[*] Binary protection state of logd
RELRO CANARY NX PIE RPATH RUNPATH SYMBOLS
No RELRO No Canary found NX disabled No PIE No RPATH No RUNPATH No Symbols
[*] Function printf tear down of logd
beqz t9, 0x40102c
addiu a0, a0, 0x7010
lw ra, 0x1c(sp)
jr t9
addiu sp, sp, 0x20
lw ra, 0x1c(sp)
nop
jr ra
addiu sp, sp, 0x20
nop
jr ra
move v0, zero
lui gp, 0x42
addiu sp, sp, -0x28
addiu gp, gp, -0xe30
sw ra, 0x24(sp)
sw gp, 0x10(sp)
lui v0, 0x41
lw v0, 0x7350(v0)
sw a1, 0x2c(sp)
sw a2, 0x30(sp)
sw a3, 0x34(sp)
beqz v0, 0x401094
move a1, a0
lw v0, -0x7f40(gp)
lw t9, -sym.imp.vfprintf(gp)
addiu a2, sp, 0x2c
lw a0, (v0)
jalr t9
sw a2, 0x18(sp)
lw gp, 0x10(sp)
lw ra, 0x24(sp)
nop
jr ra
addiu sp, sp, 0x28
lui gp, 0x42
addiu sp, sp, -0x38
addiu gp, gp, -0xe30
sw ra, 0x34(sp)
sw s6, 0x30(sp)
sw s5, 0x2c(sp)
sw s4, 0x28(sp)
sw s3, 0x24(sp)
sw s2, 0x20(sp)
sw s1, 0x1c(sp)
sw s0, 0x18(sp)
--
lw t9, -sym.imp.puts(gp)
nop
jalr t9
addiu a0, a0, 0x6268
lui v0, 0x41
addiu s1, v0, 0x7040
lui v0, 0x40
lw gp, 0x10(sp)
addiu s5, v0, 0x6278
move s0, zero
addiu s3, zero, 5
b 0x40118c
addiu s4, zero, 4
bnez s3, 0x401130
div zero, s0, s3
break 7
mfhi s2
bnez s2, 0x401154
nop
lw t9, -sym.imp.putchar(gp)
nop
jalr t9
addiu a0, zero, 9
lw gp, 0x10(sp)
nop
lw t9, -sym.imp.printf(gp)
lw a1, (s1)
jalr t9
move a0, s5
lw gp, 0x10(sp)
bne s2, s4, 0x401184
nop
lw t9, -sym.imp.putchar(gp)
nop
jalr t9
addiu a0, zero, 0xa
lw gp, 0x10(sp)
addiu s0, s0, 1
addiu s1, s1, 8
lw v0, (s1)
nop
bnez v0, 0x401124
nop
lw t9, -sym.imp.putchar(gp)
nop
jalr t9
--
jalr t9
move a0, s0
lw gp, 0x10(sp)
move a1, s2
lw t9, -sym.imp.bind(gp)
addiu a2, v0, 2
jalr t9
move a0, s1
lw gp, 0x10(sp)
bgez v0, 0x4015a8
lui a1, 0x40
lw t9, -sym.imp.__errno_location(gp)
lw v0, -0x7f54(gp)
nop
lw s0, (v0)
jalr t9
nop
lw gp, 0x10(sp)
lw a0, (v0)
lw t9, -sym.imp.strerror(gp)
nop
jalr t9
nop
lw gp, 0x10(sp)
lui a1, 0x40
lw t9, -sym.imp.fprintf(gp)
lui a2, 0x40
move a0, s0
addiu a1, a1, 0x62b0
addiu a2, a2, 0x64c0
jalr t9
move a3, v0
b 0x4015d4
nop
lw t9, -sym.imp.__errno_location(gp)
lw v0, -0x7f54(gp)
nop
lw s0, (v0)
jalr t9
nop
lw gp, 0x10(sp)
lw a0, (v0)
lw t9, -sym.imp.strerror(gp)
nop
jalr t9
nop
lw gp, 0x10(sp)
lui a1, 0x40
lw t9, -sym.imp.fprintf(gp)
lui a2, 0x40
move a0, s0
addiu a1, a1, 0x62cc
