[*] Binary protection state of udhcpd

  	RELRO          CANARY            NX           PIE          RPATH        RUNPATH      SYMBOLS      

  	No RELRO       No Canary found   NX disabled  No PIE       No RPATH     No RUNPATH   No Symbols

[*] Function sprintf tear down of udhcpd

move a0, s0

jalr t9

move a1, s2

lw gp, 0x20(sp)

bltz v0, 0x401f54

move a0, s0

lw t9, -sym.get_option(gp)

nop

jalr t9

addiu a1, zero, 0x35

lw gp, 0x20(sp)

beqz v0, 0x401db4

move s4, v0

lw t9, -sym.find_static_lease_by_chaddr(gp)

lw a0, 0x30c(sp)

jalr t9

nop

lw gp, 0x20(sp)

beqz v0, 0x402344

move s1, v0

move s3, v0

lbu a0, 0xfc(sp)

lbu a1, 0xfd(sp)

lbu v1, 0xfb(sp)

lbu v0, 0xfa(sp)

lw t9, -sym.imp.sprintf(gp)

sw a0, 0x18(sp)

sw a1, 0x1c(sp)

lbu a2, 0xf8(sp)

lbu a3, 0xf9(sp)

lw a0, 0x304(sp)

lui a1, 0x41

sw v1, 0x14(sp)

sw v0, 0x10(sp)

jalr t9

addiu a1, a1, -0x629c

lbu v1, (s4)

lw gp, 0x20(sp)

sltiu v0, v1, 9

beqz v0, 0x401db4

sll v0, v1, 2

lui v1, 0x41

addiu v1, v1, -0x6200

addu v0, v1, v0

lw v1, (v0)

nop

--

addiu a2, zero, 1

move a3, s3

jalr t9

addiu s0, s0, 0x5c

lw gp, 0x10(sp)

bne s0, s4, 0x402d48

nop

lw t9, -sym.imp.fclose(gp)

nop

jalr t9

move a0, s3

lw a0, 0x58(s5)

lw gp, 0x10(sp)

beqz a0, 0x402e7c

nop

lw t9, -sym.imp.system(gp)

nop

jalr t9

nop

lw gp, 0x10(sp)

lw a2, 0x48(s5)

nop

beqz a2, 0x402ec4

addiu s0, sp, 0x1c

lw v0, -obj.server_config(gp)

lw t9, -sym.imp.sprintf(gp)

lw a3, 0x40(v0)

lui a1, 0x41

addiu a1, a1, -0x61c4

jalr t9

move a0, s0

lw gp, 0x10(sp)

nop

lw t9, -sym.imp.system(gp)

nop

jalr t9

move a0, s0

lw gp, 0x10(sp)

lw ra, 0x144(sp)

lw fp, 0x140(sp)

lw s7, 0x13c(sp)

lw s6, 0x138(sp)

lw s5, 0x134(sp)

lw s4, 0x130(sp)

lw s3, 0x12c(sp)

lw s2, 0x128(sp)

--

nop

sw v1, 0x18(sp)

b 0x40475c

move s5, zero

b 0x40475c

move s5, zero

lui gp, 0x42

addiu sp, sp, -0x280

addiu gp, gp, 0x3960

sw ra, 0x27c(sp)

sw s1, 0x278(sp)

sw s0, 0x274(sp)

sw gp, 0x20(sp)

addiu s1, sp, 0x48

move a1, a0

addiu a2, zero, 6

jal 0x4043f0

move a0, s1

lw gp, 0x20(sp)

lbu a1, 0x69(sp)

lbu v1, 0x67(sp)

lbu a0, 0x68(sp)

lbu v0, 0x66(sp)

lbu a3, 0x65(sp)

addiu s0, sp, 0x28

lw t9, -sym.imp.sprintf(gp)

lbu a2, 0x64(sp)

sw a1, 0x1c(sp)

lui a1, 0x41

sw v1, 0x14(sp)

sw a0, 0x18(sp)

sw v0, 0x10(sp)

move a0, s0

jalr t9

addiu a1, a1, -0x629c

lw gp, 0x20(sp)

lui a1, 0x41

lw t9, -sym.imp.syslog(gp)

move a2, s0

addiu a1, a1, -0x613c

jalr t9

addiu a0, zero, 0xe5

move a0, s1

jal 0x404520

addiu a1, zero, 1

lw ra, 0x27c(sp)

