[*] Binary protection state of iwconfig
RELRO CANARY NX PIE RPATH RUNPATH SYMBOLS
No RELRO No Canary found NX disabled No PIE No RPATH No RUNPATH No Symbols
[*] Function strcpy tear down of iwconfig
lw t9, -sym.imp.fprintf(gp)
lw a0, (s0)
addiu a1, a1, -0x652c
addiu a2, a2, -0x63c4
b 0x4013f4
ori a3, zero, 0x8b1a
sll v0, s2, 2
addu v0, s6, v0
lw s0, (v0)
lw t9, -sym.imp.strlen(gp)
nop
jalr t9
move a0, s0
sltiu v0, v0, 0x21
lw gp, 0x18(sp)
bnez v0, 0x401cc0
lui a1, 0x41
lw s0, -0x7f2c(gp)
lui a2, 0x41
lw t9, -sym.imp.fprintf(gp)
lw a0, (s0)
addiu a1, a1, -0x652c
addiu a2, a2, -0x63c4
b 0x401fd4
ori a3, zero, 0x8b1a
lw t9, -sym.imp.strcpy(gp)
addiu v0, zero, 1
sh v0, 0x46(sp)
move a1, s0
addiu a0, sp, 0x70
jalr t9
addiu s1, s2, 1
slt v0, s1, s4
lw gp, 0x18(sp)
beqz v0, 0x401d38
sll v0, s1, 2
addu v0, s6, v0
lw t9, -sym.imp.sscanf(gp)
lw a0, (v0)
lui a1, 0x41
addiu a1, a1, -0x63f4
jalr t9
addiu a2, sp, 0x20
addiu v1, zero, 1
lw gp, 0x18(sp)
bne v0, v1, 0x401d38
--
addiu sp, sp, 0x320
lui gp, 0x42
addiu sp, sp, -0x478
addiu gp, gp, 0x31e0
sw ra, 0x474(sp)
sw s2, 0x470(sp)
sw s1, 0x46c(sp)
sw s0, 0x468(sp)
sw gp, 0x20(sp)
lw t9, -sym.imp.memset(gp)
addiu s0, sp, 0xe8
move s2, a0
move s1, a1
move a0, s0
move a1, zero
jalr t9
addiu a2, zero, 0x380
move a0, s2
move a1, s1
ori a2, zero, 0x8b01
jal 0x401190
addiu a3, sp, 0x28
lw gp, 0x20(sp)
bgez v0, 0x403424
move a0, s0
lw t9, -sym.imp.strcpy(gp)
addiu s0, sp, 0x48
move a0, s0
jalr t9
move a1, s1
lw gp, 0x20(sp)
move a0, s2
lw t9, -sym.imp.ioctl(gp)
move a2, s0
jalr t9
ori a1, zero, 0x8913
lw gp, 0x20(sp)
nop
lw a0, -0x7f2c(gp)
bltz v0, 0x4037bc
lui a1, 0x41
b 0x404100
addiu a1, a1, -0x5f70
lw t9, -sym.imp.strncpy(gp)
addiu a1, sp, 0x38
jalr t9
--
jr ra
addiu sp, sp, 0x20
lui gp, 0x42
andi a1, a1, 0xf00
addiu v0, zero, 0x300
addiu gp, gp, 0x31e0
beq a1, v0, 0x4067e4
move v1, a0
slti v0, a1, 0x301
beqz v0, 0x4067b0
addiu v0, zero, 0x400
addiu v0, zero, 0x100
beq a1, v0, 0x4067c8
addiu v0, zero, 0x200
bne a1, v0, 0x406810
lui a1, 0x41
b 0x4067d8
nop
beq a1, v0, 0x4067f4
addiu v0, zero, 0x800
bne a1, v0, 0x406810
lui a1, 0x41
