[*] Binary protection state of cgibin
RELRO CANARY NX PIE RPATH RUNPATH SYMBOLS
No RELRO No Canary found NX disabled No PIE No RPATH No RUNPATH No Symbols
[*] Function system tear down of cgibin
jalr t9
nop
lw gp, 0x10(sp)
nop
lw t9, -sym.imp.ferror(gp)
bnez v0, 0x40632c
move a0, s3
jalr t9
nop
lw gp, 0x10(sp)
move a0, s5
lw t9, -sym.imp.fread(gp)
addiu a1, zero, 1
move a3, s3
beqz v0, 0x406298
sltiu v1, s0, 0x401
beqz s2, 0x406348
nop
lw t9, -sym.imp.fclose(gp)
nop
jalr t9
move a0, s2
lw gp, 0x10(sp)
beqz fp, 0x406380
lui a0, 0x42
lw t9, -sym.imp.system(gp)
nop
jalr t9
addiu a0, a0, -0x1e84
lw gp, 0x10(sp)
lui a0, 0x42
lw t9, -sym.imp.unlink(gp)
nop
jalr t9
addiu a0, a0, -0x1e98
lw gp, 0x10(sp)
addiu s4, s4, 1
lw t9, -sym.imp.fclose(gp)
nop
jalr t9
move a0, s3
lw gp, 0x10(sp)
addiu s2, sp, 0x28
lw t9, -sym.imp.sprintf(gp)
lui a1, 0x42
addiu a1, a1, -0x1e60
--
lw gp, 0x18(sp)
nop
lw t9, -sym.sobj_get_string(gp)
nop
jalr t9
move a0, s6
lw gp, 0x18(sp)
lui a2, 0x42
lui a3, 0x42
lw t9, -sym.cgibin_print_http_resp(gp)
sw s7, 0x10(sp)
sw v0, 0x14(sp)
move a0, fp
addiu a2, a2, -0x1fe4
addiu a3, a3, -0x1d20
jalr t9
move a1, s5
b 0x4070b0
nop
lw t9, -sym.sobj_free(gp)
nop
jalr t9
move a0, s4
lw gp, 0x18(sp)
lui a0, 0x42
lw t9, -sym.imp.system(gp)
nop
jalr t9
addiu a0, a0, -0x1d04
lw gp, 0x18(sp)
lui s0, 0x42
lw t9, -sym.imp.fopen(gp)
addiu a1, s2, -0x28bc
jalr t9
addiu a0, s0, -0x1ce8
lw gp, 0x18(sp)
beqz v0, 0x406fcc
move s1, v0
lw t9, -sym.imp.stat(gp)
addiu a0, s0, -0x1ce8
jalr t9
addiu a1, sp, 0x108
lw gp, 0x18(sp)
beqz v0, 0x406ff4
lui a0, 0x42
lw t9, -sym.cgibin_print_http_status(gp)
--
lui a1, 0x42
lui a2, 0x42
lw t9, -sym.cgibin_print_http_status(gp)
addiu a1, a1, -0x7e4
addiu a2, a2, -0x1fc8
jalr t9
addiu a0, zero, 0x190
b 0x40942c
addiu s0, zero, -1
lw t9, -sym.imp.printf(gp)
nop
jalr t9
addiu a0, a0, -0x19b4
b 0x40942c
move s0, zero
lw t9, -sym.imp.sprintf(gp)
addiu s0, sp, 0x100
lui a1, 0x42
addiu a1, a1, -0x1918
move a2, v0
addiu a3, sp, 0xf0
jalr t9
move a0, s0
lw gp, 0x10(sp)
move a0, s0
lw t9, -sym.imp.system(gp)
nop
jalr t9
move s0, zero
lw gp, 0x10(sp)
lui a0, 0x42
lw t9, -sym.imp.printf(gp)
addiu a0, a0, -0x18c8
jalr t9
move a1, s1
jal 0x409200
nop
lw ra, 0x20c(sp)
move v0, s0
lw gp, 0x10(sp)
