[*] Binary protection state of ubcom

  	RELRO          CANARY            NX           PIE          RPATH        RUNPATH      SYMBOLS      

  	No RELRO       No Canary found   NX disabled  No PIE       No RPATH     No RUNPATH   No Symbols

[*] Function printf tear down of ubcom

lw v0, 0xc(fp)

nop

andi v0, v0, 0xffff

nor v0, zero, v0

andi v0, v0, 0xffff

sh v0, 0x14(fp)

lhu v0, 0x14(fp)

move sp, fp

lw fp, 0x1c(sp)

addiu sp, sp, 0x20

jr ra

nop

addiu sp, sp, -0x20

sw ra, 0x1c(sp)

sw fp, 0x18(sp)

move fp, sp

lui gp, 0x42

addiu gp, gp, -0x3860

sw gp, 0x10(sp)

sw a0, 0x20(fp)

lui v0, 0x41

lw v1, 0x48f0(v0)

lui v0, 0x40

addiu a0, v0, 0x4208

move a1, v1

lw t9, -sym.imp.printf(gp)

nop

jalr t9

nop

lw gp, 0x10(fp)

addiu a0, zero, 1

lw t9, -sym.imp.exit(gp)

nop

jalr t9

nop

addiu sp, sp, -0x28

sw ra, 0x24(sp)

sw fp, 0x20(sp)

move fp, sp

lui gp, 0x42

addiu gp, gp, -0x3860

sw gp, 0x10(sp)

sw a0, 0x28(fp)

lw a0, 0x28(fp)

addiu a1, zero, 3

lw t9, -sym.imp.fcntl(gp)

--

nop

beqz v0, 0x401c50

nop

lw v0, 0x34(fp)

nop

lbu v1, (v0)

addiu v0, zero, 0xb

bne v1, v0, 0x401a10

nop

lw v0, 0x34(fp)

nop

lbu v0, (v0)

nop

bnez v0, 0x401cac

nop

lui v0, 0x41

lw v0, 0x48e0(v0)

nop

beqz v0, 0x401cf4

nop

lui v0, 0x41

lw v1, 0x48f0(v0)

lui v0, 0x40

addiu a0, v0, 0x426c

move a1, v1

lw t9, -sym.imp.printf(gp)

nop

jalr t9

nop

lw gp, 0x18(fp)

b 0x401cf4

nop

lw v0, 0x34(fp)

nop

lbu v1, (v0)

addiu v0, zero, 0xb

bne v1, v0, 0x401cf4

nop

lui v0, 0x41

lw v0, 0x48e0(v0)

nop

beqz v0, 0x401cf4

nop

lui v0, 0x40

addiu a0, v0, 0x427c

lw t9, -sym.imp.puts(gp)

--

and v0, v1, v0

srl v0, v0, 0x10

sw v0, 0x28(fp)

lw v0, 0x34(fp)

nop

andi v0, v0, 0xff00

srl v0, v0, 8

sw v0, 0x2c(fp)

lw v0, 0x34(fp)

nop

andi v0, v0, 0xff

sw v0, 0x30(fp)

lui v0, 0x41

lw v0, 0x48e0(v0)

nop

beqz v0, 0x4025f0

nop

lw v0, 0x24(fp)

nop

sw v0, 0x10(sp)

lui v0, 0x40

addiu a0, v0, 0x42b4

lw a1, 0x30(fp)

lw a2, 0x2c(fp)

lw a3, 0x28(fp)

lw t9, -sym.imp.printf(gp)

nop

jalr t9

nop

lw gp, 0x18(fp)

lw v1, 0x30(fp)

lw v0, -obj.IPTMP(gp)

nop

sw v1, (v0)

lw v1, 0x2c(fp)

lw v0, -obj.IPTMP(gp)

nop

sw v1, 4(v0)

lw v1, 0x28(fp)

lw v0, -obj.IPTMP(gp)

nop

sw v1, 8(v0)

lw v1, 0x24(fp)

lw v0, -obj.IPTMP(gp)

nop

sw v1, 0xc(v0)

lw v0, 0x54(fp)

nop

lbu v0, (v0)

nop

bnez v0, 0x40268c

nop

lui v0, 0x41

lw v0, 0x48e0(v0)

