[*] Binary protection state of pppd
RELRO CANARY NX PIE RPATH RUNPATH SYMBOLS
No RELRO No Canary found NX disabled No PIE No RPATH No RUNPATH No Symbols
[*] Function strcpy tear down of pppd
b 0x406a88
move s0, v0
lui v1, 0x46
lw v0, 0x2138(v1)
lw t9, -sym.error(gp)
addiu v0, v0, -1
lui a0, 0x44
addiu a0, a0, 0x2b94
jalr t9
sw v0, 0x2138(v1)
lw gp, 0x10(sp)
b 0x406a10
addiu a0, zero, -1
lw t9, -sym.imp.getgid(gp)
nop
jalr t9
addiu s0, sp, 0x5c
lw gp, 0x10(sp)
nop
lw t9, -sym.imp.setgid(gp)
nop
jalr t9
move a0, v0
lw gp, 0x10(sp)
lw a1, 0x178(sp)
lw t9, -sym.imp.strcpy(gp)
nop
jalr t9
move a0, s0
lb a1, 0x5c(sp)
lw gp, 0x10(sp)
beqz a1, 0x406d5c
move a2, zero
lw v0, -0x7cc8(gp)
move a0, s0
lw a3, (v0)
addiu v1, zero, 1
addiu t0, sp, 0x18
bnez v1, 0x406db0
nop
sll a1, a1, 1
addu v0, a3, a1
lhu v1, (v0)
nop
andi v1, v1, 0x20
bnez v1, 0x406da8
--
lw v0, 0xc84(sp)
nop
bnez v0, 0x41aee0
move a0, s2
lw v1, 0xc74(sp)
nop
beqz v1, 0x41ad40
addiu v1, zero, 0x40
lb v0, 0x28(sp)
nop
bne v0, v1, 0x41ad28
addiu v1, zero, 0x2f
lb v0, 0x29(sp)
nop
beq v0, v1, 0x41af44
nop
lw t9, -sym.strlcpy(gp)
lw a0, 0xc2c(sp)
move a1, s2
jalr t9
addiu a2, zero, 0x400
lw gp, 0x10(sp)
lw s1, 0xc28(sp)
b 0x41ad6c
nop
lw t9, -sym.imp.strcpy(gp)
addiu a0, s0, 8
sw a0, 4(s0)
jalr t9
move a1, s2
lw gp, 0x10(sp)
sw s0, (s1)
move s1, s0
lw t9, -sym.getword(gp)
move a0, s6
move a1, s2
move a2, s4
jalr t9
move a3, s5
lw gp, 0x10(sp)
nop
lw t9, -sym.imp.strlen(gp)
beqz v0, 0x41ae5c
move a0, s2
lw v0, 0x18(sp)
nop
--
lw t9, 8(s1)
nop
jalr t9
move a0, s4
lw gp, 0x18(sp)
beqz v0, 0x41feb0
move v0, zero
lw v0, 0x10(s1)
lui v1, 1
and v0, v0, v1
beqz v0, 0x41ffac
nop
lw t9, -sym.imp.strlen(gp)
lw a0, (s4)
jalr t9
nop
lw gp, 0x18(sp)
nop
lw t9, -sym.imp.malloc(gp)
nop
jalr t9
addiu a0, v0, 0xc
lw gp, 0x18(sp)
beqz v0, 0x41ffac
move s2, v0
lw t9, -sym.imp.strcpy(gp)
lw a1, (s4)
jalr t9
addiu a0, v0, 8
lw gp, 0x18(sp)
lw v1, 0x14(s1)
lw a0, -obj.option_source(gp)
sw zero, (s2)
lw v0, (a0)
nop
sw v0, 4(s2)
beqz v1, 0x420354
addiu v0, s1, 0x14
move v0, v1
lw v1, (v1)
nop
bnez v1, 0x420340
nop
sw s2, (v0)
lw a1, 0x14(s1)
b 0x41ffb8
--
move a0, a1
move s1, a1
jalr t9
move s0, a2
lw gp, 0x10(sp)
beqz s0, 0x422dc4
move s2, v0
sltu v0, v0, s0
bnez v0, 0x422de4
move a1, s1
lw t9, -sym.imp.strncpy(gp)
move a0, s3
jalr t9
addiu a2, s0, -1
addu v0, s3, s0
lw gp, 0x10(sp)
sb zero, -1(v0)
lw ra, 0x2c(sp)
move v0, s2
lw s3, 0x28(sp)
lw s2, 0x24(sp)
lw s1, 0x20(sp)
lw s0, 0x1c(sp)
jr ra
addiu sp, sp, 0x30
lw t9, -sym.imp.strcpy(gp)
move a0, s3
jalr t9
move a1, s1
lw ra, 0x2c(sp)
move v0, s2
lw gp, 0x10(sp)
lw s3, 0x28(sp)
lw s2, 0x24(sp)
lw s1, 0x20(sp)
lw s0, 0x1c(sp)
jr ra
addiu sp, sp, 0x30
lui gp, 0x46
addiu sp, sp, -0x28
addiu gp, gp, 0x6730
sw ra, 0x24(sp)
sw s2, 0x20(sp)
sw s1, 0x1c(sp)
sw s0, 0x18(sp)
sw gp, 0x10(sp)
--
addiu s7, sp, 0x5fc
addiu v0, zero, -0x59
sh v1, 4(a3)
sw a2, 0x5fc(sp)
sw a0, 0x608(sp)
sh t1, 0x60c(sp)
sh t0, 4(s7)
sb v0, 0x60b(sp)
