[*] Binary protection state of cgibin
RELRO CANARY NX PIE RPATH RUNPATH SYMBOLS
No RELRO No Canary found NX disabled No PIE No RPATH No RUNPATH No Symbols
[*] Function strcpy tear down of cgibin
jr ra
addiu sp, sp, 0x20
nop
lui gp, 0x44
addiu sp, sp, -0x148
addiu gp, gp, -0x75f0
sw ra, 0x144(sp)
sw fp, 0x140(sp)
sw s7, 0x13c(sp)
sw s6, 0x138(sp)
sw s5, 0x134(sp)
sw s4, 0x130(sp)
sw s3, 0x12c(sp)
sw s2, 0x128(sp)
sw s1, 0x124(sp)
sw s0, 0x120(sp)
sw gp, 0x18(sp)
lw t9, -sym.imp.getenv(gp)
lui a0, 0x42
jalr t9
addiu a0, a0, -0x202c
lw gp, 0x18(sp)
bnez v0, 0x40a404
move s0, v0
lui a1, 0x42
lw t9, -sym.imp.strcpy(gp)
b 0x40a490
addiu a1, a1, -0x19c0
lw t9, -sym.imp.strcasecmp(gp)
lui a1, 0x42
addiu a1, a1, -0x2010
jalr t9
move a0, v0
lw gp, 0x18(sp)
bnez v0, 0x40a438
lui a0, 0x41
lw t9, -sym.cgibin_parse_request(gp)
addiu a0, a0, -0x5640
move a1, zero
b 0x40a468
addiu a2, zero, 0x400
lw t9, -sym.imp.strcasecmp(gp)
lui a1, 0x42
move a0, s0
jalr t9
addiu a1, a1, -0x2014
lw gp, 0x18(sp)
bnez v0, 0x40a484
move a1, zero
lui a0, 0x41
lw t9, -sym.cgibin_parse_request(gp)
addiu a0, a0, -0x5640
addiu a2, zero, 0x40
jalr t9
nop
lw gp, 0x18(sp)
bgez v0, 0x40a4b8
lui a1, 0x42
b 0x40a4ac
nop
lui a1, 0x42
lw t9, -sym.imp.strcpy(gp)
addiu a1, a1, -0x1fc8
jalr t9
addiu a0, sp, 0xa0
lw gp, 0x18(sp)
move s2, zero
addiu s1, zero, -1
b 0x40a838
move s3, zero
lw t9, -sym.imp.strcpy(gp)
b 0x40a490
addiu a1, a1, -0x15d8
lw t9, -sym.sess_ispoweruser(gp)
nop
jalr t9
nop
lw gp, 0x18(sp)
bnez v0, 0x40a4e0
lui a1, 0x42
lw t9, -sym.imp.strcpy(gp)
b 0x40a490
addiu a1, a1, -0x15b8
lw t9, -sym.sobj_new(gp)
nop
jalr t9
nop
lw gp, 0x18(sp)
beqz v0, 0x40a5ac
move s3, v0
lw t9, -sym.sess_get_uid(gp)
nop
jalr t9
move a0, v0
lui v1, 0x43
lui v0, 0x42
lw gp, 0x18(sp)
addiu s5, v1, 0x440
addiu s2, v0, -0x15ac
lw s1, 0x440(v1)
b 0x40a55c
--
nop
bnez a0, 0x40a590
nop
b 0x40a5ac
nop
bnez s0, 0x40a56c
nop
b 0x40a570
move s0, s1
lw s0, (s0)
lw t9, -sym.imp.strcmp(gp)
move a0, s2
beq s0, s5, 0x40a5ac
lui s4, 0x43
bnez s0, 0x40a52c
nop
b 0x40a5ac
nop
lw t9, -sym.imp.strdup(gp)
nop
jalr t9
nop
lw gp, 0x18(sp)
bnez v0, 0x40a5d0
move s2, v0
lw t9, -sym.imp.strcpy(gp)
lui a1, 0x42
addiu a1, a1, -0x15a4
jalr t9
addiu a0, sp, 0xa0
