[*] Binary protection state of lld2d
RELRO CANARY NX PIE RPATH RUNPATH SYMBOLS
No RELRO No Canary found NX disabled No PIE No RPATH No RUNPATH No Symbols
[*] Function printf tear down of lld2d
b 0x402904
move v0, zero
lw v0, 0x4c(sp)
sw s0, 4(s1)
addiu v1, v0, -1
sw v0, (s1)
b 0x402904
sltiu v0, v1, 0x7fff
move v0, zero
lw ra, 0xbc(sp)
lw s2, 0xb8(sp)
lw s1, 0xb4(sp)
lw s0, 0xb0(sp)
jr ra
addiu sp, sp, 0xc0
lui gp, 0x42
addiu sp, sp, -0xb0
addiu gp, gp, 0x6c70
sw ra, 0xac(sp)
sw s2, 0xa8(sp)
sw s1, 0xa4(sp)
sw s0, 0xa0(sp)
sw gp, 0x18(sp)
lw v0, -obj.g_helper(gp)
addiu s0, sp, 0x20
lw t9, -sym.imp.sprintf(gp)
move s2, a2
move s1, a1
lw a2, (v0)
lui a1, 0x41
move a3, a0
addiu a1, a1, -0x3268
jalr t9
move a0, s0
lw gp, 0x18(sp)
sw s2, 0x10(sp)
lw t9, -sym.xmldbc_ephp_wb(gp)
move a2, s0
move a3, s1
move a0, zero
jalr t9
move a1, zero
lw ra, 0xac(sp)
lw gp, 0x18(sp)
lw s2, 0xa8(sp)
lw s1, 0xa4(sp)
--
lw t9, -sym.event_add_io(gp)
lw a0, 8(s2)
lw a1, -sym.packetio_recv_handler(gp)
jalr t9
move a2, s4
lw ra, 0x64(sp)
lw gp, 0x10(sp)
lw s4, 0x60(sp)
lw s3, 0x5c(sp)
lw s2, 0x58(sp)
lw s1, 0x54(sp)
lw s0, 0x50(sp)
jr ra
addiu sp, sp, 0x68
lui gp, 0x42
addiu sp, sp, -0xa0
addiu gp, gp, 0x6c70
sw ra, 0x9c(sp)
sw s3, 0x98(sp)
sw s2, 0x94(sp)
sw s1, 0x90(sp)
sw s0, 0x8c(sp)
sw gp, 0x18(sp)
lw v0, -obj.g_Progname(gp)
lw v1, (a0)
lw t9, -sym.imp.snprintf(gp)
lw a3, (v0)
addiu s3, sp, 0x34
lui a2, 0x41
sw v1, 0x10(sp)
addiu a2, a2, -0x2e40
move a0, s3
jalr t9
addiu a1, zero, 0x50
lw gp, 0x18(sp)
move a0, s3
lw t9, -sym.imp.open(gp)
nop
jalr t9
move a1, zero
lw gp, 0x18(sp)
bgez v0, 0x403e48
move s0, v0
lw t9, -sym.imp.__errno_location(gp)
nop
jalr t9
--
addiu a2, zero, 0x1a4
lw gp, 0x18(sp)
bgez v0, 0x403fa4
move s1, v0
lw t9, -sym.imp.__errno_location(gp)
nop
jalr t9
nop
lw gp, 0x18(sp)
lw a0, (v0)
lw t9, -sym.imp.strerror(gp)
nop
jalr t9
nop
lw gp, 0x18(sp)
lui a0, 0x41
lw t9, -sym.die(gp)
b 0x404048
addiu a0, a0, -0x2d28
lw t9, -sym.imp.getpid(gp)
nop
jalr t9
addiu s0, sp, 0x24
lw gp, 0x18(sp)
lui a2, 0x41
lw t9, -sym.imp.snprintf(gp)
