[*] Binary protection state of neaps
RELRO CANARY NX PIE RPATH RUNPATH SYMBOLS
No RELRO No Canary found NX disabled No PIE No RPATH No RUNPATH No Symbols
[*] Function printf tear down of neaps
lw t9, -0x7ea8(gp)
nop
beqz t9, 0x4012ec
addiu a0, a0, 0x68ac
lw ra, 0x1c(sp)
jr t9
addiu sp, sp, 0x20
lw ra, 0x1c(sp)
nop
jr ra
addiu sp, sp, 0x20
nop
lui gp, 0x42
addiu sp, sp, -0x28
addiu gp, gp, -0x16e0
sw ra, 0x24(sp)
sw gp, 0x10(sp)
lui v0, 0x41
lw v0, 0x6afc(v0)
sw a1, 0x2c(sp)
sw a2, 0x30(sp)
sw a3, 0x34(sp)
beqz v0, 0x40134c
move a1, a0
lw v0, -0x7f3c(gp)
lw t9, -sym.imp.vfprintf(gp)
addiu a2, sp, 0x2c
lw a0, (v0)
jalr t9
sw a2, 0x18(sp)
lw gp, 0x10(sp)
lw ra, 0x24(sp)
nop
jr ra
addiu sp, sp, 0x28
lui gp, 0x42
addiu sp, sp, -0x20
addiu gp, gp, -0x16e0
sw ra, 0x1c(sp)
sw s0, 0x18(sp)
sw gp, 0x10(sp)
move s0, a0
lui a1, 0x40
lui a0, 0x40
addiu a0, a0, 0x6484
addiu a1, a1, 0x649c
jal 0x401300
move a2, s0
lw gp, 0x10(sp)
nop
lw t9, -sym.imp.exit(gp)
nop
jalr t9
move a0, s0
lui gp, 0x42
addiu sp, sp, -0x20
addiu gp, gp, -0x16e0
sw ra, 0x1c(sp)
sw s0, 0x18(sp)
sw gp, 0x10(sp)
lw t9, -sym.imp.printf(gp)
move s0, a0
lui a1, 0x40
lui a0, 0x40
addiu a1, a1, 0x649c
jalr t9
addiu a0, a0, 0x64a4
lw gp, 0x10(sp)
lui a0, 0x40
lw t9, -sym.imp.puts(gp)
nop
jalr t9
addiu a0, a0, 0x64bc
lw gp, 0x10(sp)
lui a0, 0x40
lw t9, -sym.imp.puts(gp)
nop
jalr t9
addiu a0, a0, 0x64ec
lw gp, 0x10(sp)
lui a0, 0x40
--
jalr t9
addiu a1, a1, 0x65ec
lw gp, 0x20(sp)
bnez v0, 0x4017fc
lui a1, 0x40
lw t9, -sym.imp.inet_addr(gp)
nop
jalr t9
move a0, s0
lui v1, 0x41
lw v1, 0x6afc(v1)
lw gp, 0x20(sp)
beqz v1, 0x401aac
sw v0, 0x6ad0(s3)
move s0, zero
b 0x4017b8
addiu s1, zero, 4
bnez v0, 0x4017b8
nop
lw t9, -sym.imp.putchar(gp)
nop
jalr t9
addiu a0, zero, 0xa
lw gp, 0x20(sp)
addu v0, fp, s0
lw t9, -sym.imp.printf(gp)
lbu a1, (v0)
lui a0, 0x40
addiu s0, s0, 1
jalr t9
addiu a0, a0, 0x65f4
lw gp, 0x20(sp)
bne s0, s1, 0x40179c
andi v0, s0, 0xf
lw t9, -sym.imp.putchar(gp)
nop
jalr t9
addiu a0, zero, 0xa
lw gp, 0x20(sp)
b 0x401aac
nop
lw t9, -sym.imp.strcmp(gp)
move a0, s1
jalr t9
addiu a1, a1, 0x65fc
lw gp, 0x20(sp)
--
jalr t9
move a1, zero
lw a2, 0x458(sp)
lw gp, 0x28(sp)
slti v0, a2, 0x100
