[*] Binary protection state of rgbin
RELRO CANARY NX PIE RPATH RUNPATH SYMBOLS
No RELRO No Canary found NX disabled No PIE No RPATH No RUNPATH No Symbols
[*] Function sprintf tear down of rgbin
addu v0, s1, s0
bgtz s3, 0x402f18
addiu v0, zero, 0x20
addu v0, s1, s0
sb zero, (v0)
lb v0, (s1)
nop
beqz v0, 0x403034
nop
lw v0, 0x2980(s7)
nop
beqz v0, 0x40301c
lui a1, 0x41
lw t9, -sym.imp.sscanf(gp)
lw a2, 0x20(sp)
move a0, s1
addiu a1, a1, 0x30
jalr t9
sw zero, 0x18(sp)
lw a2, 0x18(sp)
lw v0, 0x2980(s7)
lw gp, 0x10(sp)
subu v0, a2, v0
sltu a2, a2, v0
sltiu a2, a2, 1
lw t9, -sym.imp.sprintf(gp)
negu a2, a2
lui a1, 0x41
and a2, v0, a2
move a0, s1
jalr t9
addiu a1, a1, 0x30
lw gp, 0x10(sp)
nop
lw t9, -sym.imp.puts(gp)
nop
jalr t9
move a0, s1
lw gp, 0x10(sp)
nop
lw t9, -sym.imp.free(gp)
nop
jalr t9
move a0, s5
lw gp, 0x10(sp)
nop
--
lw a2, (s4)
lui a1, 0x41
jalr t9
addiu a1, a1, 0x56c
lw gp, 0x18(sp)
b 0x404a90
addiu s6, zero, 1
lw v1, 0x64(sp)
nop
beqz v1, 0x4048d4
addiu s0, s0, 0xf04
lw t9, -sym.imp.printf(gp)
lw a2, (s1)
lui a0, 0x41
lui a1, 0x41
addiu a0, a0, 0x598
jalr t9
addiu a1, a1, 0xf04
lui s0, 0x41
lw gp, 0x18(sp)
addiu s0, s0, 0x1cc0
andi v0, s3, 2
beqz v0, 0x404940
andi v0, s3, 4
lw v0, 0x10(s1)
lw t9, -sym.imp.sprintf(gp)
lw v0, (v0)
lui a1, 0x41
lbu v1, 2(v0)
lbu a2, (v0)
lbu a3, 1(v0)
sw v1, 0x10(sp)
lbu v0, 3(v0)
move a0, fp
addiu a1, a1, 0x5a0
jalr t9
sw v0, 0x14(sp)
lw gp, 0x18(sp)
lui a0, 0x41
lw t9, -sym.imp.printf(gp)
move a1, s0
addiu a0, a0, 0x598
jalr t9
move a2, fp
lui s0, 0x41
lw gp, 0x18(sp)
--
bne s3, v0, 0x404a14
move s2, zero
b 0x4049f0
nop
lbu v0, 2(v1)
lbu a2, (v1)
lbu a3, 1(v1)
sw v0, 0x10(sp)
lbu v0, 3(v1)
jalr t9
sw v0, 0x14(sp)
lw gp, 0x18(sp)
lui a0, 0x41
lw t9, -sym.imp.printf(gp)
move a1, s0
addiu a0, a0, 0x598
jalr t9
move a2, fp
lui s0, 0x41
lw gp, 0x18(sp)
addiu s0, s0, 0x1cc0
lw v0, 0x10(s1)
lui a1, 0x41
addu v0, v0, s2
lw v1, (v0)
lw t9, -sym.imp.sprintf(gp)
move a0, fp
addiu a1, a1, 0x5a0
bnez v1, 0x4049ac
addiu s2, s2, 4
lw v0, -0x7e9c(gp)
lw t9, -sym.imp.fputc(gp)
lw a1, (v0)
b 0x404a84
nop
lw t9, -sym.imp.memset(gp)
lw a0, 0x60(sp)
jalr t9
addiu a2, zero, 0x2e
lw gp, 0x18(sp)
lw v0, 0x10(s1)
lw t9, -sym.imp.inet_ntop(gp)
lw a1, (v0)
lw a2, 0x60(sp)
addiu a3, zero, 0x2e
jalr t9
--
sw t0, 0x10(sp)
jal 0x405180
subu s0, s0, v0
lui a0, 0x41
move a2, s1
move a1, s0
jal 0x405180
addiu a0, a0, 0x7f0
addiu v0, zero, 0x3e8
bnez v0, 0x405a3c
div zero, s1, v0
break 7
lui a0, 0x41
addiu a0, a0, 0x80c
addiu s2, sp, 0x30
mflo s1
nop
nop
mult s0, v0
mflo s0
addu s1, s1, s0
jal 0x405180
move a1, s1
lw gp, 0x18(sp)
lui a1, 0x41
lw t9, -sym.imp.sprintf(gp)
move a2, s1
addiu a1, a1, 0x824
jalr t9
move a0, s2
lui a0, 0x41
addiu a0, a0, 0x834
jal 0x405180
move a1, s2
lw gp, 0x18(sp)
nop
lw t9, -sym.imp.malloc(gp)
nop
jalr t9
addiu a0, zero, 8
lw gp, 0x18(sp)
beqz v0, 0x405aec
