exploit.S

        .file   "foo.c"
        .section        .rodata
        .align 8
.LC0:
        .string "%s should get paid %.3f because %s.\n"
        .text
        .globl  write_check
        .type   write_check, @function
write_check:
.LFB0:
        pushq   %rbp
        movq    %rsp, %rbp
        subq    $32, %rsp
        movq    %rdi, -8(%rbp)
        movss   %xmm0, -12(%rbp)
        movq    %rsi, -24(%rbp)
        cvtss2sd        -12(%rbp), %xmm0
        movq    -24(%rbp), %rdx
        movq    -8(%rbp), %rax
        movq    %rax, %rsi
        movl    $.LC0, %edi
        movl    $1, %eax
        call    printf
        nop
        leave
        ret
.LFE0:
        .size   write_check, .-write_check
        .section        .rodata
.LC3:
        .string "memo: %x\n"
.LC4:
        .string "memo + 32: %x\n"
.LC5:
        .string "amount: %x\n"
        .text
        .globl  payment
        .type   payment, @function
payment:
.LFB1:
        pushq   %rbp
        movq    %rsp, %rbp
        subq    $96, %rsp
        movq    %rdi, -72(%rbp)
        movss   %xmm0, -76(%rbp)
        movq    %rsi, -88(%rbp)
        movq    %fs:40, %rax
        movq    %rax, -8(%rbp)
        xorl    %eax, %eax
        cvtss2sd        -76(%rbp), %xmm0
        movsd   .LC1(%rip), %xmm1
        mulsd   %xmm1, %xmm0
        movsd   .LC2(%rip), %xmm1
        divsd   %xmm1, %xmm0
        cvtsd2ss        %xmm0, %xmm0
        movss   %xmm0, -52(%rbp)
        leaq    -48(%rbp), %rax
        movabsq $2338615488419553616, %rcx
        movq    %rcx, (%rax)
        movl    $980578150, 8(%rax)
        movw    $32, 12(%rax)
        movq    -88(%rbp), %rdx
        leaq    -48(%rbp), %rax
        movq    %rdx, %rsi
        movq    %rax, %rdi
        call    strcat
        movl    -52(%rbp), %edx
        leaq    -48(%rbp), %rcx
        movq    -72(%rbp), %rax
        movq    %rcx, %rsi
        movl    %edx, -92(%rbp)
        movss   -92(%rbp), %xmm0
        movq    %rax, %rdi
        call    write_check
        leaq    -48(%rbp), %rax
        movq    %rax, %rsi
        movl    $.LC3, %edi
        movl    $0, %eax
        call    printf
        leaq    -48(%rbp), %rax
        addq    $1024, %rax
        movq    %rax, %rsi
        movl    $.LC4, %edi
        movl    $0, %eax
        call    printf
        leaq    -52(%rbp), %rax
        movq    %rax, %rsi
        movl    $.LC5, %edi
        movl    $0, %eax
        call    printf
        nop
        movq    -8(%rbp), %rax
        xorq    %fs:40, %rax
        je      .L3
        call    __stack_chk_fail
.L3:
        leave
        ret
.LFE1:
        .size   payment, .-payment
        .section        .rodata
.LC6:
        .string "aaaaaaaaaaaaaaaaaaaaaaaaaa"
.LC7:
        .string "Elliott Beach"
        .text
        .globl  main
        .type   main, @function
main:
.LFB2:
        pushq   %rbp
        movq    %rsp, %rbp
        movl    $.LC6, %esi
        movss   .LC8(%rip), %xmm0
        movl    $.LC7, %edi
        call    payment
        movl    $0, %eax
        popq    %rbp
        ret
.LFE2:
        .size   main, .-main
        .section        .rodata
        .align 8
.LC1:
        .long   3435973837
        .long   1079274700
        .align 8
.LC2:
        .long   0
        .long   1079574528
        .align 4
.LC8:
        .long   1117782016
        .ident  "GCC: (Ubuntu 5.4.0-6ubuntu1~16.04.4) 5.4.0 20160609"
        .section        .note.GNU-stack,"",@progbits