[*] Binary protection state of ip
RELRO CANARY NX PIE RPATH RUNPATH SYMBOLS
No RELRO No Canary found NX disabled No PIE No RPATH No RUNPATH No Symbols
[*] Function sprintf tear down of ip
bnez a2, 0x404a8c
nop
lw a0, 0x2c(sp)
nop
beqz a0, 0x404920
nop
lw t9, -sym.imp.fputs(gp)
addiu a0, a0, 4
jalr t9
move a1, s3
lw gp, 0x18(sp)
lw s1, 0x38(sp)
nop
beqz s1, 0x4049e0
addiu s0, s1, 4
lw v0, -obj._SL_(gp)
lw t9, -sym.imp.fputs(gp)
lw a0, (v0)
jalr t9
move a1, s3
lw a2, 4(s0)
addiu v0, zero, -1
lw gp, 0x18(sp)
beq a2, v0, 0x404bc4
lui v1, 0x43
lw t9, -sym.imp.sprintf(gp)
addiu s2, sp, 0xe8
lui a1, 0x43
addiu a1, a1, 0x1598
jalr t9
move a0, s2
lw gp, 0x18(sp)
lw s0, 4(s1)
addiu v0, zero, -1
beq s0, v0, 0x404ce4
nop
beqz s5, 0x404b6c
nop
lw t9, -sym.imp.strlen(gp)
nop
jalr t9
move a0, s2
lw gp, 0x18(sp)
lui a1, 0x43
lw t9, -sym.imp.sprintf(gp)
addu a0, s2, v0
addiu a1, a1, 0x15c0
jalr t9
move a2, s0
lw gp, 0x18(sp)
nop
lw t9, -sym.imp.fprintf(gp)
lui a1, 0x43
addiu a1, a1, 0x15f0
move a2, s2
jalr t9
move a0, s3
lw gp, 0x18(sp)
nop
lw t9, -sym.imp.fputc(gp)
addiu a0, zero, 0xa
jalr t9
move a1, s3
lw gp, 0x18(sp)
nop
--
addiu a2, zero, 0xb
jalr t9
move a3, s3
lw gp, 0x18(sp)
lbu v1, 2(s4)
b 0x40489c
addiu s5, zero, 1
lw t9, -sym.imp.fwrite(gp)
lui a0, 0x43
sb v0, 2(s4)
addiu a0, a0, 0x1538
addiu a1, zero, 1
addiu a2, zero, 0xa
jalr t9
move a3, s3
lw gp, 0x18(sp)
lbu v1, 2(s4)
b 0x404890
andi v0, v1, 0x20
lw t9, -sym.imp.strlen(gp)
nop
jalr t9
move a0, s2
lw gp, 0x18(sp)
lui a1, 0x43
lw t9, -sym.imp.sprintf(gp)
addu a0, s2, v0
addiu a1, a1, 0x15d8
jalr t9
move a2, s0
lw gp, 0x18(sp)
b 0x4049c0
nop
lw t9, -sym.ll_idx_n2a(gp)
lw a0, 4(s4)
jalr t9
addiu a1, sp, 0xa8
lw gp, 0x18(sp)
lw a0, 0x4c(s2)
b 0x40449c
nop
addiu v0, v1, 0x1584
lw a0, 0x1584(v1)
lhu a3, 0x10(v0)
lw a1, 4(v0)
lw v1, 8(v0)
--
lw t9, -sym.matches(gp)
lw a0, (s0)
lui a1, 0x43
jalr t9
addiu a1, a1, 0xcc4
lw gp, 0x10(sp)
bnez v0, 0x41b638
nop
jal 0x41b120
nop
lw a1, (s0)
lw t9, -sym.duparg2(gp)
nop
jalr t9
addiu a0, a0, 0x335c
lui gp, 0x45
addiu sp, sp, -0xb0
addiu gp, gp, 0x28f0
sw ra, 0xac(sp)
sw s4, 0xa8(sp)
sw s3, 0xa4(sp)
sw s2, 0xa0(sp)
sw s1, 0x9c(sp)
sw s0, 0x98(sp)
sw gp, 0x10(sp)
lw t9, -sym.imp.sprintf(gp)
move s1, a1
addiu s3, sp, 0x1c
lui a1, 0x43
addiu a1, a1, 0x53b8
move a3, s1
move s4, a2
move a2, a0
jalr t9
move a0, s3
lw gp, 0x10(sp)
move a0, s3
lw t9, -sym.imp.open(gp)