addiu a2, a2, -0x2cf4
move a3, v0
addiu a1, zero, 0x10
jalr t9
move a0, s0
lw gp, 0x18(sp)
nop
lw t9, -sym.imp.strlen(gp)
nop
jalr t9
move a0, s0
lw gp, 0x18(sp)
move a1, s0
lw t9, -sym.imp.write(gp)
move a2, v0
jalr t9
move a0, s1
lw gp, 0x18(sp)
bgez v0, 0x404050
nop
--
addiu sp, sp, -0x20
addiu gp, gp, 0x6c70
sw ra, 0x1c(sp)
sw gp, 0x10(sp)
lw t9, -sym.xmalloc(gp)
nop
jalr t9
addiu a0, zero, 0xc
lw gp, 0x10(sp)
lw ra, 0x1c(sp)
lw v1, -obj.g_wl_interface(gp)
addiu sp, sp, 0x20
lw v1, (v1)
nop
sw v1, 4(v0)
addiu v1, zero, -1
jr ra
sw v1, 8(v0)
nop
lui gp, 0x42
addiu sp, sp, -0x20
addiu gp, gp, 0x6c70
sw ra, 0x1c(sp)
sw gp, 0x10(sp)
lw v0, -0x7e38(gp)
lw t9, -sym.imp.fprintf(gp)
lw a0, (v0)
lw v0, -obj.g_Progname(gp)
lui a1, 0x41
lw a2, (v0)
jalr t9
addiu a1, a1, -0x2c20
lw gp, 0x10(sp)
nop
lw t9, -sym.imp.exit(gp)
nop
jalr t9
addiu a0, zero, 2
lui gp, 0x42
addiu sp, sp, -0x28
addiu gp, gp, 0x6c70
sw ra, 0x24(sp)
sw s1, 0x20(sp)
sw s0, 0x1c(sp)
sw gp, 0x10(sp)
addiu v0, zero, 1
--
sw v0, (v1)
move s5, zero
addiu fp, zero, 0x64
addiu s7, zero, 0x74
lw s1, -0x7fc4(gp)
lw s6, -0x7e38(gp)
b 0x404474
addiu s0, zero, 0x63
beq v0, fp, 0x404474
nop
beq v0, s7, 0x404400
move a1, zero
bne v0, s0, 0x404444
nop
lw s5, (s1)
b 0x404474
nop
lw t9, -sym.imp.strtoul(gp)
lw a0, (s1)
jalr t9
move a2, zero
lw gp, 0x10(sp)
bnez v0, 0x404474
move s2, v0
lw v0, -obj.g_Progname(gp)
lw t9, -sym.imp.fprintf(gp)
lw a0, (s6)
lw a2, (v0)
lw a3, (s1)
lui a1, 0x41
jalr t9
addiu a1, a1, -0x29e8
b 0x404464
nop
lw v1, -obj.isConfTest(gp)
nop
lw v0, (v1)
nop
beqz v0, 0x404464
nop
b 0x404474
addiu s2, zero, 0x12
jal 0x4040d0
nop
lw gp, 0x10(sp)
nop
--
jalr t9
addiu a1, a1, -0x29b8
lw gp, 0x10(sp)
bnez v0, 0x4044f8
lui v0, 0x41
lui v0, 0x41
b 0x4044fc
addiu v1, v0, -0x31cc
addiu v1, v0, -0x29b4
lw v0, -obj.g_Progname(gp)
lw t9, -sym.imp.strstr(gp)
lw a0, (v0)
lw v0, -obj.g_interface(gp)
lui a1, 0x41
sw v1, (v0)
jalr t9
addiu a1, a1, -0x29b8
lw gp, 0x10(sp)
bnez v0, 0x404534
lui v0, 0x41
lui v0, 0x41
b 0x404538
addiu v1, v0, -0x29ac
addiu v1, v0, -0x29b4