addiu a2, a2, 0x64c0
jalr t9
move a3, v0
b 0x4015f0
lui a0, 0x40
lw t9, -sym.sloop_register_read_sock(gp)
addiu a1, a1, 0x161c
move a0, s1
jalr t9
move a2, zero
lw gp, 0x10(sp)
nop
lw t9, -sym.sloop_run(gp)
nop
jalr t9
nop
lw gp, 0x10(sp)
--
bnez v0, 0x401944
slti v0, v1, 7
beqz v0, 0x4017fc
move s3, s1
lw t9, -sym.imp.strchr(gp)
move a0, s1
jalr t9
addiu a1, zero, 0x3a
lw gp, 0x18(sp)
bnez v0, 0x4017fc
addiu s3, v0, 2
move s3, s1
lw t9, -sym.sobj_new(gp)
nop
jalr t9
nop
lw gp, 0x18(sp)
beqz v0, 0x401944
move s0, v0
lui v0, 0x41
lw a2, 0x71b0(v0)
lui s4, 0x41
andi v0, s2, 0x3f8
lw a3, 0x7034(s4)
addiu s1, sp, 0x60
lw t9, -sym.imp.sprintf(gp)
srl v0, v0, 3
lui a1, 0x40
addiu a1, a1, 0x62e0
move a0, s1
sw v0, 0x10(sp)
jalr t9
sw s5, 0x14(sp)
lw gp, 0x18(sp)
move a0, s0
lw t9, -sym.sobj_add_string(gp)
nop
jalr t9
move a1, s1
lw gp, 0x18(sp)
move a1, s3
lw t9, -sym.sobj_add_string(gp)
nop
jalr t9
move a0, s0
lw gp, 0x18(sp)
nop
lw t9, -sym.sobj_get_string(gp)
nop
jalr t9
move a0, s0
lw gp, 0x18(sp)
move a2, v0
lw v1, -0x7f40(gp)
lw t9, -sym.xmldbc_ephp(gp)
lw a3, (v1)
move a0, zero
jalr t9
move a1, zero
lw gp, 0x18(sp)
lw a2, 0x7034(s4)
lw t9, -sym.imp.sprintf(gp)
lui a1, 0x40
addiu a1, a1, 0x6320
jalr t9
move a0, s1
lw gp, 0x18(sp)
move a0, s1
lw t9, -sym.imp.stat(gp)
nop
jalr t9
addiu a1, sp, 0xe0
lw gp, 0x18(sp)
bnez v0, 0x401930
nop
lw t9, -sym.imp.system(gp)
nop
jalr t9
move a0, s1
lw gp, 0x18(sp)
nop
lw t9, -sym.imp.unlink(gp)
--
sw gp, 0x18(sp)
lw t9, -sym.imp.puts(gp)
lui a0, 0x40
jalr t9
addiu a0, a0, 0x64d0
lw gp, 0x18(sp)
lui a0, 0x40
lw t9, -sym.imp.puts(gp)
nop
jalr t9
addiu a0, a0, 0x64f4
lui v0, 0x42
lw s0, -0x70e8(v0)
addiu s2, v0, -0x70e8
lui v0, 0x40
lw gp, 0x18(sp)
b 0x401da8
addiu s1, v0, 0x6504
lw v0, 0x14(s0)
lw a2, 0xc(s0)
lw a3, 0x10(s0)
jalr t9
sw v0, 0x10(sp)
lw gp, 0x18(sp)
lw s0, (s0)
lw t9, -sym.imp.printf(gp)
move a1, s0
bne s0, s2, 0x401d8c
move a0, s1
lui a0, 0x40
lw t9, -sym.imp.puts(gp)
lw ra, 0x2c(sp)
lw s2, 0x28(sp)
lw s1, 0x24(sp)
lw s0, 0x20(sp)
addiu a0, a0, 0x6538
jr t9
addiu sp, sp, 0x30
lui gp, 0x42
addiu sp, sp, -0x30
addiu gp, gp, -0xe30
sw ra, 0x2c(sp)
sw s2, 0x28(sp)
sw s1, 0x24(sp)
sw s0, 0x20(sp)
sw gp, 0x18(sp)
--
lui a0, 0x40
jalr t9
addiu a0, a0, 0x64d0
lw gp, 0x18(sp)
