[*] Binary protection state of ubcfg
RELRO CANARY NX PIE RPATH RUNPATH SYMBOLS
No RELRO No Canary found NX disabled No PIE No RPATH No RUNPATH No Symbols
[*] Function printf tear down of ubcfg
move a0, s6
addiu s2, s2, 1
slt v0, s2, s5
lw gp, 0x10(sp)
bnez v0, 0x400d2c
addiu s1, s1, 4
b 0x400e44
nop
lw t9, -sym.imp.memset(gp)
addiu a2, zero, 0xff
move a0, s3
jalr t9
move a1, zero
lw gp, 0x10(sp)
lw s0, 8(s2)
lw t9, -sym.imp.strlen(gp)
nop
jalr t9
move a0, s0
move a2, v0
addiu v0, v0, 1
sltiu v0, v0, 0xff
lw gp, 0x10(sp)
bnez v0, 0x400dfc
move a1, s0
lw t9, -sym.imp.printf(gp)
nop
jalr t9
move a0, s6
b 0x400e34
addiu s1, s1, 1
lw t9, -sym.imp.strncpy(gp)
nop
jalr t9
move a0, s3
lw gp, 0x10(sp)
move a0, s3
lw t9, -sym.imp.strcat(gp)
nop
jalr t9
move a1, fp
move a0, s7
jal 0x400a28
move a1, s3
addiu s1, s1, 1
slt v0, s1, s5
lw gp, 0x10(sp)
bnez v0, 0x400da0
addiu s2, s2, 4
lw t9, -sym.imp.fopen(gp)
lui s1, 0x40
lui a1, 0x40
addiu a1, a1, 0x19bc
jalr t9
addiu a0, s1, 0x19ac
lw gp, 0x10(sp)
bnez v0, 0x400e88
move s0, v0
lui a0, 0x40
lw t9, -sym.imp.printf(gp)
addiu a0, a0, 0x19c0
jalr t9
addiu a1, s1, 0x19ac
lw gp, 0x10(sp)
b 0x4013dc
addiu v0, zero, -1
lw s5, -obj.env_buf(gp)
lw t9, -sym.imp.memset(gp)
move a0, s5
move a1, zero
jalr t9
addiu a2, zero, 0x3ffc
lw gp, 0x10(sp)
move a0, s5
lw t9, -sym.imp.fread(gp)
addiu a1, zero, 0x3ffc
addiu a2, zero, 1
jalr t9
move a3, s0
addiu v1, zero, 1
lw gp, 0x10(sp)
beq v0, v1, 0x400ef0
lui a0, 0x40
lw t9, -sym.imp.printf(gp)
addiu a0, a0, 0x19e0
jalr t9
addiu a1, s1, 0x19ac
lw gp, 0x10(sp)
nop
lw t9, -sym.imp.fclose(gp)
b 0x400f3c
move a0, s0
lw t9, -sym.imp.fclose(gp)
nop
jalr t9
move a0, s0
lw gp, 0x10(sp)
lwl s0, 3(s5)
lw t9, -sym.crc32(gp)
addiu s7, s5, 4
lwr s0, (s5)
move a0, zero
move a1, s7
jalr t9
--
addiu s6, v0, 0x1a00
move s2, zero
b 0x40108c
lui s4, 0x41
lw a0, 0x20e4(s4)
lw a1, 4(s1)
jal 0x400b3c
nop
lw gp, 0x10(sp)
lw s3, 4(s1)
beqz v0, 0x401070
move s0, v0
lw t9, -sym.imp.free(gp)
lw a0, 4(v0)
jalr t9
addiu s2, zero, 1
lw gp, 0x10(sp)
nop
lw t9, -sym.imp.strdup(gp)
nop
jalr t9
move a0, s3
lw gp, 0x10(sp)
b 0x401084
sw v0, 4(s0)
lw t9, -sym.imp.printf(gp)
move a1, s3
jalr t9
move a0, s6
lw gp, 0x10(sp)
lw s1, (s1)
nop
bnez s1, 0x40101c
nop
b 0x401230
nop
lui v0, 0x41
lw s0, 0x20e0(v0)
b 0x4010f4
lui s1, 0x41
lw a0, 0x20e4(s1)
lw a1, 4(s0)
jal 0x400b3c
nop
lw gp, 0x10(sp)
nop
--
lw s3, (s3)
nop
bnez s3, 0x401118
nop
b 0x401230
nop
lui v0, 0x41
lw s0, 0x20e4(v0)
b 0x401210
nop
lw t9, -sym.imp.puts(gp)
lw a0, 4(s0)
jalr t9
nop
lw gp, 0x10(sp)
lw s0, (s0)
nop
bnez s0, 0x4011f4
move s2, zero
b 0x401230
nop
jal 0x400940
nop
lw gp, 0x10(sp)
nop
lw t9, -sym.imp.printf(gp)
lui a0, 0x40
addiu a0, a0, 0x1a24
jalr t9
addiu a1, zero, 0x4000
lw gp, 0x10(sp)
beqz s2, 0x40139c
lui v0, 0x41
lw t9, -sym.imp.memset(gp)
lw a0, -obj.env_buf(gp)
move a1, zero
jalr t9
addiu a2, zero, 0x3ffc
lui v0, 0x41
lw gp, 0x10(sp)
lw s1, 0x20e4(v0)
b 0x4012d4
move s2, zero
lw s0, 4(s1)
lw t9, -sym.imp.strlen(gp)
nop
--
jalr t9
nop
addiu v0, v0, 1
lw gp, 0x10(sp)
lw s1, (s1)
addu s2, v0, s2
bnez s1, 0x401278
move a1, s7
lw t9, -sym.crc32(gp)
move a0, zero
jalr t9
addiu a2, zero, 0xffc
lw gp, 0x10(sp)
lui s1, 0x40
lw t9, -sym.imp.fopen(gp)
swl v0, 3(fp)
lui a1, 0x40
swr v0, (fp)
addiu a1, a1, 0x1a30
jalr t9
addiu a0, s1, 0x19ac
lw gp, 0x10(sp)
bnez v0, 0x40132c
move s0, v0
lui a0, 0x40
lw t9, -sym.imp.printf(gp)
b 0x40138c
addiu a0, a0, 0x1a34
lw t9, -sym.imp.fwrite(gp)
lw a0, -obj.env_buf(gp)
addiu a1, zero, 0x3ffc
addiu a2, zero, 1
jalr t9
move a3, v0
lw gp, 0x10(sp)
addiu v1, zero, 1
lw t9, -sym.imp.fclose(gp)
beq v0, v1, 0x401374
nop
jalr t9
move a0, s0
lw gp, 0x10(sp)
lui a0, 0x40
lw t9, -sym.imp.printf(gp)
b 0x40138c
addiu a0, a0, 0x1a54
jalr t9
move a0, s0
lw gp, 0x10(sp)
lui a0, 0x40
lw t9, -sym.imp.printf(gp)
addiu a0, a0, 0x1a7c
jalr t9
addiu a1, s1, 0x19ac
lw gp, 0x10(sp)
lui v0, 0x41
lw a0, 0x20e4(v0)
nop
beqz a0, 0x4013b8
nop
jal 0x400ad4
nop
lw gp, 0x10(sp)
lui v0, 0x41
lw a0, 0x20e0(v0)
nop
beqz a0, 0x4013dc
move v0, zero
jal 0x400ad4
nop
lw gp, 0x10(sp)
[*] Function printf used 8 times ubcfg