lw gp, 0x18(sp)
move s2, zero
b 0x40a838
addiu s1, zero, -1
lw t9, -sym.imp.getpid(gp)
nop
jalr t9
addiu s6, s4, 0x440
move s7, v0
lui v0, 0x42
lw gp, 0x18(sp)
addiu s5, v0, -0x1594
lw s1, 0x440(s4)
b 0x40a62c
move s0, zero
lw a1, 8(s0)
--
b 0x40dc70
nop
beqz v1, 0x40dc80
lui v0, 0x43
jal 0x40d310
addiu a0, zero, -1
lw gp, 0x18(sp)
lui v0, 0x43
lw a0, 0x22f0(v0)
nop
beqz a0, 0x40dcac
lui a1, 0x42
lw t9, -sym.imp.fopen(gp)
nop
jalr t9
addiu a1, a1, -0x28bc
lw gp, 0x18(sp)
b 0x40dcb8
move s0, v0
lw v0, -0x7f14(gp)
nop
lw s0, (v0)
lui v0, 0x43
lbu v1, 0x460(v0)
lui v0, 0x43
lw t9, -sym.imp.strcpy(gp)
lw a1, 0x22f4(v0)
sb v1, 0x1a4(sp)
jalr t9
addiu a0, sp, 0x1a5
lw gp, 0x18(sp)
beqz s0, 0x40dd28
move s1, zero
lw t9, -sym.imp.fread(gp)
addiu a0, sp, 0x1b6
addiu a1, zero, 1
addiu a2, zero, 0x7ee
jalr t9
move a3, s0
lui v1, 0x43
lw v1, 0x22f0(v1)
lw gp, 0x18(sp)
beqz v1, 0x40dd28
move s1, v0
lw t9, -sym.imp.fclose(gp)
nop
--
sh zero, 0x100(sp)
sh zero, 0x102(sp)
sh zero, 0x104(sp)
sh zero, 0x106(sp)
sh zero, 0x108(sp)
sh zero, 0x10a(sp)
sh t3, 0x10c(sp)
sh zero, 0x10e(sp)
sh zero, 0x110(sp)
sh zero, 0x112(sp)
sh zero, 0x114(sp)
sh zero, 0x116(sp)
sh zero, 0x118(sp)
sh zero, 0x11a(sp)
sh zero, 0x11e(sp)
sh zero, 0x120(sp)
sh zero, 0x122(sp)
sh zero, 0x124(sp)
sh zero, 0x126(sp)
sh zero, 0x128(sp)
jalr t9
sh zero, 0x12a(sp)
lw gp, 0x10(sp)
bgez v0, 0x40e090
lui a1, 0x42
lw t9, -sym.imp.strcpy(gp)
b 0x40e0b8
addiu a1, a1, -0x5b0
lw t9, -sym.imp.getenv(gp)
lui a0, 0x42
jalr t9
addiu a0, a0, -0x202c
lw gp, 0x10(sp)
bnez v0, 0x40e0d4
move s0, v0
lui a1, 0x42
lw t9, -sym.imp.strcpy(gp)
addiu a1, a1, -0x19c0
jalr t9
addiu a0, sp, 0x2c
lw gp, 0x10(sp)
addiu s6, zero, -1
move s5, zero
b 0x40e7a8
move s4, zero
lw t9, -sym.imp.strcasecmp(gp)
lui a1, 0x42
addiu a1, a1, -0x2010
jalr t9
move a0, v0
lw gp, 0x10(sp)
bnez v0, 0x40e108
lui a0, 0x41
lw t9, -sym.cgibin_parse_request(gp)
addiu a0, a0, -0x1534
move a1, zero
b 0x40e138
addiu a2, zero, 0x400
lw t9, -sym.imp.strcasecmp(gp)
lui a1, 0x42
move a0, s0
jalr t9
addiu a1, a1, -0x2014
lw gp, 0x10(sp)
bnez v0, 0x40e154
addiu a2, zero, 0x40
lui a0, 0x41
lw t9, -sym.cgibin_parse_request(gp)
addiu a0, a0, -0x15d8
move a1, zero
jalr t9
