[*] Binary protection state of xmldb

  	RELRO          CANARY            NX           PIE          RPATH        RUNPATH      SYMBOLS      

  	No RELRO       No Canary found   NX disabled  No PIE       No RPATH     No RUNPATH   No Symbols

[*] Function system tear down of xmldb

sw v0, (s0)

addiu v0, zero, -1

lw ra, 0x24(sp)

lw s2, 0x20(sp)

lw s1, 0x1c(sp)

lw s0, 0x18(sp)

jr ra

addiu sp, sp, 0x28

lui gp, 0x44

addiu sp, sp, -0x28

addiu gp, gp, -0x4690

sw ra, 0x24(sp)

sw s1, 0x20(sp)

sw s0, 0x1c(sp)

sw gp, 0x10(sp)

addiu v1, zero, 0x28

mult a0, v1

lui v0, 0x43

mflo v1

addiu v0, v0, 0x43f0

addu s0, v0, v1

lw a1, 0x24(s0)

nop

beqz a1, 0x402ce0

move s1, a0

lw t9, -sym.lxmldbc_system(gp)

lui a0, 0x42

jalr t9

addiu a0, a0, 0x1cfc

lw gp, 0x10(sp)

lw a0, 0x24(s0)

lw t9, -sym.imp.free(gp)

nop

jalr t9

nop

lw gp, 0x10(sp)

addiu a0, zero, 0x28

mult s1, a0

lui v0, 0x43

mflo a0

addiu v0, v0, 0x43f0

lw t9, -sym.imp.memset(gp)

lw ra, 0x24(sp)

lw s1, 0x20(sp)

lw s0, 0x1c(sp)

addu a0, v0, a0

--

sw a0, 4(s0)

move a0, s0

move a1, s3

addiu a2, zero, 1

jal sym.xmldb_find_node

addiu a3, zero, 1

lw gp, 0x10(sp)

beqz v0, 0x405f88

move s0, v0

lw a0, 0x20(v0)

nop

beqz a0, 0x405f1c

lui a1, 0x42

lw t9, -sym.imp.free(gp)

nop

jalr t9

nop

lui a1, 0x42

sw zero, 0x20(s0)

addiu a1, a1, 0x2550

jal 0x404aa4

move a0, s0

lw gp, 0x10(sp)

beqz v0, 0x405f58

lui a0, 0x42

lw t9, -sym.lxmldbc_system(gp)

addiu a0, a0, 0x2554

move a1, v0

jalr t9

move a2, s2

lw gp, 0x10(sp)

b 0x405f88

nop

beqz s2, 0x405f88

nop

lb v0, (s2)

nop

beqz v0, 0x405f88

nop

lw t9, -sym.imp.strdup(gp)

nop

jalr t9

move a0, s2

lw gp, 0x10(sp)

sw v0, 0x20(s0)

lw ra, 0x2c(sp)

--

lw t9, -sym.sobj_add_string(gp)

lui a1, 0x42

addiu a1, a1, 0x2aec

jalr t9

move a0, s3

lw gp, 0x18(sp)

nop

lw t9, -sym.sobj_get_string(gp)

nop

jalr t9

move a0, s2

lw gp, 0x18(sp)

move a1, v0

lw t9, -sym.sobj_add_string(gp)

nop

jalr t9

move a0, s3

lw gp, 0x18(sp)

nop

lw t9, -sym.sobj_get_string(gp)

nop

jalr t9

move a0, s3

lw gp, 0x18(sp)

nop

lw t9, -sym.imp.system(gp)

nop

jalr t9

move a0, v0

lw gp, 0x18(sp)

nop

lw t9, -sym.sobj_del(gp)

nop

jalr t9

move a0, s2

lw gp, 0x18(sp)

beqz s3, 0x40f1b0

nop

lw t9, -sym.sobj_del(gp)

nop

jalr t9

move a0, s3

lw gp, 0x18(sp)

lw ra, 0x3c(sp)

move v0, s0

lw s5, 0x38(sp)

--

lw s2, 0x2c(sp)

lw s1, 0x28(sp)

lw s0, 0x24(sp)

jr ra

addiu sp, sp, 0x38

lui gp, 0x44

addiu sp, sp, -0x428

addiu gp, gp, -0x4690

sw ra, 0x424(sp)

sw s0, 0x420(sp)

sw gp, 0x10(sp)

addiu v0, sp, 0x42c

addiu s0, sp, 0x1c

lw t9, -sym.imp.vsnprintf(gp)

sw a1, 0x42c(sp)

sw a2, 0x430(sp)

sw a3, 0x434(sp)

move a2, a0

move a3, v0

move a0, s0

sw v0, 0x18(sp)

jalr t9

addiu a1, zero, 0x400

lw gp, 0x10(sp)

nop

lw t9, -sym.imp.system(gp)

nop

jalr t9

move a0, s0

lw ra, 0x424(sp)

lw gp, 0x10(sp)

lw s0, 0x420(sp)

jr ra

addiu sp, sp, 0x428

lui gp, 0x44

addiu sp, sp, -0x438

addiu gp, gp, -0x4690

sw ra, 0x434(sp)

sw s4, 0x430(sp)

sw s3, 0x42c(sp)

sw s2, 0x428(sp)

sw s1, 0x424(sp)

sw s0, 0x420(sp)

sw gp, 0x10(sp)

lw t9, -sym.imp.vsnprintf(gp)

addiu v0, sp, 0x444

[*] Function system used 4 times xmldb