[*] Binary protection state of httpd
RELRO CANARY NX PIE RPATH RUNPATH SYMBOLS
No RELRO No Canary found NX disabled No PIE No RPATH No RUNPATH No Symbols
[*] Function sprintf tear down of httpd
move s0, v0
lw a0, -0x7e14(gp)
addiu a3, s3, 5
lw a2, (a0)
b 0x402b80
move v1, zero
lb v0, (a0)
addiu a0, zero, 0x2d
sll v0, v0, 1
addu v0, a2, v0
lh v0, (v0)
nop
bne v0, a0, 0x402b7c
nop
addiu v0, zero, 0x5f
sb v0, 5(a1)
sltu v0, v1, s0
addu a0, s6, v1
addu a1, s3, v1
bnez v0, 0x402b58
addiu v1, v1, 1
lw a1, 0x3b8(sp)
lw v0, 0xda0(s5)
addu s0, a3, s0
addu v0, v0, a1
lw t9, -sym.imp.sprintf(gp)
lw a2, 4(v0)
lui a1, 0x41
move a0, s0
jalr t9
addiu a1, a1, 0xefc
addu s2, s0, v0
lw gp, 0x20(sp)
lw s1, 0x3b4(sp)
lw s0, 0x3b0(sp)
b 0x402c18
nop
lw v0, (s1)
addiu v1, zero, 1
bne v0, v1, 0x402c10
lui a1, 0x41
lw v0, 0xda0(s5)
lw t9, -sym.imp.sprintf(gp)
addu v0, v0, s0
lw a2, 4(v0)
move a0, s2
jalr t9
addiu a1, a1, 0xf00
addiu a0, zero, 2
lw gp, 0x20(sp)
addu s2, s2, v0
sw a0, (s1)
addiu s1, s1, 4
addiu s0, s0, 8
lw a1, 0x3bc(sp)
nop
sltu v0, s7, a1
bnez v0, 0x402bd4
addiu s7, s7, 1
lw a1, 0x38(sp)
lw t9, -sym.imp.realloc(gp)
lw a0, 0x30(sp)
addiu a1, a1, 1
--
beq v0, s2, 0x4032bc
nop
lw s0, 0x9ac(s5)
lw a1, 0x9a8(s5)
beqz s0, 0x402f34
move a3, s1
lw t9, -sym.imp.strlen(gp)
nop
jalr t9
move a0, a1
lw gp, 0x20(sp)
move a0, s0
lw t9, -sym.imp.strlen(gp)
nop
jalr t9
move s0, v0
lw gp, 0x20(sp)
addu s0, s0, v0
lw t9, -sym.imp.malloc(gp)
nop
jalr t9
addiu a0, s0, 2
lw gp, 0x20(sp)
beqz v0, 0x4032bc
move s0, v0
lw t9, -sym.imp.sprintf(gp)
lw a2, 0x9a8(s5)
lw a3, 0x9ac(s5)
lui a1, 0x41
addiu a1, a1, 0xf9c
jalr t9
move a0, v0
lui a0, 0x41
addiu a0, a0, 0xfa4
move a3, s1
move a1, s0
jal 0x402468
move a2, zero
lw gp, 0x20(sp)
nop
lw t9, -sym.imp.free(gp)
bne v0, s2, 0x402f24
move a0, s0
jalr t9
nop
lw gp, 0x20(sp)
--
beq v0, s0, 0x4032bc
move a2, zero
lw a1, -obj.server_version(gp)
lui a0, 0x41
addiu a0, a0, 0x1008
jal 0x402468
move a3, s1
lw gp, 0x20(sp)
beq v0, s0, 0x4032bc
nop
lw v0, (s5)
nop
lw v0, 0x10(v0)
nop
lw a1, 0x44(v0)
nop
