[*] Binary protection state of rdisc6
RELRO CANARY NX PIE RPATH RUNPATH SYMBOLS
No RELRO No Canary found NX disabled No PIE No RPATH No RUNPATH No Symbols
[*] Function strcpy tear down of rdisc6
nop
lw v1, -obj.eui64(gp)
nop
lw v0, (v1)
nop
sw v0, 8(s1)
lw v0, 4(v1)
b 0x40178c
sw v0, 0xc(s1)
lw t9, -sym.imp.memset(gp)
addiu s2, sp, 0x20
move a0, s2
move a1, zero
jalr t9
addiu a2, zero, 0x20
lw gp, 0x10(sp)
nop
lw t9, -sym.imp.strlen(gp)
lw a0, -obj.g_ifname(gp)
jalr t9
nop
sltiu v0, v0, 0x10
lw gp, 0x10(sp)
beqz v0, 0x401720
nop
lw t9, -sym.imp.strcpy(gp)
lw a1, -obj.g_ifname(gp)
jalr t9
move a0, s2
lw gp, 0x10(sp)
addiu a0, zero, 0xa
lw t9, -sym.imp.socket(gp)
addiu a1, zero, 1
jalr t9
move a2, zero
move s0, v0
addiu v0, zero, -1
lw gp, 0x10(sp)
beq s0, v0, 0x401720
move a2, s2
lw t9, -sym.imp.ioctl(gp)
move a0, s0
jalr t9
ori a1, zero, 0x8927
lw gp, 0x10(sp)
beqz v0, 0x4016f0
--
addiu s3, s3, 1
addiu s4, s4, -1
blez v0, 0x4028c0
sltu v1, s1, s6
bnez v1, 0x402834
nop
b 0x4028c8
nop
bnez v1, 0x4027d4
nop
bnez s4, 0x402938
addiu v0, zero, -1
lw v0, -obj.gverbose(gp)
nop
lbu v0, (v0)
nop
andi v0, v0, 3
beqz v0, 0x402904
lui a0, 0x40
lw t9, -sym.imp.printf(gp)
addiu a0, a0, 0x4e78
jalr t9
addiu a1, sp, 0x18
lw gp, 0x10(sp)
nop
lw t9, -sym.imp.strcpy(gp)
addiu s0, sp, 0x218
move a0, s0
jalr t9
addiu a1, sp, 0x18
lui a0, 0x40
addiu a0, a0, 0x4e84
jal 0x402480
move a1, s0
lw gp, 0x10(sp)
b 0x402938
move v0, zero
addiu v0, zero, -1
lw ra, 0x33c(sp)
lw fp, 0x338(sp)
lw s7, 0x334(sp)
lw s6, 0x330(sp)
lw s5, 0x32c(sp)
lw s4, 0x328(sp)
lw s3, 0x324(sp)
lw s2, 0x320(sp)
--
jalr t9
nop
jal 0x40118c
nop
jal 0x401cb0
nop
lw gp, 0x20(sp)
lui v0, 0x42
lw a0, -0x7d04(v0)
lw t9, -sym.imp.close(gp)
nop
jalr t9
nop
b 0x404040
nop
lw t9, -sym.imp.inet_ntop(gp)
addiu a0, zero, 0xa
addiu a1, sp, 0x98
move a2, s0
addiu a3, zero, 0x2e
jalr t9
sw v0, 0xa8(sp)
lw gp, 0x20(sp)
lw v1, 0x8c8(sp)
lw a0, -obj.g_ifname(gp)
lw t9, -sym.imp.strcpy(gp)
andi v1, v1, 3
lw a1, 0x8c4(sp)
jalr t9
sw v1, 0x894(sp)
lw a0, 0x894(sp)
lw gp, 0x20(sp)
beqz a0, 0x402df0
lui a0, 0x40
lw t9, -sym.imp.printf(gp)
lw a3, 0x8c4(sp)
addiu a0, a0, 0x4ea4
move a1, s3
jalr t9
move a2, s0
lw gp, 0x20(sp)
nop
lw t9, -sym.imp.memcpy(gp)
addiu a0, sp, 0xac
addiu a1, sp, 0x90
jalr t9
--
sltiu v0, s1, 3
bnez v0, 0x403cf8
srl s6, s1, 1
move s0, zero
addiu s1, s3, 8
addiu s2, sp, 0x140
lw fp, -obj.gverbose(gp)
b 0x403c0c
addiu s4, sp, 0x1b0
jalr t9
nop
lw gp, 0x20(sp)
beqz v0, 0x403cf8
nop
lbu v0, (fp)
nop
andi v0, v0, 3
beqz v0, 0x403bc4
lui a0, 0x40
lw t9, -sym.imp.printf(gp)
addiu a0, a0, 0x5304
jalr t9
move a1, s2
lw gp, 0x20(sp)
nop
lw t9, -sym.imp.strcpy(gp)
lw v0, -sym.imp.strcat(gp)
move a0, s4
beqz s0, 0x403be4
move a1, s2
move a0, s4
move a1, s2
move t9, v0
jalr t9
addiu s0, s0, 1
lw gp, 0x20(sp)
lui a1, 0x40
lw t9, -sym.imp.strcat(gp)
move a0, s4
jalr t9
addiu a1, a1, 0x4c5c
lw gp, 0x20(sp)
addiu s1, s1, 0x10
sltu v0, s0, s6
lw t9, -sym.imp.inet_ntop(gp)
move a1, s1
--
lw gp, 0x18(sp)
lui a0, 0x40
lw t9, -sym.imp.printf(gp)
addiu a0, a0, 0x57b0
addiu a1, zero, 0x7d4
jalr t9
addiu a2, zero, 0x7d7
lw gp, 0x18(sp)
lui a0, 0x40
lw t9, -sym.imp.puts(gp)
nop
jalr t9
addiu a0, a0, 0x57dc
lw gp, 0x18(sp)
b 0x4046ac
move v0, zero
andi v0, s3, 3
xori v0, v0, 3
sltu v0, zero, v0
b 0x404558
addu s3, s3, v0
lw a1, (s1)
nop
beqz a1, 0x404488
lui a0, 0x40
lw t9, -sym.imp.strcpy(gp)
lw a0, -obj.configfile(gp)
jalr t9
nop
lw gp, 0x18(sp)
nop
lw a1, -obj.gverbose(gp)
nop
lbu v0, (a1)
nop
beqz v0, 0x404558
lui a0, 0x40
lw t9, -sym.imp.printf(gp)
lw a1, -obj.configfile(gp)
b 0x4044ec
addiu a0, a0, 0x5874
lw t9, -sym.imp.puts(gp)
b 0x404504
addiu a0, a0, 0x588c
lw a1, (s1)
nop
[*] Function strcpy used 5 times rdisc6
