[*] Binary protection state of rndimage
RELRO CANARY NX PIE RPATH RUNPATH SYMBOLS
No RELRO No Canary found NX disabled No PIE No RPATH No RUNPATH No Symbols
[*] Function printf tear down of rndimage
lw t9, -sym.imp.fopen(gp)
lui a1, 0x40
addiu a0, s0, 0x4b90
jalr t9
addiu a1, a1, 0x4ba8
lw gp, 0x10(sp)
b 0x400f54
move s1, v0
lw t9, -sym.imp.fscanf(gp)
lui a1, 0x40
addiu a1, a1, 0x4bac
move a0, v0
jalr t9
addiu a2, sp, 0x18
lw gp, 0x10(sp)
lw v0, 0x18(sp)
nop
addiu v0, v0, 1
slti v1, v0, 0xb
bnez v1, 0x400f74
sw v0, 0x18(sp)
addiu v0, zero, 1
sw v0, 0x18(sp)
lw a2, 0x18(sp)
addiu s0, sp, 0x38
lw t9, -sym.imp.sprintf(gp)
lui a1, 0x40
addiu a1, a1, 0x4bb0
jalr t9
move a0, s0
lw gp, 0x10(sp)
move a0, s1
lw t9, -sym.imp.rewind(gp)
nop
jalr t9
addiu s4, sp, 0x18
lw gp, 0x10(sp)
move a0, s0
lw t9, -sym.imp.strlen(gp)
nop
jalr t9
addiu s3, zero, 5
lw gp, 0x10(sp)
move a3, s1
lw t9, -sym.imp.fwrite(gp)
move a1, v0
move a0, s0
jalr t9
addiu a2, zero, 1
lw gp, 0x10(sp)
move a0, s1
lw t9, -sym.imp.fclose(gp)
nop
jalr t9
lui s0, 0x41
lw gp, 0x10(sp)
lw a2, 0x18(sp)
lw t9, -sym.imp.sprintf(gp)
lui a1, 0x40
addiu a1, a1, 0x4bb8
jalr t9
addiu a0, s0, 0x54b8
lw gp, 0x10(sp)
addiu a0, s0, 0x54b8
lw t9, -sym.imp.unlink(gp)
nop
jalr t9
addiu s0, s0, 0x54b8
lw gp, 0x10(sp)
lui v0, 0x41
sw s0, 0x5040(v0)
addiu v1, zero, 0x96
lui v0, 0x41
lui s1, 0x41
addiu s1, s1, 0x5438
lw t9, -sym.imp.memset(gp)
sw v1, 0x5030(v0)
addiu v1, zero, 0x28
lui v0, 0x41
move a0, s1
sw v1, 0x5034(v0)
move a1, zero
jalr t9
addiu a2, zero, 0x80
lui v0, 0x40
lw gp, 0x10(sp)
move s2, s1
addiu s5, v0, 0x4bd4
move s0, zero
addiu s1, zero, 0x1a
lw t9, -sym.imp.random(gp)
nop
jalr t9
addiu s0, s0, 1
bnez s1, 0x40109c
divu zero, v0, s1
break 7
lw gp, 0x10(sp)
move a0, s2
lw t9, -sym.imp.sprintf(gp)
move a1, s5
mfhi v0
addu v0, s4, v0
lb a3, 4(v0)
jalr t9
move a2, s2
lw gp, 0x10(sp)
bne s0, s3, 0x401080
lui v0, 0x41
lw t9, -sym.imp.strrchr(gp)
lui s1, 0x41
lw a0, 0x5040(v0)
sw s2, 0x5434(s1)
jalr t9
addiu a1, zero, 0x2f
lw gp, 0x10(sp)
addiu s2, v0, 1
addiu s0, sp, 0x38
lw t9, -sym.imp.sprintf(gp)