bnez v0, 0x4021b8
nop
addiu a2, zero, 0xff
lw t9, -sym.imp.memcpy(gp)
lw a1, 0x45c(sp)
jalr t9
move a0, s0
lui v0, 0x40
lw gp, 0x28(sp)
addiu a2, v0, 0x66f8
addiu v0, zero, 4
beq s3, v0, 0x402234
addiu v0, zero, 5
beq s3, v0, 0x40226c
addiu s0, zero, 3
bne s3, s0, 0x402350
lui a0, 0x40
lbu v0, 1(s1)
lbu v1, 2(s1)
lbu a3, (s1)
lw t9, -sym.imp.sprintf(gp)
sw v0, 0x10(sp)
sw a2, 0x18(sp)
addiu v0, sp, 0x130
lui a1, 0x40
lui a2, 0x40
sw v1, 0x14(sp)
sw v0, 0x1c(sp)
addiu a1, a1, 0x66fc
addiu a2, a2, 0x6728
jalr t9
addiu a0, sp, 0x230
b 0x4022b8
nop
lbu v0, 1(s1)
lbu v1, 2(s1)
lbu a0, 3(s1)
lbu a3, (s1)
lui a1, 0x40
sw v0, 0x10(sp)
addiu v0, sp, 0x130
lw t9, -sym.imp.sprintf(gp)
sw v1, 0x14(sp)
sw a0, 0x18(sp)
sw a2, 0x1c(sp)
sw v0, 0x20(sp)
b 0x4022a8
addiu a1, a1, 0x673c
lbu v0, 1(s1)
lbu a1, 4(s1)
lbu v1, 2(s1)
lbu a0, 3(s1)
lbu a3, (s1)
lw t9, -sym.imp.sprintf(gp)
sw v0, 0x10(sp)
sw a1, 0x1c(sp)
addiu v0, sp, 0x130
lui a1, 0x40
sw v1, 0x14(sp)
sw a0, 0x18(sp)
sw a2, 0x20(sp)
sw v0, 0x24(sp)
addiu a1, a1, 0x676c
lui a2, 0x40
addiu a2, a2, 0x6728
jalr t9
addiu a0, sp, 0x230
lw gp, 0x28(sp)
addiu v0, zero, 0x100
lw t9, -sym.xmldbc_ephp_wb(gp)
addiu s0, sp, 0x30
sw v0, 0x10(sp)
move a0, zero
move a1, zero
--
lw t9, -sym.imp.sendto(gp)
sw v0, 0x10(sp)
addiu v0, zero, 0x10
sw v0, 0x14(sp)
move a2, s1
addiu a1, sp, 0x40
jalr t9
move a3, zero
lw gp, 0x18(sp)
bgez v0, 0x403178
move s3, v0
lw t9, -sym.imp.__errno_location(gp)
lw v0, -0x7f3c(gp)
lw s2, (s4)
lw s1, (v0)
jalr t9
nop
lw gp, 0x18(sp)
lw s0, (v0)
lw t9, -sym.imp.strerror(gp)
nop
jalr t9
move a0, s0
lw gp, 0x18(sp)
lui a1, 0x40
lw t9, -sym.imp.fprintf(gp)
sw v0, 0x10(sp)
move a0, s1
addiu a1, a1, 0x67b4
move a2, s2
jalr t9
move a3, s0
lw gp, 0x18(sp)
lw ra, 0xffc(sp)
move v0, s3
lw s5, 0xff8(sp)
lw s4, 0xff4(sp)
lw s3, 0xff0(sp)
lw s2, 0xfec(sp)
lw s1, 0xfe8(sp)
lw s0, 0xfe4(sp)
jr ra
addiu sp, sp, 0x1000
addiu sp, sp, -0x20
sw ra, 0x1c(sp)
sw gp, 0x10(sp)
--
addiu a1, zero, 1
jalr t9
addiu a2, zero, 0x11
lw gp, 0x18(sp)
bltz v0, 0x403ce8
move s0, v0
lw t9, -sym.imp.setsockopt(gp)
addiu v0, zero, 4
sw v0, 0x10(sp)
move a0, s0
ori a1, zero, 0xffff
addiu a2, zero, 0x20
jalr t9
addiu a3, sp, 0x20
addiu v1, zero, -1
