[*] Binary protection state of libipt_DNAT.so
RELRO CANARY NX PIE RPATH RUNPATH SYMBOLS
No RELRO No Canary found NX disabled DSO No RPATH No RUNPATH Symbols
[*] Function printf tear down of libipt_DNAT.so
nop
jr t9
addiu a0, a0, 0x1a30
lui gp, 2
addiu gp, gp, -0x6f70
addu gp, gp, t9
addiu sp, sp, -0x30
sw ra, 0x2c(sp)
sw s1, 0x28(sp)
sw s0, 0x24(sp)
sw gp, 0x10(sp)
lw v0, (a0)
nop
andi v0, v0, 1
beqz v0, 0xa8c
move s0, a0
lw v0, 4(a0)
lw t9, -sym.imp.xtables_ipaddr_to_numeric(gp)
addiu s1, sp, 0x18
move a0, s1
jalr t9
sw v0, 0x18(sp)
lw gp, 0x10(sp)
move a1, v0
lw a0, -0x7fdc(gp)
lw t9, -sym.imp.printf(gp)
nop
jalr t9
addiu a0, a0, 0x16ac
lw v1, 8(s0)
lw v0, 4(s0)
lw gp, 0x10(sp)
beq v1, v0, 0xa8c
nop
lw t9, -sym.imp.xtables_ipaddr_to_numeric(gp)
sw v1, 0x18(sp)
jalr t9
move a0, s1
lw gp, 0x10(sp)
move a1, v0
lw a0, -0x7fdc(gp)
lw t9, -sym.imp.printf(gp)
nop
jalr t9
addiu a0, a0, 0x16b0
lw gp, 0x10(sp)
lw v0, (s0)
nop
andi v0, v0, 2
beqz v0, 0xb0c
nop
lw t9, -sym.imp.putchar(gp)
nop
jalr t9
addiu a0, zero, 0x3a
lw gp, 0x10(sp)
lhu a1, 0xc(s0)
lw a0, -0x7fdc(gp)
sll v0, a1, 8
lw t9, -sym.imp.printf(gp)
andi v0, v0, 0xffff
srl a1, a1, 8
addiu a0, a0, 0x16b4
jalr t9
or a1, v0, a1
lhu v0, 0xc(s0)
lhu a0, 0xe(s0)
lw gp, 0x10(sp)
beq v0, a0, 0xb0c
srl v0, a0, 8
sll a1, a0, 8
lw a0, -0x7fdc(gp)
lw t9, -sym.imp.printf(gp)
andi a1, a1, 0xffff
or a1, a1, v0
jalr t9
addiu a0, a0, str.__hu
lw gp, 0x10(sp)
lw ra, 0x2c(sp)
lw s1, 0x28(sp)
lw s0, 0x24(sp)
jr ra
addiu sp, sp, 0x30
lui gp, 2
addiu gp, gp, -0x70b0
addu gp, gp, t9
addiu sp, sp, -0x38
sw ra, 0x34(sp)
sw s6, 0x30(sp)
sw s5, 0x2c(sp)
sw s4, 0x28(sp)
sw s3, 0x24(sp)
sw s2, 0x20(sp)
--
lw v0, -0x7fdc(gp)
move s0, zero
addiu s4, v0, str.__random
lw v0, -0x7fdc(gp)
b 0xc0c
addiu s3, v0, str.__persistent
jalr t9
nop
addiu a0, s0, 2
sll a0, a0, 4
addu a0, s2, a0
move t9, s5
jalr t9
addiu a0, a0, 4
lw gp, 0x10(sp)
addiu a0, zero, 0x20
lw t9, -sym.imp.putchar(gp)
nop
jalr t9
addiu s0, s0, 1
lw v0, 0x24(s1)
lw gp, 0x10(sp)
andi v0, v0, 4
beqz v0, 0xbe4
nop
lw t9, -sym.imp.printf(gp)
nop
jalr t9
move a0, s4
lw gp, 0x10(sp)
lw v0, 0x24(s1)
nop
andi v0, v0, 8
beqz v0, 0xc0c
addiu s1, s1, 0x10
lw t9, -sym.imp.printf(gp)
nop
jalr t9
move a0, s3
lw gp, 0x10(sp)
lw v0, 0x20(s2)
lw t9, -sym.imp.printf(gp)
sltu v0, s0, v0
bnez v0, 0xb84
move a0, s6
lw ra, 0x34(sp)
lw s6, 0x30(sp)
lw s5, 0x2c(sp)
lw s4, 0x28(sp)
lw s3, 0x24(sp)
lw s2, 0x20(sp)
lw s1, 0x1c(sp)
lw s0, 0x18(sp)
jr ra
addiu sp, sp, 0x38
lui gp, 2
addiu gp, gp, -0x71d8
addu gp, gp, t9
addiu sp, sp, -0x38
sw ra, 0x34(sp)
sw s5, 0x30(sp)
sw s4, 0x2c(sp)
sw s3, 0x28(sp)
sw s2, 0x24(sp)
sw s1, 0x20(sp)
sw s0, 0x1c(sp)
sw gp, 0x10(sp)
lw v1, 0x24(a1)
lui v0, 0x4000
and v0, v1, v0
beqz v0, 0xccc
move s2, a1
lw a0, -0x7fdc(gp)
lw t9, -sym.imp.printf(gp)
addiu a0, a0, 0x16f0
jalr t9
nop
lw gp, 0x10(sp)
nop
lw v0, -0x7fdc(gp)
move s1, s2
addiu s5, v0, sym.print_range
lw v0, -0x7fdc(gp)
move s0, zero
addiu s4, v0, 0x16fc
lw v0, -0x7fdc(gp)
b 0xd58
addiu s3, v0, 0x1704
bgez v1, 0xca8
nop
lw a0, -0x7fdc(gp)
lw t9, -sym.imp.printf(gp)
b 0xc98
addiu a0, a0, str.shift:
move t9, s5
jalr t9
nop
lw gp, 0x10(sp)
nop
lw t9, -sym.imp.putchar(gp)
nop
jalr t9
addiu a0, zero, 0x20
lw v0, 0x24(s1)
lw gp, 0x10(sp)
andi v0, v0, 4
beqz v0, 0xd30
nop
lw t9, -sym.imp.printf(gp)
nop
jalr t9
move a0, s4
lw gp, 0x10(sp)
lw v0, 0x24(s1)
nop
andi v0, v0, 8
beqz v0, 0xd58
addiu s1, s1, 0x10
lw t9, -sym.imp.printf(gp)
nop
jalr t9
move a0, s3
lw gp, 0x10(sp)
addiu a0, s0, 2
lw v0, 0x20(s2)
sll a0, a0, 4
addu a0, s2, a0
sltu v0, s0, v0
addiu a0, a0, 4
bnez v0, 0xce4
addiu s0, s0, 1
lw ra, 0x34(sp)
lw s5, 0x30(sp)
lw s4, 0x2c(sp)
lw s3, 0x28(sp)
lw s2, 0x24(sp)
lw s1, 0x20(sp)
lw s0, 0x1c(sp)
jr ra
[*] Function printf used 11 times libipt_DNAT.so
