[*] Binary protection state of neaps
RELRO CANARY NX PIE RPATH RUNPATH SYMBOLS
No RELRO No Canary found NX disabled No PIE No RPATH No RUNPATH No Symbols
[*] Function strcpy tear down of neaps
lw gp, 0x20(sp)
bnez v0, 0x401648
nop
lw t9, -sym.imp.fclose(gp)
nop
jalr t9
move a0, s2
lw gp, 0x20(sp)
addiu s1, sp, 0x28
lw t9, -sym.imp.memset(gp)
move a0, s1
move a1, zero
lui v0, 0x41
lw s3, 0x6af8(v0)
jalr t9
addiu a2, zero, 0x20
lw gp, 0x20(sp)
addiu a0, zero, 2
lw t9, -sym.imp.socket(gp)
addiu a1, zero, 3
jalr t9
addiu a2, zero, 0xff
lw gp, 0x20(sp)
bltz v0, 0x401c08
move s0, v0
lw t9, -sym.imp.strcpy(gp)
addiu v0, zero, 2
move a0, s1
move a1, s3
jalr t9
sh v0, 0x38(sp)
lw gp, 0x20(sp)
move a0, s0
lw t9, -sym.imp.ioctl(gp)
ori a1, zero, 0x8915
jalr t9
move a2, s1
lw gp, 0x20(sp)
bnez v0, 0x401b94
nop
addiu s2, sp, 0x38
lw v0, 4(s2)
lw t9, -sym.imp.ioctl(gp)
lui v1, 0x41
sw v0, 0x6ad0(v1)
move a0, s0
--
lw gp, 0x18(sp)
bne v0, s2, 0x403ee0
move s0, v0
lw t9, -sym.imp.close(gp)
lw a0, (s1)
jalr t9
nop
lw gp, 0x18(sp)
b 0x4040c4
sw s0, (s1)
lw t9, -sym.imp.memset(gp)
addiu s2, sp, 0x54
move a0, s2
move a1, zero
jalr t9
addiu a2, zero, 0x20
lw gp, 0x18(sp)
addiu a0, zero, 2
lw t9, -sym.imp.socket(gp)
addiu a1, zero, 3
jalr t9
addiu a2, zero, 0xff
lw gp, 0x18(sp)
bltz v0, 0x404074
move s0, v0
lw t9, -sym.imp.strcpy(gp)
move a1, s6
move a0, s2
jalr t9
sh s7, 0x64(sp)
lw gp, 0x18(sp)
move a0, s0
lw t9, -sym.imp.ioctl(gp)
ori a1, zero, 0x8915
jalr t9
move a2, s2
lw gp, 0x18(sp)
bnez v0, 0x404028
addiu s3, sp, 0x64
lw v0, 4(s3)
lw t9, -sym.imp.ioctl(gp)
srl a1, v0, 0x18
sll v1, v0, 0x18
srl a0, v0, 8
or v1, v1, a1
andi a0, a0, 0xff00
[*] Function strcpy used 2 times neaps