\x0e\x10B\x0e\bE\vT\x0e(G\x0e B\x0e\x18B\x0e\x10B\x0e\b" -0x000208e8:1841 "\x18A\x0e\x10B\x0e\bC\vP\n\x0e\x18A\x0e\x10B\x0e\bE\vI\x0e\x18A\x0e\x10B\x0e\b" +0x000208e8:2042 " B\x0e\x18B\x0e\x10B\x0e\bE\vT\x0e(G\x0e B\x0e\x18B\x0e\x10B\x0e\b" -0x000208eb:10 "\x10B\x0e\bC\vP\n\x0e\x18A\x0e\x10B\x0e\bE\vI\x0e\x18A\x0e\x10B\x0e\b" +0x000208eb:18 "\x18B\x0e\x10B\x0e\bE\vT\x0e(G\x0e B\x0e\x18B\x0e\x10B\x0e\b" -0x000208ee:08430b500a0e18410e10420e08450b49 "\bC\vP\n\x0e\x18A\x0e\x10B\x0e\bE\vI\x0e\x18A\x0e\x10B\x0e\b" +0x000208ee:10420e08450b540e28470e20420e1842 "\x10B\x0e\bE\vT\x0e(G\x0e B\x0e\x18B\x0e\x10B\x0e\b" -0x000208ff:1841 "\x18A\x0e\x10B\x0e\b" +0x000208ff:1042 "\x10B\x0e\b" -0x00020902:10420e08 "\x10B\x0e\b" +0x00020902:08003000 "\b" -0x00020908:1000 "\x10" +0x00020908:a02a "\xa0*" -0x0002090c:942d00000067ffff110000000000000058000000a82d00000c67ffffa600000000460e108e0245 "\x94-" +0x0002090c:c467ffff4101000000460e108d02420e188c03410e208604470e70028b0a0e20410e18420e1042 "\xc4g\xff\xffA\x01" -0x00020934:188d03420e208c04410e288605470e307e0a0e28440e20420e18420e10420e08430b520a0e28430e2042 "\x18\x8d\x03B\x0e \x8c\x04A\x0e(\x86\x05G\x0e0~\n\x0e(D\x0e B\x0e\x18B\x0e\x10B\x0e\bC\vR\n\x0e(C\x0e B\x0e\x18B\x0e\x10B\x0e\bE\vT\x0e(G\x0e B\x0e\x18B\x0e\x10B\x0e\b" +0x00020934:08480b0010000000d42a0000e068ffff330000000000000028000000e82a00000c69ffff650000000046 "\bH\v" -0x0002095f:18420e10420e08450b540e28470e20420e18420e10420e080034 "\x18B\x0e\x10B\x0e\bE\vT\x0e(G\x0e B\x0e\x18B\x0e\x10B\x0e\b" +0x0002095f:108c02410e188603440e208304740a0e18410e10420e08460b18 "\x10\x8c\x02A\x0e\x18\x86\x03D\x0e \x83\x04t\n\x0e\x18A\x0e\x10B\x0e\bF\v\x18" -0x0002097c:042e "\x04." +0x0002097c:142b "\x14+" -0x00020980:6067 "g\xff\xffA\x01" +0x00020980:5069 "Pi\xff\xff\x1c" -0x00020984:4101 "A\x01" +0x00020984:1c00 "\x1c" -0x00020989:46 "F\x0e\x10\x8d\x02B\x0e\x18\x8c\x03A\x0e \x86\x04G\x0ep\x02\x8b\n\x0e A\x0e\x18B\x0e\x10B\x0e\bH\v" +0x00020989:48 "H\x0e\x10N\n\x0e\bA\v" -0x0002098c:8d02420e188c03410e208604470e70028b0a0e20410e18420e10420e08480b "\x8d\x02B\x0e\x18\x8c\x03A\x0e \x86\x04G\x0ep\x02\x8b\n\x0e A\x0e\x18B\x0e\x10B\x0e\bH\v" +0x0002098c:4e0a0e08410b000010000000302b00005469ffff37000000000000001c0000 "N\n\x0e\bA\v" +0x000209ac:442b "D+" -0x000209b0:14000000 "\x14" +0x000209b0:8069ffff "\x80i\xff\xff<" -0x000209b5:2e "." -0x000209b8:7868ffff330000000000000000 "xh\xff\xff3" -0x000209c8:2c "," +0x000209c8:34 "4" -0x000209cc:542e "T." +0x000209cc:642b "d+" -0x000209d1:68 "h\xff\xffe" +0x000209d1:69 "i\xff\xff\x8a" -0x000209d4:65 "e" +0x000209d4:8a "\x8a" -0x000209e8:74 "t\n\x0e\x18A\x0e\x10B\x0e\bF\v" +0x000209e8:7a "z\n\x0e\x18A\x0e\x10B\x0e\bH\v\n\x0e\x18A\x0e\x10B\x0e\bM\v\x1c" -0x000209f2:46 "F\v" +0x000209f2:48 "H\v\n\x0e\x18A\x0e\x10B\x0e\bM\v\x1c" +0x000209f4:600a0e18410e10420e084d0b1c0000009c2b "\n\x0e\x18A\x0e\x10B\x0e\bM\v\x1c" +0x00020a08:f869ffff4800000000450e1086025e0a0e084d0b530e08 "\xf8i\xff\xffH" -0x00020a20:e068ffff3700 "\xe0h\xff\xff7" +0x00020a20:28000000bc2b "(" +0x00020a28:286affff73 "(j\xff\xffs" -0x00020a30:1c000000bc2e00000869ffff3c00000000480e10610a0e08470b4b0e08 "\x1c" -0x00020a50:3400 "4" +0x00020a50:e82b "\xe8+" -0x00020a54:dc2e00002869ffff8a00000000460e108c02410e188603440e2083047a0a "\xdc." +0x00020a54:7c6affff6500000000460e108f02490e188e03450e208d04450e288c0544 "|j\xff\xffe" -0x00020a73:18410e10420e08480b600a0e18410e10420e084d0b1c000000142f00008069ffff48 "\x18A\x0e\x10B\x0e\bH\v\n\x0e\x18A\x0e\x10B\x0e\bM\v\x1c" +0x00020a73:308606480e388307470e406e0e38410e30410e28420e20420e18420e10420e080010 "0\x86\x06H\x0e8\x83\aG\x0e@n\x0e8A\x0e0A\x0e(B\x0e B\x0e\x18B\x0e\x10B\x0e\b" +0x00020a98:302c0000a46affff05000000000000 "0," -0x00020aa8:2c "," +0x00020aa8:14 "\x14" -0x00020aac:342f "4/" +0x00020aac:442c "D," -0x00020ab0:b069 "\xb0i\xff\xffs" +0x00020ab0:a06a "\xa0j\xff\xff\x12" -0x00020ab4:73 "s" +0x00020ab4:12 "\x12" -0x00020ab9:450e108602470e204e0a0e10440e084a0b02440a0e "E\x0e\x10\x86\x02G\x0e N\n\x0e\x10D\x0e\bJ\v\x02D\n\x0e\x10A\x0e\bA\v" -0x00020acf:410e08410b0000 "A\x0e\bA\v" +0x00020acf:011b0c07089001 "\x01\a\b\x90\x01" -0x00020ad8:44 "D" +0x00020ad8:24 "$" -0x00020adc:642f "d/" +0x00020adc:1c00 "\x1c" +0x00020ae0:4035fe "@5\xfe\xff\xb0\x06" -0x00020ae4:6500 "e" +0x00020ae4:b006 "\xb0\x06" -0x00020ae9:460e108f02490e188e03450e208d04450e288c05440e308606480e388307470e406e0e38410e30410e28420e20420e18420e10420e08 "F\x0e\x10\x8f\x02I\x0e\x18\x8e\x03E\x0e \x8d\x04E\x0e(\x8c\x05D\x0e0\x86\x06H\x0e8\x83\aG\x0e@n\x0e8A\x0e0A\x0e(B\x0e B\x0e\x18B\x0e\x10B\x0e\b" +0x00020ae9:0e10460e184a0f0b770880003f1a3a2a332422000000001400000044000000c83bfeff300000000000000000000000100000005c0000 "\x0e\x10F\x0e\x18J\x0f\vw\b\x80" -0x00020b20:14000000ac2f "\x14" +0x00020b20:e03bfeffa006 "\xe0;\xfe\xff\xa0\x06" -0x00020b28:286affff05 "(j\xff\xff\x05" -0x00020b38:10 "\x10" -0x00020b3c:c42f "\xc4/" -0x00020b40:206affff12 " j\xff\xff\x12" -0x00021010:b068 "\xb0h" -0x00021018:7068 "ph" -0x00021020:4073 "@s" -0x00021028:a078 "\xa0x" -0x00021030:5073 "Ps" +0x00021030:b068 "\xb0h" -0x00021038:6079 "y" +0x00021038:7068 "ph" -0x00021040:f06e "\xf0n" +0x00021040:3b73 ";s" +0x00021048:9b78 "\x9bx" +0x00021050:4b73 "Ks" -0x00021058:d0 "\xd0y" +0x00021058:5b "[y" -0x00021060:50c8 "P\xc8" +0x00021060:eb6e "\xebn" -0x00021068:30c9 "0\xc9" +0x00021068:fb78 "\xfbx" -0x00021070:c0c8 "\xc0\xc8" +0x00021070:fb6e "\xfbn" -0x00021078:f0c9 "\xf0\xc9" +0x00021078:cb79 "\xcby" -0x00021080:b0ca "\xb0\xca" +0x00021080:46c8 "F\xc8" -0x00021088:b0cb "\xb0\xcb" +0x00021088:26c9 "&\xc9" -0x00021090:30cb "0\xcb" +0x00021090:b6c8 "\xb6\xc8" -0x00021098:d07c "\xd0|" +0x00021098:e6c9 "\xe6\xc9" -0x000210a0:b0a5 "\xb0\xa5" +0x000210a0:a6ca "\xa6\xca" -0x000210a8:f0a5 "\xf0\xa5" +0x000210a8:a6cb "\xa6\xcb" -0x000210b0:70a7 "p\xa7" +0x000210b0:26cb "&\xcb" -0x000210b8:f0a6 "\xf0\xa6" +0x000210b8:cb7c "\xcb|" -0x000210c0:6078 "x" +0x000210c0:aaa5 "\xaa\xa5" -0x000210c8:70a6 "p\xa6" +0x000210c8:eaa5 "\xea\xa5" -0x000210d0:b0 "\xb0\xa7" +0x000210d0:6a "j\xa7" -0x000210d8:30a5 "0\xa5" +0x000210d8:eaa6 "\xea\xa6" -0x000210e0:8073 "\x80s" +0x000210e0:5b78 "[x" -0x000210e8:707c "p|" +0x000210e8:6aa6 "j\xa6" -0x000210f0:6073 "s" +0x000210f0:aaa7 "\xaa\xa7" +0x000210f8:2aa5 "*\xa5" +0x00021100:7b73 "{s" +0x00021108:6b7c "k|" +0x00021110:5b73 "[s" +0x00021118:fb7b "\xfb{" -0x00021120:b0c0 "\xb0\xc0" -0x00021128:10c2 "\x10\xc2" -0x00021130:f0c0 "\xf0\xc0" -0x00021138:20c3 " \xc3" -0x00021140:d0c4 "\xd0\xc4" +0x00021140:a6c0 "\xa6\xc0" -0x00021148:80a8 "\x80\xa8" +0x00021148:06c2 "\x06\xc2" -0x00021150:10c5 "\x10\xc5" +0x00021150:e6c0 "\xe6\xc0" -0x00021158:20c7 " \xc7" +0x00021158:16c3 "\x16\xc3" -0x00021160:60c0 "\xc0" +0x00021160:c6c4 "\xc6\xc4" -0x00021168:90c2 "\x90\xc2" +0x00021168:7aa8 "z\xa8" -0x00021170:c0bf "\xc0\xbf" +0x00021170:06c5 "\x06\xc5" -0x00021178:b0c3 "\xb0\xc3" +0x00021178:16c7 "\x16\xc7" -0x00021180:60c5 "\xc5" +0x00021180:56c0 "V\xc0" -0x00021188:f0a7 "\xf0\xa7" +0x00021188:86c2 "\x86\xc2" -0x00021190:40c6 "@\xc6" +0x00021190:b6bf "\xb6\xbf" -0x00021198:b0c7 "\xb0\xc7" +0x00021198:a6c3 "\xa6\xc3" -0x000211a0:40c1 "@\xc1" +0x000211a0:56c5 "V\xc5" -0x000211a8:50c4 "P\xc4" +0x000211a8:eaa7 "\xea\xa7" -0x000211b0:10c0 "\x10\xc0" +0x000211b0:36c6 "6\xc6" -0x000211b8:80c1 "\x80\xc1" +0x000211b8:a6c7 "\xa6\xc7" +0x000211c0:36c1 "6\xc1" -0x000211c8:807b "\x80{" +0x000211c8:46c4 "F\xc4" -0x000211d0:b0c5 "\xb0\xc5" +0x000211d0:06c0 "\x06\xc0" -0x000211d8:90c6 "\x90\xc6" +0x000211d8:76c1 "v\xc1" -0x000211e0:88c201 "\x88\xc2\x01" +0x000211e0:f6c500 "\xf6\xc5" -0x000211e8:129b01 "\x12\x9b\x01" +0x000211e8:7b7b00 "{{" -0x000211f0:169b01 "\x16\x9b\x01" +0x000211f0:a6c500 "\xa6\xc5" -0x000211f8:1c9b01 "\x1c\x9b\x01" +0x000211f8:86c600 "\x86\xc6" -0x00021200:229b "\"\x9b\x01" +0x00021200:88c2 "\x88\xc2\x01" -0x00021208:25 "%\x9b\x01" +0x00021208:12 "\x12\x9b\x01" -0x00021210:2a "*\x9b\x01" +0x00021210:16 "\x16\x9b\x01" -0x00021218:32 "2\x9b\x01" +0x00021218:1c "\x1c\x9b\x01" -0x00021220:2f "/\x9b\x01" +0x00021220:22 "\"\x9b\x01" +0x00021228:259b01 "%\x9b\x01" +0x00021230:2a9b01 "*\x9b\x01" +0x00021238:329b01 "2\x9b\x01" -0x00021240:36 "6\x9b\x01" +0x00021240:2f "/\x9b\x01" -0x00021248:bcbe01 "\xbc\xbe\x01" -0x00021250:3c9b01 "<\x9b\x01" -0x00021258:409b01 "@\x9b\x01" -0x00021260:46 "F\x9b\x01" +0x00021260:36 "6\x9b\x01" +0x00021268:bcbe01 "\xbc\xbe\x01" +0x00021270:3c9b01 "<\x9b\x01" +0x00021278:409b01 "@\x9b\x01" -0x00021280:25 "%\x9b\x01" +0x00021280:46 "F\x9b\x01" -0x00021288:b19901 "\xb1\x99\x01" -0x00021290:a39901 "\xa3\x99\x01" -0x00021298:4d9b01 "M\x9b\x01" -0x000212a0:cf97 "\xcf\x97\x01" +0x000212a0:259b "%\x9b\x01" +0x000212a8:b19901 "\xb1\x99\x01" +0x000212b0:a39901 "\xa3\x99\x01" +0x000212b8:4d9b01 "M\x9b\x01" -0x000212c0:579b "W\x9b\x01" +0x000212c0:cf97 "\xcf\x97\x01" -0x000212c8:5f9b01 "_\x9b\x01" -0x000212d0:649b01 "d\x9b\x01" -0x000212d8:6b9b01 "k\x9b\x01" -0x000212e0:76 "v\x9b\x01" +0x000212e0:57 "W\x9b\x01" -0x000212e8:7d "}\x9b\x01" +0x000212e8:5f "_\x9b\x01" -0x000212f0:86 "\x86\x9b\x01" +0x000212f0:64 "d\x9b\x01" +0x000212f8:6b9b01 "k\x9b\x01" -0x00021300:209c " \x9c\x01" +0x00021300:769b "v\x9b\x01" +0x00021308:7d9b01 "}\x9b\x01" +0x00021310:869b01 "\x86\x9b\x01" -0x00021318:61 "a" -0x00021320:74c2 "t\xc2\x01" +0x00021320:209c " \x9c\x01" -0x00021338:62 "b" +0x00021338:61 "a" -0x00021340:949b "\x94\x9b\x01" +0x00021340:74c2 "t\xc2\x01" -0x00021358:64 "d" +0x00021358:62 "b" -0x00021360:9e "\x9e\x9b\x01" +0x00021360:94 "\x94\x9b\x01" -0x00021378:44 "D" +0x00021378:64 "d" -0x00021380:a4 "\xa4\x9b\x01" +0x00021380:9e "\x9e\x9b\x01" -0x00021398:86 "\x86" +0x00021398:44 "D" -0x000213a0:ae "\xae\x9b\x01" +0x000213a0:a4 "\xa4\x9b\x01" -0x000213b8:87 "\x87" +0x000213b8:86 "\x86" -0x000213c0:c6 "\xc6\x9b\x01" +0x000213c0:ae "\xae\x9b\x01" -0x000213d8:68 "h" +0x000213d8:87 "\x87" -0x000213e0:d5 "\xd5\x9b\x01" +0x000213e0:c6 "\xc6\x9b\x01" -0x000213f8:69 "i" +0x000213f8:68 "h" -0x00021400:db "\xdb\x9b\x01" +0x00021400:d5 "\xd5\x9b\x01" -0x00021418:6b "k" +0x00021418:69 "i" -0x00021420:e5 "\xe5\x9b\x01" +0x00021420:db "\xdb\x9b\x01" -0x00021438:6e "n" +0x00021438:6b "k" -0x00021440:f5 "\xf5\x9b\x01" +0x00021440:e5 "\xe5\x9b\x01" -0x00021458:47 "G" +0x00021458:6e "n" -0x00021460:fe "\xfe\x9b\x01" +0x00021460:f5 "\xf5\x9b\x01" -0x00021478:71 "q" +0x00021478:47 "G" -0x00021480:119c "\x11\x9c\x01" +0x00021480:fe9b "\xfe\x9b\x01" -0x00021498:72 "r" +0x00021498:71 "q" -0x000214a0:a399 "\xa3\x99\x01" +0x000214a0:119c "\x11\x9c\x01" -0x000214b8:73 "s" +0x000214b8:72 "r" -0x000214c0:86 "\x86\x99\x01" +0x000214c0:a3 "\xa3\x99\x01" -0x000214c8:01 "\x01" -0x000214d8:77 "w" +0x000214d8:73 "s" -0x000214e0:199c "\x19\x9c\x01" +0x000214e0:8699 "\x86\x99\x01" +0x000214e8:01 "\x01" -0x000214f8:41 "A" +0x000214f8:77 "w" -0x00021500:24 "$\x9c\x01" +0x00021500:19 "\x19\x9c\x01" -0x00021518:42 "B" +0x00021518:41 "A" -0x00021520:33 "3\x9c\x01" +0x00021520:24 "$\x9c\x01" -0x00021538:46 "F" +0x00021538:42 "B" -0x00021540:3c "<\x9c\x01" +0x00021540:33 "3\x9c\x01" -0x00021558:84 "\x84" +0x00021558:46 "F" -0x00021560:46 "F\x9c\x01" +0x00021560:3c "<\x9c\x01" -0x00021578:8d "\x8d" +0x00021578:84 "\x84" -0x00021580:49 "I\x9c\x01" +0x00021580:46 "F\x9c\x01" -0x00021598:48 "H" +0x00021598:8d "\x8d" -0x000215a0:18be "\x18\xbe\x01" +0x000215a0:499c "I\x9c\x01" -0x000215b8:83 "\x83" +0x000215b8:48 "H" -0x000215c0:629c "b\x9c\x01" +0x000215c0:18be "\x18\xbe\x01" -0x000215c8:01 "\x01" -0x000215d8:88 "\x88" +0x000215d8:83 "\x83" -0x000215e0:67 "g\x9c\x01" +0x000215e0:62 "b\x9c\x01" -0x000215f8:49 "I" +0x000215f8:88 "\x88" -0x00021600:d599 "\xd5\x99\x01" +0x00021600:679c "g\x9c\x01" -0x00021618:8a "\x8a" +0x00021618:49 "I" -0x00021620:6e9c "n\x9c\x01" +0x00021620:d599 "\xd5\x99\x01" +0x00021628:01 "\x01" -0x00021638:4c "L" +0x00021638:8a "\x8a" -0x00021640:7a "z\x9c\x01" +0x00021640:6e "n\x9c\x01" -0x00021658:4e "N" +0x00021658:4c "L" -0x00021660:82 "\x82\x9c\x01" +0x00021660:7a "z\x9c\x01" -0x00021678:51 "Q" +0x00021678:4e "N" -0x00021680:e799 "\xe7\x99\x01" +0x00021680:829c "\x82\x9c\x01" -0x00021688:01 "\x01" -0x00021698:8b "\x8b" +0x00021698:51 "Q" -0x000216a0:8d9c "\x8d\x9c\x01" +0x000216a0:e799 "\xe7\x99\x01" +0x000216a8:01 "\x01" -0x000216b8:52 "R" +0x000216b8:8b "\x8b" -0x000216c0:b899 "\xb8\x99\x01" +0x000216c0:8d9c "\x8d\x9c\x01" -0x000216c8:01 "\x01" -0x000216d8:85 "\x85" +0x000216d8:52 "R" -0x000216e0:979c "\x97\x9c\x01" +0x000216e0:b899 "\xb8\x99\x01" +0x000216e8:01 "\x01" -0x000216f8:8c "\x8c" +0x000216f8:85 "\x85" -0x00021700:aa99 "\xaa\x99\x01" +0x00021700:979c "\x97\x9c\x01" -0x00021708:01 "\x01" -0x00021718:8e "\x8e" +0x00021718:8c "\x8c" -0x00021721:9c "\x9c\x01" +0x00021721:99 "\x99\x01" -0x00021738:54 "T" +0x00021738:8e "\x8e" -0x00021740:b199 "\xb1\x99\x01" +0x00021740:aa9c "\xaa\x9c\x01" -0x00021758:8f "\x8f" +0x00021758:54 "T" -0x00021760:b29c "\xb2\x9c\x01" +0x00021760:b199 "\xb1\x99\x01" -0x00021778:90 "\x90" +0x00021778:8f "\x8f" -0x00021780:c199 "\xc1\x99\x01" +0x00021780:b29c "\xb2\x9c\x01" -0x00021788:02 "\x02" +0x00021788:01 "\x01" -0x00021798:82 "\x82" +0x00021798:90 "\x90" -0x000217a0:c9 "\xc9\x99\x01" +0x000217a0:c1 "\xc1\x99\x01" -0x000217b8:89 "\x89" +0x000217b8:82 "\x82" -0x000217c0:bd9c "\xbd\x9c\x01" +0x000217c0:c999 "\xc9\x99\x01" -0x000217c8:01 "\x01" +0x000217c8:02 "\x02" -0x000217d8:81 "\x81" +0x000217d8:89 "\x89" -0x000217e0:c8 "\xc8\x9c\x01" +0x000217e0:bd "\xbd\x9c\x01" +0x000217e8:01 "\x01" -0x000217f8:5a "Z" +0x000217f8:81 "\x81" -0x00021800:d0 "\xd0\x9c\x01" +0x00021800:c8 "\xc8\x9c\x01" -0x00021818:80 "\x80" +0x00021818:5a "Z" -0x00021820:d7 "\xd7\x9c\x01" +0x00021820:d0 "\xd0\x9c\x01" -0x00021838:7effffff "~\xff\xff\xff" +0x00021838:80000000 "\x80" -0x00021840:cf97 "\xcf\x97\x01" +0x00021840:d79c "\xd7\x9c\x01" -0x00021858:7d "}\xff\xff\xff" +0x00021858:7e "~\xff\xff\xff" +0x00021860:cf9701 "\xcf\x97\x01" +0x00021878:7dffffff "}\xff\xff\xff" -0x00021880:469901 "F\x99\x01" -0x00021888:3b9d01 ";\x9d\x01" -0x00021890:3e9d01 ">\x9d\x01" -0x00021898:0e9c01 "\x0e\x9c\x01" -0x000218a0:229b "\"\x9b\x01" +0x000218a0:4699 "F\x99\x01" -0x000218a8:41 "A\x9d\x01" +0x000218a8:3b ";\x9d\x01" -0x000218b0:44 "D\x9d\x01" +0x000218b0:3e ">\x9d\x01" -0x000218b8:479d "G\x9d\x01" +0x000218b8:0e9c "\x0e\x9c\x01" -0x000218c0:4a9d "J\x9d\x01" +0x000218c0:229b "\"\x9b\x01" -0x000218c8:7d "}\x9d\x01" +0x000218c8:41 "A\x9d\x01" -0x000218d0:4d "M\x9d\x01" +0x000218d0:44 "D\x9d\x01" -0x000218d8:50 "P\x9d\x01" +0x000218d8:47 "G\x9d\x01" -0x000218e0:53 "S\x9d\x01" +0x000218e0:4a "J\x9d\x01" -0x000218e8:d49c "\xd4\x9c\x01" +0x000218e8:7d9d "}\x9d\x01" -0x000218f0:56 "V\x9d\x01" +0x000218f0:4d "M\x9d\x01" -0x000218f8:59 "Y\x9d\x01" +0x000218f8:50 "P\x9d\x01" -0x00021900:5c "\\\x9d\x01" +0x00021900:53 "S\x9d\x01" -0x00021908:5f9d "_\x9d\x01" +0x00021908:d49c "\xd4\x9c\x01" -0x00021910:c39b "\xc3\x9b\x01" +0x00021910:569d "V\x9d\x01" -0x00021918:62 "b\x9d\x01" +0x00021918:59 "Y\x9d\x01" -0x00021920:65 "e\x9d\x01" +0x00021920:5c "\\\x9d\x01" -0x00021928:68 "h\x9d\x01" +0x00021928:5f "_\x9d\x01" -0x00021930:6b9d "k\x9d\x01" +0x00021930:c39b "\xc3\x9b\x01" -0x00021938:6e "n\x9d\x01" +0x00021938:62 "b\x9d\x01" +0x00021940:659d01 "e\x9d\x01" +0x00021948:689d01 "h\x9d\x01" +0x00021950:6b9d01 "k\x9d\x01" +0x00021958:6e9d01 "n\x9d\x01" -0x00021960:259b01 "%\x9b\x01" -0x00021968:719d01 "q\x9d\x01" -0x00021970:3c9c01 "<\x9c\x01" -0x00021978:339c01 "3\x9c\x01" +0x00021980:259b01 "%\x9b\x01" +0x00021988:719d01 "q\x9d\x01" +0x00021990:3c9c01 "<\x9c\x01" +0x00021998:339c01 "3\x9c\x01" -0x000219a0:3d9901 "=\x99\x01" -0x000219a8:779d01 "w\x9d\x01" -0x000219b0:7c9d01 "|\x9d\x01" -0x000219b8:549901 "T\x99\x01" +0x000219c0:3d9901 "=\x99\x01" +0x000219c8:779d01 "w\x9d\x01" -0x000219d0:c69b "\xc6\x9b\x01" +0x000219d0:7c9d "|\x9d\x01" -0x000219d8:469c "F\x9c\x01" +0x000219d8:5499 "T\x99\x01" +0x000219f0:c69b01 "\xc6\x9b\x01" +0x000219f8:469c01 "F\x9c\x01" -0x00021a00:7a9c01 "z\x9c\x01" -0x00021a08:5bc201 "[\xc2\x01" -0x00021a10:61c201 "a\xc2\x01" -0x00021a18:6ec201 "n\xc2\x01" -0x00021a20:7bc2 "{\xc2\x01" +0x00021a20:7a9c "z\x9c\x01" -0x00021a28:eccc "\xec\xcc\x01" +0x00021a28:5bc2 "[\xc2\x01" -0x00021a30:8f "\x8f\xc2\x01" +0x00021a30:61 "a\xc2\x01" -0x00021a38:74 "t\xc2\x01" +0x00021a38:6e "n\xc2\x01" -0x00021a40:5499 "T\x99\x01" +0x00021a40:7bc2 "{\xc2\x01" -0x00021a48:97c2 "\x97\xc2\x01" +0x00021a48:eccc "\xec\xcc\x01" +0x00021a50:8fc201 "\x8f\xc2\x01" -0x00021a58:010000 "\x01" +0x00021a58:74c201 "t\xc2\x01" -0x00021a60:010000 "\x01" +0x00021a60:549901 "T\x99\x01" -0x00021a68:010000 "\x01" +0x00021a68:97c201 "\x97\xc2\x01" -0x00021a70:76 "v" -0x00021a78:0c "\f" +0x00021a78:01 "\x01" +0x00021a80:0100 "\x01" -0x00021a88:0d "\r" +0x00021a88:01 "\x01" -0x00021a90:747501 "tu\x01" +0x00021a90:ce0100 "\xce\x01" -0x00021aa0:10 "\x10 \x02" +0x00021aa0:30 "0 \x02" -0x00021ac0:18 "\x18 \x02" +0x00021ac0:38 "8 \x02" -0x00021ae0:a0 "\xa0\x03" +0x00021ae0:b8 "\xb8\x03" -0x00021af0:9011 "\x90\x11" +0x00021af0:8010 "\x80\x10" -0x00021b00:88 "\x88\x04" +0x00021b00:68 "h\x04" -0x00021b10:4c06 "L\x06" +0x00021b10:b405 "\xb4\x05" -0x00021b70:b82c "\xb8," +0x00021b70:f82a "\xf8*" -0x00021b80:6819 "h\x19" +0x00021b80:a817 "\xa8\x17" -0x00021bd0:f818 "\xf8\x18" +0x00021bd0:3817 "8\x17" -0x00021bf0:dc17 "\xdc\x17" +0x00021bf0:3416 "4\x16" -0x00021c58:58 "X*\x02" +0x00021c58:78 "x*\x02" -0x000221f0:d0 "\xd0\xd4" +0x000221f0:c6 "\xc6\xd4" -0x00022258:20 " D\x02" +0x00022258:80 "\x80D\x02" -0x00022260:60 "i\x01" +0x00022260:41 "Ai\x01" -0x00022268:31356164383336626533333339646563306532653661336336333765303865343861616362642e6465627567 "15ad836be3339dec0e2e6a3c637e08e48aacbd.debug" -0x00022298:fb071937002e7368737472746162 "\xfb\a\x197" -0x000222a7:2e696e74657270 ".interp" -0x000222af:2e6e6f74652e676e752e70726f7065727479 ".note.gnu.property" -0x000222c2:2e6e6f74652e676e752e6275696c642d6964 ".note.gnu.build-id" -0x000222d5:2e6e6f74652e4142492d746167 ".note.ABI-tag" -0x000222e3:2e676e752e68617368 ".gnu.hash" -0x000222ed:2e64796e73796d ".dynsym" -0x000222f5:2e64796e737472002e676e752e76657273696f6e ".dynstr" -0x0002230a:2e676e752e76657273696f6e5f72002e72656c612e64796e ".gnu.version_r" -0x00022323:2e72656c612e706c74002e696e6974 ".rela.plt" -0x00022333:2e706c742e676f74 ".plt.got" -0x0002233c:2e706c742e736563002e74657874 ".plt.sec" -0x0002234b:2e66696e69 ".fini" -0x00022351:2e726f64617461 ".rodata" -0x00022359:2e65685f6672616d655f686472 ".eh_frame_hdr" -0x00022367:2e65685f6672616d65 ".eh_frame" -0x00022371:2e696e69745f6172726179 ".init_array" -0x0002237d:2e66696e695f6172726179 ".fini_array" -0x00022389:2e646174612e72656c2e726f ".data.rel.ro" -0x00022396:2e64796e616d6963 ".dynamic" -0x0002239f:2e64617461002e627373002e676e755f64656275676c696e6b ".data" +0x000223bc:03 "\x03" +0x000223be:0e "\x0e" +0x000223c0:d046 "\xd0F" +0x000223d4:03 "\x03" +0x000223d6:0f "\x0f" +0x000223d9:47 "G" +0x000223ec:03 "\x03" +0x000223ee:10 "\x10" +0x000223f0:a04d "\xa0M" -0x00022400:0b "\v" -0x00022404:01 "\x01" +0x00022404:03 "\x03" +0x00022406:11 "\x11" -0x00022408:020000 "\x02" +0x00022408:647501 "du\x01" -0x00022410:1803 "\x18\x03" -0x00022418:1803 "\x18\x03" +0x0002241c:03 "\x03" +0x0002241e:12 "\x12" -0x00022420:1c0000 "\x1c" -0x00022430:01 "\x01" +0x00022434:03 "\x03" +0x00022436:13 "\x13" +0x00022438:4cd201 "L\xd2\x01" -0x00022440:13 "\x13" -0x00022444:07 "\a" -0x00022448:02 "\x02" +0x0002244c:03 "\x03" +0x0002244e:14 "\x14" -0x00022450:380300 "8\x03" +0x00022450:78db01 "x\xdb\x01" -0x00022458:3803 "8\x03" -0x00022460:20 " " +0x00022464:03 "\x03" +0x00022466:15 "\x15" +0x00022468:302002 "0 \x02" -0x00022470:08 "\b" +0x0002247c:03 "\x03" +0x0002247e:16 "\x16" -0x00022480:260000 "&" +0x00022480:382002 "8 \x02" -0x00022484:07 "\a" -0x00022488:02 "\x02" -0x00022490:5803 "X\x03" +0x00022494:03 "\x03" +0x00022496:17 "\x17" -0x00022498:580300 "X\x03" +0x00022498:402002 "@ \x02" -0x000224a0:24 "$" +0x000224ac:03 "\x03" +0x000224ae:18 "\x18" -0x000224b0:040000 "\x04" +0x000224b0:782a02 "x*\x02" -0x000224c0:39 "9" -0x000224c4:07 "\a" +0x000224c4:03 "\x03" +0x000224c6:19 "\x19" -0x000224c8:020000 "\x02" +0x000224c8:582c02 "X,\x02" -0x000224d0:7c03 "|\x03" -0x000224d8:7c03 "|\x03" +0x000224dc:03 "\x03" +0x000224de:1a "\x1a" -0x000224e0:200000 " " -0x000224f0:04 "\x04" +0x000224f4:03 "\x03" +0x000224f6:1b "" +0x000224f8:803202 "\x802\x02" -0x00022500:47 "G" -0x00022504:f6ffff6f02 "\xf6\xff\xffo\x02" +0x0002250c:04 "\x04" +0x0002250e:f1ff0000 "\xf1\xff" -0x00022518:a003 "\xa0\x03" -0x00022520:e4 "\xe4" +0x00022520:11 "\x11" +0x00022524:02 "\x02" +0x00022526:0c "\f" -0x00022528:0600 "\x06" -0x00022530:08 "\b" +0x00022538:1a "\x1a" +0x0002253c:02 "\x02" +0x0002253e:10 "\x10" -0x00022540:5100 "Q" +0x00022540:a04d "\xa0M" -0x00022544:0b "\v" -0x00022548:02 "\x02" -0x00022550:8804 "\x88\x04" +0x00022550:2300 "#" +0x00022554:02 "\x02" +0x00022556:10 "\x10" -0x00022558:8804 "\x88\x04" +0x00022558:a54d "\xa5M" -0x00022560:080d "\b\r" -0x00022568:07 "\a" +0x00022568:2c "," -0x0002256c:01 "\x01" +0x0002256c:02 "\x02" +0x0002256e:10 "\x10" -0x00022570:0800 "\b" +0x00022570:aa4d "\xaaM" -0x00022578:18 "\x18" -0x00022580:59 "Y" +0x00022580:35 "5" -0x00022584:03 "\x03" +0x00022584:02 "\x02" +0x00022586:10 "\x10" -0x00022588:0200 "\x02" +0x00022588:af4d "\xafM" -0x00022590:9011 "\x90\x11" -0x00022598:9011 "\x90\x11" +0x00022598:3e00 ">" +0x0002259c:02 "\x02" +0x0002259e:10 "\x10" -0x000225a0:4c06 "L\x06" +0x000225a0:b44d "\xb4M" -0x000225b0:01 "\x01" +0x000225b0:47 "G" +0x000225b4:02 "\x02" +0x000225b6:10 "\x10" +0x000225b8:b94d "\xb9M" -0x000225c0:61 "a" -0x000225c4:ffffff6f02 "\xff\xff\xffo\x02" +0x000225cc:02 "\x02" +0x000225ce:10 "\x10" -0x000225d0:dc17 "\xdc\x17" +0x000225d0:be4d "\xbeM" -0x000225d8:dc17 "\xdc\x17" -0x000225e0:1601 "\x16\x01" +0x000225e0:5900 "Y" +0x000225e4:02 "\x02" +0x000225e6:10 "\x10" -0x000225e8:0600 "\x06" +0x000225e8:c34d "\xc3M" -0x000225f0:02 "\x02" -0x000225f8:02 "\x02" +0x000225f8:62 "b" +0x000225fc:02 "\x02" +0x000225fe:10 "\x10" -0x00022600:6e00 "n" +0x00022600:c84d "\xc8M" -0x00022604:feffff6f02 "\xfe\xff\xffo\x02" -0x00022610:f818 "\xf8\x18" +0x00022610:6b00 "k" +0x00022614:02 "\x02" +0x00022616:10 "\x10" -0x00022618:f818 "\xf8\x18" +0x00022618:cd4d "\xcdM" -0x00022620:70 "p" -0x00022628:07 "\a" +0x00022628:74 "t" -0x0002262c:01 "\x01" +0x0002262c:02 "\x02" +0x0002262e:10 "\x10" -0x00022630:0800 "\b" +0x00022630:d24d "\xd2M" -0x00022644:04 "\x04" +0x00022644:02 "\x02" +0x00022646:10 "\x10" -0x00022648:0200 "\x02" +0x00022648:d74d "\xd7M" -0x00022650:6819 "h\x19" -0x00022658:6819 "h\x19" +0x00022658:8600 "\x86" +0x0002265c:02 "\x02" +0x0002265e:10 "\x10" -0x00022660:5013 "P\x13" +0x00022660:dc4d "\xdcM" -0x00022668:06 "\x06" -0x00022670:08 "\b" +0x00022670:8f "\x8f" +0x00022674:02 "\x02" +0x00022676:10 "\x10" -0x00022678:1800 "\x18" +0x00022678:e14d "\xe1M" -0x00022680:87 "\x87" -0x00022684:04 "\x04" -0x00022688:42 "B" +0x00022688:98 "\x98" +0x0002268c:02 "\x02" +0x0002268e:10 "\x10" -0x00022690:b82c "\xb8," +0x00022690:e64d "\xe6M" -0x00022698:b82c "\xb8," -0x000226a0:f009 "\xf0\t" +0x000226a0:a100 "\xa1" +0x000226a4:02 "\x02" +0x000226a6:10 "\x10" -0x000226a8:0600 "\x06" +0x000226a8:eb4d "\xebM" -0x000226ac:19 "\x19" -0x000226b0:08 "\b" -0x000226b8:18 "\x18" +0x000226b8:aa "\xaa" +0x000226bc:02 "\x02" +0x000226be:10 "\x10" -0x000226c0:910000 "\x91" +0x000226c0:bd3201 "\xbd2\x01" -0x000226c4:01 "\x01" -0x000226c8:06 "\x06" +0x000226d0:b400 "\xb4" +0x000226d4:02 "\x02" +0x000226d6:10 "\x10" +0x000226d8:d6df "\xd6\xdf" -0x000226e0:1b "" +0x000226e8:bd "\xbd" +0x000226ec:02 "\x02" +0x000226ee:10 "\x10" -0x000226f0:040000 "\x04" +0x000226f0:507501 "Pu\x01" -0x00022700:8c "\x8c" +0x00022700:c7 "\xc7" -0x00022704:01 "\x01" +0x00022704:02 "\x02" +0x00022706:10 "\x10" -0x00022708:060000 "\x06" +0x00022708:a84801 "\xa8H\x01" -0x00022710:2040 " @" -0x00022718:2040 " @" +0x00022718:d100 "\xd1" +0x0002271c:02 "\x02" +0x0002271e:10 "\x10" -0x00022720:b006 "\xb0\x06" +0x00022720:d6d4 "\xd6\xd4" -0x00022730:10 "\x10" +0x00022730:da "\xda" +0x00022734:02 "\x02" +0x00022736:10 "\x10" -0x00022738:100000 "\x10" +0x00022738:975d01 "\x97]\x01" -0x00022740:97 "\x97" -0x00022744:01 "\x01" -0x00022748:06 "\x06" +0x00022748:e4 "\xe4" +0x0002274c:02 "\x02" +0x0002274e:10 "\x10" -0x00022750:d04600 "\xd0F" +0x00022750:884801 "\x88H\x01" -0x00022758:d046 "\xd0F" -0x00022760:30 "0" +0x00022760:ee "\xee" +0x00022764:02 "\x02" +0x00022766:10 "\x10" +0x00022768:a6d7 "\xa6\xd7" -0x00022770:10 "\x10" -0x00022778:10 "\x10" +0x00022778:f7 "\xf7" +0x0002277c:02 "\x02" +0x0002277e:10 "\x10" -0x00022780:a00000 "\xa0" +0x00022780:a75801 "\xa7X\x01" -0x00022784:01 "\x01" -0x00022788:06 "\x06" +0x00022790:0101 "\x01\x01" +0x00022794:02 "\x02" +0x00022796:10 "\x10" +0x00022798:d60901 "\xd6\t\x01" -0x000227a0:a006 "\xa0\x06" +0x000227a8:0b01 "\v\x01" +0x000227ac:02 "\x02" +0x000227ae:10 "\x10" -0x000227b0:1000 "\x10" +0x000227b0:ab6b "\xabk" -0x000227b8:10 "\x10" -0x000227c0:a900 "\xa9" +0x000227c0:1401 "\x14\x01" -0x000227c4:01 "\x01" +0x000227c4:02 "\x02" +0x000227c6:10 "\x10" -0x000227c8:060000 "\x06" +0x000227c8:285001 "(P\x01" -0x000227d0:a04d "\xa0M" -0x000227d8:a04d "\xa0M" +0x000227d8:1e01 "\x1e\x01" +0x000227dc:02 "\x02" +0x000227de:10 "\x10" -0x000227e0:d227 "\xd2'\x01" +0x000227e0:575b "W[\x01" -0x000227f0:1000 "\x10" +0x000227f0:2801 "(\x01" +0x000227f4:02 "\x02" +0x000227f6:10 "\x10" +0x000227f8:375701 "7W\x01" -0x00022800:af "\xaf" -0x00022804:01 "\x01" -0x00022808:0600 "\x06" +0x00022808:3201 "2\x01" +0x0002280c:02 "\x02" +0x0002280e:10 "\x10" -0x00022810:7475 "tu\x01" +0x00022810:4848 "HH\x01" -0x00022818:747501 "tu\x01" -0x00022820:0d00 "\r" +0x00022820:3c01 "<\x01" +0x00022824:02 "\x02" +0x00022826:10 "\x10" +0x00022828:c84801 "\xc8H\x01" -0x00022830:04 "\x04" +0x00022838:4601 "F\x01" +0x0002283c:02 "\x02" +0x0002283e:10 "\x10" -0x00022840:b500 "\xb5" +0x00022840:46eb "F\xeb" -0x00022844:01 "\x01" -0x00022848:02 "\x02" +0x00022850:4f0100 "O\x01" +0x00022854:02 "\x02" +0x00022856:10 "\x10" +0x00022858:2b6b00 "+k" -0x00022860:4952 "IR" +0x00022868:5801 "X\x01" +0x0002286c:02 "\x02" +0x0002286e:10 "\x10" -0x00022870:2000 " " +0x00022870:d068 "\xd0h" -0x00022880:bd00 "\xbd" +0x00022880:6101 "a\x01" -0x00022884:01 "\x01" +0x00022884:02 "\x02" +0x00022886:10 "\x10" -0x00022888:0200 "\x02" +0x00022888:c068 "\xc0h" -0x00022890:4cd201 "L\xd2\x01" -0x00022898:4cd201 "L\xd2\x01" +0x00022898:6a0100 "j\x01" +0x0002289c:02 "\x02" +0x0002289e:10 "\x10" -0x000228a0:2c09 ",\t" +0x000228a0:b6f4 "\xb6\xf4" -0x000228b0:0400 "\x04" +0x000228b0:7301 "s\x01" +0x000228b4:02 "\x02" +0x000228b6:10 "\x10" +0x000228b8:406d01 "@m\x01" -0x000228c0:cb "\xcb" -0x000228c4:01 "\x01" -0x000228c8:0200 "\x02" +0x000228c8:7d01 "}\x01" +0x000228cc:02 "\x02" +0x000228ce:10 "\x10" -0x000228d0:78db01 "x\xdb\x01" +0x000228d0:6b6f00 "ko" -0x000228d8:78db01 "x\xdb\x01" -0x000228e0:d82f "\xd8/" +0x000228e0:8601 "\x86\x01" +0x000228e4:02 "\x02" +0x000228e6:10 "\x10" +0x000228e8:caa9 "\xca\xa9" -0x000228f0:08 "\b" +0x000228f8:8f01 "\x8f\x01" +0x000228fc:02 "\x02" +0x000228fe:10 "\x10" -0x00022900:d500 "\xd5" +0x00022900:bab8 "\xba\xb8" -0x00022904:0e "\x0e" -0x00022908:03 "\x03" -0x00022910:102002 "\x10 \x02" +0x00022910:980100 "\x98\x01" +0x00022914:02 "\x02" +0x00022916:10 "\x10" -0x00022918:101002 "\x10\x10\x02" +0x00022918:f6fb00 "\xf6\xfb" -0x00022920:08 "\b" +0x00022928:a101 "\xa1\x01" +0x0002292c:02 "\x02" +0x0002292e:10 "\x10" -0x00022930:0800 "\b" +0x00022930:16f0 "\x16\xf0" -0x00022938:08 "\b" -0x00022940:e100 "\xe1" +0x00022940:aa01 "\xaa\x01" -0x00022944:0f "\x0f" +0x00022944:02 "\x02" +0x00022946:10 "\x10" -0x00022948:0300 "\x03" +0x00022948:76f6 "v\xf6" -0x00022950:182002 "\x18 \x02" -0x00022958:181002 "\x18\x10\x02" +0x00022958:b30100 "\xb3\x01" +0x0002295c:02 "\x02" +0x0002295e:10 "\x10" -0x00022960:0800 "\b" +0x00022960:7b6e "{n" -0x00022970:0800 "\b" +0x00022970:bc01 "\xbc\x01" +0x00022974:02 "\x02" +0x00022976:10 "\x10" -0x00022978:0800 "\b" +0x00022978:5b80 "[\x80" -0x00022980:ed "\xed" -0x00022984:01 "\x01" -0x00022988:0300 "\x03" +0x00022988:c501 "\xc5\x01" +0x0002298c:02 "\x02" +0x0002298e:10 "\x10" -0x00022990:202002 " \x02" +0x00022990:bb7d00 "\xbb}" -0x00022998:201002 " \x10\x02" -0x000229a0:380a "8\n" +0x000229a0:ce01 "\xce\x01" +0x000229a4:02 "\x02" +0x000229a6:10 "\x10" +0x000229a8:f75a01 "\xf7Z\x01" -0x000229b0:20 " " +0x000229b8:d801 "\xd8\x01" +0x000229bc:02 "\x02" +0x000229be:10 "\x10" -0x000229c0:fa00 "\xfa" +0x000229c0:1069 "\x10i" -0x000229c4:06 "\x06" -0x000229c8:03 "\x03" -0x000229d0:582a02 "X\x02" +0x000229d0:e10100 "\xe1\x01" +0x000229d4:02 "\x02" +0x000229d6:10 "\x10" -0x000229d8:581a02 "X\x1a\x02" +0x000229d8:7b7100 "{q" -0x000229e1:02 "\x02" -0x000229e8:0700 "\a" +0x000229e8:ea01 "\xea\x01" +0x000229ec:02 "\x02" +0x000229ee:10 "\x10" -0x000229f0:0800 "\b" +0x000229f0:9ba1 "\x9b\xa1" -0x000229f8:10 "\x10" -0x00022a00:9b00 "\x9b" +0x00022a00:f301 "\xf3\x01" -0x00022a04:01 "\x01" +0x00022a04:02 "\x02" +0x00022a06:10 "\x10" -0x00022a08:030000 "\x03" +0x00022a08:b75c01 "\xb7\\x01" -0x00022a10:582c02 "X,\x02" -0x00022a18:581c02 "X\x1c\x02" +0x00022a18:fd0100 "\xfd\x01" +0x00022a1c:02 "\x02" +0x00022a1e:10 "\x10" -0x00022a20:a003 "\xa0\x03" +0x00022a20:eb75 "\xebu" -0x00022a30:0800 "\b" +0x00022a30:0602 "\x06\x02" +0x00022a34:02 "\x02" +0x00022a36:10 "\x10" -0x00022a38:0800 "\b" +0x00022a38:2b6c "+l" -0x00022a40:0301 "\x03\x01" -0x00022a44:01 "\x01" -0x00022a48:0300 "\x03" +0x00022a48:0f02 "\x0f\x02" +0x00022a4c:02 "\x02" +0x00022a4e:10 "\x10" +0x00022a50:3b6b00 ";k" -0x00022a59:2002 " \x02" -0x00022a60:68 "h\x02" +0x00022a60:18 "\x18\x02" +0x00022a64:02 "\x02" +0x00022a66:10 "\x10" +0x00022a68:8b73 "\x8bs" -0x00022a70:20 " " +0x00022a78:2102 "!\x02" +0x00022a7c:02 "\x02" +0x00022a7e:10 "\x10" -0x00022a80:0901 "\t\x01" +0x00022a80:96cc "\x96\xcc" -0x00022a84:08 "\b" -0x00022a88:03 "\x03" -0x00022a90:803202 "\x802\x02" +0x00022a90:2a0200 "\x02" +0x00022a94:02 "\x02" +0x00022a96:10 "\x10" -0x00022a98:682202 "h\"\x02" +0x00022a98:e6d500 "\xe6\xd5" -0x00022aa0:d812 "\xd8\x12" +0x00022aa8:3302 "3\x02" +0x00022aac:02 "\x02" +0x00022aae:10 "\x10" -0x00022ab0:200000 " " +0x00022ab0:175b01 "\x17[\x01" -0x00022ac0:0e01 "\x0e\x01" +0x00022ac0:3d02 "=\x02" -0x00022ac4:01 "\x01" +0x00022ac4:02 "\x02" +0x00022ac6:10 "\x10" +0x00022ac8:546201 "Tb\x01" -0x00022ad8:682202 "h\"\x02" +0x00022ad8:470200 "G\x02" +0x00022adc:02 "\x02" +0x00022ade:10 "\x10" -0x00022ae0:340000 "4" +0x00022ae0:407501 "@u\x01" -0x00022af0:0400 "\x04" +0x00022af0:5102 "Q\x02" +0x00022af4:02 "\x02" +0x00022af6:10 "\x10" +0x00022af8:d07401 "\xd0t\x01" -0x00022b00:01 "\x01" -0x00022b04:03 "\x03" +0x00022b08:5b02 "[\x02" +0x00022b0c:02 "\x02" +0x00022b0e:10 "\x10" +0x00022b11:68 "h" -0x00022b18:9c2202 "\x9c\"\x02" -0x00022b20:1d01 "\x1d\x01" +0x00022b20:6402 "d\x02" +0x00022b24:02 "\x02" +0x00022b26:10 "\x10" +0x00022b28:7068 "ph" -0x00022b30:01 "\x01" +0x00022b38:7a02 "z\x02" +0x00022b3c:02 "\x02" +0x00022b3e:10 "\x10"