nop
jalr t9
move a1, zero
lw gp, 0x10(sp)
bltz v0, 0x41b838
move s0, v0
lw t9, -sym.imp.read(gp)
addiu s2, sp, 0x48
--
addiu a1, zero, 0x20
lw ra, 0x24(sp)
addiu v0, s0, -0x4ba0
lw gp, 0x10(sp)
lw s0, 0x20(sp)
jr ra
addiu sp, sp, 0x28
lhu v1, 0xc40(v0)
lui s0, 0x45
sh v1, -0x4ba0(s0)
lw ra, 0x24(sp)
addiu v0, s0, -0x4ba0
lw s0, 0x20(sp)
jr ra
addiu sp, sp, 0x28
lui gp, 0x45
addiu sp, sp, -0x20
addiu gp, gp, 0x28f0
sw ra, 0x1c(sp)
sw s0, 0x18(sp)
sw gp, 0x10(sp)
addiu v0, zero, -1
beq a0, v0, 0x41d104
move a3, a1
lui s0, 0x45
lw t9, -sym.imp.sprintf(gp)
lui a1, 0x43
move a2, a0
addiu a1, a1, 0x58d0
jalr t9
addiu a0, s0, -0x4b80
lw ra, 0x1c(sp)
addiu v1, s0, -0x4b80
lw gp, 0x10(sp)
move v0, v1
lw s0, 0x18(sp)
jr ra
addiu sp, sp, 0x20
bne a1, a0, 0x41d0d0
lui s0, 0x45
lui v1, 0x43
addiu v0, v1, 0x58c8
lhu a0, 4(v0)
lw v0, 0x58c8(v1)
addiu v1, s0, -0x4b80
sw v0, -0x4b80(s0)
--
addiu sp, sp, 0x40
lui gp, 0x45
addiu sp, sp, -0x20
addiu gp, gp, 0x28f0
sw ra, 0x1c(sp)
sw s0, 0x18(sp)
sw gp, 0x10(sp)
andi a2, a0, 0xff
bnez a2, 0x41d648
addiu v0, zero, 1
lui v1, 0x43
addiu v0, v1, 0x59f8
lbu a0, 4(v0)
lui s0, 0x45
lw v0, 0x59f8(v1)
addiu v1, s0, -0x4b60
sw v0, -0x4b60(s0)
sb a0, 4(v1)
lw ra, 0x1c(sp)
move v0, v1
lw s0, 0x18(sp)
jr ra
addiu sp, sp, 0x20
beq a2, v0, 0x41d680
lui s0, 0x45
lw t9, -sym.imp.sprintf(gp)
lui a1, 0x43
addiu a0, s0, -0x4b60
jalr t9
addiu a1, a1, 0x5c8c
lw ra, 0x1c(sp)
addiu v1, s0, -0x4b60
lw gp, 0x10(sp)
move v0, v1
lw s0, 0x18(sp)
jr ra
addiu sp, sp, 0x20
lui v0, 0x43
lw v1, 0x5a00(v0)
nop
sw v1, -0x4b60(s0)
lw ra, 0x1c(sp)
addiu v1, s0, -0x4b60
move v0, v1
lw s0, 0x18(sp)
jr ra
--
addiu sp, sp, -0x20
addiu gp, gp, 0x28f0
sw ra, 0x1c(sp)
sw s0, 0x18(sp)
sw gp, 0x10(sp)
andi a2, a0, 0xff
addiu v0, zero, 1
beq a2, v0, 0x41d778
lui v1, 0x43
bnez a2, 0x41d700
addiu v0, zero, 2
lui v0, 0x43
lw v1, 0x3318(v0)
lui s0, 0x45
sw v1, -0x4b30(s0)
lw ra, 0x1c(sp)
addiu v1, s0, -0x4b30
move v0, v1
lw s0, 0x18(sp)
jr ra
addiu sp, sp, 0x20
beq a2, v0, 0x41d7a8
addiu v0, zero, 3
beq a2, v0, 0x41d740
lui s0, 0x45
lw t9, -sym.imp.sprintf(gp)
lui a1, 0x43
addiu a0, s0, -0x4b30
jalr t9
addiu a1, a1, 0x5c8c
lw ra, 0x1c(sp)
addiu v1, s0, -0x4b30
lw gp, 0x10(sp)
move v0, v1
lw s0, 0x18(sp)
jr ra
addiu sp, sp, 0x20
lui v0, 0x43
addiu v1, v0, 0x5a0c
lw a0, 0x5a0c(v0)
lbu a2, 6(v1)
lhu a1, 4(v1)
addiu v1, s0, -0x4b30
sw a0, -0x4b30(s0)