lui a0, 0x40
lw t9, -sym.imp.puts(gp)
nop
jalr t9
addiu a0, a0, 0x655c
lui v0, 0x42
lw s0, -0x70e0(v0)
addiu s2, v0, -0x70e0
lui v0, 0x40
lw gp, 0x18(sp)
b 0x401e64
addiu s1, v0, 0x656c
lw v0, 0x14(s0)
lw a2, 0xc(s0)
lw a3, 0x10(s0)
sw v0, 0x10(sp)
lw v0, 0x18(s0)
jalr t9
sw v0, 0x14(sp)
lw gp, 0x18(sp)
lw s0, (s0)
lw t9, -sym.imp.printf(gp)
move a1, s0
bne s0, s2, 0x401e40
move a0, s1
lui a0, 0x40
lw t9, -sym.imp.puts(gp)
lw ra, 0x2c(sp)
lw s2, 0x28(sp)
lw s1, 0x24(sp)
lw s0, 0x20(sp)
addiu a0, a0, 0x6538
jr t9
addiu sp, sp, 0x30
lui gp, 0x42
addiu sp, sp, -0x30
addiu gp, gp, -0xe30
sw ra, 0x2c(sp)
sw s2, 0x28(sp)
sw s1, 0x24(sp)
sw s0, 0x20(sp)
sw gp, 0x18(sp)
lw t9, -sym.imp.puts(gp)
lui a0, 0x40
jalr t9
addiu a0, a0, 0x64d0
lw gp, 0x18(sp)
lui a0, 0x40
lw t9, -sym.imp.puts(gp)
nop
jalr t9
addiu a0, a0, 0x65a4
lui v0, 0x42
lw s0, -0x70f0(v0)
addiu s2, v0, -0x70f0
lui v0, 0x40
lw gp, 0x18(sp)
b 0x401f18
addiu s1, v0, 0x65b4
lw v0, 0x14(s0)
lw a2, 0xc(s0)
lw a3, 0x10(s0)
jalr t9
sw v0, 0x10(sp)
lw gp, 0x18(sp)
lw s0, (s0)
lw t9, -sym.imp.printf(gp)
move a1, s0
bne s0, s2, 0x401efc
move a0, s1
lui a0, 0x40
lw t9, -sym.imp.puts(gp)
lw ra, 0x2c(sp)
lw s2, 0x28(sp)
lw s1, 0x24(sp)
lw s0, 0x20(sp)
addiu a0, a0, 0x6538
jr t9
addiu sp, sp, 0x30
lui gp, 0x42
addiu sp, sp, -0x30
addiu gp, gp, -0xe30
sw ra, 0x2c(sp)
sw s2, 0x28(sp)
sw s1, 0x24(sp)
sw s0, 0x20(sp)
sw gp, 0x18(sp)
lw t9, -sym.imp.puts(gp)
lui a0, 0x40
jalr t9
addiu a0, a0, 0x64d0
lw gp, 0x18(sp)
lui a0, 0x40
lw t9, -sym.imp.puts(gp)
nop
jalr t9
addiu a0, a0, 0x65e8
lui v0, 0x42
lw s0, -0x70f8(v0)
addiu s2, v0, -0x70f8
lui v0, 0x40
lw gp, 0x18(sp)
b 0x401fcc
addiu s1, v0, 0x65b4
lw v0, 0x14(s0)
lw a2, 0xc(s0)
lw a3, 0x10(s0)
jalr t9
sw v0, 0x10(sp)
lw gp, 0x18(sp)
lw s0, (s0)
lw t9, -sym.imp.printf(gp)
move a1, s0
bne s0, s2, 0x401fb0
move a0, s1
lui a0, 0x40
lw t9, -sym.imp.puts(gp)
lw ra, 0x2c(sp)
lw s2, 0x28(sp)
lw s1, 0x24(sp)
lw s0, 0x20(sp)
addiu a0, a0, 0x6538
jr t9
addiu sp, sp, 0x30
addiu sp, sp, -0x20
sw ra, 0x1c(sp)
sw gp, 0x10(sp)
jal 0x401f4c
nop
jal 0x401e98
nop
jal sym.sloop_dump_timeout
--
addiu gp, gp, -0xe30
sw ra, 0x94(sp)
sw s1, 0x90(sp)
sw s0, 0x8c(sp)
sw gp, 0x10(sp)
lw t9, -sym.imp.socket(gp)
move s1, a0
addiu a1, zero, 2
addiu a0, zero, 1
jalr t9