and much more differences on the top.

Ideally I would like to have no difference with the original binary with diff ls ls-out.

adamjseitz commented 1 year ago

Generating byte-for-byte identical binaries after reassembly is not currently a design goal of ddisasm - instead it is to produce GTIRB IR and assembly that can be used to build functionally equivalent binaries.

I expect it would be impossible to reliably generate byte-for-byte identical binaries with the current approach of generating assembly and re-assembling it with gcc - we'd likely need to directly generate binaries without the help of an external toolchain to achieve this.

gogo2464 commented 1 year ago

I think having a such tool sounds very interesting for malware analysis because it requires to document a malware that must not be altered.

Sounds also interesting to create tests that check the signature of the recompiled binary.

I may create this tool when I will finish the documentation.

gogo2464 commented 1 year ago

I passed the -O0 to gcc to tell to not optimize the binary.

gogo2464 commented 1 year ago

EDIT: no. I do not need to create the tool.

But yes I may need to create the tool to generate binaries.

gogo2464 commented 1 year ago

@adamjseitz hi.

I digged a lot and a lot of.

Point 1: the sections

First point, gcc create and remove some sections:

$ diff <(radare2 -e bin.cache=true -qc 'iS~[7]' ls) <(radare2 -e bin.cache=true -qc 'iS~[7]' ls-new )
< .gnu_debugaltlink
< .gnu_debuglink
---
> .symtab
> .strtab

then so the sections:

< .gnu_debugaltlink
< .gnu_debuglink

have been deleted

and the sections:

< .gnu_debugaltlink
< .gnu_debuglink

have been created.

Point 2 : the GOT

All the differences found on the rewritten elf are from know issues about GOT.

https://github.com/GrammaTech/ddisasm/blob/main/doc/AuxData.md#got-references

According to the doc:

The linker will then take care of creating a new GOT entry based on this symbolic expression.

If you want to check you can do radiff2 -u ls new-ls.

Others:

I also see difference in the rodata. I absolutely entierely misunderstand this point.

aeflores commented 1 year ago

In general, it is expected that there will be lots of differences at the byte level:

Other than that, different versions of the compiler or linker could decide to arrange sections differently, which would result in further differences.

Note that we perform symbolization, i.e. we create labels for symbolic references, which allows us to make changes in the assembly without breaking functionality. This will likely amplify the differences at the byte level. For example, my copy of ls has some jump tables in the .rodata section that look like this:

.L_18020:
          .long .L_6a61-.L_18020
          .long .L_6a61-.L_18020
...

The bytes in .long .L_6a61-.L_18020 will be resolved to the difference between the location of labels .L_6a61 and .L_18020. If those location change in the reassembled binary, the resulting bytes of the expression .long .L_6a61-.L_18020 will be different. This will often happen. In this case L_18020 points to the current location in .rodata and .L_6a61 points somewhere .text section.

Finally, I have found some differences in the .text section that should not be there. It looks like some notrack jmpq *%rax instructions that we interpret as just jmpq *%rax which is a shorter instruction (2 bytes instead of 3) and is probably exacerbating differences (by shifting the subsequent code).

gogo2464 commented 1 year ago

I would like to make some pull requests to:

-generate .plt and .got at the right place -have a way to tell the linker to generate a copy relocation for the existing slot at the old address

The idea is to keep symbolization to avoid breaking changes but still try to kee the same signature of the malware.

My wish is to be able to document malwares with no need to beak these signatures. Else we could not ensure that we did document these correctly.

I do not plan to help the user to find the good linker / compiler version. There could be other tools which will do that. One tool, one objective. It is the linux philosophy.

the sections could be removed with compiler options. it is not my own priority.

Should I add a PR directly in the core or should I add it in an option? Like --keep-signature maybe.

aeflores commented 1 year ago

-generate .plt and .got at the right place -have a way to tell the linker to generate a copy relocation for the existing slot at the old address

These would be definitely nice to have!

Should I add a PR directly in the core or should I add it in an option? Like --keep-signature maybe.

I am not sure what approach you are planning to take for this. Would these be changes to gtirb-pprinter? For what is worth, I tried to find a better way to deal with COPY relocations, but I couldn't find a nice way to do it. I would think we want these things on by default, but it would depend on the specific approach (and whether is general enough).

My wish is to be able to document malwares with no need to beak these signatures.

I am not sure I understand what you are trying to do, will you be annotating the assembly listings with comments? adding symbols to the rewritten binaries, or something else?

gogo2464 commented 1 year ago

I am not sure what approach you are planning to take for this. Would these be changes to gtirb-pprinter? For what is worth, I tried to find a better way to deal with COPY relocations, but I couldn't find a nice way to do it. I would think we want these things on by default, but it would depend on the specific approach (and whether is general enough).

I am currently watching.

I am not sure I understand what you are trying to do, will you be annotating the assembly listings with comments? adding symbols to the rewritten binaries, or something else?

Yes absolutely I may in the future, use ddisasm on malwares in order to document malware with comments, to rename labels and functions. And if I have a great great time, I might spend time to rewrites asm to c with the exact compiler and linker version. Seems pretty long to do of course.

gogo2464 commented 1 year ago

I am very busy. I may start this PR this week. I will push a pr fro documentation ion ddisasm before.