[*] Binary protection state of neaps
RELRO CANARY NX PIE RPATH RUNPATH SYMBOLS
No RELRO No Canary found NX disabled No PIE No RPATH No RUNPATH No Symbols
[*] Function fprintf tear down of neaps
lw t9, -0x7ea8(gp)
nop
beqz t9, 0x4012ec
addiu a0, a0, 0x68ac
lw ra, 0x1c(sp)
jr t9
addiu sp, sp, 0x20
lw ra, 0x1c(sp)
nop
jr ra
addiu sp, sp, 0x20
nop
lui gp, 0x42
addiu sp, sp, -0x28
addiu gp, gp, -0x16e0
sw ra, 0x24(sp)
sw gp, 0x10(sp)
lui v0, 0x41
lw v0, 0x6afc(v0)
sw a1, 0x2c(sp)
sw a2, 0x30(sp)
sw a3, 0x34(sp)
beqz v0, 0x40134c
move a1, a0
lw v0, -0x7f3c(gp)
lw t9, -sym.imp.vfprintf(gp)
addiu a2, sp, 0x2c
lw a0, (v0)
jalr t9
sw a2, 0x18(sp)
lw gp, 0x10(sp)
lw ra, 0x24(sp)
nop
jr ra
addiu sp, sp, 0x28
lui gp, 0x42
addiu sp, sp, -0x20
addiu gp, gp, -0x16e0
sw ra, 0x1c(sp)
sw s0, 0x18(sp)
sw gp, 0x10(sp)
move s0, a0
lui a1, 0x40
lui a0, 0x40
addiu a0, a0, 0x6484
addiu a1, a1, 0x649c
--
lw t9, -sym.imp.sendto(gp)
sw v0, 0x10(sp)
addiu v0, zero, 0x10
sw v0, 0x14(sp)
move a2, s1
addiu a1, sp, 0x40
jalr t9
move a3, zero
lw gp, 0x18(sp)
bgez v0, 0x403178
move s3, v0
lw t9, -sym.imp.__errno_location(gp)
lw v0, -0x7f3c(gp)
lw s2, (s4)
lw s1, (v0)
jalr t9
nop
lw gp, 0x18(sp)
lw s0, (v0)
lw t9, -sym.imp.strerror(gp)
nop
jalr t9
move a0, s0
lw gp, 0x18(sp)
lui a1, 0x40
lw t9, -sym.imp.fprintf(gp)
sw v0, 0x10(sp)
move a0, s1
addiu a1, a1, 0x67b4
move a2, s2
jalr t9
move a3, s0
lw gp, 0x18(sp)
lw ra, 0xffc(sp)
move v0, s3
lw s5, 0xff8(sp)
lw s4, 0xff4(sp)
lw s3, 0xff0(sp)
lw s2, 0xfec(sp)
lw s1, 0xfe8(sp)
lw s0, 0xfe4(sp)
jr ra
addiu sp, sp, 0x1000
addiu sp, sp, -0x20
sw ra, 0x1c(sp)
sw gp, 0x10(sp)
--
addiu a1, zero, 1
jalr t9
addiu a2, zero, 0x11
lw gp, 0x18(sp)
bltz v0, 0x403ce8
move s0, v0
lw t9, -sym.imp.setsockopt(gp)
addiu v0, zero, 4
sw v0, 0x10(sp)
move a0, s0
ori a1, zero, 0xffff
addiu a2, zero, 0x20
jalr t9
addiu a3, sp, 0x20
addiu v1, zero, -1
lw gp, 0x18(sp)
bne v0, v1, 0x403d3c
nop
lw t9, -sym.imp.__errno_location(gp)
nop
jalr t9
nop
lw gp, 0x18(sp)
lw a2, (v0)
lw v0, -0x7f3c(gp)
lw t9, -sym.imp.fprintf(gp)
lw a0, (v0)
lui a1, 0x40
jalr t9
addiu a1, a1, 0x6850
lw gp, 0x18(sp)
nop
lw t9, -sym.imp.free(gp)
nop
jalr t9
move a0, s1
lw gp, 0x18(sp)
b 0x403d44
move v0, zero
sw s0, (s1)
move v0, s1
lw ra, 0x34(sp)
lw s1, 0x30(sp)
lw s0, 0x2c(sp)
jr ra
addiu sp, sp, 0x38
--
sh a0, 4(v1)
sh a1, 2(v1)
jalr t9
move a0, s0
lw gp, 0x18(sp)
b 0x4040c8
addiu v0, zero, 1
jalr t9
move a0, s0
b 0x4040c0
nop
lw t9, -sym.imp.__errno_location(gp)
lw v0, -0x7f3c(gp)
nop
lw s0, (v0)
jalr t9
nop
lw gp, 0x18(sp)
lw a0, (v0)
lw t9, -sym.imp.strerror(gp)
nop
jalr t9
nop
lw gp, 0x18(sp)
lui a1, 0x40
lw t9, -sym.imp.fprintf(gp)
move a0, s0
addiu a1, a1, 0x6868
jalr t9
move a2, v0
lw gp, 0x18(sp)
move v0, zero
lw ra, 0x9c(sp)
lw s7, 0x98(sp)
lw s6, 0x94(sp)
lw s5, 0x90(sp)
lw s4, 0x8c(sp)
lw s3, 0x88(sp)
lw s2, 0x84(sp)
lw s1, 0x80(sp)
lw s0, 0x7c(sp)
jr ra
addiu sp, sp, 0xa0
nop
nop
nop
[*] Function fprintf used 4 times neaps