lui a2, 0x40
lui a1, 0x40
move a3, s2
addiu a2, a2, 0x4be8
move a0, s0
jalr t9
addiu a1, a1, 0x4bdc
lw gp, 0x10(sp)
lui a1, 0x40
lw t9, -sym.imp.fopen(gp)
addiu a1, a1, 0x4ba8
jalr t9
move a0, s0
lw gp, 0x10(sp)
lw s0, 0x5434(s1)
lw t9, -sym.imp.strlen(gp)
move a0, s0
jalr t9
move s1, v0
lw gp, 0x10(sp)
move a3, s1
lw t9, -sym.imp.fwrite(gp)
move a1, v0
move a0, s0
jalr t9
addiu a2, zero, 1
lw gp, 0x10(sp)
nop
lw t9, -sym.imp.fclose(gp)
nop
jalr t9
move a0, s1
lw gp, 0x10(sp)
lui a0, 0x40
lw t9, -sym.imp.printf(gp)
move a1, s2
jalr t9
addiu a0, a0, 0x4bf4
lw ra, 0xd4(sp)
lw gp, 0x10(sp)
lw s5, 0xd0(sp)
lw s4, 0xcc(sp)
lw s3, 0xc8(sp)
lw s2, 0xc4(sp)
lw s1, 0xc0(sp)
lw s0, 0xbc(sp)
jr ra
addiu sp, sp, 0xd8
lui gp, 0x42
addiu sp, sp, -0x30
addiu gp, gp, -0x2d00
sw ra, 0x2c(sp)
sw s1, 0x28(sp)
sw s0, 0x24(sp)
sw gp, 0x10(sp)
lw s0, -0x7f6c(gp)
sw a1, 0x34(sp)
lw t9, -sym.imp.fputs(gp)
lw a1, (s0)
move s1, a0
lui a0, 0x40
sw a2, 0x38(sp)
sw a3, 0x3c(sp)
jalr t9
addiu a0, a0, 0x4c14
lw gp, 0x10(sp)
lw a0, (s0)
lw t9, -sym.imp.vfprintf(gp)
addiu a2, sp, 0x34
sw a2, 0x18(sp)
jalr t9
move a1, s1
lw gp, 0x10(sp)
nop
lw t9, -sym.imp.exit(gp)
nop
jalr t9
addiu a0, zero, 1
lui gp, 0x42
addiu sp, sp, -0x120
addiu gp, gp, -0x2d00
sw ra, 0x11c(sp)
sw fp, 0x118(sp)
sw s7, 0x114(sp)
sw s6, 0x110(sp)
sw s5, 0x10c(sp)
sw s4, 0x108(sp)
sw s3, 0x104(sp)
sw s2, 0x100(sp)
sw s1, 0xfc(sp)
sw s0, 0xf8(sp)
sw gp, 0x20(sp)
lw t9, -sym.imp.strrchr(gp)
move s2, a0
lw a0, (a1)
move s1, a1
jalr t9
addiu a1, zero, 0x2f
lui v1, 0x41
lw gp, 0x20(sp)
beqz v0, 0x401294
sw v0, 0x5430(v1)
b 0x40129c
addiu v0, v0, 1
lw v0, (s1)
nop
sw v0, 0x5430(v1)
slti v0, s2, 2
beqz v0, 0x4012e0
addiu fp, zero, 0x63
lui v0, 0x41
lw t9, -sym.imp.printf(gp)
lw a1, 0x5430(v0)
lui a0, 0x40
addiu a0, a0, 0x4c28
addiu a2, zero, 0x1f4
jalr t9
addiu a3, zero, 0xc8
lw gp, 0x20(sp)
nop
lw t9, -sym.imp.exit(gp)
b 0x40141c
addiu a0, zero, -1
lw v1, -loc._fbss(gp)
lw s0, -0x7fd0(gp)
sw zero, (v1)
lui s7, 0x41
addiu s6, zero, 0x66
lui s5, 0x41
addiu s4, zero, 0x44
b 0x401430
addiu s3, zero, 1
--
nop
lui a0, 0x41
lw gp, 0x20(sp)