sh a1, 4(v1)
sb a2, 6(v1)
--
sw a0, 4(v1)
lw ra, 0x1c(sp)
move v0, v1
lw s0, 0x18(sp)
jr ra
addiu sp, sp, 0x20
lui v1, 0x43
addiu v0, v1, 0x5364
lbu a0, 4(v0)
lui s0, 0x45
lw v0, 0x5364(v1)
addiu v1, s0, -0x4b30
sw v0, -0x4b30(s0)
sb a0, 4(v1)
lw ra, 0x1c(sp)
move v0, v1
lw s0, 0x18(sp)
jr ra
addiu sp, sp, 0x20
lui gp, 0x45
addiu sp, sp, -0x20
addiu gp, gp, 0x28f0
sw ra, 0x1c(sp)
sw s0, 0x18(sp)
sw gp, 0x10(sp)
lw t9, -sym.imp.sprintf(gp)
lui s0, 0x45
lui a1, 0x43
move a2, a0
addiu a1, a1, 0x5a14
jalr t9
addiu a0, s0, -0x4b10
lw ra, 0x1c(sp)
addiu v0, s0, -0x4b10
lw gp, 0x10(sp)
lw s0, 0x18(sp)
jr ra
addiu sp, sp, 0x20
lui gp, 0x45
addiu sp, sp, -0x20
addiu gp, gp, 0x28f0
sw ra, 0x1c(sp)
sw s0, 0x18(sp)
sw gp, 0x10(sp)
lui v0, 0x45
lw s0, -0x6f74(v0)
nop
beqz s0, 0x41d890
addiu v0, zero, 2
beq a0, v0, 0x41d8b4
lui v0, 0x45
addiu v0, v0, -0x6f6c
b 0x41d880
addiu a1, zero, -1
lw v1, 4(v0)
nop
beq v1, a1, 0x41d890
addiu v0, v0, 8
beq v1, a0, 0x41d8b4
nop
lw s0, (v0)
nop
bnez s0, 0x41d868
nop
lw t9, -sym.imp.sprintf(gp)
lui s0, 0x45
lui a1, 0x43
move a2, a0
addiu a1, a1, 0x6be0
jalr t9
addiu a0, s0, -0x4af0
lw gp, 0x10(sp)
addiu s0, s0, -0x4af0
lw ra, 0x1c(sp)
move v0, s0
lw s0, 0x18(sp)
jr ra
addiu sp, sp, 0x20
lui gp, 0x45
addiu sp, sp, -0x38
addiu gp, gp, 0x28f0
sw ra, 0x34(sp)
sw s5, 0x30(sp)
sw s4, 0x2c(sp)
sw s3, 0x28(sp)
--
addiu gp, gp, 0x28f0
sw ra, 0x1c(sp)
sw s0, 0x18(sp)
sw gp, 0x10(sp)
lui v0, 0x45
lw s0, -0x6f4c(v0)
nop
beqz s0, 0x41dc38
andi a2, a0, 0xff
addiu v0, zero, 0x32
beq a2, v0, 0x41dc58
lui v0, 0x45
addiu v0, v0, -0x6f44
b 0x41dc28
addiu a0, zero, -1
lw v1, 4(v0)
nop
beq v1, a0, 0x41dc38
addiu v0, v0, 8
beq v1, a2, 0x41dc58
nop
lw s0, (v0)
nop
bnez s0, 0x41dc10
nop
lw t9, -sym.imp.sprintf(gp)
lui s0, 0x45
lui a1, 0x43
addiu a0, s0, -0x4ad0
jalr t9
addiu a1, a1, 0x5c8c
lw gp, 0x10(sp)
addiu s0, s0, -0x4ad0
lw ra, 0x1c(sp)
move v0, s0
lw s0, 0x18(sp)
jr ra
addiu sp, sp, 0x20
lui gp, 0x45
addiu sp, sp, -0x148
addiu gp, gp, 0x28f0
sw ra, 0x144(sp)
sw fp, 0x140(sp)
sw s7, 0x13c(sp)
sw s6, 0x138(sp)
sw s5, 0x134(sp)
--
lw v1, -obj._SL_(gp)
lw t9, -sym.imp.fputs(gp)
lw a0, (v1)
jalr t9
move a1, s2
lw v0, (s6)
lw gp, 0x28(sp)
blez v0, 0x41e5bc
nop
beqz s4, 0x41e4c0
nop
lw t9, -sym.imp.fputs(gp)
move a0, s4
jalr t9
move a1, s2
lw gp, 0x28(sp)
nop
lw t9, -sym.imp.fputc(gp)
move a1, s2
jalr t9
addiu a0, zero, 9