lw v0, -obj.g_Progname(gp)
lw t9, -sym.imp.printf(gp)
lw a1, (v0)
lw v0, -obj.g_interface(gp)
lui a0, 0x41
lw a2, (v0)
lw v0, -obj.g_wl_interface(gp)
addiu a0, a0, -0x29a4
jalr t9
sw v1, (v0)
b 0x4045a4
nop
lw v1, (s1)
nop
slt v0, v1, s4
bnez v0, 0x4045b0
sll v0, v1, 2
lw v0, -0x7e38(gp)
lw t9, -sym.imp.fprintf(gp)
lw a0, (v0)
lw v0, -obj.g_Progname(gp)
lui a1, 0x41
lw a2, (v0)
jalr t9
addiu a1, a1, -0x2974
jal 0x4040d0
nop
lw gp, 0x10(sp)
b 0x404610
nop
addu v0, s3, v0
lw t9, -sym.imp.strdup(gp)
lw a0, (v0)
lw s0, -obj.g_wl_interface(gp)
jalr t9
nop
lw v1, (s1)
lw gp, 0x10(sp)
move a0, v0
--
lui gp, 0x42
addiu sp, sp, -0x30
addiu gp, gp, 0x6c70
sw ra, 0x2c(sp)
sw s1, 0x28(sp)
sw s0, 0x24(sp)
sw gp, 0x10(sp)
lui v0, 0x42
lw v0, -0xeb0(v0)
addiu v1, sp, 0x34
sw a1, 0x34(sp)
sw a2, 0x38(sp)
sw a3, 0x3c(sp)
move s1, a0
beqz v0, 0x405524
sw v1, 0x18(sp)
lw t9, -sym.imp.vsyslog(gp)
move a1, a0
move a2, v1
jalr t9
addiu a0, zero, 3
b 0x40555c
nop
lw s0, -0x7e38(gp)
lw v0, -obj.g_Progname(gp)
lw t9, -sym.imp.fprintf(gp)
lw a0, (s0)
lw a2, (v0)
lui a1, 0x41
jalr t9
addiu a1, a1, -0x2814
lw gp, 0x10(sp)
lw a0, (s0)
lw t9, -sym.imp.vfprintf(gp)
lw a2, 0x18(sp)
jalr t9
move a1, s1
lw gp, 0x10(sp)
nop
lw t9, -sym.imp.exit(gp)
nop
jalr t9
addiu a0, zero, 1
lui gp, 0x42
addiu sp, sp, -0x20
addiu gp, gp, 0x6c70
sw ra, 0x1c(sp)
sw s0, 0x18(sp)
sw gp, 0x10(sp)
lw t9, -sym.imp.malloc(gp)
nop
jalr t9
move s0, a0
lw gp, 0x10(sp)
--
lw v0, -obj.g_band(gp)
addiu v1, zero, 0x2710
jr ra
sw v1, (v0)
lui gp, 0x42
addiu gp, gp, 0x6c70
lw v1, -obj.g_band(gp)
nop
lw v0, 4(v1)
nop
addiu a2, v0, 1
beqz a0, 0x4068b4
sw a2, 4(v1)
addiu v0, zero, 1
sw v0, 8(v1)
lw v0, -obj.g_trace_flags(gp)
nop
lw v0, (v0)
nop
andi v0, v0, 1
beqz v0, 0x4068ec
lui a0, 0x41
lw v0, -obj.g_band(gp)
nop
lw a1, (v0)
lw t9, -sym.dbgprintf(gp)
nop
jr t9
addiu a0, a0, -0x1f20
jr ra
nop
lui gp, 0x42
addiu sp, sp, -0x28
addiu gp, gp, 0x6c70
sw ra, 0x24(sp)
sw s0, 0x20(sp)
sw gp, 0x10(sp)
lw v0, -obj.g_band(gp)
lw t9, -sym.random_uniform(gp)
lw a0, (v0)
jalr t9
nop
lw gp, 0x10(sp)