--

b 0x406530

addiu s5, zero, 1

sll v0, s4, 2

sll v1, s4, 4

subu v1, v1, v0

subu v1, v1, s4

lw a2, -obj.options(gp)

sll v1, v1, 1

addu v1, a2, v1

lbu v0, 0x15(v1)

addiu s5, s5, 1

beqz v0, 0x4064a0

addiu s0, s0, 1

lbu v0, -5(s0)

addiu a1, zero, 1

bne v0, a1, 0x406504

move s4, s5

lbu v0, -4(s0)

addiu a2, zero, 4

bne v0, a2, 0x406508

sll v0, s4, 2

lbu v0, -1(s0)

lbu v1, (s0)

lbu a2, -3(s0)

lbu a3, -2(s0)

lw t9, -sym.imp.sprintf(gp)

lw a0, 0x380(sp)

lui a1, 0x41

sw v0, 0x10(sp)

sw v1, 0x14(sp)

jalr t9

addiu a1, a1, -0x5bd0

lbu v0, -3(s0)

lw gp, 0x18(sp)

beqz v0, 0x4065d4

nop

lbu v0, -2(s0)

nop

bnez v0, 0x406974

nop

lbu v0, -1(s0)

nop

bnez v0, 0x4065d4

nop

lbu v0, (s0)

nop

--

nop

lbu v0, 0x2c(a3)

nop

beqz v0, 0x4081e0

addiu v0, s0, 5

addiu v0, s0, 6

sll a0, v0, 2

lw t9, -sym.imp.malloc(gp)

lw s0, -obj.client_config(gp)

jalr t9

nop

lw gp, 0x20(sp)

lw a0, 4(s0)

lw t9, -sym.imp.strlen(gp)

nop

jalr t9

sw v0, 0x58(sp)

lw gp, 0x20(sp)

nop

lw t9, -sym.imp.malloc(gp)

nop

jalr t9

addiu a0, v0, 0xb

lw gp, 0x20(sp)

lw v1, 0x58(sp)

lw t9, -sym.imp.sprintf(gp)

lw a2, 4(s0)

lui a1, 0x41

sw v0, (v1)

move a0, v0

jalr t9

addiu a1, a1, -0x58e0

lui a0, 0x41

lui a1, 0x41

addiu a0, a0, -0x58d0

jal 0x407300

addiu a1, a1, -0x58c8

lw a2, 0x58(sp)

lui a0, 0x41

lui a1, 0x41

addiu a0, a0, -0x58a4

addiu a1, a1, -0x589c

jal 0x407300

sw v0, 4(a2)

lw a3, 0x58(sp)

lw gp, 0x20(sp)

sw v0, 8(a3)

lw v0, 0x98(sp)

nop

beqz v0, 0x408270

sw a3, 0x54(sp)

lw t9, -sym.imp.malloc(gp)

nop

jalr t9

addiu a0, zero, 0x13

lw a0, 0x98(sp)

lw gp, 0x20(sp)

addiu v1, a0, 0x10

lbu a1, 2(v1)

lbu a2, 3(v1)

lbu a3, 0x10(a0)

lbu a0, 1(v1)

sw a1, 0x14(sp)

lw a1, 0x58(sp)

lui v1, 0x41

lw t9, -sym.imp.sprintf(gp)

sw a0, 0x10(sp)

sw a2, 0x18(sp)

addiu s0, v1, -0x5880

sw v0, 0xc(a1)

lui a2, 0x41

lui a1, 0x41

addiu a1, a1, -0x5894

sw s0, 0x1c(sp)

move a0, v0

jalr t9

addiu a2, a2, -0x5884

lw gp, 0x20(sp)

nop

lw v0, -obj.options(gp)

nop

lbu a1, 0x15(v0)