lw s1, 0x208(sp)
lw s0, 0x204(sp)
jr ra
addiu sp, sp, 0x210
lui gp, 0x44
addiu sp, sp, -0x28
--
move a0, zero
jalr t9
move a1, zero
lw gp, 0x18(sp)
lui a1, 0x42
lw t9, -sym.imp.sprintf(gp)
move a0, s4
move a2, s5
addiu a1, a1, -0x14f4
jalr t9
move a3, s7
lw gp, 0x18(sp)
move a0, zero
lw t9, -sym.xmldbc_timer(gp)
move a1, zero
jalr t9
move a2, s4
b 0x40a82c
nop
jalr t9
move a0, s0
lw gp, 0x18(sp)
bnez v0, 0x40a830
nop
lui a0, 0x42
lw t9, -sym.lxmldbc_system(gp)
nop
jalr t9
addiu a0, a0, -0x14c0
lw gp, 0x18(sp)
bnez s1, 0x40a68c
move s0, s1
lw t9, -sym.imp.puts(gp)
lui a0, 0x42
jalr t9
addiu a0, a0, -0x14a8
lw gp, 0x18(sp)
lui a0, 0x42
lw t9, -sym.imp.puts(gp)
nop
jalr t9
addiu a0, a0, -0x147c
lw gp, 0x18(sp)
lui a0, 0x42
lw t9, -sym.imp.puts(gp)
nop
--
lw gp, 0x10(sp)
bnez v0, 0x40ac88
lui a2, 0x42
lw t9, -sym.imp.snprintf(gp)
addiu a2, a2, -0x1398
addiu a0, sp, 0x18
jalr t9
addiu a1, zero, 0x100
b 0x40ac38
nop
lui a0, 0x42
jal 0x40aa80
addiu a0, a0, -0x1388
lui a0, 0x42
addiu a0, a0, -0x1818
jal 0x40aa80
move s2, v0
lui a0, 0x42
addiu a0, a0, -0x1380
jal 0x40aa80
move s0, v0
lw gp, 0x10(sp)
beqz s2, 0x40acd4
move s1, v0
lui a0, 0x42
lw t9, -sym.lxmldbc_system(gp)
addiu a0, a0, -0x1378
b 0x40ad68
move a1, s2
beqz v0, 0x40ad90
nop
beqz s0, 0x40ad90
lui a1, 0x42
lw t9, -sym.imp.strcasecmp(gp)
addiu a1, a1, -0x1360
jalr t9
move a0, s0
lw gp, 0x10(sp)
bnez v0, 0x40ad10
lui a1, 0x42
lui a0, 0x42
lw t9, -sym.lxmldbc_system(gp)
b 0x40ad64
addiu a0, a0, -0x1358
lw t9, -sym.imp.strcasecmp(gp)
addiu a1, a1, -0x1338
jalr t9
move a0, s0
lw gp, 0x10(sp)
bnez v0, 0x40ad3c
lui a1, 0x42
lui a0, 0x42
lw t9, -sym.lxmldbc_system(gp)
b 0x40ad64
addiu a0, a0, -0x1330
lw t9, -sym.imp.strcasecmp(gp)
addiu a1, a1, -0x1314
jalr t9
move a0, s0
lw gp, 0x10(sp)
bnez v0, 0x40ad7c
lui a2, 0x42
lui a0, 0x42
lw t9, -sym.lxmldbc_system(gp)
addiu a0, a0, -0x130c
move a1, s1
jalr t9
nop
lw gp, 0x10(sp)
b 0x40ad90
nop
lw t9, -sym.imp.snprintf(gp)
addiu a2, a2, -0x12ec
move a3, s0
b 0x40ac30
addiu a0, sp, 0x18
lw t9, -sym.imp.memset(gp)
addiu a0, sp, 0x18
move a1, zero
jalr t9
addiu a2, zero, 0x100
lw gp, 0x10(sp)
move s1, zero
lw t9, -sym.imp.puts(gp)
--
move s3, v0
lw gp, 0x18(sp)
lui a0, 0x42
lw t9, -sym.imp.getenv(gp)