nop

beqz v0, 0x4026d4

nop

lui v0, 0x41

lw v1, 0x48f0(v0)

lui v0, 0x40

addiu a0, v0, 0x426c

move a1, v1

lw t9, -sym.imp.printf(gp)

nop

jalr t9

nop

lw gp, 0x18(fp)

b 0x4026d4

nop

lw v0, 0x54(fp)

nop

lbu v1, (v0)

addiu v0, zero, 0xb

bne v1, v0, 0x4026d4

nop

lui v0, 0x41

lw v0, 0x48e0(v0)

nop

beqz v0, 0x4026d4

nop

lui v0, 0x40

addiu a0, v0, 0x427c

lw t9, -sym.imp.puts(gp)

--

lw v0, 0x34(fp)

nop

addiu v0, v0, -1

sw v0, 0x34(fp)

lw v1, 0x38(fp)

lui v0, 0xf

ori v0, v0, 0x4240

addu v0, v1, v0

sw v0, 0x38(fp)

lui v0, 0x41

lw v0, 0x48e0(v0)

nop

beqz v0, 0x402884

nop

lw v1, 0x34(fp)

lw v0, 0x2c(fp)

nop

subu a1, v1, v0

lw v1, 0x38(fp)

lw v0, 0x30(fp)

nop

subu v1, v1, v0

lui v0, 0x40

addiu a0, v0, 0x42c4

move a2, v1

lw t9, -sym.imp.printf(gp)

nop

jalr t9

nop

lw gp, 0x10(fp)

lw v1, 0x38(fp)

lw v0, 0x30(fp)

nop

subu v0, v1, v0

sw v0, 0x1c(fp)

lw v0, 0x1c(fp)

nop

addiu v0, v0, -0x1d4c

slti v0, v0, -0xc7

bnez v0, 0x4028c8

nop

lw v0, 0x1c(fp)

nop

addiu v0, v0, -0x1d4c

slti v0, v0, 0xc8

bnez v0, 0x40299c

--

lw v0, 0x4474(v0)

nop

addiu v1, v0, 0xa

lui v0, 0x41

sw v1, 0x4474(v0)

lui v0, 0x41

lw v0, 0x4474(v0)

nop

bgez v0, 0x40293c

nop

move a0, zero

lw t9, -sym.imp.exit(gp)

nop

jalr t9

nop

lui v0, 0x41

lw v0, 0x48e0(v0)

nop

beqz v0, 0x402978

nop

lui v0, 0x41

lw v1, 0x4474(v0)

lui v0, 0x40

addiu a0, v0, 0x42dc

move a1, v1

lw t9, -sym.imp.printf(gp)

nop

jalr t9

nop

lw gp, 0x10(fp)

lw v0, 0x28(fp)

nop

addiu v0, v0, 1

sw v0, 0x28(fp)

lw v0, 0x28(fp)

nop

slti v0, v0, 0x14

bnez v0, 0x402720

nop

lui v0, 0x41

lw v1, 0x4474(v0)

lui v0, 0x40

addiu a0, v0, 0x42f8

move a1, v1

lw t9, -sym.imp.printf(gp)

nop

jalr t9

nop

lw gp, 0x10(fp)

move sp, fp

lw ra, 0x4c(sp)

lw fp, 0x48(sp)

addiu sp, sp, 0x50

jr ra

nop

addiu sp, sp, -8

sw fp, 4(sp)

move fp, sp

lui gp, 0x42

addiu gp, gp, -0x3860

lw v0, -obj.bwmax(gp)

nop

sw zero, (v0)

lw v0, -loc._fbss(gp)

nop

--

lw a2, (v0)

lw v0, 0x28(fp)

lw v1, -obj.IPARRAY(gp)

sll v0, v0, 2

addiu v0, v0, 1

sll v0, v0, 2

addu v0, v1, v0

lw a3, (v0)

lw v0, 0x28(fp)

lw v1, -obj.IPARRAY(gp)

sll v0, v0, 1

addiu v0, v0, 1

sll v0, v0, 3

addu v0, v1, v0

lw a0, (v0)

lw v0, 0x28(fp)

lw v1, -obj.IPARRAY(gp)

sll v0, v0, 4

addu v0, v1, v0

lw v0, 0xc(v0)

sw a0, 0x10(sp)

