[*] Binary protection state of klogd
RELRO CANARY NX PIE RPATH RUNPATH SYMBOLS
No RELRO No Canary found NX disabled No PIE No RPATH No RUNPATH Symbols
[*] Function printf tear down of klogd
lw gp, 0x10(sp)
move a0, zero
lw t9, -sym.imp.klogctl(gp)
move a1, zero
jalr t9
move a2, zero
lw gp, 0x10(sp)
nop
lw t9, -sym.imp.exit(gp)
nop
jalr t9
move a0, zero
lui gp, 0x42
addiu sp, sp, -0x28
addiu gp, gp, -0x5960
sw ra, 0x24(sp)
sw gp, 0x10(sp)
lui v0, 0x41
lw v0, 0x2790(v0)
sw a1, 0x2c(sp)
sw a2, 0x30(sp)
sw a3, 0x34(sp)
beqz v0, 0x400c14
move a1, a0
lw v0, -0x7f7c(gp)
lw t9, -sym.imp.vfprintf(gp)
addiu a2, sp, 0x2c
lw a0, (v0)
jalr t9
sw a2, 0x18(sp)
lw gp, 0x10(sp)
lw ra, 0x24(sp)
nop
jr ra
addiu sp, sp, 0x28
lui gp, 0x42
addiu sp, sp, -0x38
addiu gp, gp, -0x5960
sw ra, 0x34(sp)
sw s6, 0x30(sp)
sw s5, 0x2c(sp)
sw s4, 0x28(sp)
sw s3, 0x24(sp)
sw s2, 0x20(sp)
sw s1, 0x1c(sp)
sw s0, 0x18(sp)
--
lw t9, -sym.imp.puts(gp)
nop
jalr t9
addiu a0, a0, 0x1ff0
lui v0, 0x41
addiu s1, v0, 0x2530
lui v0, 0x40
lw gp, 0x10(sp)
addiu s5, v0, 0x2000
move s0, zero
addiu s3, zero, 5
b 0x400d0c
addiu s4, zero, 4
bnez s3, 0x400cb0
div zero, s0, s3
break 7
mfhi s2
bnez s2, 0x400cd4
nop
lw t9, -sym.imp.putchar(gp)
nop
jalr t9
addiu a0, zero, 9
lw gp, 0x10(sp)
nop
lw t9, -sym.imp.printf(gp)
lw a1, (s1)
jalr t9
move a0, s5
lw gp, 0x10(sp)
bne s2, s4, 0x400d04
nop
lw t9, -sym.imp.putchar(gp)
nop
jalr t9
addiu a0, zero, 0xa
lw gp, 0x10(sp)
addiu s0, s0, 1
addiu s1, s1, 8
lw v0, (s1)
nop
bnez v0, 0x400ca4
nop
lw t9, -sym.imp.putchar(gp)
nop
jalr t9
--
lw t9, -sym.imp.exit(gp)
nop
jalr t9
move a0, s6
lui gp, 0x42
addiu sp, sp, -0x28
addiu gp, gp, -0x5960
sw ra, 0x24(sp)
sw s2, 0x20(sp)
sw s1, 0x1c(sp)
sw s0, 0x18(sp)
sw gp, 0x10(sp)
lw t9, -sym.imp.strcmp(gp)
move s1, a1
lui a1, 0x40
addiu a1, a1, 0x2024
move s2, a0
move a0, a2
jalr t9
move s0, a2
lw gp, 0x10(sp)
lw a3, 0x38(sp)
lw a0, 0x3c(sp)
lw v1, 0x40(sp)
lw a1, 0x44(sp)
lw t9, -sym.imp.sprintf(gp)
bnez v0, 0x400dd8
nop
sw a1, 0x40(sp)
lui a1, 0x40
sw v1, 0x38(sp)
sw s1, 0x44(sp)
move a0, s2
b 0x400df4
addiu a1, a1, 0x202c
sw a1, 0x40(sp)
lui a1, 0x40
sw a0, 0x38(sp)
sw v1, 0x3c(sp)
sw s1, 0x44(sp)
move a0, s2
addiu a1, a1, 0x2068
move a2, s0
lw ra, 0x24(sp)
lw s2, 0x20(sp)
lw s1, 0x1c(sp)
--
nop
sb zero, (v0)
addiu v1, fp, -1
sltiu v0, v1, 9
beqz v0, 0x4017cc
move a2, s2
lui a2, 0x40
sll v0, v1, 2
addiu a2, a2, 0x24c0
addu v0, a2, v0
lw v0, (v0)
nop
addu v0, v0, gp
jr v0
addiu a0, sp, 0x98
lui a1, 0x40
b 0x4017c0
addiu a1, a1, 0x2180
lw t9, -sym.imp.strcmp(gp)
lui a1, 0x40
move a0, s2
jalr t9
addiu a1, a1, 0x2024
lw gp, 0x20(sp)
nop
lw t9, -sym.imp.sprintf(gp)
bnez v0, 0x401738
addiu a0, sp, 0x98
lui a1, 0x40
sw s4, 0x10(sp)
sw s1, 0x14(sp)
sw s0, 0x18(sp)
b 0x40174c
addiu a1, a1, 0x2194
lui a1, 0x40
sw s1, 0x10(sp)
sw s4, 0x14(sp)
sw s0, 0x18(sp)
addiu a1, a1, 0x21d0
move a2, s2
jalr t9
move a3, s3
b 0x4017f0
nop
lw t9, -sym.imp.sprintf(gp)
lui a1, 0x40
addiu a1, a1, 0x2200
jalr t9
move a2, s3
b 0x4017f0
nop
lui a1, 0x40
b 0x4017c0
addiu a1, a1, 0x221c
lui a1, 0x40
b 0x4017c0
addiu a1, a1, 0x2234
lui a1, 0x40
b 0x4017c0
addiu a1, a1, 0x224c