addiu a0, a0, -0x1278
jalr t9
move s2, v0
lw gp, 0x18(sp)
beqz s0, 0x40b1a0
move s1, v0
beqz s3, 0x40b1a0
nop
beqz s2, 0x40b1a0
nop
beqz v0, 0x40b1a0
lui a1, 0x42
lw t9, -sym.imp.strncmp(gp)
addiu a1, a1, -0x126c
move a0, s0
jalr t9
addiu a2, zero, 8
lw gp, 0x18(sp)
bnez v0, 0x40b090
lui a1, 0x42
lui a0, 0x42
lw t9, -sym.lxmldbc_system(gp)
sw s1, 0x10(sp)
b 0x40b180
addiu a0, a0, -0x1260
lw t9, -sym.imp.strncmp(gp)
addiu a1, a1, -0x1228
move a0, s0
jalr t9
addiu a2, zero, 0xf
lw gp, 0x18(sp)
bnez v0, 0x40b0c4
lui a1, 0x42
lui a0, 0x42
lw t9, -sym.lxmldbc_system(gp)
sw s1, 0x10(sp)
b 0x40b180
addiu a0, a0, -0x1218
lw t9, -sym.imp.strncmp(gp)
addiu a1, a1, -0x11fc
move a0, s0
jalr t9
addiu a2, zero, 5
lw gp, 0x18(sp)
bnez v0, 0x40b0fc
lui a1, 0x42
lui a0, 0x42
lw t9, -sym.lxmldbc_system(gp)
sw s1, 0x10(sp)
sw s0, 0x14(sp)
b 0x40b180
addiu a0, a0, -0x11f4
lw t9, -sym.imp.strncmp(gp)
addiu a1, a1, -0x11dc
move a0, s0
jalr t9
addiu a2, zero, 4
lw gp, 0x18(sp)
bnez v0, 0x40b1ac
move v0, zero
lw t9, -sym.imp.strstr(gp)
lui a1, 0x42
addiu a1, a1, -0x11d4
jalr t9
move a0, s0
lw gp, 0x18(sp)
beqz v0, 0x40b150
lui a0, 0x42
lw t9, -sym.lxmldbc_system(gp)
sw s1, 0x10(sp)
sw s0, 0x14(sp)
b 0x40b180
addiu a0, a0, -0x11c8
lw t9, -sym.imp.strstr(gp)
lui a1, 0x42
addiu a1, a1, -0x11ac
jalr t9
move a0, s0
lw gp, 0x18(sp)
beqz v0, 0x40b1a8
lui a0, 0x42
lw t9, -sym.lxmldbc_system(gp)
sw s1, 0x10(sp)
sw s0, 0x14(sp)
addiu a0, a0, -0x11a0
lui a1, 0x42
addiu a1, a1, -0x1248
move a2, s3
jalr t9
move a3, s2
lw gp, 0x18(sp)
b 0x40b1ac
move v0, zero
b 0x40b1ac
addiu v0, zero, -1
move v0, zero
lw ra, 0x34(sp)
lw s3, 0x30(sp)
lw s2, 0x2c(sp)
lw s1, 0x28(sp)
lw s0, 0x24(sp)
jr ra
--
jalr t9
sw v0, 0x10(sp)
lw gp, 0x30(sp)
nop
lw t9, -sym.imp.fclose(gp)
nop
jalr t9
move a0, s0
lw gp, 0x30(sp)
nop
lw t9, -sym.imp.getpid(gp)
nop
jalr t9
nop
lw gp, 0x30(sp)
lui a1, 0x42
lw t9, -sym.imp.sprintf(gp)
addiu a1, a1, -0x1064
addiu a2, s1, -0x1088
move a3, s5
addiu a0, s2, 0x1ed0
jalr t9
sw v0, 0x10(sp)
lw gp, 0x30(sp)
nop
lw t9, -sym.imp.system(gp)
nop
jalr t9
addiu a0, s2, 0x1ed0
lw gp, 0x30(sp)
nop
lw t9, -sym.xmldbc_del(gp)
lui a2, 0x43
addiu a2, a2, 0xe90
move a0, zero
jalr t9
move a1, zero
b 0x40bb5c
move s0, zero
addiu s0, zero, -1