nop

beqz a1, 0x4084d4

addiu a3, zero, 4

lui a2, 0x41

--

lui v1, 0x41

bnez a1, 0x407728

div zero, a0, a1

break 7

addiu v1, v1, -0x576c

addu s0, s0, v1

lw a1, (s0)

lw t9, -sym.imp.malloc(gp)

addiu v0, v0, 2

addiu s4, s3, -1

move s1, fp

mflo a0

nop

nop

mult a0, a1

mflo a0

jalr t9

addu a0, v0, a0

lw a0, 0x44(sp)

lw a1, 0x54(sp)

sll v1, a0, 2

addu v1, a1, v1

lw gp, 0x20(sp)

move s0, v0

sw v0, (v1)

lw t9, -sym.imp.sprintf(gp)

lui a1, 0x41

move a0, s0

lbu s6, (s4)

move a2, s1

addiu a1, a1, -0x587c

jalr t9

sw zero, 0x38(sp)

lbu v1, 0x14(s1)

lw gp, 0x20(sp)

andi v1, v1, 0xf

sll a0, v1, 2

sw v1, 0x40(sp)

lw v1, -obj.option_lengths(gp)

lui a2, 0x41

addu v1, v1, a0

addiu a2, a2, -0x57a0

addu a0, a2, a0

lw s5, (v1)

addu s0, s0, v0

sw a0, 0x5c(sp)

--

lwc1 f20, 0x88(sp)

lw fp, 0x80(sp)

lw s7, 0x7c(sp)

lw s6, 0x78(sp)

lwc1 f23, 0x94(sp)

lw s5, 0x74(sp)

lwc1 f21, 0x8c(sp)

lw s4, 0x70(sp)

lw s3, 0x6c(sp)

lw s2, 0x68(sp)

lw s1, 0x64(sp)

lw s0, 0x60(sp)

jr ra

addiu sp, sp, 0x98

lw v1, 0x5c(sp)

nop

lw v0, (v1)

nop

addu v0, v0, gp

jr v0

nop

lbu v0, 1(s3)

lbu a3, (s3)

sw v0, 0x10(sp)

lbu v1, 2(s3)

lw t9, -sym.imp.sprintf(gp)

sw v1, 0x14(sp)

lbu v0, 3(s3)

lui v1, 0x41

addiu v1, v1, -0x5880

lui a1, 0x41

lui a2, 0x41

sw v1, 0x1c(sp)

move a0, s0

sw v0, 0x18(sp)

addiu a1, a1, -0x5894

jalr t9

addiu a2, a2, -0x62dc

addu v0, s0, v0

addiu v1, zero, 0x2f

lw gp, 0x20(sp)

addiu s0, v0, 1

sb v1, (v0)

addiu s3, s3, 4

addiu s5, zero, 4

lbu v0, 1(s3)

lbu a3, (s3)

sw v0, 0x10(sp)

lbu v1, 2(s3)

lui a0, 0x41

sw v1, 0x14(sp)

lbu v0, 3(s3)

addiu a0, a0, -0x5880

lui a1, 0x41

lui a2, 0x41

lw t9, -sym.imp.sprintf(gp)

sw v0, 0x18(sp)

sw a0, 0x1c(sp)

addiu a1, a1, -0x5894

addiu a2, a2, -0x62dc

jalr t9

move a0, s0

addu s0, s0, v0

lw gp, 0x20(sp)

b 0x4077e8

move v0, s5

lbu a0, (s3)

lw t9, -sym.imp.ceil(gp)

mtc1 a0, f0

nop

cvt.d.w f12, f0

jalr t9

mul.d f12, f12, f22

cfc1 a2, 31

cfc1 a2, 31

nop

--

lw v0, 0x34(sp)

negu v1, v1

sllv v0, v0, v1

sll a0, v0, 0x18

srl a1, v0, 0x18

srl v1, v0, 8

or a0, a0, a1

andi v1, v1, 0xff00

andi v0, v0, 0xff00

or a0, a0, v1

sll v0, v0, 8

or a0, a0, v0

blez s4, 0x4079e0

sw a0, 0x34(sp)

move a1, zero

addiu a2, sp, 0x38

addu v0, s3, a1

lbu a0, 1(v0)