move s0, v0
lw t9, -sym.imp.strdup(gp)
nop
jalr t9
--
lw a0, (s2)
jalr t9
nop
lw gp, 0x10(sp)
move a2, s6
move a1, zero
move s1, v0
beqz v0, 0x4091b8
move a0, v0
jal 0x4082bc
nop
lw a1, (s2)
lui a0, 0x41
move a2, v0
addiu a0, a0, 0x171c
jal 0x408260
move s0, v0
lw gp, 0x10(sp)
nop
lw t9, -sym.imp.rewind(gp)
nop
jalr t9
move a0, s1
lw gp, 0x10(sp)
lw a2, (s2)
lw t9, -sym.imp.sprintf(gp)
lui a1, 0x41
move a0, s5
jalr t9
addiu a1, a1, 0x1734
lw gp, 0x10(sp)
lui a1, 0x41
lw t9, -sym.imp.fopen(gp)
move a0, s5
jalr t9
addiu a1, a1, 0x7a4
move a3, s0
lw gp, 0x10(sp)
move a1, s7
move s0, v0
beqz v0, 0x4091a0
move a0, v0
lw a2, 0x2ad4(s4)
jal 0x4088b8
nop
lw gp, 0x10(sp)
--
lw gp, 0x10(sp)
lw s0, (s4)
lw t9, -sym.imp.strlen(gp)
nop
jalr t9
move a0, s0
sltiu v1, v0, 0x2e
lw gp, 0x10(sp)
bnez v1, 0x409768
move s1, v0
addiu s1, zero, 0x2e
lw t9, -sym.imp.strncmp(gp)
lui a1, 0x41
move a0, s0
addiu a1, a1, 0x1bc0
jalr t9
addiu a2, zero, 2
lw gp, 0x10(sp)
bnez v0, 0x40979c
move a1, s0
lw t9, -sym.imp.memcpy(gp)
move a2, s1
b 0x4097cc
move a0, s3
lbu v0, (s0)
lw t9, -sym.imp.sprintf(gp)
bne v0, s5, 0x4097bc
lui a1, 0x41
move a2, s0
move a0, s3
b 0x4097cc
addiu a1, a1, 0x1bc4
lui a1, 0x41
move a2, s0
move a0, s3
addiu a1, a1, 0x1bc8
jalr t9
nop
lw gp, 0x10(sp)
addiu a0, zero, 0xa
lw t9, -sym.imp.inet_pton(gp)
move a1, s3
jalr t9
move a2, s6
lw gp, 0x10(sp)
bgtz v0, 0x409820
--
lw s0, (s2)
lw t9, -sym.imp.strlen(gp)
nop
jalr t9
move a0, s0
sltiu v1, v0, 0x2e
lw gp, 0x18(sp)
bnez v1, 0x409f20
move s1, v0
addiu s1, zero, 0x2e
lw t9, -sym.imp.strncmp(gp)
lui a1, 0x41
move a0, s0
addiu a1, a1, 0x1bc0
jalr t9
addiu a2, zero, 2
lw gp, 0x18(sp)
bnez v0, 0x409f58
addiu v0, zero, 0x3a
lw t9, -sym.imp.memcpy(gp)
move a1, s0
move a2, s1
b 0x409f88
move a0, s6
lbu v1, (s0)
lw t9, -sym.imp.sprintf(gp)
bne v1, v0, 0x409f78
lui a1, 0x41
move a2, s0
move a0, s6
b 0x409f88
addiu a1, a1, 0x1bc4
lui a1, 0x41
move a2, s0
move a0, s6
addiu a1, a1, 0x1bc8
jalr t9
nop
lw gp, 0x18(sp)
addiu a0, zero, 0xa
lw t9, -sym.imp.inet_pton(gp)
move a1, s6
jalr t9
addiu a2, sp, 0x30
lw gp, 0x18(sp)
bgtz v0, 0x40a004
--
sw t6, 0x30(sp)
sw t7, 0x34(sp)
jalr t9
addiu a0, a0, 0x1d80
lw ra, 0x5c(sp)
lui v0, 0x42
lw gp, 0x48(sp)
addiu v0, v0, 0x2ee0
lw s1, 0x58(sp)
lw s0, 0x54(sp)
jr ra
addiu sp, sp, 0x60
lui gp, 0x43
addiu sp, sp, -0x30
addiu gp, gp, -0x5d20
sw ra, 0x2c(sp)
sw s0, 0x28(sp)
sw gp, 0x20(sp)
lbu a1, 5(a0)
lbu a2, (a0)
lbu a3, 1(a0)
lbu v0, 2(a0)
lbu v1, 3(a0)
lbu a0, 4(a0)
lui s0, 0x42
lw t9, -sym.imp.sprintf(gp)
sw a1, 0x1c(sp)
lui a1, 0x41
sw a0, 0x18(sp)
sw v0, 0x10(sp)
sw v1, 0x14(sp)
addiu a0, s0, 0x2f08
jalr t9
addiu a1, a1, 0x1dc8
lw ra, 0x2c(sp)
addiu v0, s0, 0x2f08
lw gp, 0x20(sp)
lw s0, 0x28(sp)
jr ra
addiu sp, sp, 0x30
nop
nop
nop
lui v0, 0x1032
ori v0, v0, 0x5476
sw v0, 0xc(a0)
[*] Function sprintf used 8 times rgbin