beqz a1, 0x4030bc
lui a0, 0x41
addiu a0, a0, 0x1018
move a3, s1
jal 0x402468
move a2, zero
lw gp, 0x20(sp)
beq v0, s0, 0x4032bc
nop
lw t9, -sym.imp.sprintf(gp)
addiu s0, sp, 0x40
lw a2, 0x9b4(s5)
lw a3, 0x9b8(s5)
lui a1, 0x41
addiu a1, a1, 0x1024
jalr t9
move a0, s0
addiu s1, sp, 0x30
lui a0, 0x41
addiu a0, a0, 0x1030
move a1, s0
move a2, zero
jal 0x402468
move a3, s1
addiu v1, zero, -1
lw gp, 0x20(sp)
beq v0, v1, 0x4032bc
move s3, s1
lw v0, 0x9c4(s5)
nop
--
beqz v0, 0x4062f4
move s2, v0
lw t9, -sym.imp.strcpy(gp)
bnez s0, 0x40624c
addiu s1, v0, 9
lui a1, 0x41
addiu a1, a1, 0x1754
jalr t9
move a0, v0
lw gp, 0x10(sp)
lui v0, 0x41
move s3, s1
lw s5, -obj.pollfds(gp)
b 0x4061ac
addiu s6, v0, 0x1760
lw v0, (s5)
nop
addu v0, v0, v1
lw a2, (v0)
jalr t9
nop
lw gp, 0x10(sp)
addu s1, s1, v0
slt v0, s0, s4
sll v1, s0, 3
lw t9, -sym.imp.sprintf(gp)
move a0, s1
move a1, s6
bnez v0, 0x40618c
addiu s0, s0, 1
lw t9, -sym.log_d(gp)
nop
jalr t9
move a0, s2
lw gp, 0x10(sp)
lui a1, 0x41
lw t9, -sym.imp.strcpy(gp)
addiu a1, a1, 0x1768
jalr t9
move a0, s2
lw gp, 0x10(sp)
lui v0, 0x41
addiu s5, v0, 0x1774
lw s1, -obj.pollfds(gp)
b 0x406228
move s0, zero
lw v0, (s1)
nop
addu v0, v0, v1
lh a2, 4(v0)
jalr t9
nop
lw gp, 0x10(sp)
addu s3, s3, v0
slt v0, s0, s4
sll v1, s0, 3
lw t9, -sym.imp.sprintf(gp)
move a0, s3
move a1, s5
bnez v0, 0x406208
addiu s0, s0, 1
b 0x4062b0
nop
lui a1, 0x41
addiu a1, a1, 0x177c
jalr t9
move a0, v0
lw gp, 0x10(sp)
lui v0, 0x41
addiu s5, v0, 0x1774
lw s3, -obj.pollfds(gp)
b 0x406294
move s0, zero
lw v0, (s3)
nop
addu v0, v0, v1
lh a2, 6(v0)
jalr t9
nop
lw gp, 0x10(sp)
addu s1, s1, v0
slt v0, s0, s4
sll v1, s0, 3
lw t9, -sym.imp.sprintf(gp)
move a0, s1
move a1, s5
bnez v0, 0x406274
addiu s0, s0, 1
lw t9, -sym.log_d(gp)
nop
jalr t9
move a0, s2
lw gp, 0x10(sp)
move a0, s2
lw t9, -sym.imp.free(gp)
lw ra, 0x34(sp)
lw s6, 0x30(sp)
lw s5, 0x2c(sp)
lw s4, 0x28(sp)
lw s3, 0x24(sp)
lw s2, 0x20(sp)
lw s1, 0x1c(sp)
lw s0, 0x18(sp)
jr t9
--
lw t9, -sym.imp.fputs(gp)
move a1, s1
jalr t9
addiu a0, a0, 0x1cdc
lw ra, 0x8c(sp)
lw gp, 0x18(sp)
