[*] Binary protection state of updateleases
RELRO CANARY NX PIE RPATH RUNPATH SYMBOLS
No RELRO No Canary found NX disabled No PIE No RPATH No RUNPATH No Symbols
[*] Function printf tear down of updateleases
move a2, zero
jalr t9
move a0, v0
lw gp, 0x20(sp)
move a0, s5
lw t9, -sym.imp.fclose(gp)
nop
jalr t9
addiu s4, zero, -1
lw gp, 0x20(sp)
nop
lw t9, -sym.imp.remove(gp)
nop
jalr t9
addiu a0, s0, 0x2994
lw gp, 0x20(sp)
nop
lw t9, -sym.imp.fclose(gp)
nop
jalr t9
move a0, s6
lw gp, 0x20(sp)
b 0x4015d4
nop
addiu s0, sp, 0x31c
lw t9, -sym.imp.sprintf(gp)
lui a1, 0x40
move a0, s0
move a2, s2
jalr t9
addiu a1, a1, 0x29a8
lw gp, 0x20(sp)
addiu s1, sp, 0x30
lw t9, -sym.xmldbc_get_wb(gp)
addiu v0, zero, 5
move a2, s0
move a3, s1
move a0, zero
move a1, zero
jalr t9
sw v0, 0x10(sp)
lw gp, 0x20(sp)
move a0, s1
lw t9, -sym.imp.atoi(gp)
nop
jalr t9
--
move a0, s1
lw t9, -sym.imp.inet_addr(gp)
move v1, v0
bnez v0, 0x4010c0
sw v0, 8(s0)
lw v0, -0x7f84(gp)
lw t9, -sym.imp.fputs(gp)
lw a1, (v0)
lui a0, 0x40
jalr t9
addiu a0, a0, 0x29c8
lw gp, 0x20(sp)
b 0x401108
addiu s4, zero, -1
lw v0, (s0)
move s0, v1
addiu v0, v0, 1
jalr t9
sw v0, (v1)
lw gp, 0x20(sp)
sw v0, 4(s0)
sw zero, 8(s0)
lui a1, 0x40
slt v0, s4, s3
move a3, s3
lw t9, -sym.imp.sprintf(gp)
move a0, s7
addiu a1, a1, 0x29b4
lw a2, 0x834(sp)
beqz v0, 0x400ff8
addiu s3, s3, 1
move s4, zero
lw t9, -sym.imp.sysinfo(gp)
nop
jalr t9
addiu a0, sp, 0x80
lui v0, 0x40
addiu s7, v0, 0x2a30
lui v0, 0x40
lw v0, 0x2aa0(v0)
lw gp, 0x20(sp)
sw v0, 0x830(sp)
addiu v0, sp, 0xc0
sw v0, 0x824(sp)
addiu v0, sp, 0x50
sw v0, 0x828(sp)
--
addiu a0, zero, 0xc
lw gp, 0x20(sp)
move v1, v0
bnez v0, 0x4011dc
sw v0, 8(s0)
lw v0, -0x7f84(gp)
lw t9, -sym.imp.fputs(gp)
lw a1, (v0)
lui a0, 0x40
jalr t9
addiu a0, a0, 0x29c8
lw gp, 0x20(sp)
b 0x401560
addiu s4, zero, -1
lw v0, (s0)
move s2, v1
addiu v0, v0, 1
sw v0, (v1)
lw v0, 0xd0(sp)
sw zero, 8(v1)
sw v0, 4(v1)
lbu a0, 0xc4(sp)
lbu a1, 0xc5(sp)
lbu v1, 0xc3(sp)
lbu v0, 0xc2(sp)
lw t9, -sym.imp.sprintf(gp)
lbu a2, 0xc0(sp)
lbu a3, 0xc1(sp)
sw a0, 0x18(sp)
sw a1, 0x1c(sp)
lw a0, 0x82c(sp)
lui a1, 0x40
sw v1, 0x14(sp)
addiu a1, a1, 0x29e8
jalr t9
sw v0, 0x10(sp)
lw gp, 0x20(sp)
addiu s3, sp, 0x31c
lw t9, -sym.imp.sprintf(gp)
addiu s1, sp, 0x21c
lw a3, (s2)
lui a1, 0x40
move a0, s3
addiu a1, a1, 0x2a08
jalr t9
move a2, s1
lw gp, 0x20(sp)
lw a3, 0x82c(sp)
lw t9, -sym.xmldbc_set(gp)
move a0, zero
move a1, zero
jalr t9
move a2, s3
lw gp, 0x20(sp)
lw a3, (s2)
lw t9, -sym.imp.sprintf(gp)
lui a1, 0x40
addiu a1, a1, 0x29b4
move a2, s1
lw s0, 0xd0(sp)
jalr t9
move a0, s3
lw gp, 0x20(sp)
nop
lw t9, -sym.imp.inet_ntoa(gp)
nop
jalr t9
move a0, s0
lw gp, 0x20(sp)
move a3, v0
lw t9, -sym.xmldbc_set(gp)
move a0, zero
move a1, zero
jalr t9
move a2, s3
lw gp, 0x20(sp)
lw a3, (s2)
lw t9, -sym.imp.sprintf(gp)
lui a1, 0x40
move a2, s1
move a0, s3
