.section ".tbss", "awT", @nobits
|
.section ".tbss", "awT", @nobits
|
.globl bg1, bg2, bg3, bg4, bg5, bg6, bg7, bg8
|
.globl bg1, bg2, bg3, bg4, bg5, bg6, bg7, bg8
|
bg1: .space 4
|
bg1: .space 4
|
bg2: .space 4
|
bg2: .space 4
|
bg3: .space 4
|
bg3: .space 4
|
bg4: .space 4
|
bg4: .space 4
|
bg5: .space 4
|
bg5: .space 4
|
bg6: .space 4
|
bg6: .space 4
|
bg7: .space 4
|
bg7: .space 4
|
bg8: .space 4
|
bg8: .space 4
|
bl1: .space 4
|
bl1: .space 4
|
bl2: .space 4
|
bl2: .space 4
|
bl3: .space 4
|
bl3: .space 4
|
bl4: .space 4
|
bl4: .space 4
|
bl5: .space 4
|
bl5: .space 4
|
bl6: .space 4
|
bl6: .space 4
|
bl7: .space 4
|
bl7: .space 4
|
bl8: .space 4
|
bl8: .space 4
|
.text
|
.text
|
.globl _start
|
.globl _start
|
.type _start,@function
|
.type _start,@function
|
_start:
|
_start:
|
pushq %rbp
|
pushq %rbp
|
movq %rsp, %rbp
|
movq %rsp, %rbp
|
|
|
/* IE against global var */
|
/* IE against global var */
|
movq %fs:0, %r11
|
movq %fs:0, %r11
|
nop;nop
|
nop;nop
|
addq sG6@gottpoff(%rip), %r11
|
addq sG6@gottpoff(%rip), %r11
|
nop;nop;nop;nop
|
nop;nop;nop;nop
|
|
|
/* IE -> LE against global var defined in exec */
|
/* IE -> LE against global var defined in exec */
|
movq %fs:0, %rdx
|
movq %fs:0, %rdx
|
nop;nop
|
nop;nop
|
addq bg6@gottpoff(%rip), %rdx
|
addq bg6@gottpoff(%rip), %rdx
|
nop;nop;nop;nop
|
nop;nop;nop;nop
|
|
|
/* IE -> LE against local var */
|
/* IE -> LE against local var */
|
movq %fs:0, %r12
|
movq %fs:0, %r12
|
nop;nop
|
nop;nop
|
addq bl6@gottpoff(%rip), %r12
|
addq bl6@gottpoff(%rip), %r12
|
nop;nop;nop;nop
|
nop;nop;nop;nop
|
|
|
/* direct %fs access IE -> LE against local var */
|
/* direct %fs access IE -> LE against local var */
|
movq bl8@gottpoff(%rip), %rdx
|
movq bl8@gottpoff(%rip), %rdx
|
nop;nop
|
nop;nop
|
movq %fs:(%rdx), %rax
|
movq %fs:(%rdx), %rax
|
nop;nop;nop;nop
|
nop;nop;nop;nop
|
|
|
/* IE -> LE against hidden but not local var */
|
/* IE -> LE against hidden but not local var */
|
movq %fs:0, %rdx
|
movq %fs:0, %rdx
|
nop;nop
|
nop;nop
|
addq sh6@gottpoff(%rip), %rdx
|
addq sh6@gottpoff(%rip), %rdx
|
nop;nop;nop;nop
|
nop;nop;nop;nop
|
|
|
/* direct %fs access IE -> LE against hidden but not local var */
|
/* direct %fs access IE -> LE against hidden but not local var */
|
movq sh8@gottpoff(%rip), %rdx
|
movq sh8@gottpoff(%rip), %rdx
|
nop;nop
|
nop;nop
|
movq %fs:(%rdx), %rax
|
movq %fs:(%rdx), %rax
|
nop;nop;nop;nop
|
nop;nop;nop;nop
|
|
|
/* LE, global var defined in exec */
|
/* LE, global var defined in exec */
|
movq %fs:0, %rax
|
movq %fs:0, %rax
|
nop;nop
|
nop;nop
|
leaq sg2@tpoff(%rax), %rdx
|
leaq sg2@tpoff(%rax), %rdx
|
nop;nop;nop;nop
|
nop;nop;nop;nop
|
|
|
/* LE, local var, non-canonical sequence */
|
/* LE, local var, non-canonical sequence */
|
movq $2+bl2@tpoff, %r9
|
movq $2+bl2@tpoff, %r9
|
nop;nop
|
nop;nop
|
movq %fs:0, %rdx
|
movq %fs:0, %rdx
|
nop;nop
|
nop;nop
|
addq %r9, %rdx
|
addq %r9, %rdx
|
nop;nop;nop;nop
|
nop;nop;nop;nop
|
|
|
/* LE, hidden var defined in exec, non-canonical sequence */
|
/* LE, hidden var defined in exec, non-canonical sequence */
|
movq %fs:0, %rdx
|
movq %fs:0, %rdx
|
nop;nop
|
nop;nop
|
addq $sh2@tpoff+1, %rdx
|
addq $sh2@tpoff+1, %rdx
|
nop;nop;nop;nop
|
nop;nop;nop;nop
|
|
|
/* Direct %fs access */
|
/* Direct %fs access */
|
|
|
/* LE, global var defined in exec */
|
/* LE, global var defined in exec */
|
movq %fs:sg3@tpoff, %rax
|
movq %fs:sg3@tpoff, %rax
|
nop;nop;nop;nop
|
nop;nop;nop;nop
|
|
|
/* LE, local var */
|
/* LE, local var */
|
movq %fs:bl3@tpoff+3, %r10
|
movq %fs:bl3@tpoff+3, %r10
|
nop;nop;nop;nop
|
nop;nop;nop;nop
|
|
|
/* LE, hidden var defined in exec */
|
/* LE, hidden var defined in exec */
|
movq %fs:1+sh3@tpoff, %rdx
|
movq %fs:1+sh3@tpoff, %rdx
|
nop;nop;nop;nop
|
nop;nop;nop;nop
|
|
|
leave
|
leave
|
ret
|
ret
|
|
|