b 0x406804
nop
lui a1, 0x41
lw t9, -sym.imp.strcpy(gp)
b 0x406820
addiu a1, a1, -0x5728
lw t9, -sym.imp.strcpy(gp)
b 0x406820
addiu a1, a1, -0x570c
lui a1, 0x41
lw t9, -sym.imp.strcpy(gp)
b 0x406820
addiu a1, a1, -0x56ec
lui a1, 0x41
lw t9, -sym.imp.strcpy(gp)
b 0x406820
addiu a1, a1, -0x56d0
lw t9, -sym.imp.strcpy(gp)
b 0x406820
addiu a1, a1, -0x56bc
lui a1, 0x41
lw t9, -sym.imp.strcpy(gp)
move a0, v1
addiu a1, a1, -0x5a5c
jr t9
nop
lui gp, 0x42
addiu sp, sp, -0x28
addiu gp, gp, 0x31e0
sw ra, 0x24(sp)
sw s2, 0x20(sp)
sw s1, 0x1c(sp)
sw s0, 0x18(sp)
sw gp, 0x10(sp)
addiu v0, zero, 2
lw t9, -sym.imp.strcmp(gp)
sh v0, (a1)
sh zero, 2(a1)
move s1, a1
lui a1, 0x41
addiu a1, a1, -0x56a4
jalr t9
move s2, a0
lw gp, 0x10(sp)
bnez v0, 0x406880
nop
b 0x4068dc
sw zero, 4(s1)
lw t9, -sym.imp.getnetbyname(gp)
nop
jalr t9
move a0, s2
lw gp, 0x10(sp)
beqz v0, 0x4068e4
move a1, v0
lw v0, 0xc(v0)
lw t9, -sym.imp.strcpy(gp)
srl a2, v0, 0x18
sll v1, v0, 0x18
srl a0, v0, 8
or v1, v1, a2
andi a0, a0, 0xff00
andi v0, v0, 0xff00
or v1, v1, a0
sll v0, v0, 8
or v1, v1, v0
lw a1, (a1)
sw v1, 4(s1)
jalr t9
move a0, s2
lw gp, 0x10(sp)
b 0x406974
addiu v1, zero, 1
lw t9, -sym.imp.gethostbyname(gp)
nop
jalr t9
move a0, s2
--
bnez v0, 0x40693c
move s0, v0
lw t9, -sym.imp.__errno_location(gp)
nop
jalr t9
nop
lw gp, 0x10(sp)
nop
lw t9, -sym.imp.__h_errno_location(gp)
nop
jalr t9
move s0, v0
lw v0, (v0)
lw gp, 0x10(sp)
addiu v1, zero, -1
b 0x406974
sw v0, (s0)
lw v0, 0x10(v0)
lw t9, -sym.imp.memcpy(gp)
lw a2, 0xc(s0)
lw a1, (v0)
jalr t9
addiu a0, s1, 4
lw gp, 0x10(sp)
lw a1, (s0)
lw t9, -sym.imp.strcpy(gp)
nop
jalr t9
move a0, s2
lw gp, 0x10(sp)
move v1, zero
lw ra, 0x24(sp)
move v0, v1
lw s2, 0x20(sp)
lw s1, 0x1c(sp)
lw s0, 0x18(sp)
jr ra
addiu sp, sp, 0x28
lui gp, 0x42
addiu sp, sp, -0x98
addiu gp, gp, 0x31e0
sw ra, 0x94(sp)
sw s5, 0x90(sp)
sw s4, 0x8c(sp)
sw s3, 0x88(sp)
sw s2, 0x84(sp)
--
nop
nop
bnez a3, 0x406d0c
div zero, v1, a3
break 7
mflo a3
jalr t9
sw v0, 0x10(sp)
lw ra, 0x24(sp)
lw gp, 0x18(sp)
jr ra
addiu sp, sp, 0x28
lui gp, 0x42
addiu sp, sp, -0x28
addiu gp, gp, 0x31e0
