[*] Binary protection state of xmldb

  	RELRO          CANARY            NX           PIE          RPATH        RUNPATH      SYMBOLS      

  	No RELRO       No Canary found   NX disabled  No PIE       No RPATH     No RUNPATH   No Symbols

[*] Function strcpy tear down of xmldb

nop

lui s2, 0x43

lw a0, 0x490c(s2)

nop

beqz a0, 0x404744

lui v0, 0x43

lw t9, -sym.imp.strlen(gp)

nop

jalr t9

lui s1, 0x43

lw gp, 0x10(sp)

lw a0, 0x4910(s1)

lw t9, -sym.imp.strlen(gp)

nop

jalr t9

move s0, v0

lw gp, 0x10(sp)

addu s0, s0, v0

lw t9, -sym.imp.malloc(gp)

nop

jalr t9

addiu a0, s0, 2

lw gp, 0x10(sp)

beqz v0, 0x404740

move s0, v0

lw t9, -sym.imp.strcpy(gp)

lw a1, 0x4910(s1)

jalr t9

move a0, v0

lw gp, 0x10(sp)

lw a1, 0x490c(s2)

lw t9, -sym.imp.strcat(gp)

nop

jalr t9

move a0, s0

lw gp, 0x10(sp)

lui v0, 0x43

lw a0, 0x48fc(v0)

lw v0, -0x7e28(gp)

lw t9, -sym.xmldbc_ephp(gp)

lw a3, (v0)

move a2, s0

jalr t9

move a1, zero

lw gp, 0x10(sp)

move a0, s0

--

mult v1, s0

lw t9, -sym.imp.sprintf(gp)

mflo v0

nop

nop

mult s1, a3

move a0, s6

mflo v1

nop

nop

multu a3, s0

addu v0, v0, v1

mfhi a3

mflo a2

b 0x40dbac

addu a3, v0, a3

bgtz v1, 0x40daf0

nop

bnez v1, 0x40dafc

nop

beqz a3, 0x40dafc

nop

lw t9, -sym.__divdi3(gp)

b 0x40db88

move a2, a3

lw t9, -sym.imp.strcpy(gp)

lui a1, 0x42

move a0, s6

jalr t9

addiu a1, a1, 0x2950

lw gp, 0x18(sp)

lw v0, 0xc8(sp)

lw t9, -sym.client_printf(gp)

lw a0, (v0)

lui a2, 0x42

lui a1, 0x42

addiu a2, a2, 0x25d0

jalr t9

addiu a1, a1, 0x25ac

lw gp, 0x18(sp)

lw v1, 0xc8(sp)

lw t9, -sym.client_printf(gp)

lw a0, (v1)

lui a1, 0x42

jalr t9

addiu a1, a1, 0x2964

--

lw gp, 0x18(sp)

bltz v0, 0x40ef08

addiu s0, zero, -1

lw t9, -sym.sobj_get_string(gp)

nop

jalr t9

move a0, s4

lw gp, 0x18(sp)

lui a1, 0x42

lw t9, -sym.sobj_strcmp(gp)

addiu a1, a1, 0x2aa4

move a0, s2

jalr t9

move s0, v0

lw gp, 0x18(sp)

bnez v0, 0x40ee18

lui a1, 0x42

lw t9, -sym.imp.strlen(gp)

nop

jalr t9

move a0, s0

sltiu v0, v0, 0x40

lw gp, 0x18(sp)

beqz v0, 0x40ef68

lui a0, 0x43

lw t9, -sym.imp.strcpy(gp)

addiu a0, a0, 0x35a0

jalr t9

move a1, s0

b 0x40eecc

nop

lw t9, -sym.sobj_strcmp(gp)

addiu a1, a1, 0x2ae4

jalr t9

move a0, s2

lw gp, 0x18(sp)

bnez v0, 0x40ee40

move a1, s0

move a2, s5

b 0x40eec4

move a0, zero

lw t9, -sym.sobj_strcmp(gp)

lui a1, 0x42

addiu a1, a1, 0x2ab0

jalr t9

move a0, s2

--

move s2, a1

beqz a1, 0x41e408

move v1, zero

lw t9, -sym.imp.strlen(gp)

nop

jalr t9

move a0, a1

lw gp, 0x10(sp)

bnez v0, 0x41e3bc

move s1, v0

b 0x41e408

move v1, zero

jal 0x41e2c4

nop

lw gp, 0x10(sp)

bltz v0, 0x41e408

addiu v1, zero, -1

lw v1, 0x10(s0)

lw v0, 0xc(s0)

nop

subu v0, v0, v1

sltu v0, v0, s1

bnez v0, 0x41e3a8

move a0, s0

lw a0, 0x14(s0)

lw t9, -sym.imp.strcpy(gp)

addu a0, a0, v1

jalr t9

move a1, s2

lw v0, 0x10(s0)

lw gp, 0x10(sp)

addu v0, v0, s1

move v1, zero

b 0x41e408

sw v0, 0x10(s0)

addiu v1, zero, -1

lw ra, 0x24(sp)

move v0, v1

lw s2, 0x20(sp)

lw s1, 0x1c(sp)

lw s0, 0x18(sp)

jr ra

addiu sp, sp, 0x28

bnez a0, 0x41e434

addiu v0, zero, -1

jr ra

[*] Function strcpy used 4 times xmldb