move a2, zero
lw gp, 0x10(sp)
bgez v0, 0x402d84
move s0, v0
b 0x402e08
addiu s0, zero, -1
lw t9, -sym.imp.fcntl(gp)
move a0, v0
addiu a1, zero, 2
jalr t9
addiu a2, zero, 1
lw gp, 0x10(sp)
bnez s1, 0x402da8
lui v0, 0x40
addiu s1, v0, 0x65f8
lw t9, -sym.imp.snprintf(gp)
addiu v0, zero, 1
lui a2, 0x40
addiu a2, a2, 0x660c
move a3, s1
addiu a0, sp, 0x1a
addiu a1, zero, 0x6c
jalr t9
sh v0, 0x18(sp)
lw gp, 0x10(sp)
move a0, s0
lw t9, -sym.imp.connect(gp)
addiu a1, sp, 0x18
jalr t9
addiu a2, zero, 0x6e
lw gp, 0x10(sp)
bgez v0, 0x402e08
nop
lw t9, -sym.imp.close(gp)
nop
jalr t9
--
jalr t9
move s0, a1
addiu v0, v0, 1
move a0, s1
move a2, s0
move a3, s2
addiu a1, zero, 0xc
jal 0x402ebc
sw v0, 0x10(sp)
lw ra, 0x2c(sp)
lw gp, 0x18(sp)
lw s2, 0x28(sp)
lw s1, 0x24(sp)
lw s0, 0x20(sp)
jr ra
addiu sp, sp, 0x30
lui gp, 0x42
addiu sp, sp, -0x230
addiu gp, gp, -0xe30
sw ra, 0x22c(sp)
sw s2, 0x228(sp)
sw s1, 0x224(sp)
sw s0, 0x220(sp)
sw gp, 0x18(sp)
addiu s0, sp, 0x20
lw t9, -sym.imp.snprintf(gp)
move v0, a2
lui a2, 0x40
sw a3, 0x10(sp)
addiu a2, a2, 0x6610
move a3, v0
move s1, a0
move s2, a1
move a0, s0
jalr t9
addiu a1, zero, 0x1ff
lw gp, 0x18(sp)
move a0, s0
lw t9, -sym.imp.strlen(gp)
nop
jalr t9
sb zero, 0x21f(sp)
addiu v0, v0, 1
move a0, s1
move a2, s2
move a3, s0
addiu a1, zero, 0xb
jal 0x402ebc
sw v0, 0x10(sp)
lw ra, 0x22c(sp)
lw gp, 0x18(sp)
lw s2, 0x228(sp)
lw s1, 0x224(sp)
lw s0, 0x220(sp)
jr ra
addiu sp, sp, 0x230
lui gp, 0x42
addiu sp, sp, -0x230
addiu gp, gp, -0xe30
sw ra, 0x22c(sp)
sw s2, 0x228(sp)
sw s1, 0x224(sp)
sw s0, 0x220(sp)
sw gp, 0x18(sp)
addiu s0, sp, 0x20
lw t9, -sym.imp.snprintf(gp)
move v0, a2
lui a2, 0x40
sw a3, 0x10(sp)
addiu a2, a2, 0x6610
move a3, v0
move s1, a0
move s2, a1
move a0, s0
jalr t9
addiu a1, zero, 0x1ff
lw gp, 0x18(sp)
move a0, s0
lw t9, -sym.imp.strlen(gp)
nop
jalr t9
sb zero, 0x21f(sp)
addiu v0, v0, 1
move a0, s1
move a2, s2
move a3, s0
--
move s3, a3
addiu v0, v0, 1
move a0, s1
move a2, s0
move a3, s2
addiu a1, zero, 1
sw s3, 0x14(sp)
jal 0x4037b4
sw v0, 0x10(sp)
lw ra, 0x34(sp)
lw gp, 0x18(sp)
lw s3, 0x30(sp)
lw s2, 0x2c(sp)
lw s1, 0x28(sp)
lw s0, 0x24(sp)
jr ra
addiu sp, sp, 0x38
lui gp, 0x42
addiu sp, sp, -0x428
addiu gp, gp, -0xe30
sw ra, 0x424(sp)
sw s0, 0x420(sp)
sw gp, 0x10(sp)