sw ra, 0x24(sp)
sw s2, 0x20(sp)
sw s1, 0x1c(sp)
sw s0, 0x18(sp)
sw gp, 0x10(sp)
andi v0, a2, 1
move s2, a2
move s1, a1
beqz v0, 0x406d74
move s0, a0
lw t9, -sym.imp.strcpy(gp)
lui a1, 0x41
addiu a1, a1, -0x5574
jalr t9
addiu s0, a0, 4
lw gp, 0x10(sp)
andi v0, s2, 2
beqz v0, 0x406da0
andi v0, s2, 0x2000
lw t9, -sym.imp.strcpy(gp)
lui a1, 0x41
move a0, s0
jalr t9
addiu a1, a1, -0x556c
lw gp, 0x10(sp)
addiu s0, s0, 4
andi v0, s2, 0x2000
beqz v0, 0x406ea4
lui a1, 0x41
lw t9, -sym.imp.strcpy(gp)
move a0, s0
jalr t9
addiu a1, a1, -0x5564
andi v0, s2, 4
lw gp, 0x10(sp)
beqz v0, 0x406e00
addiu a0, s0, 0xa
mtc1 s1, f0
lui v0, 0x41
lui a1, 0x41
cvt.d.w f2, f0
lw t9, -sym.imp.sprintf(gp)
lwc1 f0, -0x5c48(v0)
nop
lwc1 f1, -0x5c44(v0)
nop
div.d f4, f2, f0
mfc1 a2, f4
mfc1 a3, f5
b 0x406e44
--
addiu a1, a1, -0x5548
lui a1, 0x41
lw t9, -sym.imp.sprintf(gp)
move a0, s0
addiu a1, a1, -0x5540
move a2, s1
lw ra, 0x24(sp)
lw s2, 0x20(sp)
lw s1, 0x1c(sp)
lw s0, 0x18(sp)
jr t9
addiu sp, sp, 0x28
lui gp, 0x42
addiu sp, sp, -0x28
addiu gp, gp, 0x31e0
sw ra, 0x24(sp)
sw s2, 0x20(sp)
sw s1, 0x1c(sp)
sw s0, 0x18(sp)
sw gp, 0x10(sp)
andi v0, a2, 1
move s1, a2
move s2, a1
beqz v0, 0x406f1c
move s0, a0
lw t9, -sym.imp.strcpy(gp)
lui a1, 0x41
addiu a1, a1, -0x5574
jalr t9
addiu s0, a0, 4
lw gp, 0x10(sp)
andi v0, s1, 2
beqz v0, 0x406f48
andi v0, s1, 0x2000
lw t9, -sym.imp.strcpy(gp)
lui a1, 0x41
move a0, s0
jalr t9
addiu a1, a1, -0x556c
lw gp, 0x10(sp)
addiu s0, s0, 4
andi v0, s1, 0x2000
lw t9, -sym.imp.strcpy(gp)
beqz v0, 0x406f6c
move a0, s0
lui a1, 0x41
jalr t9
addiu a1, a1, -0x5534
lw gp, 0x10(sp)
b 0x406f80
addiu a0, s0, 9
lui a1, 0x41
jalr t9
addiu a1, a1, -0x5528
lw gp, 0x10(sp)
addiu a0, s0, 8
andi v0, s1, 4
beqz v0, 0x406fc4
lui v0, 0xf
mtc1 s2, f0
lui v0, 0x41
lui a1, 0x41
cvt.d.w f2, f0
--
move a2, s2
lw ra, 0x24(sp)
lw s2, 0x20(sp)
lw s1, 0x1c(sp)
lw s0, 0x18(sp)
addiu a1, a1, -0x5548
jr t9
addiu sp, sp, 0x28
lui gp, 0x42
addiu sp, sp, -0x38
addiu gp, gp, 0x31e0
sw ra, 0x34(sp)
sw s6, 0x30(sp)
sw s5, 0x2c(sp)
sw s4, 0x28(sp)
sw s3, 0x24(sp)
sw s2, 0x20(sp)
sw s1, 0x1c(sp)
sw s0, 0x18(sp)
