[*] Binary protection state of dnsmasq
RELRO CANARY NX PIE RPATH RUNPATH SYMBOLS
No RELRO No Canary found NX disabled No PIE No RPATH No RUNPATH No Symbols
[*] Function strcat tear down of dnsmasq
nop
jalr t9
move a0, s2
lw gp, 0x18(sp)
lw a0, 0x8c(sp)
lw t9, -sym.imp.strlen(gp)
nop
jalr t9
move s0, v0
lw gp, 0x18(sp)
addu s0, s0, v0
lw t9, -sym.whine_malloc(gp)
nop
jalr t9
addiu a0, s0, 0x2a
lw gp, 0x18(sp)
beqz v0, 0x404934
move s1, v0
addiu s0, v0, 0x28
lw t9, -sym.imp.strcpy(gp)
move a0, s0
jalr t9
move a1, s2
lw gp, 0x18(sp)
lui a1, 0x42
lw t9, -sym.imp.strcat(gp)
move a0, s0
jalr t9
addiu a1, a1, 0x2274
lw gp, 0x18(sp)
lw a1, 0x8c(sp)
lw t9, -sym.imp.strcat(gp)
nop
jalr t9
move a0, s0
lw v0, 0x90(sp)
lw a1, 0x4c(sp)
move a0, s1
move a2, s6
move a3, s5
sw s4, 0x14(sp)
jal 0x4042e4
sw v0, 0x10(sp)
lw gp, 0x18(sp)
addiu s3, s3, 1
addiu s4, zero, 1
lw t9, -sym.imp.strlen(gp)
nop
jalr t9
move a0, s2
lw gp, 0x18(sp)
nop
--
lb v0, 0x13(s0)
nop
bne v0, s6, 0x40a7dc
nop
bne v1, s6, 0x40a7e4
nop
b 0x40a8e4
nop
beq v0, s7, 0x40a8e4
nop
lw t9, -sym.imp.strlen(gp)
nop
jalr t9
move a0, s2
addu v0, s1, v0
jal 0x409fb8
addiu a0, v0, 2
lw gp, 0x18(sp)
move a0, v0
lw t9, -sym.imp.strcpy(gp)
move a1, s2
jalr t9
move s0, v0
lw gp, 0x18(sp)
lui a1, 0x42
lw t9, -sym.imp.strcat(gp)
move a0, s0
jalr t9
addiu a1, a1, 0x11f0
lw gp, 0x18(sp)
move a1, s3
lw t9, -sym.imp.strcat(gp)
nop
jalr t9
move a0, s0
lw gp, 0x18(sp)
lw a1, 0x138(sp)
lw t9, -sym.imp.stat64(gp)
nop
jalr t9
move a0, s0
addiu a1, zero, -1
lw gp, 0x18(sp)
bne v0, a1, 0x40a888
lui a0, 0x42
lw t9, -sym.die(gp)
addiu a0, a0, 0x11f4
move a1, s0
jalr t9
addiu a2, zero, 3
lw gp, 0x18(sp)
lw v0, 0xa0(sp)
--
lw v0, 8(s0)
nop
beqz v0, 0x40ec0c
nop
lw s1, (s0)
lw t9, -sym.imp.strchr(gp)
move a0, s1
jalr t9
addiu a1, zero, 0x2e
lw gp, 0x18(sp)
beqz v0, 0x40ec0c
move s2, v0
lw t9, -sym.imp.strrchr(gp)
move a0, s1
jalr t9
addiu a1, zero, 0x2e
lw gp, 0x18(sp)
bne s2, v0, 0x40ec0c
move a1, s1
lw t9, -sym.imp.strcpy(gp)
nop
jalr t9
move a0, s3
lw gp, 0x18(sp)
move a0, s3
lw t9, -sym.imp.strcat(gp)
nop
jalr t9
move a1, s5
lw gp, 0x18(sp)
lw v0, (s4)
lw t9, -sym.imp.strcat(gp)
lw a1, 0x4c(v0)
jalr t9
move a0, s3
lw gp, 0x18(sp)
lw a0, (s0)
lw t9, -sym.imp.free(gp)
nop
jalr t9
nop
jal 0x40a02c
move a0, s3
lw gp, 0x18(sp)
sw v0, (s0)
lw s0, 0x1c(s0)
nop
bnez s0, 0x40eb58
nop
lw ra, 0xe4(sp)
lw fp, 0xe0(sp)
lw s7, 0xdc(sp)
--
nop
lw t9, -sym.imp.__errno_location(gp)
nop
jalr t9
nop
lw v0, (v0)
lw gp, 0x10(sp)
beqz v0, 0x41209c
nop
lw v1, (s1)
nop
lw v0, (v1)
nop
andi v0, v0, 0x2000
beqz v0, 0x41209c
nop
lw t9, -sym.prettyprint_addr(gp)
lw a1, 0xf8(v1)