lw fp, 0x88(sp)
lw s7, 0x84(sp)
lw s6, 0x80(sp)
lw s5, 0x7c(sp)
lw s4, 0x78(sp)
lw s3, 0x74(sp)
lw s2, 0x70(sp)
lw s1, 0x6c(sp)
lw s0, 0x68(sp)
jr ra
addiu sp, sp, 0x90
lui gp, 0x43
addiu sp, sp, -0x58
addiu gp, gp, -0x4840
sw ra, 0x54(sp)
sw s1, 0x50(sp)
sw s0, 0x4c(sp)
sw gp, 0x10(sp)
lw v0, -obj.my_pid(gp)
lw t9, -sym.imp.sprintf(gp)
addiu s0, sp, 0x20
lw a2, (v0)
lui a1, 0x41
addiu a1, a1, 0x1cf0
jalr t9
move a0, s0
lw gp, 0x10(sp)
nop
lw t9, -sym.imp.mkstemp(gp)
nop
jalr t9
move a0, s0
move s1, v0
addiu v0, zero, -1
lw gp, 0x10(sp)
bne s1, v0, 0x4085e8
lui a1, 0x41
lw t9, -sym.lerror(gp)
lui a0, 0x41
jalr t9
--
sw v0, 0x18(sp)
lw gp, 0x10(sp)
move s3, v0
lw v0, -obj.log_gmt(gp)
lw s4, (s3)
lw v0, (v0)
nop
beqz v0, 0x40940c
nop
lw t9, -sym.imp.gmtime(gp)
b 0x409410
nop
lw t9, -sym.imp.localtime(gp)
lw a0, -obj.current_time(gp)
jalr t9
addiu s1, sp, 0x1c
lw gp, 0x10(sp)
move a0, v0
lw t9, -sym.imp.asctime(gp)
nop
jalr t9
addiu s0, zero, 0x3e7
lw gp, 0x10(sp)
lui a1, 0x41
lw v1, -obj.my_pid(gp)
lw t9, -sym.imp.sprintf(gp)
lw a3, (v1)
addiu a1, a1, 0x1f60
move a2, v0
jalr t9
move a0, s1
lw gp, 0x10(sp)
subu s0, s0, v0
lw t9, -sym.imp.vsnprintf(gp)
lw a3, 0x18(sp)
addu a0, s1, v0
move a2, s5
move a1, s0
jalr t9
move s2, v0
move v1, v0
slt v0, v0, s0
lw gp, 0x10(sp)
beqz v0, 0x409494
addiu a0, s0, -1
move a0, v1
--
move s0, s7
lw v0, (s1)
b 0x409c60
addiu s0, v0, 0x1c
lw v0, (s1)
b 0x409c60
addiu s0, v0, 0x56
lw v0, (s1)
b 0x409c60
addiu s0, v0, 0x5c
lw v0, (s1)
b 0x409c60
addiu s0, v0, 0x96
lw s0, 0x14(s1)
b 0x409c60
nop
lw s0, 0x9a4(s1)
b 0x409c60
nop
lw s0, 0x9a8(s1)
b 0x409c60
nop
lw s0, 0x9b0(s1)
b 0x409c60
nop
lw t9, -sym.imp.sprintf(gp)
lw a2, 0x9c0(s1)
b 0x409c44
lui a1, 0x41
lw v0, 0x988(s1)
nop
bltz v0, 0x409b54
move a2, zero
lw a2, 0x990(s1)
nop
nor v0, zero, a2
sra v0, v0, 0x1f
and a2, a2, v0
lui a1, 0x41
lw t9, -sym.imp.sprintf(gp)
move a0, s4
b 0x409c4c
addiu a1, a1, 0x1fd4
lw s0, 0xc(s1)
b 0x409c60
nop
lw s0, 8(s1)
b 0x409c60
nop
lw v0, (s1)
lw t9, -sym.imp.sprintf(gp)
lw a2, 0x120(v0)
lw a3, 0x124(v0)