bnez a1, 0x42c820
sh zero, 0x18(s2)
addiu s5, sp, 0x610
move s4, s5
move s3, zero
beqz s6, 0x42c688
nop
lw t9, -sym.imp.strlen(gp)
nop
jalr t9
move a0, s6
lw gp, 0x10(sp)
andi s0, v0, 0xffff
move s1, v0
sll v1, s0, 8
srl v0, s0, 8
or v1, v1, v0
lw t9, -sym.imp.strcpy(gp)
addiu v0, zero, 0x302
sh v1, 0x1e(sp)
move a1, s6
addiu a0, sp, 0x20
jalr t9
sh v0, 0x1c(sp)
lw gp, 0x10(sp)
addiu s1, s1, 4
lw t9, -sym.imp.memcpy(gp)
move a0, s4
addiu a1, sp, 0x1c
move a2, s1
jalr t9
addiu s0, s0, 4
addu s0, s3, s0
lw gp, 0x10(sp)
addu s4, s4, s1
andi s3, s0, 0xffff
lhu v0, 0x38(s2)
nop
--
addiu s7, sp, 0x5fc
addiu v0, zero, -0x59
sh v1, 4(a3)
sw a2, 0x5fc(sp)
sw a0, 0x608(sp)
sh t1, 0x60c(sp)
sh t0, 4(s7)
sb v0, 0x60b(sp)
bnez a1, 0x42e418
sh zero, 0x18(s2)
addiu s6, sp, 0x610
move s3, s6
move s4, zero
beqz s5, 0x42e2a4
nop
lw t9, -sym.imp.strlen(gp)
nop
jalr t9
move a0, s5
lw gp, 0x10(sp)
andi s0, v0, 0xffff
move s1, v0
sll v1, s0, 8
srl v0, s0, 8
or v1, v1, v0
lw t9, -sym.imp.strcpy(gp)
addiu v0, zero, 0x302
sh v1, 0x1e(sp)
move a1, s5
addiu a0, sp, 0x20
jalr t9
sh v0, 0x1c(sp)
lw gp, 0x10(sp)
addiu s1, s1, 4
lw t9, -sym.imp.memcpy(gp)
move a0, s3
addiu a1, sp, 0x1c
move a2, s1
jalr t9
addiu s0, s0, 4
addu s0, s4, s0
lw gp, 0x10(sp)
addu s3, s3, s1
andi s4, s0, 0xffff
lhu v0, 0x48(s2)
nop
--
lw v0, -0x1b60(v1)
nop
beqz v0, 0x43a720
addiu s2, s2, -1
lw v1, 0x424(sp)
nop
sltu v0, v1, s5
bnez v0, 0x43aa00
subu a1, s5, v1
lui a0, 0x45
jal 0x438c58
addiu a0, a0, -0x5350
lw gp, 0x10(sp)
nop
lw t9, -sym.imp.alarm(gp)
nop
jalr t9
move a0, zero
lw gp, 0x10(sp)
sll v0, s2, 2
addu v0, s6, v0
lw a0, -obj.fail_buffer(gp)
lw a1, (v0)
addiu v1, s2, 4
lui v0, 0x47
lw t9, -sym.imp.strcpy(gp)
sw v1, 0x735c(v0)
lui v0, 0x47
lui v1, 0x47
sw zero, 0x73a4(v0)
jalr t9
sw a0, 0x7374(v1)
lw gp, 0x10(sp)
b 0x43a3ec
move v0, zero
lw v1, 0x428(sp)
nop
sltu v0, s5, v1
beqz v0, 0x43a7e4
move s0, s5
lui v1, 0x47
lw v0, 0x73a4(v1)
nop
beqz v0, 0x43a440
lui v1, 0x46
lw v0, -0x1b60(v1)
--
sw ra, 0xb4(sp)
sw s3, 0xb0(sp)
sw s2, 0xac(sp)
sw s1, 0xa8(sp)
sw s0, 0xa4(sp)
sw gp, 0x18(sp)
lw v0, -obj.baud_rate(gp)
lw t9, -sym.imp.sprintf(gp)
lw a2, (v0)
addiu s2, sp, 0x20
lui a1, 0x45
move s3, a0
addiu a1, a1, -0x71b8
jalr t9
move a0, s2
lw gp, 0x18(sp)
addiu s1, sp, 0x40
lw v0, -obj.ipv6cp_gotoptions(gp)
nop
lw a1, 0x28(v0)
lw a0, 0x24(v0)
jal 0x441080
addiu s0, sp, 0x60
lw gp, 0x18(sp)
move a0, s1
lw t9, -sym.imp.strcpy(gp)
nop
jalr t9
move a1, v0
lw gp, 0x18(sp)
nop
lw v0, -obj.ipv6cp_hisoptions(gp)
nop
lw a1, 0x30(v0)
lw a0, 0x2c(v0)
jal 0x441080
nop
lw gp, 0x18(sp)
move a0, s0
lw t9, -sym.imp.strcpy(gp)
nop
jalr t9
move a1, v0
lw gp, 0x18(sp)
lui a3, 0x44
lw v0, -obj.ipparam(gp)
lw v1, -obj.devnam(gp)
lw a0, (v0)
lw v0, -obj.ifname(gp)
lw t9, -sym.run_program(gp)
sw v1, 0x88(sp)
sw s2, 0x8c(sp)
sw s1, 0x90(sp)
sw s0, 0x94(sp)
sw a0, 0x98(sp)
sw s3, 0x80(sp)
sw v0, 0x84(sp)
sw zero, 0x9c(sp)
sw zero, 0x10(sp)
move a0, s3
[*] Function strcpy used 9 times pppd