sw v0, 0x14(sp)

lw a0, -obj.IPTMP2(gp)

lui v0, 0x40

addiu a1, v0, 0x4344

lw t9, -sym.imp.sprintf(gp)

nop

jalr t9

nop

lw gp, 0x18(fp)

lw v0, 0x28(fp)

nop

addiu v0, v0, 1

sw v0, 0x28(fp)

lw v0, 0x28(fp)

lw v1, -obj.IPARRAY(gp)

sll v0, v0, 4

addu v0, v1, v0

lw a2, (v0)

lw v0, 0x28(fp)

lw v1, -obj.IPARRAY(gp)

sll v0, v0, 2

addiu v0, v0, 1

sll v0, v0, 2

addu v0, v1, v0

lw a3, (v0)

lw v0, 0x28(fp)

lw v1, -obj.IPARRAY(gp)

sll v0, v0, 1

addiu v0, v0, 1

sll v0, v0, 3

addu v0, v1, v0

lw a0, (v0)

lw v0, 0x28(fp)

lw v1, -obj.IPARRAY(gp)

sll v0, v0, 4

addu v0, v1, v0

lw v0, 0xc(v0)

sw a0, 0x10(sp)

sw v0, 0x14(sp)

lw a0, -obj.IPTMP3(gp)

lui v0, 0x40

addiu a1, v0, 0x4344

lw t9, -sym.imp.sprintf(gp)

nop

jalr t9

nop

lw gp, 0x18(fp)

lui v0, 0x40

addiu a0, v0, 0x4350

lw t9, -sym.imp.puts(gp)

nop

jalr t9

nop

lw gp, 0x18(fp)

lui v0, 0x41

lw v0, 0x48e4(v0)

nop

sw v0, 0x190(fp)

lw v0, 0x190(fp)

nop

beqz v0, 0x403a24

nop

addiu v0, zero, 1

lw v1, 0x190(fp)

nop

bne v1, v0, 0x403f68

nop

sw zero, 0x30(fp)

b 0x4036b0

nop

lw a0, -obj.IPTMP3(gp)

addiu a1, zero, 1

jal 0x401530

nop

lw gp, 0x18(fp)

lw v0, 0x30(fp)

nop

addiu v0, v0, 1

sw v0, 0x30(fp)

lw v0, 0x30(fp)

nop

slti v0, v0, 0xa

bnez v0, 0x40368c

nop

lui v0, 0x40

addiu a0, v0, 0x4364

lw t9, -sym.imp.printf(gp)

nop

jalr t9

nop

lw gp, 0x18(fp)

addiu v1, fp, 0x188

lui v0, 0x40

addiu a0, v0, 0x436c

move a1, v1

lw t9, -sym.imp.scanf(gp)

nop

jalr t9

nop

lw gp, 0x18(fp)

lw v0, 0x188(fp)

nop

blez v0, 0x403f68

nop

lw v1, 0x188(fp)

addiu v0, zero, 1

bne v1, v0, 0x403770

--

addu v0, v0, v1

lb v1, 0x14(v0)

addiu v0, zero, 0x2e

bne v1, v0, 0x4037f0

nop

lw v0, 0x30(fp)

addiu v1, fp, 0x20

addu v0, v1, v0

sb zero, 0x14(v0)

b 0x403810

nop

lw v0, 0x30(fp)

nop

addiu v0, v0, -1

sw v0, 0x30(fp)

lw v0, 0x30(fp)

nop

bgtz v0, 0x4037bc

nop

addiu v0, fp, 0x98

addiu v1, fp, 0x34

move a0, v0

lui v0, 0x40

addiu a1, v0, 0x4370

move a2, v1

lw t9, -sym.imp.sprintf(gp)

nop

jalr t9

nop

lw gp, 0x18(fp)

lui v0, 0x41

lw v0, 0x48e0(v0)

nop

beqz v0, 0x40387c

nop

addiu v0, fp, 0x98

lui v1, 0x40

addiu a0, v1, 0x4378

move a1, v0

lw a2, -obj.IPTMP3(gp)

lw t9, -sym.imp.printf(gp)

nop

jalr t9

nop

lw gp, 0x18(fp)

nop

lw a0, -obj.IPTMP3(gp)

move a1, zero

jal 0x401530

nop

lw gp, 0x18(fp)