b 0x409bac
lui a1, 0x41
lw v0, (s1)
lw t9, -sym.imp.sprintf(gp)
lw a2, 0x128(v0)
lw a3, 0x12c(v0)
lui a1, 0x41
move a0, s4
jalr t9
addiu a1, a1, 0x1fd8
b 0x409c54
nop
lw s0, 0x9ac(s1)
b 0x409c60
nop
lw v0, (s1)
nop
lw v1, 0x140(v0)
lw a0, 0x13c(v0)
lw v0, 0x20(sp)
nop
subu a3, v0, v1
lw v0, 0x1c(sp)
bgez a3, 0x409c04
subu a2, v0, a0
lui v0, 0xf
ori v0, v0, 0x4240
addu a3, a3, v0
addiu a2, a2, -1
lw t9, -sym.imp.sprintf(gp)
b 0x409c20
lui a1, 0x41
lw t9, -sym.imp.sprintf(gp)
lw a2, 0x1c(sp)
lw a3, 0x20(sp)
lui a1, 0x41
move a0, s4
jalr t9
addiu a1, a1, 0x1fdc
b 0x409c54
nop
lw v1, -obj.my_pid(gp)
lw t9, -sym.imp.sprintf(gp)
lw a2, (v1)
lui a1, 0x41
move a0, s4
addiu a1, a1, 0x17e8
jalr t9
nop
lw gp, 0x10(sp)
b 0x409c68
move s0, s4
beqz s0, 0x409c78
nop
lb v0, (s0)
nop
bnez v0, 0x409c94
nop
beqz s3, 0x409cec
addiu v0, zero, 9
addiu v0, zero, 0x2d
sb v0, (s2)
addiu s3, s3, -1
--
nop
sw v0, (s2)
addiu v0, zero, -1
lw gp, 0x18(sp)
beq s1, v0, 0x40ad8c
move a0, s1
lw t9, -sym.imp.ftruncate(gp)
nop
jalr t9
move a1, zero
lw gp, 0x18(sp)
nop
lw v0, -obj.tuning(gp)
nop
lw v0, 0x28(v0)
nop
slti v0, v0, 2
bnez v0, 0x40ad20
addiu s0, sp, 0x38
lw t9, -sym.imp.getpgrp(gp)
nop
jalr t9
nop
lw gp, 0x18(sp)
lui a1, 0x41
lw t9, -sym.imp.sprintf(gp)
move a0, s0
addiu a1, a1, 0x2338
b 0x40ad34
move a2, v0
lui a1, 0x41
lw a2, (s2)
lw t9, -sym.imp.sprintf(gp)
move a0, s0
addiu a1, a1, 0x1cd8
jalr t9
addiu s0, sp, 0x38
lw gp, 0x18(sp)
nop
lw t9, -sym.imp.strlen(gp)
nop
jalr t9
move a0, s0
lw gp, 0x18(sp)
move a1, s0
lw t9, -sym.imp.write(gp)
move a2, v0
jalr t9
move a0, s1
lw gp, 0x18(sp)
nop
lw t9, -sym.imp.close(gp)
nop
--
beqz v0, 0x40bb98
nop
lb v0, -1(s2)
nop
bne v0, s7, 0x40bdd8
nop
beqz s2, 0x40bdd8
nop
lw v0, 0x4c(s3)
nop
bnez v0, 0x40bc88
move s1, zero
lw v0, 0x50(sp)
lw s4, (s5)
lw s6, 0x14(v0)
addiu s5, fp, -1
lw s0, 0x4c(sp)
b 0x40bc24
addiu s7, zero, 0x2a
lb v0, (s4)
nop
beqz v0, 0x40bc30
nop
bne v0, s7, 0x40bc14
lui a1, 0x41
lw t9, -sym.imp.sprintf(gp)
move a0, s0
subu a2, s5, s1
addiu a1, a1, 0x26d8
beqz s6, 0x40bc14