lui a1, 0x40
b 0x4017c0
addiu a1, a1, 0x2260
lui a1, 0x40
b 0x4017c0
--
beqz v0, 0x401c24
lui a1, 0x40
lw t9, -sym.imp.strstr(gp)
sb zero, (v0)
addiu a0, v0, 1
jalr t9
addiu a1, a1, 0x2134
lw gp, 0x20(sp)
beqz v0, 0x4018cc
move s1, v0
lw t9, -sym.imp.strchr(gp)
addiu s1, v0, 4
move a0, s1
jalr t9
addiu a1, zero, 0x20
lw gp, 0x20(sp)
beqz v0, 0x401c24
nop
sb zero, (v0)
lw t9, -sym.imp.atoi(gp)
nop
jalr t9
move a0, s3
lw gp, 0x20(sp)
addiu s5, sp, 0x118
lw t9, -sym.imp.snprintf(gp)
lw a3, 0x1318(sp)
lui a2, 0x40
addiu a2, a2, 0x22c4
move a0, s5
addiu a1, zero, 0xff
jalr t9
sw v0, 0x10(sp)
lw gp, 0x20(sp)
lui a1, 0x40
lw t9, -sym.imp.popen(gp)
addiu a1, a1, 0x2360
jalr t9
move a0, s5
lw gp, 0x20(sp)
beqz v0, 0x401c24
move s4, v0
addiu s0, sp, 0x218
lw t9, -sym.imp.memset(gp)
move a0, s0
move a1, zero
jalr t9
addiu a2, zero, 0x100
lw gp, 0x20(sp)
move a2, s4
lw t9, -sym.imp.fgets(gp)
move a0, s0
jalr t9
addiu a1, zero, 0x100
lw gp, 0x20(sp)
addiu a1, zero, 0xa
lw t9, -sym.imp.strchr(gp)
nop
jalr t9
move a0, s0
lw gp, 0x20(sp)
move a0, s3
lw t9, -sym.imp.atoi(gp)
nop
jalr t9
sb zero, (v0)
lw gp, 0x20(sp)
lui a2, 0x40
lw t9, -sym.imp.snprintf(gp)
move a3, s2
addiu a2, a2, 0x22d0
move a0, s5
addiu a1, zero, 0xff
sw v0, 0x10(sp)
sw s1, 0x14(sp)
jalr t9
sw s0, 0x18(sp)
lw gp, 0x20(sp)
lw a1, 0x131c(sp)
lw t9, -sym.imp.printf(gp)
lui a0, 0x40
addiu a0, a0, 0x22dc
jalr t9
move a2, s5
lw gp, 0x20(sp)
addiu a0, zero, 1
lw t9, -sym.imp.socket(gp)
addiu a1, zero, 1
jalr t9
move a2, zero
lw gp, 0x20(sp)
bltz v0, 0x401aa8
move s2, v0
lw t9, -sym.imp.memset(gp)
addiu s1, sp, 0x28
move a0, s1
move a1, zero
jalr t9
addiu a2, zero, 0x6e
lw gp, 0x20(sp)
--
jalr t9
move a0, s2
lw gp, 0x20(sp)
nop
lw t9, -sym.imp.pclose(gp)
nop
jalr t9
move a0, s4
b 0x401c20
nop
lw t9, -sym.imp.strncmp(gp)
move a0, s3
addiu a1, a1, 0x22f4
jalr t9
addiu a2, zero, 6
lw gp, 0x20(sp)
bnez v0, 0x401b20
move a0, s3
lw t9, -sym.imp.strstr(gp)
lui a1, 0x40
jalr t9
addiu a1, a1, 0x22fc
lw gp, 0x20(sp)
beqz v0, 0x401c24
addiu s0, sp, 0x98
lw t9, -sym.imp.snprintf(gp)
lui a2, 0x40
addiu a2, a2, 0x2304
move a3, v0
move a0, s0
jalr t9
addiu a1, zero, 0x80
b 0x401c00
nop
lw t9, -sym.imp.strncmp(gp)
lui a1, 0x40
addiu a1, a1, 0x2308
jalr t9
addiu a2, zero, 7
lw gp, 0x20(sp)
bnez v0, 0x401c24
addiu a0, sp, 0x218
lw t9, -sym.imp.memset(gp)
move a1, zero
jalr t9
addiu a2, zero, 0x100
--
jalr t9
addiu a1, zero, 0x20
lw gp, 0x20(sp)
beqz v0, 0x401c24
addiu s3, v0, 1
sb zero, (v0)
lw t9, -sym.imp.strstr(gp)
lui a1, 0x40
move a0, s3
jalr t9
addiu a1, a1, 0x2310
lw gp, 0x20(sp)
beqz v0, 0x401bdc
move s1, v0
lw t9, -sym.imp.strchr(gp)
addiu s1, v0, 5
move a0, s1
jalr t9
addiu a1, zero, 0x20
lw gp, 0x20(sp)
beqz v0, 0x401c24
nop
sb zero, (v0)
addiu s0, sp, 0x218
lui a2, 0x40
lw t9, -sym.imp.snprintf(gp)
sw s2, 0x10(sp)
move a3, s1
move a0, s0
addiu a1, zero, 0xff
jalr t9
addiu a2, a2, 0x2318
lw gp, 0x20(sp)
lui a1, 0x40
lw t9, -sym.imp.syslog(gp)
addiu a1, a1, 0x22b4
move a2, s0
addiu a0, zero, 0xe5
jalr t9
nop
lw gp, 0x20(sp)
beqz s6, 0x40113c
nop
lb v0, (s6)
nop
beqz v0, 0x40113c
[*] Function printf used 10 times klogd
