[*] Binary protection state of tc
RELRO CANARY NX PIE RPATH RUNPATH SYMBOLS
No RELRO No Canary found NX disabled No PIE No RPATH No RUNPATH Symbols
[*] Function strcpy tear down of tc
lw t9, -sym.imp.malloc(gp)
nop
jalr t9
addiu a0, zero, 0x1c
lw gp, 0x18(sp)
beqz v0, 0x403c58
move s0, v0
lw t9, -sym.imp.strlen(gp)
move a0, s1
sw zero, (v0)
sw zero, 4(v0)
sw zero, 8(v0)
sw zero, 0xc(v0)
sw zero, 0x10(v0)
sw zero, 0x14(v0)
jalr t9
sw zero, 0x18(v0)
lw gp, 0x18(sp)
nop
lw t9, -sym.imp.malloc(gp)
nop
jalr t9
addiu a0, v0, 1
lw gp, 0x18(sp)
move a0, v0
lw t9, -sym.imp.strcpy(gp)
nop
jalr t9
move a1, s1
sw v0, 4(s0)
lui v1, 0x40
lui v0, 0x40
addiu v0, v0, 0x30e8
addiu v1, v1, 0x3098
lw gp, 0x18(sp)
sw v0, 8(s0)
sw v1, 0xc(s0)
lw v0, 0x15d0(s3)
lw ra, 0x134(sp)
sw v0, (s0)
lw s2, 0x12c(sp)
sw s0, 0x15d0(s3)
move v0, s0
lw s3, 0x130(sp)
lw s1, 0x128(sp)
lw s0, 0x124(sp)
--
lui v1, 0x45
lw a0, 0x1650(v1)
jal sym.ematch_restart
addiu s5, zero, 1
lw gp, 0x10(sp)
b 0x4118f8
lui t1, 0x45
lw v0, -0x7dac(gp)
lw t9, -sym.imp.fwrite(gp)
lw a3, (v0)
lui a0, 0x43
addiu a0, a0, 0x7c74
jalr t9
addiu a2, zero, 0x2a
lw gp, 0x10(sp)
b 0x410fb4
addiu v0, zero, 0x102
lw v0, 0x1660(a0)
lui a1, 0x45
lw v1, 0x165c(a1)
sll v0, v0, 2
addu v1, v1, v0
lw a1, (v1)
lw t1, 0x20(sp)
lw a0, 4(a1)
lw t9, -sym.imp.strcpy(gp)
addu a0, a0, t1
jalr t9
move a1, s3
lw gp, 0x10(sp)
nop
lw v1, -obj.ematch_argv(gp)
lw t9, -sym.imp.strlen(gp)
lw v0, (v1)
nop
lw a0, (v0)
jalr t9
nop
lui a0, 0x45
lw v1, 0x1660(a0)
lui a1, 0x45
lw a0, 0x165c(a1)
sll v1, v1, 2
addu a0, a0, v1
lw a1, (a0)
lw t1, 0x20(sp)
--
move a1, s5
lw t9, -sym.imp.memcpy(gp)
move a2, s3
move a0, v0
jalr t9
move s4, v0
lw gp, 0x10(sp)
b 0x42b578
sll v0, s1, 4
lui gp, 0x46
addiu sp, sp, -0x30
addiu gp, gp, -0x6f60
sw ra, 0x2c(sp)
sw s1, 0x28(sp)
sw s0, 0x24(sp)
sw gp, 0x10(sp)
move s0, a0
beqz a0, 0x42b67c
move v0, a1
sw zero, 0x18(sp)
lw a1, 0x2c(a0)
beqz v0, 0x42b694
addiu s1, a1, 0x20
sw v0, 0x54(a0)
lw a0, 0x54(s0)
lw t9, -sym.imp.strcpy(gp)
addiu a1, s0, 4
jalr t9
addiu a0, a0, 2
lw ra, 0x2c(sp)
lw gp, 0x10(sp)
move v0, zero
lw s1, 0x28(sp)
lw s0, 0x24(sp)
jr ra
addiu sp, sp, 0x30
lw ra, 0x2c(sp)
addiu v0, zero, -1
lw s1, 0x28(sp)
lw s0, 0x24(sp)
jr ra
addiu sp, sp, 0x30
lw t9, -sym.imp.calloc(gp)
addiu a0, zero, 1
jalr t9
move a1, s1
--
bnez s0, 0x42c854
nop
lw v0, -0x7fe0(gp)
lw v1, -0x7fe0(gp)
addiu s2, v0, 0x16f4
addiu s3, v1, 0x1734
lw s0, (s2)
nop
bnez s0, 0x42c7c4
nop
b 0x42c824
addiu s2, s2, 4
lw s0, (s0)
nop
beqz s0, 0x42c820
nop
lw t9, -sym.imp.strcmp(gp)
addiu a0, s0, 0x28
jalr t9
move a1, s1
lw gp, 0x10(sp)
bnez v0, 0x42c7b4
move a1, s1
lw v0, 4(s0)
lw a0, -0x7fe0(gp)
lw t9, -sym.imp.strcpy(gp)
sw v0, 0x16d0(s4)
jalr t9
addiu a0, a0, 0x16d4
lw ra, 0x2c(sp)
lw v0, 4(s0)
lw gp, 0x10(sp)
lw s4, 0x28(sp)
lw s3, 0x24(sp)
lw s2, 0x20(sp)
lw s1, 0x1c(sp)
lw s0, 0x18(sp)
jr ra
addiu sp, sp, 0x30
addiu s2, s2, 4
bne s2, s3, 0x42c79c
nop
lw t9, -sym.imp.if_nametoindex(gp)
move a0, s1
lw ra, 0x2c(sp)
lw s4, 0x28(sp)
--
beqz s0, 0x42cbec
nop
lw v0, 4(s0)
nop
bne v0, a0, 0x42cb60
nop
lhu v1, 2(s2)
lw a1, 0x1c(sp)
sw v1, 8(s0)
lw v0, 8(s2)
beqz a1, 0x42cc20
sw v0, 0x10(s0)
lhu v0, (a1)
nop
addiu a2, v0, -4
sltiu v1, a2, 0x15
bnez v1, 0x42cbb8
sw a2, 0xc(s0)
addiu a2, zero, 0x14
lw t9, -sym.imp.memcpy(gp)
addiu a1, a1, 4
jalr t9
addiu a0, s0, 0x14
lw gp, 0x10(sp)
lw a1, 0x24(sp)
lw t9, -sym.imp.strcpy(gp)
addiu a0, s0, 0x28
jalr t9
addiu a1, a1, 4
lw gp, 0x10(sp)
b 0x42cabc
move v0, zero
lw t9, -sym.imp.malloc(gp)
nop
jalr t9
addiu a0, zero, 0x38
lw gp, 0x10(sp)
beqz v0, 0x42cab8
move s0, v0
lw v0, (s1)
lw v1, 4(s2)
sw v0, (s0)
sw v1, 4(s0)
b 0x42cb84
sw s0, (s1)
addiu v0, s0, 0x14
[*] Function strcpy used 5 times tc