lw gp, 0x18(sp)
bne v0, v1, 0x403d3c
nop
lw t9, -sym.imp.__errno_location(gp)
nop
jalr t9
nop
lw gp, 0x18(sp)
lw a2, (v0)
lw v0, -0x7f3c(gp)
lw t9, -sym.imp.fprintf(gp)
lw a0, (v0)
lui a1, 0x40
jalr t9
addiu a1, a1, 0x6850
lw gp, 0x18(sp)
nop
lw t9, -sym.imp.free(gp)
nop
jalr t9
move a0, s1
lw gp, 0x18(sp)
b 0x403d44
move v0, zero
sw s0, (s1)
move v0, s1
lw ra, 0x34(sp)
lw s1, 0x30(sp)
lw s0, 0x2c(sp)
jr ra
addiu sp, sp, 0x38
--
sh a0, 4(v1)
sh a1, 2(v1)
jalr t9
move a0, s0
lw gp, 0x18(sp)
b 0x4040c8
addiu v0, zero, 1
jalr t9
move a0, s0
b 0x4040c0
nop
lw t9, -sym.imp.__errno_location(gp)
lw v0, -0x7f3c(gp)
nop
lw s0, (v0)
jalr t9
nop
lw gp, 0x18(sp)
lw a0, (v0)
lw t9, -sym.imp.strerror(gp)
nop
jalr t9
nop
lw gp, 0x18(sp)
lui a1, 0x40
lw t9, -sym.imp.fprintf(gp)
move a0, s0
addiu a1, a1, 0x6868
jalr t9
move a2, v0
lw gp, 0x18(sp)
move v0, zero
lw ra, 0x9c(sp)
lw s7, 0x98(sp)
lw s6, 0x94(sp)
lw s5, 0x90(sp)
lw s4, 0x8c(sp)
lw s3, 0x88(sp)
lw s2, 0x84(sp)
lw s1, 0x80(sp)
lw s0, 0x7c(sp)
jr ra
addiu sp, sp, 0xa0
nop
nop
nop
--
addiu gp, gp, -0x16e0
sw ra, 0x94(sp)
sw s1, 0x90(sp)
sw s0, 0x8c(sp)
sw gp, 0x10(sp)
lw t9, -sym.imp.socket(gp)
move s1, a0
addiu a1, zero, 2
addiu a0, zero, 1
jalr t9
move a2, zero
lw gp, 0x10(sp)
bgez v0, 0x405274
move s0, v0
b 0x4052f8
addiu s0, zero, -1
lw t9, -sym.imp.fcntl(gp)
move a0, v0
addiu a1, zero, 2
jalr t9
addiu a2, zero, 1
lw gp, 0x10(sp)
bnez s1, 0x405298
lui v0, 0x40
addiu s1, v0, 0x687c
lw t9, -sym.imp.snprintf(gp)
addiu v0, zero, 1
lui a2, 0x40
addiu a2, a2, 0x6878
move a3, s1
addiu a0, sp, 0x1a
addiu a1, zero, 0x6c
jalr t9
sh v0, 0x18(sp)
lw gp, 0x10(sp)
move a0, s0
lw t9, -sym.imp.connect(gp)
addiu a1, sp, 0x18
jalr t9
addiu a2, zero, 0x6e
lw gp, 0x10(sp)
bgez v0, 0x4052f8
nop
lw t9, -sym.imp.close(gp)
nop
jalr t9
--
jalr t9
move s0, a1
addiu v0, v0, 1
move a0, s1
move a2, s0
move a3, s2
addiu a1, zero, 0xc
jal 0x4053ac
sw v0, 0x10(sp)
lw ra, 0x2c(sp)
lw gp, 0x18(sp)
lw s2, 0x28(sp)
lw s1, 0x24(sp)
lw s0, 0x20(sp)
jr ra
addiu sp, sp, 0x30
lui gp, 0x42
addiu sp, sp, -0x230
addiu gp, gp, -0x16e0
sw ra, 0x22c(sp)
sw s2, 0x228(sp)
sw s1, 0x224(sp)
sw s0, 0x220(sp)
sw gp, 0x18(sp)
addiu s0, sp, 0x20