nop
lw gp, 0x10(sp)
bgez v0, 0x40e1a0
move s6, v0
b 0x40e164
lui a1, 0x42
lui a1, 0x42
lw t9, -sym.imp.strcpy(gp)
b 0x40e0b8
addiu a1, a1, -0x1fc8
lw t9, -sym.imp.strcpy(gp)
b 0x40e0b8
addiu a1, a1, -0x15d8
lw a1, 8(s0)
jalr t9
nop
lw gp, 0x10(sp)
bnez v0, 0x40e1b8
nop
lw s0, 0xc(s0)
nop
bnez s0, 0x40e214
sw s0, 0x534(sp)
b 0x40e1e4
lui a1, 0x42
lui v0, 0x43
lw s1, 0x478(v0)
addiu s3, v0, 0x478
lui v0, 0x42
addiu s2, v0, -0x5a0
move s0, zero
bnez s0, 0x40e1c8
nop
b 0x40e1cc
move s0, s1
lw s0, (s0)
lw t9, -sym.imp.strcmp(gp)
beq s0, s3, 0x40e1e0
move a0, s2
bnez s0, 0x40e170
nop
lui a1, 0x42
lw t9, -sym.imp.strcpy(gp)
b 0x40e0b8
addiu a1, a1, -0x598
lw a1, 8(s0)
jalr t9
nop
lw gp, 0x10(sp)
bnez v0, 0x40e228
nop
lw a0, 0xc(s0)
b 0x40e254
nop
lui v0, 0x43
addiu s3, v0, 0x478
lui v0, 0x42
addiu s2, v0, -0x578
move s0, zero
bnez s0, 0x40e238
nop
b 0x40e23c
move s0, s1
--
addiu v1, sp, 0x12c
addiu a2, sp, 0xac
sw v0, 0x530(sp)
addiu v0, sp, 0xec
sw v1, 0x53c(sp)
sw a2, 0x540(sp)
sw v0, 0x544(sp)
addiu v1, sp, 0x1c
addiu a2, sp, 0x18
addiu v0, sp, 0xfc
move s5, zero
move s4, zero
sw v1, 0x548(sp)
sw a2, 0x54c(sp)
b 0x40e788
sw v0, 0x550(sp)
lw t9, -sym.imp.fopen(gp)
lui a0, 0x42
addiu a0, a0, -0x558
jalr t9
addiu a1, s0, -0x28bc
lw gp, 0x10(sp)
bnez v0, 0x40e2a8
move fp, v0
lui a1, 0x42
lw t9, -sym.imp.strcpy(gp)
b 0x40e0b8
addiu a1, a1, -0x540
lw t9, -sym.imp.strrchr(gp)
lw a0, 0x53c(sp)
jalr t9
addiu a1, zero, 0x53
lw gp, 0x10(sp)
beqz v0, 0x40e788
lui a1, 0x42
lw t9, -sym.imp.strncmp(gp)
lw a0, 0x53c(sp)
addiu a1, a1, -0x524
jalr t9
addiu a2, zero, 3
lw gp, 0x10(sp)
beqz v0, 0x40e384
lui a1, 0x42
lw t9, -sym.imp.strncmp(gp)
lw a0, 0x53c(sp)
lui a1, 0x42
--
sll v0, v1, 0x18
or v0, v0, a1
srl a0, a0, 8
andi v1, v1, 0xff00
or v0, v0, a0
sll v1, v1, 8
or v0, v0, v1
lw v1, 0x538(sp)
lw gp, 0x10(sp)
and v0, v1, v0
and a0, v0, a2
srl a1, v0, 0x18
sll v1, v0, 0x18
or v1, v1, a1
srl a0, a0, 8
andi v0, v0, 0xff00
or v1, v1, a0
sll v0, v0, 8
or v1, v1, v0
lw t9, -sym.imp.inet_ntoa(gp)
move a0, v1
jalr t9
sw v1, 0x18(sp)
lw gp, 0x10(sp)
lw a0, 0x548(sp)
lw t9, -sym.imp.strcpy(gp)
nop
jalr t9
move a1, v0
lw gp, 0x10(sp)
lw a0, 0x534(sp)
lw t9, -sym.imp.strlen(gp)
nop
jalr t9
nop