addu v1, a2, a1

addiu a1, a1, 1

slt v0, a1, s4

bnez v0, 0x4079c4

sb a0, (v1)

lw a0, 0x34(sp)

lw v0, 0x38(sp)

lw t9, -sym.imp.sprintf(gp)

and v0, v0, a0

srl a1, v0, 0x18

andi a3, v0, 0xff

srl v1, v0, 8

srl a0, v0, 0x10

sw v0, 0x38(sp)

lui v0, 0x41

lui s2, 0x41

andi v1, v1, 0xff

lui s1, 0x41

andi a0, a0, 0xff

addiu v0, v0, -0x5844

sw v1, 0x10(sp)

sw a0, 0x14(sp)

sw a1, 0x18(sp)

move a0, s0

addiu a1, s2, -0x5894

addiu a2, s1, -0x62dc

jalr t9

sw v0, 0x1c(sp)

addiu v1, sp, 0x34

lw gp, 0x20(sp)

lbu a2, 3(v1)

lbu a0, 1(v1)

lbu a1, 2(v1)

lui v1, 0x41

lw t9, -sym.imp.sprintf(gp)

addiu v1, v1, -0x5844

lbu a3, 0x34(sp)

addu s0, s0, v0

sw v1, 0x1c(sp)

sw a0, 0x10(sp)

sw a1, 0x14(sp)

move a0, s0

sw a2, 0x18(sp)

addiu a1, s2, -0x5894

jalr t9

addiu a2, s1, -0x62dc

lw gp, 0x20(sp)

addu s0, s0, v0

lw t9, -sym.imp.sprintf(gp)

lbu a2, (s3)

lui a1, 0x41

move a0, s0

jalr t9

addiu a1, a1, -0x5878

addiu v1, s4, 1

addu v1, s3, v1

lbu a0, 1(v1)

lbu a3, (v1)

sw a0, 0x10(sp)

lbu a1, 2(v1)

lw gp, 0x20(sp)

sw a1, 0x14(sp)

addu s0, s0, v0

lui a0, 0x41

lbu v0, 3(v1)

addiu a0, a0, -0x5880

lw t9, -sym.imp.sprintf(gp)

sw v0, 0x18(sp)

sw a0, 0x1c(sp)

addiu a1, s2, -0x5894

b 0x407908

addiu a2, s1, -0x62dc

lbu v0, 1(s3)

lbu a3, (s3)

sw v0, 0x10(sp)

lbu v1, 2(s3)

lui a1, 0x41

sw v1, 0x14(sp)

lbu v0, 3(s3)

addiu a1, a1, -0x5844

lw t9, -sym.imp.sprintf(gp)

sw a1, 0x1c(sp)

lui a2, 0x41

lui a1, 0x41

move a0, s0

sw v0, 0x18(sp)

addiu a1, a1, -0x5894

jalr t9

addiu a2, a2, -0x62dc

lbu a0, (s3)

addu s0, s0, v0

sll v0, a0, 0x18

sra v0, v0, 0x18

lw gp, 0x20(sp)

bltz v0, 0x408144

lui v0, 0x41

lw v1, -0x5874(v0)

addiu v0, v0, -0x5874

lw a0, 4(v0)

lw a1, 8(v0)

swl v1, 3(s0)

swr v1, (s0)

swl a0, 7(s0)

swr a0, 4(s0)

swl a1, 0xb(s0)

swr a1, 8(s0)

lbu v1, 0xc(v0)

addiu s1, s0, 0xc

sb v1, 0xc(s0)

addiu s3, s3, 4

lbu v0, 1(s3)

lbu a3, (s3)

sw v0, 0x10(sp)

lbu v1, 2(s3)

lw t9, -sym.imp.sprintf(gp)

sw v1, 0x14(sp)

lbu v0, 3(s3)

lui a1, 0x41

sw v0, 0x18(sp)

lui v0, 0x41

addiu v0, v0, -0x5880

lui a2, 0x41

sw v0, 0x1c(sp)

addiu a1, a1, -0x5894

addiu a2, a2, -0x62dc

jalr t9

move a0, s1

addu s0, s1, v0

lw gp, 0x20(sp)