move a3, s6
jalr t9
addiu s4, s4, 1
lw gp, 0x18(sp)
addu s1, s1, v0
b 0x40bc24
addu s0, s0, v0
sb v0, (s0)
addiu s1, s1, 1
addiu s0, s0, 1
addiu s4, s4, 1
sltu v0, s1, s5
bnez v0, 0x40bbcc
nop
sb zero, (s0)
lw v0, 0x18(s3)
lw v1, 0x50(sp)
lw v0, (v0)
sw s1, 0xd98(v1)
lb v1, (v0)
addiu v0, zero, 0x2f
beq v1, v0, 0x40bc64
nop
lw v0, 4(s3)
nop
bnez v0, 0x40bdf0
nop
lw v0, 0x4c(sp)
nor a2, zero, s1
lui a1, 0x41
lw t9, -sym.imp.sprintf(gp)
addu a0, v0, s1
addu a2, a2, fp
addiu a1, a1, 0x26d8
b 0x40bdc4
move a3, s2
lb v0, (s2)
lw t9, -sym.imp.strchr(gp)
xori v0, v0, 0x2f
sltiu v0, v0, 1
addu s2, s2, v0
move a0, s2
jalr t9
addiu a1, zero, 0x2f
lw gp, 0x18(sp)
beqz v0, 0x40bcb8
move s1, v0
sb zero, (v0)
lw t9, -sym.imp.getpwnam(gp)
nop
jalr t9
--
beqz v0, 0x40bdd8
nop
lw s0, 0x14(v0)
nop
beqz s0, 0x40bdd8
nop
lw t9, -sym.imp.strlen(gp)
nop
jalr t9
move a0, s0
move v1, v0
addiu v0, v0, 1
slt v0, v0, fp
lw gp, 0x18(sp)
bnez v0, 0x40bd38
subu a3, fp, v1
lui a0, 0x41
lw t9, -sym.log_d(gp)
addiu a0, a0, 0x26e0
jalr t9
move s3, zero
lw gp, 0x18(sp)
b 0x40be14
nop
lw v0, 0x18(s3)
lw t9, -sym.imp.sprintf(gp)
lw v0, (v0)
lw a0, 0x4c(sp)
lui a1, 0x41
sw v0, 0x10(sp)
addiu a1, a1, 0x26f8
move a2, s0
jalr t9
addiu a3, a3, -2
move a0, v0
lw v0, 0x50(sp)
lw gp, 0x18(sp)
beqz s1, 0x40bdf0
sw a0, 0xd98(v0)
lw v0, 0x18(s3)
nop
lw v0, (v0)
nop
lb v1, (v0)
addiu v0, zero, 0x2f
beq v1, v0, 0x40bda4
nop
lw v0, 4(s3)
nop
bnez v0, 0x40bdf0
nop
lw v1, 0x4c(sp)
nor a2, zero, a0
lui a1, 0x41
lw t9, -sym.imp.sprintf(gp)
addu a0, v1, a0
addu a2, a2, fp
addiu a1, a1, 0x26d8
move a3, s1
jalr t9
nop
lw gp, 0x18(sp)
b 0x40bdf0
nop
lw s3, 0x14(s3)
nop
bnez s3, 0x40bab0
nop
b 0x40be14
nop
lw v0, 0x54(sp)
nop
beqz v0, 0x40be14
nop
lw v0, 0x18(s3)
--
nop
beqz a2, 0x40ca1c
lui a1, 0x41
move a0, s1
jal sym.pool_print
addiu a1, a1, 0x2aac
addiu v1, zero, -1
lw gp, 0x20(sp)
beq v0, v1, 0x40ca90
addiu v0, zero, -1
lw v1, 0xc8(s3)
lw v0, 0xcc(s3)
nop
subu v0, v0, v1
sra v1, v0, 0x1f
sw v1, 0x994(s2)
bnez s6, 0x40ca58
sw v0, 0x990(s2)
lw t9, -sym.log_d(gp)
lui a0, 0x41