nop

lw a0, -obj.TICK1(gp)

move a1, zero

lw t9, -sym.imp.gettimeofday(gp)

nop

jalr t9

nop

lw gp, 0x18(fp)

lw v1, 0x188(fp)

addiu v0, fp, 0x98

--

lw v1, (v0)

lw v0, -obj.TICK1(gp)

nop

lw v0, (v0)

nop

subu v0, v1, v0

bnez v0, 0x403988

div zero, a0, v0

break 7

mflo v0

move v1, v0

lw v0, -obj.TICKRATE(gp)

nop

sw v1, (v0)

lui v0, 0x41

lw v0, 0x48e0(v0)

nop

beqz v0, 0x4039dc

nop

lw v0, -obj.TICKCOUNT(gp)

nop

lw v1, (v0)

lui v0, 0x40

addiu a0, v0, 0x4388

move a1, v1

lw t9, -sym.imp.printf(gp)

nop

jalr t9

nop

lw gp, 0x18(fp)

lui v0, 0x41

lw v0, 0x48e0(v0)

nop

beqz v0, 0x4036c4

nop

lw v0, -obj.TICKRATE(gp)

nop

lw v1, (v0)

lui v0, 0x40

addiu a0, v0, 0x4398

move a1, v1

lw t9, -sym.imp.printf(gp)

nop

jalr t9

nop

lw gp, 0x18(fp)

b 0x4036c4

nop

jal 0x4029dc

nop

lw gp, 0x18(fp)

sw zero, 0x30(fp)

b 0x403a84

nop

lw a0, -obj.IPTMP3(gp)

addiu a1, zero, 1

jal 0x401530

nop

lw gp, 0x18(fp)

nop

lw v0, -obj.TICKDELAY(gp)

nop

--

sw v0, 0x20(fp)

b 0x403ae8

nop

lw v0, -obj.TICKDELAY(gp)

nop

lw v0, (v0)

lw a0, 0x20(fp)

move a1, v0

jal 0x402b04

nop

lw gp, 0x18(fp)

sw v0, 0x20(fp)

lw v0, 0x20(fp)

nop

blez v0, 0x403e10

nop

lw v0, -obj.TICKRATE(gp)

nop

lw v0, (v0)

nop

sw v0, 0x24(fp)

lui v0, 0x40

addiu a0, v0, 0x43a4

lw a1, 0x2c(fp)

lw a2, 0x20(fp)

lw t9, -sym.imp.printf(gp)

nop

jalr t9

nop

lw gp, 0x18(fp)

addiu v0, fp, 0x34

move a0, v0

lw a1, -obj.IPTMP2(gp)

lw t9, -sym.imp.strcpy(gp)

nop

jalr t9

nop

lw gp, 0x18(fp)

addiu v0, fp, 0x34

move a0, v0

lw t9, -sym.imp.strlen(gp)

nop

jalr t9

nop

lw gp, 0x18(fp)

addiu v0, v0, -1

--

addu v0, v0, v1

lb v1, 0x14(v0)

addiu v0, zero, 0x2e

bne v1, v0, 0x403bb0

nop

lw v0, 0x30(fp)

addiu v1, fp, 0x20

addu v0, v1, v0

sb zero, 0x14(v0)

b 0x403bd0

nop

lw v0, 0x30(fp)

nop

addiu v0, v0, -1

sw v0, 0x30(fp)

lw v0, 0x30(fp)

nop

bgtz v0, 0x403b7c

nop

addiu v0, fp, 0x98

addiu v1, fp, 0x34

move a0, v0

lui v0, 0x40

addiu a1, v0, 0x4370

move a2, v1

lw t9, -sym.imp.sprintf(gp)

nop

jalr t9

nop

lw gp, 0x18(fp)

lui v0, 0x41

lw v0, 0x48e0(v0)

nop

beqz v0, 0x403c3c

nop

addiu v0, fp, 0x98

lui v1, 0x40

addiu a0, v1, 0x4378

move a1, v0

lw a2, -obj.IPTMP3(gp)

lw t9, -sym.imp.printf(gp)

nop

jalr t9

nop

lw gp, 0x18(fp)

nop

lw a0, -obj.IPTMP3(gp)

move a1, zero

jal 0x401530

nop

lw gp, 0x18(fp)