addiu s6, s6, -4

addiu s5, zero, 4

b 0x4077e8

addiu v0, zero, 4

lwl a3, 3(s3)

lw t9, -sym.imp.sprintf(gp)

lwr a3, (s3)

move a0, s0

srl a1, a3, 0x18

sll v1, a3, 0x18

srl v0, a3, 8

or v1, v1, a1

andi a2, a3, 0xff00

andi v0, v0, 0xff00

or v1, v1, v0

sll a2, a2, 8

sw a3, 0x30(sp)

lui a3, 0x41

or a2, v1, a2

addiu a1, a3, -0x5818

jalr t9

subu s6, s6, s5

addu s0, s0, v0

lw gp, 0x20(sp)

b 0x4077ec

move v0, s5

lwl a1, 3(s3)

lw t9, -sym.imp.sprintf(gp)

lwr a1, (s3)

nop

srl a0, a1, 0x18

sll v1, a1, 0x18

srl v0, a1, 8

or v1, v1, a0

andi a2, a1, 0xff00

andi v0, v0, 0xff00

or v1, v1, v0

sll a2, a2, 8

sw a1, 0x2c(sp)

lui a1, 0x41

or a2, v1, a2

addiu a1, a1, -0x5820

b 0x407c20

move a0, s0

lbu v1, (s3)

lui a1, 0x41

sb v1, 0x2a(sp)

lbu v0, 1(s3)

lw t9, -sym.imp.sprintf(gp)

sb v0, 0x2b(sp)

lhu v1, 0x2a(sp)

addiu a1, a1, -0x581c

sll a2, v1, 8

andi a2, a2, 0xffff

srl v1, v1, 8

or a2, a2, v1

b 0x407c20

move a0, s0

lbu v1, (s3)

lui a1, 0x41

sb v1, 0x28(sp)

lbu v0, 1(s3)

lw t9, -sym.imp.sprintf(gp)

sb v0, 0x29(sp)

lhu v1, 0x28(sp)

b 0x407ca0

addiu a1, a1, -0x5820

lui a1, 0x41

lw t9, -sym.imp.sprintf(gp)

lbu a2, (s3)

addiu a1, a1, -0x5820

b 0x407c20

move a0, s0

lbu v0, (s3)

nop

bnez v0, 0x408134

lui a1, 0x41

lui a1, 0x41

addiu a1, a1, -0x582c

lw t9, -sym.imp.sprintf(gp)

nop

jalr t9

move a0, s0

addu s0, s0, v0

lw gp, 0x20(sp)

b 0x4077e8

move v0, s5

lw t9, -sym.imp.memcpy(gp)

move a1, s3

move a0, s0

jalr t9

move a2, s6

addu v0, s0, s6

lw gp, 0x20(sp)

sb zero, (v0)

lw v0, 0x44(sp)

nop

addiu v0, v0, 1

sw v0, 0x44(sp)

lbu a1, 0x2b(fp)

--

andi v0, s1, 2

bnez v0, 0x407ddc

nop

lw v1, 0x98(sp)

nop

lbu v0, 0x2c(v1)

nop

bnez v0, 0x408460

nop

lw v0, 0x4c(sp)

nop

beqz v0, 0x407f14

nop

lw t9, -sym.imp.malloc(gp)

nop

jalr t9

addiu a0, zero, 0x18

lw a0, 0x44(sp)

lw a1, 0x58(sp)

sll v1, a0, 2

lw a3, 0x4c(sp)

addu v1, a1, v1

lw gp, 0x20(sp)

sw v0, (v1)

lbu a2, 2(a3)

lw t9, -sym.imp.sprintf(gp)

lui a1, 0x41

addiu a1, a1, -0x57ec

jalr t9

move a0, v0

lw gp, 0x20(sp)

lw v0, 0x44(sp)

lw t9, -sym.imp.malloc(gp)

addiu a0, zero, 0x1b

jalr t9

addiu s0, v0, 1

lw v1, 0x58(sp)

sll s0, s0, 2

addu s0, v1, s0

lw gp, 0x20(sp)