lw t9, -sym.imp.snprintf(gp)
move v0, a2
lui a2, 0x40
sw a3, 0x10(sp)
addiu a2, a2, 0x6890
move a3, v0
move s1, a0
move s2, a1
move a0, s0
jalr t9
addiu a1, zero, 0x1ff
lw gp, 0x18(sp)
move a0, s0
lw t9, -sym.imp.strlen(gp)
nop
jalr t9
sb zero, 0x21f(sp)
addiu v0, v0, 1
move a0, s1
move a2, s2
move a3, s0
addiu a1, zero, 0xb
jal 0x4053ac
sw v0, 0x10(sp)
lw ra, 0x22c(sp)
lw gp, 0x18(sp)
lw s2, 0x228(sp)
lw s1, 0x224(sp)
lw s0, 0x220(sp)
jr ra
addiu sp, sp, 0x230
lui gp, 0x42
addiu sp, sp, -0x230
addiu gp, gp, -0x16e0
sw ra, 0x22c(sp)
sw s2, 0x228(sp)
sw s1, 0x224(sp)
sw s0, 0x220(sp)
sw gp, 0x18(sp)
addiu s0, sp, 0x20
lw t9, -sym.imp.snprintf(gp)
move v0, a2
lui a2, 0x40
sw a3, 0x10(sp)
addiu a2, a2, 0x6890
move a3, v0
move s1, a0
move s2, a1
move a0, s0
jalr t9
addiu a1, zero, 0x1ff
lw gp, 0x18(sp)
move a0, s0
lw t9, -sym.imp.strlen(gp)
nop
jalr t9
sb zero, 0x21f(sp)
addiu v0, v0, 1
move a0, s1
move a2, s2
move a3, s0
--
move s3, a3
addiu v0, v0, 1
move a0, s1
move a2, s0
move a3, s2
addiu a1, zero, 1
sw s3, 0x14(sp)
jal 0x405ca4
sw v0, 0x10(sp)
lw ra, 0x34(sp)
lw gp, 0x18(sp)
lw s3, 0x30(sp)
lw s2, 0x2c(sp)
lw s1, 0x28(sp)
lw s0, 0x24(sp)
jr ra
addiu sp, sp, 0x38
lui gp, 0x42
addiu sp, sp, -0x428
addiu gp, gp, -0x16e0
sw ra, 0x424(sp)
sw s0, 0x420(sp)
sw gp, 0x10(sp)
addiu v0, sp, 0x42c
addiu s0, sp, 0x1c
lw t9, -sym.imp.vsnprintf(gp)
sw a1, 0x42c(sp)
sw a2, 0x430(sp)
sw a3, 0x434(sp)
move a2, a0
move a3, v0
move a0, s0
sw v0, 0x18(sp)
jalr t9
addiu a1, zero, 0x400
lw gp, 0x10(sp)
nop
lw t9, -sym.imp.system(gp)
nop
jalr t9
move a0, s0
lw ra, 0x424(sp)
lw gp, 0x10(sp)
lw s0, 0x420(sp)
jr ra
addiu sp, sp, 0x428
lui gp, 0x42
addiu sp, sp, -0x438
addiu gp, gp, -0x16e0
sw ra, 0x434(sp)
sw s4, 0x430(sp)
sw s3, 0x42c(sp)
sw s2, 0x428(sp)
sw s1, 0x424(sp)
sw s0, 0x420(sp)
sw gp, 0x10(sp)
lw t9, -sym.imp.vsnprintf(gp)
addiu v0, sp, 0x444
addiu s0, sp, 0x1c
sw a3, 0x444(sp)
move s2, a0
move a3, v0
move a0, s0
move s3, a1
sw v0, 0x18(sp)
jalr t9
addiu a1, zero, 0x400
lw gp, 0x10(sp)
lui a1, 0x40
lw t9, -sym.imp.popen(gp)
move a0, s0
jalr t9
addiu a1, a1, 0x65b0
lw gp, 0x10(sp)
beqz v0, 0x40607c
move s1, v0
addiu s3, s3, -1
[*] Function printf used 14 times neaps