addiu v0, sp, 0x42c
addiu s0, sp, 0x1c
lw t9, -sym.imp.vsnprintf(gp)
sw a1, 0x42c(sp)
sw a2, 0x430(sp)
sw a3, 0x434(sp)
move a2, a0
move a3, v0
move a0, s0
sw v0, 0x18(sp)
jalr t9
addiu a1, zero, 0x400
lw gp, 0x10(sp)
nop
lw t9, -sym.imp.system(gp)
nop
jalr t9
move a0, s0
lw ra, 0x424(sp)
lw gp, 0x10(sp)
lw s0, 0x420(sp)
jr ra
addiu sp, sp, 0x428
lui gp, 0x42
addiu sp, sp, -0x438
addiu gp, gp, -0xe30
sw ra, 0x434(sp)
sw s4, 0x430(sp)
sw s3, 0x42c(sp)
sw s2, 0x428(sp)
sw s1, 0x424(sp)
sw s0, 0x420(sp)
sw gp, 0x10(sp)
lw t9, -sym.imp.vsnprintf(gp)
addiu v0, sp, 0x444
addiu s0, sp, 0x1c
sw a3, 0x444(sp)
move s2, a0
move a3, v0
move a0, s0
move s3, a1
sw v0, 0x18(sp)
jalr t9
addiu a1, zero, 0x400
lw gp, 0x10(sp)
lui a1, 0x40
lw t9, -sym.imp.popen(gp)
move a0, s0
jalr t9
addiu a1, a1, 0x6368
lw gp, 0x10(sp)
beqz v0, 0x403b8c
move s1, v0
addiu s3, s3, -1
--
lw s1, 0x1c(sp)
lw s0, 0x18(sp)
jr ra
addiu sp, sp, 0x28
bnez a0, 0x404994
addiu v0, zero, -1
jr ra
nop
sw zero, 8(a0)
j sym.sobj_add_string
sw zero, 0x10(a0)
lui gp, 0x42
addiu sp, sp, -0x430
addiu gp, gp, -0xe30
sw ra, 0x42c(sp)
sw s1, 0x428(sp)
sw s0, 0x424(sp)
sw gp, 0x10(sp)
move s1, a0
sw a2, 0x438(sp)
sw a3, 0x43c(sp)
beqz a0, 0x404a14
addiu v0, zero, -1
beqz a1, 0x404a14
move v0, zero
lw t9, -sym.imp.vsnprintf(gp)
addiu v0, sp, 0x438
addiu s0, sp, 0x1c
move a2, a1
move a3, v0
move a0, s0
addiu a1, zero, 0x400
jalr t9
sw v0, 0x18(sp)
move a0, s1
move a1, s0
jal sym.sobj_add_string
sb zero, 0x41b(sp)
lw gp, 0x10(sp)
move v0, zero
lw ra, 0x42c(sp)
lw s1, 0x428(sp)
lw s0, 0x424(sp)
jr ra
addiu sp, sp, 0x430
lui gp, 0x42
addiu sp, sp, -0x430
addiu gp, gp, -0xe30
sw ra, 0x42c(sp)
sw s2, 0x428(sp)
sw s1, 0x424(sp)
sw s0, 0x420(sp)
sw gp, 0x10(sp)
move s2, a0
sw a2, 0x438(sp)
sw a3, 0x43c(sp)
move s1, a1
beqz a0, 0x404ab0
addiu v0, zero, -1
jal 0x404678
nop
lw gp, 0x10(sp)
beqz s1, 0x404ab0
move v0, zero
lw t9, -sym.imp.vsnprintf(gp)
addiu v0, sp, 0x438
addiu s0, sp, 0x1c
move a2, s1
move a3, v0
move a0, s0
addiu a1, zero, 0x400
jalr t9
sw v0, 0x18(sp)
move a0, s2
move a1, s0
jal sym.sobj_add_string
sb zero, 0x41b(sp)
lw gp, 0x10(sp)
move v0, zero
lw ra, 0x42c(sp)
lw s2, 0x428(sp)
lw s1, 0x424(sp)
lw s0, 0x420(sp)
jr ra
addiu sp, sp, 0x430
[*] Function printf used 17 times logd