bnez v0, 0x401430
sw v0, 0x5030(a0)
lui a0, 0x40
b 0x4013d4
addiu a0, a0, 0x4da4
lw t9, -sym.imp.atoi(gp)
lw a0, (s0)
jalr t9
nop
lui v1, 0x41
lw gp, 0x20(sp)
bnez v0, 0x401430
sw v0, 0x5034(v1)
lui a0, 0x40
addiu a0, a0, 0x4dbc
jal sym.error_exit
nop
lw gp, 0x20(sp)
b 0x401430
nop
addiu s0, zero, -1
lui v0, 0x41
lw t9, -sym.imp.printf(gp)
lw a1, 0x5430(v0)
lui a0, 0x40
addiu a0, a0, 0x4c28
addiu a2, zero, 0x1f4
jalr t9
addiu a3, zero, 0xc8
lw gp, 0x20(sp)
move a0, s0
lw t9, -sym.imp.exit(gp)
nop
jalr t9
nop
lw a0, -loc._fbss(gp)
nop
sw s3, (a0)
lw t9, -sym.imp.getopt(gp)
lui a2, 0x40
move a0, s2
move a1, s1
jalr t9
--
lw t9, -sym.imp.random(gp)
mfhi s5
jalr t9
addiu s0, s0, -1
subu s0, s0, s5
bnez s0, 0x401a7c
divu zero, v0, s0
break 7
lw gp, 0x20(sp)
mfhi s1
sltiu v0, s1, 0x32
beqz v0, 0x401a94
nop
addiu s1, s1, 0x1e
lw t9, -sym.imp.random(gp)
lui v0, 0x41
lw s0, 0x5044(v0)
jalr t9
nop
bnez s7, 0x401ab4
div zero, v0, s7
break 7
lw gp, 0x20(sp)
lw a0, 0xe8(sp)
lw v1, -obj.g_font_file(gp)
lw t9, -sym.imp.sprintf(gp)
lui a1, 0x40
move a2, s0
mfhi v0
sll v0, v0, 2
addu v0, v1, v0
lw a3, (v0)
jalr t9
addiu a1, a1, 0x4e38
lui a0, 0x41
lw v0, 0x5434(a0)
lw gp, 0x20(sp)
addu v0, v0, s3
lb a1, (v0)
lw a3, 0x28(sp)
lui v0, 0xff
lw t9, -sym.get_chr_from_file(gp)
ori v0, v0, 0xffff
lw a0, 0xe8(sp)
and a3, a3, v0
jalr t9
--
addiu v1, v1, 4
sw v1, 0xd4(sp)
lw v0, 0x5038(s1)
nop
slt v0, s0, v0
bnez v0, 0x401c5c
lui v0, 0x41
lw a0, 0x5040(v0)
lui v0, 0x41
lw v0, 0x5048(v0)
lw t9, -sym.write_jpeg(gp)
lhu a2, 0x34(sp)
lhu a3, 0x36(sp)
lw a1, 0x38(sp)
jalr t9
sw v0, 0x10(sp)
lw gp, 0x20(sp)
beqz v0, 0x401cf0
nop
lui a0, 0x40
jal sym.error_exit
addiu a0, a0, 0x4e64
lw gp, 0x20(sp)
nop
lw v0, -0x7f6c(gp)
lw t9, -sym.imp.fprintf(gp)
lw a0, (v0)
lui v0, 0x41
lw a2, 0x5040(v0)
lhu v0, 0x36(sp)
lhu a3, 0x34(sp)
lui a1, 0x40
sw v0, 0x10(sp)
jalr t9
addiu a1, a1, 0x4e7c
lw gp, 0x20(sp)
nop
lw t9, -sym.free_image(gp)
nop
jalr t9
addiu a0, sp, 0x34
lw ra, 0x11c(sp)
lw gp, 0x20(sp)
move v0, zero
lw fp, 0x118(sp)
lw s7, 0x114(sp)
[*] Function printf used 10 times rndimage