jalr t9
addiu a0, a0, 0x2ae4
lw gp, 0x20(sp)
b 0x40ca90
addiu v0, zero, -1
lw t9, -sym.imp.sprintf(gp)
lui a1, 0x41
move a0, s6
sw v0, 0x10(sp)
sw v1, 0x14(sp)
addiu a1, a1, 0x2afc
jalr t9
subu a2, s7, s6
addiu v0, zero, 0xd
lw gp, 0x20(sp)
sb v0, (s7)
b 0x40ca90
move v0, zero
addiu v0, zero, -1
lw ra, 0x7c(sp)
lw fp, 0x78(sp)
lw s7, 0x74(sp)
lw s6, 0x70(sp)
lw s5, 0x6c(sp)
lw s4, 0x68(sp)
lw s3, 0x64(sp)
--
addiu a0, a0, 0x2ea0
jalr t9
nop
b 0x40ec74
sw zero, 0x1298(s2)
lw v0, 0xa64(s2)
nop
bnez v0, 0x40ec8c
addiu s0, zero, 1
b 0x40eb08
nop
lw s3, 0xa64(s2)
nop
beqz s3, 0x40dc40
move s0, fp
lw s4, 0x14(s2)
move s1, zero
addiu s6, zero, 0x2a
addiu s5, zero, 0x31f
lb v0, (s3)
nop
beqz v0, 0x40dc34
addiu s3, s3, 1
bne v0, s6, 0x40dc1c
lui a1, 0x41
lw t9, -sym.imp.sprintf(gp)
move a0, s0
subu a2, s5, s1
addiu a1, a1, 0x26d8
beqz s4, 0x40dc1c
move a3, s4
jalr t9
nop
lw gp, 0x18(sp)
addu s1, s1, v0
b 0x40dc28
addu s0, s0, v0
sb v0, (s0)
addiu s1, s1, 1
addiu s0, s0, 1
sltiu v0, s1, 0x31f
bnez v0, 0x40dbd4
nop
sb zero, (s0)
sw s1, 0xd98(s2)
sw zero, 0xa64(s2)
--
beqz v0, 0x4101f4
nop
lw v0, 0x150(s2)
nop
beqz v0, 0x4100b0
subu s1, a2, a0
lw v0, 0xf4(s2)
nop
sw v0, 0xfc(s2)
b 0x4101f4
sw v0, 0x104(s2)
lw v0, 0xcc(s2)
lw v1, 0xc0(s2)
nop
subu s3, v1, v0
sltu v0, s3, s1
beqz v0, 0x4100d0
nop
move s1, s3
beqz s1, 0x4101f4
nop
lw v0, 0x14c(s2)
nop
beqz v0, 0x410170
addiu s4, sp, 0x24
lw t9, -sym.imp.sprintf(gp)
lui s5, 0x41
move a0, s4
addiu a1, s5, 0x3618
jalr t9
move a2, s1
move s0, v0
addiu v0, v0, 2
sltu v0, v0, s3
lw gp, 0x18(sp)
beqz v0, 0x4101f4
addiu v0, s1, 2
addu v0, v0, s0
sltu v0, s3, v0
beqz v0, 0x410148
addiu v0, s1, -2
subu s1, v0, s0
lw t9, -sym.imp.sprintf(gp)
move a0, s4
addiu a1, s5, 0x3618
jalr t9
move a2, s1
lw gp, 0x18(sp)
move s0, v0
lw t9, -sym.imp.memcpy(gp)
lw a0, 0xcc(s2)
addiu a1, sp, 0x24
jalr t9
move a2, s0
lw v0, 0xcc(s2)
lw gp, 0x18(sp)
addu v0, v0, s0
beqz s1, 0x4101f4
sw v0, 0xcc(s2)
lw t9, -sym.imp.memcpy(gp)
lw a0, 0xcc(s2)
lw a1, 0xfc(s2)
jalr t9
[*] Function sprintf used 26 times httpd