jal 0x40b624
move a0, s6
lw gp, 0x30(sp)
lw ra, 0x54(sp)
move v0, s0
lw s6, 0x50(sp)
--
nop
jalr t9
move a0, v0
lw gp, 0x10(sp)
lw ra, 0x1c(sp)
lw t9, -sym.ixmlNode_getNodeValue(gp)
move a0, v0
jr t9
addiu sp, sp, 0x20
lw ra, 0x1c(sp)
move v0, zero
jr ra
addiu sp, sp, 0x20
lui gp, 0x44
addiu sp, sp, -0x30
addiu gp, gp, -0x75f0
sw ra, 0x2c(sp)
sw s4, 0x28(sp)
sw s3, 0x24(sp)
sw s2, 0x20(sp)
sw s1, 0x1c(sp)
sw s0, 0x18(sp)
sw gp, 0x10(sp)
beqz a1, 0x40c734
move s2, a1
lw t9, -sym.lxmldbc_system(gp)
lui a0, 0x42
jalr t9
addiu a0, a0, -0xdf4
lui v0, 0x42
lw gp, 0x10(sp)
addiu s4, v0, -0xdcc
move s1, zero
addiu s3, zero, 5
lw t9, -sym.usock_open(gp)
move a0, zero
jalr t9
move a1, s4
lw gp, 0x10(sp)
addiu s1, s1, 1
lw t9, -sym.imp.sleep(gp)
addiu a0, zero, 1
bnez v0, 0x40c6ec
move s0, v0
jalr t9
nop
--
move a0, s2
lw t9, -sym.imp.strcpy(gp)
nop
jalr t9
move a1, s0
lui a1, 0x42
addiu a1, a1, -0x1d0
jal 0x40eb80
move a0, s2
lw gp, 0x18(sp)
nop
lw t9, -sym.imp.sprintf(gp)
bnez v0, 0x40f684
lui a1, 0x42
move a0, s2
b 0x40f690
addiu a1, a1, -0x1ac
lui a1, 0x42
move a0, s2
addiu a1, a1, -0x190
move a3, s0
jalr t9
move a2, s4
lw gp, 0x18(sp)
nop
lw t9, -sym.imp.system(gp)
nop
jalr t9
addiu a0, sp, 0xa4
lw gp, 0x18(sp)
addiu a1, zero, 2
lw t9, -sym.imp.lockf(gp)
move a2, zero
jalr t9
move a0, s3
lw gp, 0x18(sp)
nop
lw t9, -sym.imp.close(gp)
nop
jalr t9
move a0, s3
lw gp, 0x18(sp)
lui a0, 0x42
lw t9, -sym.imp.unlink(gp)
nop
jalr t9
--
lw s2, 0x2c(sp)
lw s1, 0x28(sp)
lw s0, 0x24(sp)
jr ra
addiu sp, sp, 0x38
lui gp, 0x44
addiu sp, sp, -0x428
addiu gp, gp, -0x75f0
sw ra, 0x424(sp)
sw s0, 0x420(sp)
sw gp, 0x10(sp)
addiu v0, sp, 0x42c
addiu s0, sp, 0x1c
lw t9, -sym.imp.vsnprintf(gp)
sw a1, 0x42c(sp)
sw a2, 0x430(sp)
sw a3, 0x434(sp)
move a2, a0
move a3, v0
move a0, s0
sw v0, 0x18(sp)
jalr t9
addiu a1, zero, 0x400
lw gp, 0x10(sp)
nop
lw t9, -sym.imp.system(gp)
nop
jalr t9
move a0, s0
lw ra, 0x424(sp)
lw gp, 0x10(sp)
lw s0, 0x420(sp)
jr ra
addiu sp, sp, 0x428
lui gp, 0x44
addiu sp, sp, -0x438
addiu gp, gp, -0x75f0
sw ra, 0x434(sp)
sw s4, 0x430(sp)
sw s3, 0x42c(sp)
sw s2, 0x428(sp)
sw s1, 0x424(sp)
sw s0, 0x420(sp)
sw gp, 0x10(sp)
lw t9, -sym.imp.vsnprintf(gp)
addiu v0, sp, 0x444
[*] Function system used 17 times cgibin