jal sym.strxf_algotype
addiu a0, zero, 2
lw gp, 0x28(sp)
lw a2, 0x38(s1)
lw t9, -sym.imp.sprintf(gp)
move a0, s5
move a1, s7
jalr t9
move s0, v0
lw gp, 0x28(sp)
lui a1, 0x43
lw t9, -sym.imp.fprintf(gp)
move a2, s0
move a3, s5
addiu a1, a1, 0x5b40
jalr t9
move a0, s2
jal sym.strxf_algotype
addiu a0, zero, 1
lw gp, 0x28(sp)
lw a2, 0x34(s1)
lw t9, -sym.imp.sprintf(gp)
move a0, s5
move a1, s7
jalr t9
move s0, v0
lw gp, 0x28(sp)
lui a1, 0x43
lw t9, -sym.imp.fprintf(gp)
move a2, s0
move a3, s5
addiu a1, a1, 0x5b40
jalr t9
move a0, s2
jal sym.strxf_algotype
addiu a0, zero, 3
lw gp, 0x28(sp)
lw a2, 0x3c(s1)
lw t9, -sym.imp.sprintf(gp)
move a0, s5
move a1, s7
jalr t9
move s0, v0
lw gp, 0x28(sp)
lui a1, 0x43
lw t9, -sym.imp.fprintf(gp)
move a2, s0
move a0, s2
addiu a1, a1, 0x5b4c
jalr t9
move a3, s5
lw gp, 0x28(sp)
nop
lw v0, -obj._SL_(gp)
lw t9, -sym.imp.fputs(gp)
lw a0, (v0)
jalr t9
move a1, s2
lw gp, 0x28(sp)
--
jalr t9
move a1, s2
lw gp, 0x28(sp)
b 0x41e5d0
nop
lui gp, 0x45
addiu sp, sp, -0x28
addiu gp, gp, 0x28f0
sw ra, 0x24(sp)
sw s1, 0x20(sp)
sw s0, 0x1c(sp)
sw gp, 0x10(sp)
lw t9, -sym.imp.getprotobynumber(gp)
andi s1, a0, 0xff
jalr t9
move a0, s1
lw gp, 0x10(sp)
beqz v0, 0x41e91c
lui s0, 0x45
lw v0, (v0)
lw ra, 0x24(sp)
lw s1, 0x20(sp)
lw s0, 0x1c(sp)
jr ra
addiu sp, sp, 0x28
lw t9, -sym.imp.sprintf(gp)
lui a1, 0x43
addiu a1, a1, 0x5c8c
move a2, s1
jalr t9
addiu a0, s0, -0x4b50
lw gp, 0x10(sp)
b 0x41e908
addiu v0, s0, -0x4b50
lui gp, 0x45
addiu sp, sp, -0xc0
addiu gp, gp, 0x28f0
sw ra, 0xbc(sp)
sw fp, 0xb8(sp)
sw s7, 0xb4(sp)
sw s6, 0xb0(sp)
sw s5, 0xac(sp)
sw s4, 0xa8(sp)
sw s3, 0xa4(sp)
sw s2, 0xa0(sp)
sw s1, 0x9c(sp)
--
sw s4, 0x28(sp)
sw s3, 0x24(sp)
sw s2, 0x20(sp)
sw s1, 0x1c(sp)
sw s0, 0x18(sp)
sw gp, 0x10(sp)
move s4, a1
move s7, a0
sw a2, 0x48(sp)
blez a1, 0x42c770
move s0, a3
slti v0, a3, 3
bnez v0, 0x42c770
addiu s3, a1, -1
lw v0, -0x7fe4(gp)
nop
addiu s5, v0, 0x4f28
move s2, a2
move s1, zero
addiu s6, zero, 1
b 0x42c724
addiu fp, zero, 0x3a
bnez v1, 0x42c770
nop
addu v0, s7, s1
lw t9, -sym.imp.sprintf(gp)
lbu a2, (v0)
move a0, s2
jalr t9
move a1, s5
lw gp, 0x10(sp)
addiu s0, s0, -2
beq s3, s1, 0x42c760
addiu s2, s2, 2
beq s0, s6, 0x42c760
nop
sb fp, (s2)
addiu s0, s0, -1
addiu s2, s2, 1
addiu s1, s1, 1
slt v0, s1, s4
bnez v0, 0x42c71c
slti v1, s0, 3
lw ra, 0x3c(sp)
lw v0, 0x48(sp)
lw fp, 0x38(sp)
[*] Function sprintf used 15 times ip
