[*] Binary protection state of rgbin

  	RELRO          CANARY            NX           PIE          RPATH        RUNPATH      SYMBOLS      

  	No RELRO       No Canary found   NX disabled  No PIE       No RPATH     No RUNPATH   No Symbols

[*] Function strcpy tear down of rgbin

addiu v1, v1, 0x80

addu v0, v1, v0

lw v0, (v0)

nop

addu v0, v0, gp

jr v0

nop

jal 0x402d60

nop

b 0x4032c4

nop

lw s0, (s1)

lw t9, -sym.imp.strlen(gp)

nop

jalr t9

move a0, s0

sltiu v0, v0, 0x80

lw gp, 0x10(sp)

bnez v0, 0x403178

lui a0, 0x41

lw v0, -0x7ed8(gp)

lw t9, -sym.imp.fputs(gp)

lw a1, (v0)

b 0x4031c4

addiu a0, a0, 0x34

lw t9, -sym.imp.strcpy(gp)

move a1, s0

jalr t9

move a0, fp

b 0x40321c

nop

lw t9, -sym.imp.sscanf(gp)

lw a0, (s1)

move a1, s2

jalr t9

move a2, s6

lw v0, 0x20f0(s3)

lw gp, 0x10(sp)

bgtz v0, 0x40323c

lui a0, 0x41

lw v0, -0x7ed8(gp)

lw t9, -sym.imp.fputs(gp)

lw a1, (v0)

addiu a0, a0, 0x4c

jalr t9

nop

--

move a1, zero

lw v0, 0x2140(s1)

lw s2, 0x2a40(s0)

addiu s6, v0, -0x10

lui v0, 0x42

lw gp, 0x10(sp)

lw s4, 0x2a54(v0)

addiu s5, s2, 0x10

move s3, zero

b 0x40571c

addiu s7, zero, 0x3d

lw s1, 4(s4)

jalr t9

move a0, s1

lw gp, 0x10(sp)

lw a0, 8(s4)

lw t9, -sym.imp.strlen(gp)

nop

jalr t9

move s0, v0

addu s0, s0, v0

lw gp, 0x10(sp)

addiu s0, s0, 2

subu v0, s6, s3

sltu s0, v0, s0

lw t9, -sym.imp.strcpy(gp)

move a1, s1

bnez s0, 0x405728

addu a0, s5, s3

jalr t9

nop

lw gp, 0x10(sp)

lw a0, 4(s4)

lw t9, -sym.imp.strlen(gp)

nop

jalr t9

nop

addu s0, s3, v0

lw gp, 0x10(sp)

addu v0, s5, s0

sb s7, (v0)

lw t9, -sym.imp.strcpy(gp)

lw a1, 8(s4)

addiu s0, s0, 1

jalr t9

addu a0, s5, s0

lw gp, 0x10(sp)

lw a0, 8(s4)

lw t9, -sym.imp.strlen(gp)

nop

jalr t9

nop

addu s0, s0, v0

addu v0, s5, s0

lw gp, 0x10(sp)

sb zero, (v0)

lw s4, (s4)

addiu s3, s0, 1

lw t9, -sym.imp.strlen(gp)

bnez s4, 0x405660

nop

lui v0, 0xdeda

--

addiu fp, v0, 0x1288

lui v0, 0x41

addiu s7, v0, 0x1298

move s2, zero

move s1, zero

lui s6, 0x42

b 0x407714

addiu s4, sp, 0xc0

lw t9, -sym.lrgbin_pa_get_nth(gp)

lui a0, 0x42

addiu a0, a0, 0x2a98

jalr t9

move a1, s2

lw gp, 0x18(sp)

beqz v0, 0x407728

move s0, v0

lw t9, -sym.imp.strncasecmp(gp)

move a0, v0

move a1, fp

jalr t9

addiu a2, zero, 0xf

lw gp, 0x18(sp)

bnez v0, 0x4076cc

nop

move s0, s4

lw t9, -sym.imp.strcpy(gp)

addu a0, s3, s1

jalr t9

move a1, s0

lw gp, 0x18(sp)

move a0, s0

lw t9, -sym.imp.strlen(gp)

nop

jalr t9

addiu s2, s2, 1

lw gp, 0x18(sp)

addu v0, s1, v0

lw t9, -sym.imp.strcpy(gp)

addu a0, s3, v0

move a1, s7

jalr t9

addiu s1, v0, 2

lw gp, 0x18(sp)

lw v0, 0x2a80(s6)

nop

sltu v0, s2, v0

bnez v0, 0x407688

nop

lw t9, -sym.imp.strcpy(gp)

lui a1, 0x41

addiu a1, a1, 0x1298

jalr t9

addu a0, s3, s1

lw gp, 0x18(sp)

lui v0, 0x42

lw a1, 0x2a88(v0)

lui v0, 0x42

lw t9, -sym.imp.memcpy(gp)

addiu a0, s1, 2

lw a2, 0x2a84(v0)

jalr t9

addu a0, s3, a0

lui v0, 0x42

lw v1, 0x2180(v0)

addiu v0, zero, 1

lw gp, 0x18(sp)

beq v1, v0, 0x407788

addiu v0, zero, 2

bne v1, v0, 0x407d64

--

move s2, a1

beqz a1, 0x40de88

move v1, zero

lw t9, -sym.imp.strlen(gp)

nop

jalr t9

move a0, a1

lw gp, 0x10(sp)

bnez v0, 0x40de3c

move s1, v0

b 0x40de88

move v1, zero

jal 0x40dd44

nop

lw gp, 0x10(sp)

bltz v0, 0x40de88

addiu v1, zero, -1

lw v1, 0x10(s0)

lw v0, 0xc(s0)

nop

subu v0, v0, v1

sltu v0, v0, s1

bnez v0, 0x40de28

move a0, s0

lw a0, 0x14(s0)

lw t9, -sym.imp.strcpy(gp)

addu a0, a0, v1

jalr t9

move a1, s2

lw v0, 0x10(s0)

lw gp, 0x10(sp)

addu v0, v0, s1

move v1, zero

b 0x40de88

sw v0, 0x10(s0)

addiu v1, zero, -1

lw ra, 0x24(sp)

move v0, v1

lw s2, 0x20(sp)

lw s1, 0x1c(sp)

lw s0, 0x18(sp)

jr ra

addiu sp, sp, 0x28

bnez a0, 0x40deb4

addiu v0, zero, -1

jr ra

[*] Function strcpy used 7 times rgbin