lw gp, 0x10(sp)
lw a0, 0x548(sp)
lw t9, -sym.imp.strncmp(gp)
lw a1, 0x534(sp)
jalr t9
move a2, v0
sltiu v0, v0, 1
lw gp, 0x10(sp)
sw v0, 0x530(sp)
addiu s3, s3, 1
addiu a2, zero, 4
--
nop
lw v0, 0x18(s0)
nop
addiu v0, v0, 1
b 0x40e77c
sw v0, 0x18(s0)
lw v0, 0x1c(s0)
nop
addiu v0, v0, 1
b 0x40e784
sw v0, 0x1c(s0)
lw t9, -sym.imp.malloc(gp)
nop
jalr t9
addiu a0, zero, 0x20
lw gp, 0x10(sp)
beqz v0, 0x40e774
move s0, v0
lw t9, -sym.imp.memset(gp)
move a0, v0
move a1, zero
jalr t9
addiu a2, zero, 0x20
lw gp, 0x10(sp)
move a1, s2
lw t9, -sym.imp.strcpy(gp)
nop
jalr t9
addiu a0, s0, 8
lw gp, 0x10(sp)
beqz s7, 0x40e748
nop
lw v0, 0x18(s0)
nop
addiu v0, v0, 1
b 0x40e758
sw v0, 0x18(s0)
lw v0, 0x1c(s0)
nop
addiu v0, v0, 1
sw v0, 0x1c(s0)
lui a2, 0x43
lw v0, 0x470(a2)
sw s0, 0x470(a2)
sw s0, 4(v0)
sw v0, (s0)
--
lui v0, 0x42
move s1, zero
lui v0, 0x42
addiu s2, sp, 0xa4
lw t9, -sym.imp.sprintf(gp)
addiu s4, v0, -0x1dc
lui a1, 0x42
lui a2, 0x42
addiu a1, a1, -0x210
addiu a2, a2, -0x1f4
move a0, s2
move a3, s0
sw s4, 0x10(sp)
jalr t9
sw s0, 0x14(sp)
lw gp, 0x18(sp)
move a2, s2
lw v0, -0x7dd8(gp)
lw t9, -sym.xmldbc_ephp(gp)
lw a3, (v0)
move a0, zero
jalr t9
move a1, zero
lw gp, 0x18(sp)
move a0, s2
lw t9, -sym.imp.strcpy(gp)
nop
jalr t9
move a1, s0
lui a1, 0x42
addiu a1, a1, -0x1d0
jal 0x40eb80
move a0, s2
lw gp, 0x18(sp)
nop
lw t9, -sym.imp.sprintf(gp)
bnez v0, 0x40f684
lui a1, 0x42
move a0, s2
b 0x40f690
addiu a1, a1, -0x1ac
lui a1, 0x42
move a0, s2
addiu a1, a1, -0x190
move a3, s0
jalr t9
--
move s2, a1
beqz a1, 0x410fc8
move v1, zero
lw t9, -sym.imp.strlen(gp)
nop
jalr t9
move a0, a1
lw gp, 0x10(sp)
bnez v0, 0x410f7c
move s1, v0
b 0x410fc8
move v1, zero
jal 0x410e84
nop
lw gp, 0x10(sp)
bltz v0, 0x410fc8
addiu v1, zero, -1
lw v1, 0x10(s0)
lw v0, 0xc(s0)
nop
subu v0, v0, v1
sltu v0, v0, s1
bnez v0, 0x410f68
move a0, s0
lw a0, 0x14(s0)
lw t9, -sym.imp.strcpy(gp)
addu a0, a0, v1
jalr t9
move a1, s2
lw v0, 0x10(s0)
lw gp, 0x10(sp)
addu v0, v0, s1
move v1, zero
b 0x410fc8
sw v0, 0x10(s0)
addiu v1, zero, -1
lw ra, 0x24(sp)
move v0, v1
lw s2, 0x20(sp)
lw s1, 0x1c(sp)
lw s0, 0x18(sp)
jr ra
addiu sp, sp, 0x28
bnez a0, 0x410ff4
addiu v0, zero, -1
jr ra
[*] Function strcpy used 16 times cgibin
