[*] Binary protection state of dhcp6s
RELRO CANARY NX PIE RPATH RUNPATH SYMBOLS
No RELRO No Canary found NX disabled No PIE No RPATH No RUNPATH No Symbols
[*] Function fprintf tear down of dhcp6s
nop
bnez v0, 0x409784
move a0, zero
lw t9, -sym.imp.daemon(gp)
nop
jalr t9
move a1, zero
lw gp, 0x18(sp)
bltz v0, 0x40a4a0
lui a1, 0x42
lw t9, -sym.imp.getpid(gp)
nop
jalr t9
nop
lw gp, 0x18(sp)
lui v1, 0x44
lw t9, -sym.imp.fopen(gp)
lw a0, -0x7760(v1)
lui a1, 0x42
addiu a1, a1, 0x2c30
jalr t9
move s1, v0
lw gp, 0x18(sp)
beqz v0, 0x4097f4
move s0, v0
lw t9, -sym.imp.fprintf(gp)
lui a1, 0x42
addiu a1, a1, 0x23c4
move a2, s1
jalr t9
move a0, v0
lw gp, 0x18(sp)
nop
lw t9, -sym.imp.fclose(gp)
nop
jalr t9
move a0, s0
lw gp, 0x18(sp)
lw v0, -0x59c4(s6)
nop
beqz v0, 0x409830
lui s0, 0x44
lw v0, (s7)
nop
bnez v0, 0x40a43c
lui a1, 0x42
--
nop
jalr t9
move a0, zero
lw gp, 0x30(sp)
bltz v0, 0x40ac4c
sw v0, 0x3c(sp)
lw t9, -sym.imp.localtime(gp)
nop
jalr t9
addiu a0, sp, 0x3c
lw gp, 0x30(sp)
lw v1, 0x10(v0)
lw a0, -0x7dfc(gp)
sll v1, v1, 2
addu a1, sp, v1
lw a0, (a0)
lw a2, 0x40(a1)
lw t2, (v0)
lw a3, 0xc(v0)
lw v1, 0x14(v0)
lw t1, 8(v0)
lw t0, 4(v0)
bnez s1, 0x40ac40
lui v0, 0x42
addiu a1, v0, 0x2380
lw t9, -sym.imp.fprintf(gp)
sw a1, 0x24(sp)
addiu v0, v1, 0x76c
lui a1, 0x42
sw s2, 0x20(sp)
sw s3, 0x28(sp)
sw v0, 0x10(sp)
sw t1, 0x14(sp)
sw t0, 0x18(sp)
sw t2, 0x1c(sp)
jalr t9
addiu a1, a1, 0x2ac4
lw ra, 0x884(sp)
lw gp, 0x30(sp)
lw s3, 0x880(sp)
lw s2, 0x87c(sp)
lw s1, 0x878(sp)
lw s0, 0x874(sp)
jr ra
addiu sp, sp, 0x888
lui v0, 0x42
--
sw zero, 4(s3)
lui v0, 0x44
lw a1, -0x7750(v0)
addiu v1, zero, 1
beq a1, v1, 0x40ecd4
addiu v0, zero, 3
beq a1, v0, 0x40ed64
nop
jal sym.duidstr
move a0, s3
lui a2, 0x42
move a3, v0
addiu a1, s2, 0x3fb4
addiu a2, a2, 0x3428
jal sym.dprintf
addiu a0, zero, 7
lw gp, 0x18(sp)
nop
lw v0, -0x7dfc(gp)
nop
lw s0, (v0)
jal sym.duidstr
move a0, s3
lw gp, 0x18(sp)
lui a1, 0x42
lw t9, -sym.imp.fprintf(gp)
lui a2, 0x42
move a0, s0
addiu a1, a1, 0x3444
addiu a2, a2, 0x3fa8
jalr t9
move a3, v0
lw gp, 0x18(sp)
lui a1, 0x42
lw t9, -sym.imp.fopen(gp)
addiu a1, a1, 0x3464
jalr t9
move a0, s4
lw gp, 0x18(sp)
move s1, v0
beqz v0, 0x40edac
lui s0, 0x42
lw t9, -sym.imp.fwrite(gp)
addiu a0, sp, 0x20
addiu a1, zero, 2
addiu a2, zero, 1
--
addiu a1, s2, 0x3fb4
addiu a2, a2, 0x196c
jal sym.dprintf
addiu a0, zero, 3
lw gp, 0x18(sp)
beqz s1, 0x40e98c
nop
b 0x40e978
nop
lui s0, 0x44
lw a2, -0x5928(s0)
addiu a0, sp, 0x24
jal 0x40e720
addiu a3, sp, 0x22
lw gp, 0x18(sp)
bgez v0, 0x40eb84
move a0, v0
lui a2, 0x42
addiu a1, s2, 0x3fb4
addiu a2, a2, 0x33ac
jal sym.dprintf
addiu a0, zero, 6
lw gp, 0x18(sp)
lw v0, -0x5928(s0)
lw v1, -0x7dfc(gp)
lw t9, -sym.imp.fprintf(gp)
lb a2, (v0)
lw a0, (v1)
lui a1, 0x42
jalr t9
addiu a1, a1, 0x33d0
lw gp, 0x18(sp)
b 0x40e98c
nop
lui a2, 0x42
addiu a1, s2, 0x3fb4
addiu a2, a2, 0x33ac
jal sym.dprintf
addiu a0, zero, 6
lw gp, 0x18(sp)
lw v0, -0x5924(s0)
b 0x40ec88
nop
lhu v0, 0x22(sp)
lw t9, -sym.imp.time(gp)
sll v1, v0, 8
--
lw s2, 0x20(sp)
move v0, zero
lw s1, 0x1c(sp)
lw s0, 0x18(sp)
sw zero, -0x31fc(v1)
jr ra
addiu sp, sp, 0x28
lui gp, 0x44
addiu gp, gp, 0x900
lw t9, -sym.imp.realloc(gp)
nop
jr t9
nop
lui gp, 0x44
addiu gp, gp, 0x900
lw t9, -sym.imp.malloc(gp)
nop
jr t9
nop
lui gp, 0x44
addiu sp, sp, -0x20
addiu gp, gp, 0x900
sw ra, 0x1c(sp)
sw gp, 0x10(sp)
lw v0, -0x7dfc(gp)
lw t9, -sym.imp.fprintf(gp)
move a2, a0
lui a1, 0x42
lw a0, (v0)
jalr t9
addiu a1, a1, 0x6350
lw gp, 0x10(sp)
nop
lw t9, -sym.imp.exit(gp)
nop
jalr t9
addiu a0, zero, 2
lui gp, 0x44
addiu sp, sp, -0x28
addiu gp, gp, 0x900
sw ra, 0x24(sp)
sw s2, 0x20(sp)
sw s1, 0x1c(sp)
sw s0, 0x18(sp)
sw gp, 0x10(sp)
lui s1, 0x44
[*] Function fprintf used 5 times dhcp6s