sw gp, 0x10(sp)
andi a3, a3, 0x800
move s4, a1
move s3, a2
beqz a3, 0x407174
move s1, a0
lw t9, -sym.imp.strcpy(gp)
bgtz a2, 0x4070fc
lui s0, 0x41
lui a1, 0x41
lw ra, 0x34(sp)
lw s6, 0x30(sp)
lw s5, 0x2c(sp)
lw s4, 0x28(sp)
lw s3, 0x24(sp)
lw s2, 0x20(sp)
lw s1, 0x1c(sp)
lw s0, 0x18(sp)
addiu a1, a1, -0x6490
jr t9
addiu sp, sp, 0x38
jalr t9
addiu a1, s0, -0x551c
lui v0, 0x41
lw gp, 0x10(sp)
addiu s1, s1, 2
addiu s5, v0, -0x63b8
addiu s4, s0, -0x551c
b 0x40715c
addiu s2, zero, 1
bnez v1, 0x407144
move a0, s1
lw t9, -sym.imp.strcpy(gp)
nop
jalr t9
move a1, s5
addiu s0, s1, 1
lw gp, 0x10(sp)
move s1, s0
lw t9, -sym.imp.strcpy(gp)
move a0, s1
jalr t9
move a1, s4
lw gp, 0x10(sp)
addiu s1, s1, 2
slt v0, s2, s3
andi v1, s2, 1
bnez v0, 0x407120
addiu s2, s2, 1
b 0x4071f8
nop
lw t9, -sym.imp.sprintf(gp)
lui s0, 0x41
lbu a2, (a1)
jalr t9
addiu a1, s0, -0x5518
lui v0, 0x41
lw gp, 0x10(sp)
addiu s1, s1, 2
addiu s6, v0, -0x63b8
addiu s5, s0, -0x5518
b 0x4071ec
addiu s2, zero, 1
bnez v1, 0x4071cc
addu v0, s4, s2
lw t9, -sym.imp.strcpy(gp)
move a0, s1
jalr t9
move a1, s6
addiu s0, s1, 1
lw gp, 0x10(sp)
move s1, s0
addu v0, s4, s2
lw t9, -sym.imp.sprintf(gp)
lbu a2, (v0)
move a0, s1
jalr t9
move a1, s5
lw gp, 0x10(sp)
addiu s2, s2, 1
addiu s1, s1, 2
slt v0, s2, s3
bnez v0, 0x4071a4
andi v1, s2, 1
lw ra, 0x34(sp)
lw s6, 0x30(sp)
--
b 0x407a68
addiu a0, a0, -0x53f0
lw t9, -sym.imp.strlen(gp)
nop
jalr t9
move a0, s1
lw gp, 0x10(sp)
nop
lw t9, -sym.imp.malloc(gp)
nop
jalr t9
addiu a0, v0, 0x21
lw gp, 0x10(sp)
bnez v0, 0x407a7c
move s3, v0
lw v0, -0x7f2c(gp)
lui a0, 0x41
lw t9, -sym.imp.fputs(gp)
lw a1, (v0)
addiu a0, a0, -0x5174
jalr t9
addiu s0, zero, -1
lw gp, 0x10(sp)
b 0x407bbc
nop
lw t9, -sym.imp.strcpy(gp)
addiu s0, v0, 0x20
move a1, s1
jalr t9
move a0, s0
lw gp, 0x10(sp)
lui s1, 0x41
lw t9, -sym.imp.strtok(gp)
addiu a1, s1, -0x5150
jalr t9
move a0, s0
addiu fp, s1, -0x5150
lw gp, 0x10(sp)
move s2, v0
move s1, zero
addiu s7, zero, 0x20
addiu s6, sp, 0x1c
addiu s5, sp, 0x18
b 0x407b7c
addiu s4, zero, 2
lw t9, -sym.imp.sscanf(gp)
[*] Function strcpy used 21 times iwconfig
