[*] Binary protection state of ddnsd
RELRO CANARY NX PIE RPATH RUNPATH SYMBOLS
No RELRO No Canary found NX disabled No PIE No RPATH No RUNPATH No Symbols
[*] Function strcpy tear down of ddnsd
lui s4, 0x42
lui s3, 0x42
lui s2, 0x42
b 0x4019ec
lui s1, 0x42
sltiu v0, v1, 0xf
beqz v0, 0x4019dc
addiu a0, zero, -1
sll v0, v1, 2
addu v0, s7, v0
lw v0, (v0)
nop
addu v0, v0, gp
jr v0
nop
b 0x4019dc
move a0, zero
lw v0, -0x5300(s1)
nop
addiu v0, v0, 1
b 0x4019ec
sw v0, -0x5300(s1)
lw v0, (s0)
b 0x4019ec
sw v0, -0x5610(s2)
lw t9, -sym.imp.strcpy(gp)
lw a1, (s0)
jalr t9
move a0, s6
b 0x4019e4
nop
lw t9, -sym.imp.atoi(gp)
lw a0, (s0)
jalr t9
nop
lw gp, 0x10(sp)
b 0x4019ec
sw v0, -0x5620(s3)
lw t9, -sym.imp.atoi(gp)
lw a0, (s0)
jalr t9
nop
lw gp, 0x10(sp)
b 0x4019ec
sw v0, -0x561c(s4)
lw v0, (s0)
--
move a1, s2
lw gp, 0x10(sp)
bnez v0, 0x402094
addiu a0, s0, 4
lw t9, -sym.imp.strstr(gp)
lui a1, 0x41
move a0, s0
jalr t9
addiu a1, a1, -0x601c
lw gp, 0x10(sp)
addiu s1, v0, 9
lw t9, -sym.imp.strchr(gp)
move a0, s1
jalr t9
addiu a1, zero, 0x22
subu a2, v0, s1
lw gp, 0x10(sp)
blez a2, 0x4020bc
addiu s0, sp, 0x18
lw t9, -sym.imp.strncpy(gp)
move a1, s1
jalr t9
move a0, s0
lw gp, 0x10(sp)
move a0, s5
lw t9, -sym.sobj_strcpy(gp)
nop
jalr t9
move a1, s0
lw gp, 0x10(sp)
b 0x4020bc
nop
lw t9, -sym.imp.strstr(gp)
nop
jalr t9
move a1, s4
lw gp, 0x10(sp)
move a1, s3
lw t9, -sym.imp.strstr(gp)
move s0, v0
bnez v0, 0x401fc0
move a0, v0
lw ra, 0x84(sp)
lw s5, 0x80(sp)
lw s4, 0x7c(sp)
lw s3, 0x78(sp)
--
addiu a2, a2, 0x3674
move a1, zero
jalr t9
move a3, s1
lw gp, 0x18(sp)
b 0x4032e4
sw v0, 0x10(s1)
lw t9, -sym.imp.strstr(gp)
lui s0, 0x41
jalr t9
addiu a1, s0, -0x5c58
lw gp, 0x18(sp)
beqz v0, 0x4032a4
move a2, s3
addiu a1, s0, -0x5c58
jal 0x401f58
move a0, s2
lw gp, 0x18(sp)
move a0, s3
lw t9, -sym.sobj_get_string(gp)
nop
jalr t9
lui s0, 0x42
lw gp, 0x18(sp)
addiu a0, s0, -0x52fc
lw t9, -sym.imp.strcpy(gp)
nop
jalr t9
move a1, v0
lui a1, 0x41
move a2, s3
addiu a1, a1, -0x5c50
jal 0x401f58
move a0, s2
lw gp, 0x18(sp)
nop
lw t9, -sym.sobj_get_string(gp)
nop
jalr t9
move a0, s3
lw gp, 0x18(sp)
lui a0, 0x42
lw t9, -sym.imp.strcpy(gp)
addiu a0, a0, -0x52ac
jalr t9
move a1, v0
lui a1, 0x41
move a2, s3
addiu a1, a1, -0x5c48
jal 0x401f58
move a0, s2
lw gp, 0x18(sp)
nop
lw t9, -sym.sobj_get_string(gp)
nop
jalr t9
move a0, s3
lw gp, 0x18(sp)
lui a0, 0x42
lw t9, -sym.imp.strcpy(gp)
addiu a0, a0, -0x525c
jalr t9
move a1, v0
lw a0, 0x28(s1)
jal 0x4023dc
addiu a1, s0, -0x52fc
lw gp, 0x18(sp)
lui a2, 0x40
lw t9, -sym.sloop_register_timeout(gp)
sw v0, 0x28(s1)
addiu a2, a2, 0x3674
move a3, s1
move a0, zero
jalr t9
move a1, zero
b 0x4032e0
nop
lw v0, 0x18(s1)
lw t9, -sym.imp.syslog(gp)
lw a2, 8(v0)
--
sw v0, (s0)
lw gp, 0x10(sp)
beq s1, s2, 0x403b34
addiu s0, s0, 4
lw t9, -sym.solist_get_next(gp)
nop
jalr t9
move a0, s4
lw gp, 0x10(sp)
nop
lw t9, -sym.sobj_get_string(gp)
bnez v0, 0x403af8
move a0, v0
lw s0, 0x18(sp)
lw t9, -sym.imp.strcmp(gp)
lui a1, 0x41
addiu a1, a1, -0x5b64
jalr t9
move a0, s0
lw gp, 0x10(sp)
bnez v0, 0x403b74
slti v0, s1, 2
bnez v0, 0x403efc
nop
lui a0, 0x42
lw t9, -sym.imp.strcpy(gp)
lw a1, 0x1c(sp)
b 0x404034
addiu a0, a0, -0x5660
lw t9, -sym.imp.strcmp(gp)
lui a1, 0x41
addiu a1, a1, -0x5b50
jalr t9
move a0, s0
lw gp, 0x10(sp)
bnez v0, 0x403e28
slti v0, s1, 7
bnez v0, 0x403f00
lui a1, 0x41
lw a0, 0x1c(sp)
jal 0x401d00
nop
lw gp, 0x10(sp)
bnez v0, 0x403c2c
move s0, v0
lw t9, -sym.imp.malloc(gp)
--
move s2, a1
beqz a1, 0x407008
move v1, zero
lw t9, -sym.imp.strlen(gp)
nop
jalr t9
move a0, a1
lw gp, 0x10(sp)
bnez v0, 0x406fbc
move s1, v0
b 0x407008
move v1, zero
jal 0x406ec4
nop
lw gp, 0x10(sp)
bltz v0, 0x407008
addiu v1, zero, -1
lw v1, 0x10(s0)
lw v0, 0xc(s0)
nop
subu v0, v0, v1
sltu v0, v0, s1
bnez v0, 0x406fa8
move a0, s0
lw a0, 0x14(s0)
lw t9, -sym.imp.strcpy(gp)
addu a0, a0, v1
jalr t9
move a1, s2
lw v0, 0x10(s0)
lw gp, 0x10(sp)
addu v0, v0, s1
move v1, zero
b 0x407008
sw v0, 0x10(s0)
addiu v1, zero, -1
lw ra, 0x24(sp)
move v0, v1
lw s2, 0x20(sp)
lw s1, 0x1c(sp)
lw s0, 0x18(sp)
jr ra
addiu sp, sp, 0x28
bnez a0, 0x407034
addiu v0, zero, -1
jr ra
[*] Function strcpy used 7 times ddnsd
