[*] Binary protection state of ubcom

  	RELRO          CANARY            NX           PIE          RPATH        RUNPATH      SYMBOLS      

  	No RELRO       No Canary found   NX disabled  No PIE       No RPATH     No RUNPATH   No Symbols

[*] Function sprintf tear down of ubcom

lw a2, (v0)

lw v0, 0x28(fp)

lw v1, -obj.IPARRAY(gp)

sll v0, v0, 2

addiu v0, v0, 1

sll v0, v0, 2

addu v0, v1, v0

lw a3, (v0)

lw v0, 0x28(fp)

lw v1, -obj.IPARRAY(gp)

sll v0, v0, 1

addiu v0, v0, 1

sll v0, v0, 3

addu v0, v1, v0

lw a0, (v0)

lw v0, 0x28(fp)

lw v1, -obj.IPARRAY(gp)

sll v0, v0, 4

addu v0, v1, v0

lw v0, 0xc(v0)

sw a0, 0x10(sp)

sw v0, 0x14(sp)

lw a0, -obj.IPTMP2(gp)

lui v0, 0x40

addiu a1, v0, 0x4344

lw t9, -sym.imp.sprintf(gp)

nop

jalr t9

nop

lw gp, 0x18(fp)

lw v0, 0x28(fp)

nop

addiu v0, v0, 1

sw v0, 0x28(fp)

lw v0, 0x28(fp)

lw v1, -obj.IPARRAY(gp)

sll v0, v0, 4

addu v0, v1, v0

lw a2, (v0)

lw v0, 0x28(fp)

lw v1, -obj.IPARRAY(gp)

sll v0, v0, 2

addiu v0, v0, 1

sll v0, v0, 2

addu v0, v1, v0

lw a3, (v0)

lw v0, 0x28(fp)

lw v1, -obj.IPARRAY(gp)

sll v0, v0, 1

addiu v0, v0, 1

sll v0, v0, 3

addu v0, v1, v0

lw a0, (v0)

lw v0, 0x28(fp)

lw v1, -obj.IPARRAY(gp)

sll v0, v0, 4

addu v0, v1, v0

lw v0, 0xc(v0)

sw a0, 0x10(sp)

sw v0, 0x14(sp)

lw a0, -obj.IPTMP3(gp)

lui v0, 0x40

addiu a1, v0, 0x4344

lw t9, -sym.imp.sprintf(gp)

nop

jalr t9

nop

lw gp, 0x18(fp)

lui v0, 0x40

addiu a0, v0, 0x4350

lw t9, -sym.imp.puts(gp)

nop

jalr t9

nop

lw gp, 0x18(fp)

lui v0, 0x41

lw v0, 0x48e4(v0)

nop

sw v0, 0x190(fp)

lw v0, 0x190(fp)

nop

beqz v0, 0x403a24

nop

addiu v0, zero, 1

--

addu v0, v0, v1

lb v1, 0x14(v0)

addiu v0, zero, 0x2e

bne v1, v0, 0x4037f0

nop

lw v0, 0x30(fp)

addiu v1, fp, 0x20

addu v0, v1, v0

sb zero, 0x14(v0)

b 0x403810

nop

lw v0, 0x30(fp)

nop

addiu v0, v0, -1

sw v0, 0x30(fp)

lw v0, 0x30(fp)

nop

bgtz v0, 0x4037bc

nop

addiu v0, fp, 0x98

addiu v1, fp, 0x34

move a0, v0

lui v0, 0x40

addiu a1, v0, 0x4370

move a2, v1

lw t9, -sym.imp.sprintf(gp)

nop

jalr t9

nop

lw gp, 0x18(fp)

lui v0, 0x41

lw v0, 0x48e0(v0)

nop

beqz v0, 0x40387c

nop

addiu v0, fp, 0x98

lui v1, 0x40

addiu a0, v1, 0x4378

move a1, v0

lw a2, -obj.IPTMP3(gp)

lw t9, -sym.imp.printf(gp)

nop

jalr t9

nop

lw gp, 0x18(fp)

nop

--

addu v0, v0, v1

lb v1, 0x14(v0)

addiu v0, zero, 0x2e

bne v1, v0, 0x403bb0

nop

lw v0, 0x30(fp)

addiu v1, fp, 0x20

addu v0, v1, v0

sb zero, 0x14(v0)

b 0x403bd0

nop

lw v0, 0x30(fp)

nop

addiu v0, v0, -1

sw v0, 0x30(fp)

lw v0, 0x30(fp)

nop

bgtz v0, 0x403b7c

nop

addiu v0, fp, 0x98

addiu v1, fp, 0x34

move a0, v0

lui v0, 0x40

addiu a1, v0, 0x4370

move a2, v1

lw t9, -sym.imp.sprintf(gp)

nop

jalr t9

nop

lw gp, 0x18(fp)

lui v0, 0x41

lw v0, 0x48e0(v0)

nop

beqz v0, 0x403c3c

nop

addiu v0, fp, 0x98

lui v1, 0x40

addiu a0, v1, 0x4378

move a1, v0

lw a2, -obj.IPTMP3(gp)

lw t9, -sym.imp.printf(gp)

nop

jalr t9

nop

lw gp, 0x18(fp)

nop

--

lw t9, -sym.imp.printf(gp)

nop

jalr t9

nop

lw gp, 0x18(fp)

lw v0, 0x24(fp)

nop

sw v0, 0x1a0(fp)

lw v0, 0x1a0(fp)

nop

bgez v0, 0x403eb0

nop

lw v1, 0x1a0(fp)

nop

addiu v1, v1, 0x3ff

sw v1, 0x1a0(fp)

lw v1, 0x1a0(fp)

nop

sra v0, v1, 0xa

move v1, v0

addiu v0, fp, 0xfc

move a0, v0

lui v0, 0x40

addiu a1, v0, 0x43cc

move a2, v1

lw t9, -sym.imp.sprintf(gp)

nop

jalr t9

nop

lw gp, 0x18(fp)

lw v0, 0x24(fp)

nop

sw v0, 0x1a4(fp)

lw v0, 0x1a4(fp)

nop

bgez v0, 0x403f14

nop

lw v1, 0x1a4(fp)

nop

addiu v1, v1, 0x3ff

sw v1, 0x1a4(fp)

lw v1, 0x1a4(fp)

nop

sra v0, v1, 0xa

move v1, v0

addiu v0, fp, 0xfc

move a0, v0

lui v0, 0x40

addiu a1, v0, 0x43fc

move a2, v1

lw t9, -sym.imp.sprintf(gp)

nop

jalr t9

nop

lw gp, 0x18(fp)

addiu v0, fp, 0xfc

move a0, v0

lw t9, -sym.imp.system(gp)

nop

jalr t9

nop

lw gp, 0x18(fp)

move v0, zero

move sp, fp

lw ra, 0x1ac(sp)

lw fp, 0x1a8(sp)

addiu sp, sp, 0x1b0

jr ra

nop

nop

nop

[*] Function sprintf used 6 times ubcom