move s0, v0
lw v0, -obj.g_trace_flags(gp)
nop
lw v0, (v0)
nop
andi v0, v0, 1
beqz v0, 0x406960
sltiu v0, s0, 0x2d
lw t9, -sym.dbgprintf(gp)
lui a0, 0x41
addiu a0, a0, -0x1f04
jalr t9
move a1, s0
lw gp, 0x10(sp)
sltiu v0, s0, 0x2d
beqz v0, 0x406a64
nop
lw v0, -obj.g_hello_timer(gp)
nop
lw v0, (v0)
nop
bnez v0, 0x406a64
addiu a0, sp, 0x18
lw t9, -sym.imp.gettimeofday(gp)
nop
jalr t9
move a1, zero
addiu v0, zero, 0xa
mult s0, v0
--
lw v1, 0x1c(sp)
mflo v0
b 0x4069f4
addu v1, v0, v1
addu v1, v1, a1
slt v0, v1, a3
move a2, a0
beqz v0, 0x4069f0
addiu a0, a0, 1
lw t9, -sym.event_add(gp)
lw a1, -sym.state_hello_delay_timeout(gp)
sw a2, 0x18(sp)
sw v1, 0x1c(sp)
addiu a0, sp, 0x18
jalr t9
move a2, zero
lw gp, 0x10(sp)
nop
lw v1, -obj.g_trace_flags(gp)
lw a0, -obj.g_hello_timer(gp)
lw v1, (v1)
nop
andi v1, v1, 1
beqz v1, 0x406a98
sw v0, (a0)
lw t9, -sym.dbgprintf(gp)
lw a1, 0x18(sp)
lw a2, 0x1c(sp)
lui a0, 0x41
jalr t9
addiu a0, a0, -0x1ee8
b 0x406a94
nop
lw v0, -obj.g_trace_flags(gp)
nop
lw v0, (v0)
nop
andi v0, v0, 1
beqz v0, 0x406a98
nop
lui a0, 0x41
lw t9, -sym.dbgprintf(gp)
nop
jalr t9
addiu a0, a0, -0x1ecc
lw gp, 0x10(sp)
lw ra, 0x24(sp)
lw s0, 0x20(sp)
jr ra
addiu sp, sp, 0x28
lui gp, 0x42
addiu sp, sp, -0x28
addiu gp, gp, 0x6c70
sw ra, 0x24(sp)
sw gp, 0x10(sp)
lw v0, -obj.g_band(gp)
addiu a2, zero, 0xa
lw v1, (v0)
lw a3, 4(v0)
addiu a1, zero, 3
mult a3, v1
lui a0, 4
--
ori v0, v1, 0x4241
sltu v0, a0, v0
bnez v0, 0x406b78
nop
ori a0, v1, 0x4240
lw v1, -obj.g_band(gp)
nop
lw v0, 8(v1)
nop
beqz v0, 0x406bac
sw a0, (v1)
sltiu v0, a0, 0x1388
bnez v0, 0x406ba8
sll v0, a0, 1
sltiu v0, a0, 0x2710
beqz v0, 0x406bac
addiu v0, zero, 0x2710
sw v0, (v1)
lw v0, -obj.g_trace_flags(gp)
lw a1, -obj.g_band(gp)
lw v0, (v0)
nop
andi v0, v0, 1
beqz v0, 0x406be8
sw zero, 8(a1)
lw t9, -sym.dbgprintf(gp)
lw a1, (a1)
lui a0, 0x41
addiu a0, a0, -0x1eac
jalr t9
move a2, a3
lw gp, 0x10(sp)
nop
lw v0, -obj.g_block_timer(gp)
nop
lw v0, (v0)
nop
bnez v0, 0x406c80
nop
lw t9, -sym.imp.gettimeofday(gp)
addiu a0, sp, 0x18
jalr t9
move a1, zero
lui v0, 4