nop

lw a0, -obj.TICK1(gp)

move a1, zero

lw t9, -sym.imp.gettimeofday(gp)

nop

jalr t9

nop

lw gp, 0x18(fp)

addiu v0, fp, 0x98

move a0, v0

--

lw v1, (v0)

lw v0, -obj.TICK1(gp)

nop

lw v0, (v0)

nop

subu v0, v1, v0

bnez v0, 0x403d3c

div zero, a0, v0

break 7

mflo v0

move v1, v0

lw v0, -obj.TICKRATE(gp)

nop

sw v1, (v0)

lui v0, 0x41

lw v0, 0x48e0(v0)

nop

beqz v0, 0x403d90

nop

lw v0, -obj.TICKCOUNT(gp)

nop

lw v1, (v0)

lui v0, 0x40

addiu a0, v0, 0x4388

move a1, v1

lw t9, -sym.imp.printf(gp)

nop

jalr t9

nop

lw gp, 0x18(fp)

lui v0, 0x41

lw v0, 0x48e0(v0)

nop

beqz v0, 0x403dd0

nop

lw v0, -obj.TICKRATE(gp)

nop

lw v1, (v0)

lui v0, 0x40

addiu a0, v0, 0x4398

move a1, v1

lw t9, -sym.imp.printf(gp)

nop

jalr t9

nop

lw gp, 0x18(fp)

lui v0, 0xf

ori a0, v0, 0x4240

lw t9, -sym.imp.usleep(gp)

nop

jalr t9

nop

lw gp, 0x18(fp)

lw v0, 0x2c(fp)

nop

addiu v0, v0, 1

sw v0, 0x2c(fp)

lw v0, 0x2c(fp)

nop

slti v0, v0, 0x14

bnez v0, 0x403aa4

nop

addiu v0, fp, 0x98

move a0, v0

addiu a1, zero, 0x3e8

jal 0x400e4c

nop

lw gp, 0x18(fp)

lw v0, 0x24(fp)

nop

sw v0, 0x19c(fp)

lw v0, 0x19c(fp)

nop

bgez v0, 0x403e54

nop

lw v1, 0x19c(fp)

nop

addiu v1, v1, 0x3ff

sw v1, 0x19c(fp)

lw v1, 0x19c(fp)

nop

sra v0, v1, 0xa

move v1, v0

lui v0, 0x40

addiu a0, v0, 0x43b8

move a1, v1

lw t9, -sym.imp.printf(gp)

nop

jalr t9

nop

lw gp, 0x18(fp)

lw v0, 0x24(fp)

nop

sw v0, 0x1a0(fp)

lw v0, 0x1a0(fp)

nop

bgez v0, 0x403eb0

nop

lw v1, 0x1a0(fp)

nop

addiu v1, v1, 0x3ff

sw v1, 0x1a0(fp)

lw v1, 0x1a0(fp)

nop

sra v0, v1, 0xa

move v1, v0

addiu v0, fp, 0xfc

move a0, v0

lui v0, 0x40

addiu a1, v0, 0x43cc

move a2, v1

lw t9, -sym.imp.sprintf(gp)

nop

jalr t9

nop

lw gp, 0x18(fp)

lw v0, 0x24(fp)

nop

sw v0, 0x1a4(fp)

lw v0, 0x1a4(fp)

nop

bgez v0, 0x403f14

nop

lw v1, 0x1a4(fp)

nop

addiu v1, v1, 0x3ff

sw v1, 0x1a4(fp)

lw v1, 0x1a4(fp)

nop

sra v0, v1, 0xa

move v1, v0

addiu v0, fp, 0xfc

move a0, v0

lui v0, 0x40

addiu a1, v0, 0x43fc

move a2, v1

lw t9, -sym.imp.sprintf(gp)

nop

jalr t9

nop

lw gp, 0x18(fp)

addiu v0, fp, 0xfc

move a0, v0

lw t9, -sym.imp.system(gp)

nop

jalr t9

nop

lw gp, 0x18(fp)

move v0, zero

move sp, fp

lw ra, 0x1ac(sp)

lw fp, 0x1a8(sp)

addiu sp, sp, 0x1b0

jr ra

nop

nop

nop

[*] Function printf used 22 times ubcom