[*] Binary protection state of pppd

  	RELRO          CANARY            NX           PIE          RPATH        RUNPATH      SYMBOLS      

  	No RELRO       No Canary found   NX disabled  No PIE       No RPATH     No RUNPATH   No Symbols

[*] Function system tear down of pppd

move a2, s1

jalr t9

move a0, v0

lw gp, 0x18(sp)

move a0, s0

lw t9, -sym.imp.fclose(gp)

nop

jalr t9

addiu s0, sp, 0x20

lw gp, 0x18(sp)

lui v1, 0x46

lui v0, 0x46

lhu a0, -0xed8(v0)

lw v0, -0xed4(v1)

lw t9, -sym.imp.sprintf(gp)

lw a2, -obj.linkname(gp)

lui a1, 0x44

sw a0, 0x10(sp)

addiu a1, a1, 0x2d4c

move a3, s1

move a0, s0

jalr t9

sw v0, 0x14(sp)

lw gp, 0x18(sp)

nop

lw t9, -sym.imp.system(gp)

nop

jalr t9

move a0, s0

lw gp, 0x18(sp)

lw ra, 0x6c(sp)

lw s1, 0x68(sp)

lw s0, 0x64(sp)

jr ra

addiu sp, sp, 0x70

lw t9, -sym.slprintf(gp)

lui a3, 0x44

sw v1, 0x10(sp)

addiu a2, a2, 0x2d3c

addiu a3, a3, 0x2b48

addiu a0, s0, -0xec8

jalr t9

addiu a1, zero, 0x1000

lw gp, 0x18(sp)

bnez s1, 0x40743c

nop

--

lw t9, -sym.script_setenv(gp)

move a1, v0

move a2, zero

jalr t9

addiu a0, a0, -0x4da0

lw a0, 0x2c(s1)

lw a1, 0x30(s1)

jal 0x441080

nop

lw gp, 0x18(sp)

lui a0, 0x45

lw t9, -sym.script_setenv(gp)

move a1, v0

addiu a0, a0, -0x4d98

jalr t9

move a2, zero

lw gp, 0x18(sp)

lui a1, 0x45

lw a2, -obj.ifname(gp)

lw t9, -sym.imp.sprintf(gp)

addiu a1, a1, -0x4d8c

jalr t9

move a0, s0

lw gp, 0x18(sp)

nop

lw t9, -sym.imp.system(gp)

nop

jalr t9

move a0, s0

lw gp, 0x18(sp)

lui a1, 0x45

lw a2, -obj.ifname(gp)

lw t9, -sym.imp.sprintf(gp)

addiu a1, a1, -0x4d58

jalr t9

move a0, s0

lw gp, 0x18(sp)

nop

lw t9, -sym.imp.system(gp)

nop

jalr t9

move a0, s0

lw gp, 0x18(sp)

lui a0, 0x45

lw t9, -sym.imp.system(gp)

nop

jalr t9

addiu a0, a0, -0x4d40

lw gp, 0x18(sp)

nop

lw v0, -obj.demand(gp)

nop

lbu v1, (v0)

nop

beqz v1, 0x441ce8

nop

lw v1, 0x24(s2)

lw v0, 0x24(s3)

nop

beq v1, v0, 0x441e70

nop

lw a0, 0x24(s2)

lw a1, 0x28(s2)

jal 0x441080

nop

[*] Function system used 4 times pppd