[*] Binary protection state of udhcpd
RELRO CANARY NX PIE RPATH RUNPATH SYMBOLS
No RELRO No Canary found NX disabled No PIE No RPATH No RUNPATH No Symbols
[*] Function strcpy tear down of udhcpd
addiu a2, sp, 0x52
lbu t2, 4(a0)
lbu t1, 5(a0)
swr v0, (a1)
sw s1, 0x138(sp)
swl a3, 3(a2)
lw v0, 0x144(sp)
addiu a0, zero, 0x100
sh t0, 4(v0)
addiu v0, zero, 0x608
sw v1, 0x3c(sp)
sh v0, 0x48(sp)
addiu v1, zero, 8
addiu v0, zero, 6
sb t1, 5(a1)
swr a3, (a2)
sh v1, 0x4c(sp)
sb v0, 0x4e(sp)
sh a0, 0x50(sp)
sb s4, 0x4f(sp)
sb t2, 4(a1)
sb t2, 4(a2)
lw v1, 0x178(sp)
addiu s0, sp, 0x2c
sw v1, 0x138(sp)
lw t9, -sym.imp.strcpy(gp)
swl v1, 0x65(sp)
sb t1, 5(a2)
move a1, s2
swr v1, 0x62(sp)
sw s1, 0x58(sp)
sh a0, 0x4a(sp)
sw zero, 4(s0)
sw zero, 8(s0)
sw zero, 0xc(s0)
addiu a0, sp, 0x2e
jalr t9
sw zero, 0x2c(sp)
lw gp, 0x18(sp)
addiu v0, zero, 0x10
lw t9, -sym.imp.sendto(gp)
lw a1, 0x144(sp)
sw s0, 0x10(sp)
move a0, fp
addiu a2, zero, 0x3c
move a3, zero
--
addiu a1, a1, 1
andi v0, v0, 0xff
sltiu v0, v0, 6
beqz v0, 0x403738
addiu v0, a0, -0x37
b 0x403618
or v1, a2, v0
beq a0, t2, 0x403618
srl v1, a2, 4
beq a0, t3, 0x403618
nop
beqz a0, 0x403624
addu v0, s1, a3
b 0x403498
move s0, zero
bne a3, v0, 0x403494
nop
lw v1, -0x4420(s2)
lw s0, -obj.static_leases(gp)
sll a0, v1, 3
sll v0, v1, 5
subu v0, v0, a0
subu v0, v0, v1
lw a0, (s0)
sll v0, v0, 2
lw t9, -sym.imp.strcpy(gp)
addu a0, a0, v0
addiu a0, a0, 0x1c
jalr t9
move a1, s3
lw v1, -0x4420(s2)
lw a0, (s0)
sll a1, v1, 3
sll v0, v1, 5
subu v0, v0, a1
subu v0, v0, v1
sll v0, v0, 2
lw v1, 0x18(sp)
addu a0, a0, v0
sw v1, 0x10(a0)
lw v0, 0xc(s1)
lw v1, (s1)
lw a1, 4(s1)
lw a2, 8(s1)
lw gp, 0x10(sp)
sw v0, 0xc(a0)
--
sw zero, -0x43e8(v1)
jr ra
addiu sp, sp, 0x20
lui gp, 0x42
addiu sp, sp, -0x40
addiu gp, gp, 0x3960
sw ra, 0x3c(sp)
sw s3, 0x38(sp)
sw s2, 0x34(sp)
sw s1, 0x30(sp)
sw s0, 0x2c(sp)
sw gp, 0x10(sp)
lui s3, 0x42
lw v0, -0x43f0(s3)
nop
addiu v0, v0, -2
sltiu v0, v0, 3
beqz v0, 0x405180
lui s2, 0x42
lw t9, -sym.imp.inet_ntoa(gp)
lw a0, -0x43ec(s2)
jalr t9
addiu s0, sp, 0x18
lw gp, 0x10(sp)
move a1, v0
lw t9, -sym.imp.strcpy(gp)
nop
jalr t9
move a0, s0
lw gp, 0x10(sp)
lui s1, 0x42
lw t9, -sym.imp.inet_ntoa(gp)
lw a0, -0x43fc(s1)
jalr t9
nop
lw gp, 0x10(sp)
lui a1, 0x41
lw t9, -sym.imp.syslog(gp)
move a2, v0
move a3, s0
addiu a1, a1, -0x6054
jalr t9
addiu a0, zero, 0xe5
lw gp, 0x10(sp)
lw a0, -0x43ec(s2)
lw t9, -sym.send_release(gp)
--
sw zero, (v0)
lw a0, 0x380(sp)
lw a1, 0x36c(sp)
jalr t9
nop
lw v1, 0x370(sp)
lw gp, 0x18(sp)
sw zero, (v1)
lw t9, -sym.imp.inet_aton(gp)
lw a1, 0x370(sp)
lw a0, 0x384(sp)
jalr t9
nop
lw v1, 0x13c(sp)
lw gp, 0x18(sp)
lw a0, 0x28(sp)
lw v0, 0x2c(sp)
and a0, v1, a0
lw t9, -sym.imp.inet_ntoa(gp)
lui a1, 0x42
sw v1, -0x43f4(a1)
jalr t9
or a0, a0, v0
lw gp, 0x18(sp)
lw a0, 0x37c(sp)
lw t9, -sym.imp.strcpy(gp)
nop
jalr t9
move a1, v0
lw gp, 0x18(sp)
lw a0, 0x37c(sp)
lw t9, -sym.imp.puts(gp)
nop
jalr t9
nop
lw gp, 0x18(sp)
b 0x406508
sll v0, s4, 2
lw t9, -sym.imp.printf(gp)
lui a0, 0x41
lui a1, 0x41
addiu a0, a0, -0x6008
jalr t9
addiu a1, a1, -0x5ff0
jal 0x4051c0
move a0, zero
--
sw s3, 0x48(sp)
sw s2, 0x44(sp)
sw s1, 0x40(sp)
sw s0, 0x3c(sp)
sw gp, 0x10(sp)
lw t9, -sym.imp.socket(gp)
move s2, a0
move s5, a1
move s4, a2
sw zero, 0x18(sp)
sw zero, 0x1c(sp)
sw zero, 0x20(sp)
sw zero, 0x24(sp)
sw zero, 0x28(sp)
sw zero, 0x2c(sp)
sw zero, 0x30(sp)
sw zero, 0x34(sp)
addiu a0, zero, 2
addiu a1, zero, 3
addiu a2, zero, 0xff
jalr t9
move s3, a3
lw gp, 0x10(sp)
bltz v0, 0x408e10
move s0, v0
lw t9, -sym.imp.strcpy(gp)
addiu v0, zero, 2
addiu s1, sp, 0x18
sh v0, 0x28(sp)
move a1, s2
jalr t9
move a0, s1
lw gp, 0x10(sp)
beqz s4, 0x408df0
move a0, s0
lw t9, -sym.imp.ioctl(gp)
ori a1, zero, 0x8915
jalr t9
move a2, s1
lw gp, 0x10(sp)
bnez v0, 0x408e14
addiu v0, zero, -1
lw v0, 0x2c(sp)
nop
sw v0, (s4)
lw t9, -sym.imp.ioctl(gp)
[*] Function strcpy used 5 times udhcpd