jalr t9
move a0, s0
lb v0, 0x38(s0)
lw gp, 0x10(sp)
beqz v0, 0x412080
nop
lw v0, (s1)
lw t9, -sym.imp.strcat(gp)
lw a0, 0xf8(v0)
jalr t9
move a1, s3
lw gp, 0x10(sp)
lw v0, (s1)
lw t9, -sym.imp.strcat(gp)
lw a0, 0xf8(v0)
jalr t9
move a1, s2
lw gp, 0x10(sp)
lw v0, (s1)
lw t9, -sym.die(gp)
lw a1, 0xf8(v0)
move a0, s4
jalr t9
addiu a2, zero, 2
lw gp, 0x10(sp)
lw s0, 0x64(s0)
nop
bnez s0, 0x411fc8
nop
lw ra, 0x4c(sp)
lw s4, 0x48(sp)
lw s3, 0x44(sp)
lw s2, 0x40(sp)
lw s1, 0x3c(sp)
--
lw t9, -sym.imp.strlen(gp)
nop
jalr t9
move a0, s2
lw gp, 0x10(sp)
move a0, s5
lw t9, -sym.imp.strlen(gp)
nop
jalr t9
move s0, v0
lw gp, 0x10(sp)
addu s0, s0, v0
lw t9, -sym.whine_malloc(gp)
nop
jalr t9
addiu a0, s0, 2
lw gp, 0x10(sp)
beqz v0, 0x4184d4
move s1, v0
lw t9, -sym.imp.strcpy(gp)
move a1, s2
jalr t9
move a0, v0
lw gp, 0x10(sp)
lui a1, 0x42
lw t9, -sym.imp.strcat(gp)
addiu a1, a1, 0x2274
jalr t9
move a0, s1
lw gp, 0x10(sp)
move a1, s5
lw t9, -sym.imp.strcat(gp)
nop
jalr t9
move a0, s1
lw gp, 0x10(sp)
lw v0, 8(s4)
nop
beqz v0, 0x418500
nop
lw t9, -sym.imp.free(gp)
lw a0, 0x10(s4)
jalr t9
nop
lw v0, 8(s4)
lw gp, 0x10(sp)
sw v0, 0x10(s4)
lw t9, -sym.imp.free(gp)
lw a0, 0xc(s4)
jalr t9
nop
addiu v1, zero, 1
--
addiu a0, zero, 0x100
lw s1, (s3)
lui v1, 0x40
lw a0, (s1)
lw a1, 0xc8(s1)
sw v0, 0x38c(s0)
and a0, a0, v1
lui v0, 0x43
lw gp, 0x20(sp)
beqz a0, 0x4193c8
sw a1, 0x5f60(v0)
lw a1, 0x54(s1)
nop
bnez a1, 0x419374
lui v0, 0x43
sw zero, 0x5f58(v0)
lui v0, 0x43
b 0x41978c
sw zero, 0x5f5c(v0)
lw t9, -sym.imp.strcpy(gp)
lw a0, 0x388(s1)
jalr t9
nop
lw gp, 0x20(sp)
lw v0, (s3)
lw t9, -sym.imp.strcat(gp)
lw a0, 0x388(v0)
lui a1, 0x42
jalr t9
addiu a1, a1, 0x40b4
lw gp, 0x20(sp)
lw v0, (s3)
lw t9, -sym.imp.popen(gp)
lw a0, 0x388(v0)
lui a1, 0x42
jalr t9
addiu a1, a1, 0x2080
lw gp, 0x20(sp)
b 0x419424
move s2, v0
lw t9, -sym.imp.fopen64(gp)
lw a0, 0x34(s1)
lui a1, 0x42
jalr t9
addiu a1, a1, 0x40bc
lw gp, 0x20(sp)
--
nop
bnez v0, 0x41b2f8
nop
beqz s1, 0x41b3bc
move v1, s3
lw v0, -obj.dnsmasq_daemon(gp)
lui v1, 0x1000
lw a0, (v0)
nop
lw v0, (a0)
nop
and v0, v0, v1
beqz v0, 0x41b3bc
move v1, s3
lw s0, 0xf8(a0)
lui v0, 0x42
sb zero, (s0)
addiu s4, v0, 0x41f0
lw t9, -sym.imp.strncat(gp)
lw a1, (s1)
move a0, s0
jalr t9
addiu a2, zero, 0x401
lw gp, 0x10(sp)
lw v0, 4(s1)
lw t9, -sym.imp.strcat(gp)
move a0, s0
beqz v0, 0x41b38c
move a1, s4
jalr t9
nop
lw gp, 0x10(sp)
lw s1, 4(s1)
nop
bnez s1, 0x41b354
move a2, s0
lw t9, -sym.my_syslog(gp)
lui a1, 0x42
sb zero, 0x400(s0)
addiu a1, a1, 0x424c
jalr t9
addiu a0, zero, 6
lw gp, 0x10(sp)
move v1, s3
b 0x41b3dc
addiu a0, zero, 0x34
[*] Function strcat used 12 times dnsmasq