lw v1, 0x1c(sp)
ori v0, v0, 0x93e0
--
sw v0, (v1)
lw t9, -sym.warn(gp)
lui a0, 0x41
jalr t9
addiu a0, a0, -0x1e90
lw gp, 0x10(sp)
lw ra, 0x24(sp)
nop
jr ra
addiu sp, sp, 0x28
lui gp, 0x42
addiu sp, sp, -0x28
addiu gp, gp, 0x6c70
sw ra, 0x24(sp)
sw gp, 0x10(sp)
lw v0, -obj.g_trace_flags(gp)
lw a0, -obj.g_band(gp)
lw v1, (v0)
addiu v0, zero, 0x2710
sw v0, (a0)
andi v1, v1, 1
addiu v0, zero, 0x12c
sw v0, 4(a0)
beqz v1, 0x406d00
sw zero, 8(a0)
lw t9, -sym.dbgprintf(gp)
lui a0, 0x41
addiu a0, a0, -0x1e64
addiu a1, zero, 0x2710
jalr t9
addiu a2, zero, 0x12c
lw gp, 0x10(sp)
nop
lw t9, -sym.imp.gettimeofday(gp)
addiu a0, sp, 0x18
jalr t9
move a1, zero
lui v0, 4
lw v1, 0x1c(sp)
ori v0, v0, 0x93e0
addu v1, v1, v0
lui v0, 0xf
ori a3, v0, 0x4241
lui v0, 0xfff0
lw gp, 0x10(sp)
lw a0, 0x18(sp)
--
addiu gp, gp, 0x6c70
sw ra, 0x94(sp)
sw s1, 0x90(sp)
sw s0, 0x8c(sp)
sw gp, 0x10(sp)
lw t9, -sym.imp.socket(gp)
move s1, a0
addiu a1, zero, 2
addiu a0, zero, 1
jalr t9
move a2, zero
lw gp, 0x10(sp)
bgez v0, 0x40b474
move s0, v0
b 0x40b4f8
addiu s0, zero, -1
lw t9, -sym.imp.fcntl(gp)
move a0, v0
addiu a1, zero, 2
jalr t9
addiu a2, zero, 1
lw gp, 0x10(sp)
bnez s1, 0x40b498
lui v0, 0x41
addiu s1, v0, -0x1750
lw t9, -sym.imp.snprintf(gp)
addiu v0, zero, 1
lui a2, 0x41
addiu a2, a2, -0x173c
move a3, s1
addiu a0, sp, 0x1a
addiu a1, zero, 0x6c
jalr t9
sh v0, 0x18(sp)
lw gp, 0x10(sp)
move a0, s0
lw t9, -sym.imp.connect(gp)
addiu a1, sp, 0x18
jalr t9
addiu a2, zero, 0x6e
lw gp, 0x10(sp)
bgez v0, 0x40b4f8
nop
lw t9, -sym.imp.close(gp)
nop
jalr t9
--
jalr t9
move s0, a1
addiu v0, v0, 1
move a0, s1
move a2, s0
move a3, s2
addiu a1, zero, 0xc
jal 0x40b5ac
sw v0, 0x10(sp)
lw ra, 0x2c(sp)
lw gp, 0x18(sp)
lw s2, 0x28(sp)
lw s1, 0x24(sp)
lw s0, 0x20(sp)
jr ra
addiu sp, sp, 0x30
lui gp, 0x42
addiu sp, sp, -0x230
addiu gp, gp, 0x6c70
sw ra, 0x22c(sp)
sw s2, 0x228(sp)
sw s1, 0x224(sp)
sw s0, 0x220(sp)
sw gp, 0x18(sp)
addiu s0, sp, 0x20
lw t9, -sym.imp.snprintf(gp)
move v0, a2
lui a2, 0x41
sw a3, 0x10(sp)
addiu a2, a2, -0x1738
move a3, v0
move s1, a0
move s2, a1
move a0, s0