lw a0, 0x4c(sp)

sw v0, (s0)

lw t9, -sym.imp.sprintf(gp)

lbu a2, 3(a0)

lui a1, 0x41

addiu a1, a1, -0x57dc

jalr t9

move a0, v0

lw gp, 0x20(sp)

lw a1, 0x44(sp)

lw t9, -sym.imp.malloc(gp)

addiu s0, a1, 2

lw a2, 0x58(sp)

addiu a0, zero, 0x80

sll s0, s0, 2

jalr t9

addu s0, a2, s0

lui v1, 0x41

lw a1, -0x57c8(v1)

lw gp, 0x20(sp)

addiu v1, v1, -0x57c8

swl a1, 3(v0)

lw a0, 4(v1)

--

nop

lbu v0, 0x6c(a2)

nop

beqz v0, 0x407524

nop

b 0x407524

addiu s0, s0, 1

b 0x407f28

sw zero, 0xc(a3)

lw t9, -sym.imp.malloc(gp)

nop

jalr t9

addiu a0, zero, 0x17

lw a0, 0x98(sp)

lw gp, 0x20(sp)

addiu v1, a0, 0x14

lbu a1, 1(v1)

lbu a2, 2(v1)

lbu t0, 3(v1)

lw v1, 0x58(sp)

lbu a3, 0x14(a0)

sll a0, s0, 2

addu a0, v1, a0

lui v1, 0x41

sw v0, (a0)

lw t9, -sym.imp.sprintf(gp)

sw a1, 0x10(sp)

sw a2, 0x14(sp)

addiu v1, v1, -0x5880

lui a1, 0x41

lui a2, 0x41

addiu s0, s0, 1

sw t0, 0x18(sp)

sw v1, 0x1c(sp)

move a0, v0

addiu a1, a1, -0x5894

addiu a2, a2, -0x5810

jalr t9

sw s0, 0x44(sp)

lw gp, 0x20(sp)

b 0x407d88

nop

lui a2, 0x41

lw v0, -0x5864(a2)

addiu a3, a2, -0x5864

lw v1, 4(a3)

--

nop

sw zero, 0x48(sp)

b 0x408250

move v1, zero

b 0x408104

move s0, zero

addiu s0, a1, 0x6c

lw t9, -sym.imp.strlen(gp)

sb zero, 0xeb(a1)

jalr t9

move a0, s0

lw gp, 0x20(sp)

nop

lw t9, -sym.imp.malloc(gp)

nop

jalr t9

addiu a0, v0, 0xb

lw a2, 0x44(sp)

lw a3, 0x58(sp)

sll v1, a2, 2

addu v1, a3, v1

lw gp, 0x20(sp)

sw v0, (v1)

move a0, v0

lw v0, 0x44(sp)

lw t9, -sym.imp.sprintf(gp)

addiu v0, v0, 1

lui a1, 0x41

addiu a1, a1, -0x5808

move a2, s0

jalr t9

sw v0, 0x44(sp)

lw gp, 0x20(sp)

b 0x407dbc

andi v0, s1, 2

addiu s0, v1, 0x2c

lw t9, -sym.imp.strlen(gp)

sb zero, 0x6b(v1)

jalr t9

move a0, s0

lw gp, 0x20(sp)

nop

lw t9, -sym.imp.malloc(gp)

nop

jalr t9

addiu a0, v0, 7

lw a0, 0x44(sp)

lw gp, 0x20(sp)

lw a1, 0x58(sp)

lw a3, 0x44(sp)

sll v1, a0, 2

addu v1, a1, v1

lw t9, -sym.imp.sprintf(gp)

addiu a3, a3, 1

lui a1, 0x41

sw v0, (v1)

move a0, v0

addiu a1, a1, -0x57f8

move a2, s0

jalr t9

sw a3, 0x44(sp)

lw gp, 0x20(sp)

b 0x407ddc

nop

addiu s0, zero, 4

b 0x407d70

sw s0, 0x44(sp)

b 0x407484

move s0, zero

nop

nop

addiu t7, a0, 0x2c

addiu t0, a0, 0xf0

[*] Function sprintf used 26 times udhcpd