jalr t9
addiu a1, zero, 0x1ff
lw gp, 0x18(sp)
move a0, s0
lw t9, -sym.imp.strlen(gp)
nop
jalr t9
sb zero, 0x21f(sp)
addiu v0, v0, 1
move a0, s1
move a2, s2
move a3, s0
addiu a1, zero, 0xb
jal 0x40b5ac
sw v0, 0x10(sp)
lw ra, 0x22c(sp)
lw gp, 0x18(sp)
lw s2, 0x228(sp)
lw s1, 0x224(sp)
lw s0, 0x220(sp)
jr ra
addiu sp, sp, 0x230
lui gp, 0x42
addiu sp, sp, -0x230
addiu gp, gp, 0x6c70
sw ra, 0x22c(sp)
sw s2, 0x228(sp)
sw s1, 0x224(sp)
sw s0, 0x220(sp)
sw gp, 0x18(sp)
addiu s0, sp, 0x20
lw t9, -sym.imp.snprintf(gp)
move v0, a2
lui a2, 0x41
sw a3, 0x10(sp)
addiu a2, a2, -0x1738
move a3, v0
move s1, a0
move s2, a1
move a0, s0
jalr t9
addiu a1, zero, 0x1ff
lw gp, 0x18(sp)
move a0, s0
lw t9, -sym.imp.strlen(gp)
nop
jalr t9
sb zero, 0x21f(sp)
addiu v0, v0, 1
move a0, s1
move a2, s2
move a3, s0
--
move s3, a3
addiu v0, v0, 1
move a0, s1
move a2, s0
move a3, s2
addiu a1, zero, 1
sw s3, 0x14(sp)
jal 0x40bea4
sw v0, 0x10(sp)
lw ra, 0x34(sp)
lw gp, 0x18(sp)
lw s3, 0x30(sp)
lw s2, 0x2c(sp)
lw s1, 0x28(sp)
lw s0, 0x24(sp)
jr ra
addiu sp, sp, 0x38
lui gp, 0x42
addiu sp, sp, -0x428
addiu gp, gp, 0x6c70
sw ra, 0x424(sp)
sw s0, 0x420(sp)
sw gp, 0x10(sp)
addiu v0, sp, 0x42c
addiu s0, sp, 0x1c
lw t9, -sym.imp.vsnprintf(gp)
sw a1, 0x42c(sp)
sw a2, 0x430(sp)
sw a3, 0x434(sp)
move a2, a0
move a3, v0
move a0, s0
sw v0, 0x18(sp)
jalr t9
addiu a1, zero, 0x400
lw gp, 0x10(sp)
nop
lw t9, -sym.imp.system(gp)
nop
jalr t9
move a0, s0
lw ra, 0x424(sp)
lw gp, 0x10(sp)
lw s0, 0x420(sp)
jr ra
addiu sp, sp, 0x428
lui gp, 0x42
addiu sp, sp, -0x438
addiu gp, gp, 0x6c70
sw ra, 0x434(sp)
sw s4, 0x430(sp)
sw s3, 0x42c(sp)
sw s2, 0x428(sp)
sw s1, 0x424(sp)
sw s0, 0x420(sp)
sw gp, 0x10(sp)
lw t9, -sym.imp.vsnprintf(gp)
addiu v0, sp, 0x444
addiu s0, sp, 0x1c
sw a3, 0x444(sp)
move s2, a0
move a3, v0
move a0, s0
move s3, a1
sw v0, 0x18(sp)
jalr t9
addiu a1, zero, 0x400
lw gp, 0x10(sp)
lui a1, 0x41
lw t9, -sym.imp.popen(gp)
move a0, s0
jalr t9
addiu a1, a1, -0x3088
lw gp, 0x10(sp)
beqz v0, 0x40c27c
move s1, v0
addiu s3, s3, -1
[*] Function printf used 20 times lld2d