jalr t9
addiu a1, a1, 0x2a1c
lw v0, 0x820(sp)
lw gp, 0x20(sp)
beqz v0, 0x40131c
addiu s0, sp, 0x38
lw t9, -sym.xmldbc_del(gp)
move a2, s3
move a0, zero
jalr t9
move a1, zero
b 0x401370
nop
lw a2, 0xd4(sp)
lw t9, -sym.imp.sprintf(gp)
srl a0, a2, 0x18
sll v1, a2, 0x18
srl v0, a2, 8
or v1, v1, a0
andi v0, v0, 0xff00
andi a2, a2, 0xff00
or v1, v1, v0
sll a2, a2, 8
or a2, v1, a2
move a0, s0
jalr t9
move a1, s7
lw gp, 0x20(sp)
move a2, s3
lw t9, -sym.xmldbc_set(gp)
move a3, s0
move a0, zero
jalr t9
move a1, zero
lw gp, 0x20(sp)
--
addiu a3, zero, 0x2d
addiu v1, v1, 1
addu v0, a0, v1
lb a1, (v0)
nop
sll v0, a1, 1
addu v0, a2, v0
lhu v0, (v0)
nop
andi v0, v0, 0x800
bnez v0, 0x4013a4
nop
beq a1, a3, 0x4013a8
addiu v1, v1, 1
addiu v1, v1, -1
bnez v1, 0x401400
addu v0, sp, v1
lw t9, -sym.imp.strcpy(gp)
lui a1, 0x40
jalr t9
addiu a1, a1, 0x2a34
lw gp, 0x20(sp)
b 0x401404
nop
sb zero, 0x41c(v0)
lw t9, -sym.imp.sprintf(gp)
addiu s0, sp, 0x31c
addiu s1, sp, 0x21c
lw a3, (s2)
lui a1, 0x40
move a0, s0
addiu a1, a1, 0x2a40
jalr t9
move a2, s1
lw gp, 0x20(sp)
move a0, zero
lw t9, -sym.xmldbc_set(gp)
move a1, zero
move a2, s0
jalr t9
addiu a3, sp, 0x41c
lw gp, 0x20(sp)
lw a3, (s2)
lw t9, -sym.imp.sprintf(gp)
lui a1, 0x40
move a2, s1
move a0, s0
jalr t9
addiu a1, a1, 0x2a58
lw v0, 0x820(sp)
lw gp, 0x20(sp)
lw a2, 0xd4(sp)
beqz v0, 0x4014a4
srl v0, a2, 0x18
sll v1, a2, 0x18
srl a0, a2, 0x18
srl v0, a2, 8
or v1, v1, a0
andi v0, v0, 0xff00
andi a2, a2, 0xff00
or v1, v1, v0
sll a2, a2, 8
lw t9, -sym.imp.sprintf(gp)
b 0x4014fc
or a2, v1, a2
sll a0, a2, 0x18
srl v1, a2, 8
or a0, a0, v0
andi v1, v1, 0xff00
andi v0, a2, 0xff00
or a0, a0, v1
sll v0, v0, 8
or s0, a0, v0
lw v0, 0x830(sp)
lw t9, -sym.imp.memcmp(gp)
sw v0, 0x28(sp)
sw s0, 0x2c(sp)
addiu a0, sp, 0x2c
addiu a1, sp, 0x28
jalr t9
addiu a2, zero, 4
lw gp, 0x20(sp)
beqz v0, 0x4014f4
addu v0, s0, fp
sw v0, 0x2c(sp)
lw t9, -sym.imp.sprintf(gp)
lw a2, 0x2c(sp)
addiu a0, sp, 0x44
jalr t9
move a1, s7
lw gp, 0x20(sp)
move a0, zero
lw t9, -sym.xmldbc_set(gp)
move a1, zero
addiu a2, sp, 0x31c
jalr t9
addiu a3, sp, 0x44
lw gp, 0x20(sp)
nop
lw t9, -sym.imp.fread(gp)
lw a0, 0x824(sp)
addiu a1, zero, 0x5c
addiu a2, zero, 1
jalr t9
move a3, s6
lw gp, 0x20(sp)
--
addiu gp, gp, -0x54b0
sw ra, 0x94(sp)
sw s1, 0x90(sp)
sw s0, 0x8c(sp)
sw gp, 0x10(sp)
lw t9, -sym.imp.socket(gp)
move s1, a0
addiu a1, zero, 2
addiu a0, zero, 1
jalr t9
move a2, zero
lw gp, 0x10(sp)
bgez v0, 0x401754
move s0, v0
b 0x4017d8
addiu s0, zero, -1
lw t9, -sym.imp.fcntl(gp)
move a0, v0
addiu a1, zero, 2
jalr t9
addiu a2, zero, 1
lw gp, 0x10(sp)
bnez s1, 0x401778
lui v0, 0x40
addiu s1, v0, 0x2ab0
lw t9, -sym.imp.snprintf(gp)
addiu v0, zero, 1
lui a2, 0x40
addiu a2, a2, 0x2ac4
move a3, s1
addiu a0, sp, 0x1a
addiu a1, zero, 0x6c
jalr t9
sh v0, 0x18(sp)
lw gp, 0x10(sp)
move a0, s0
lw t9, -sym.imp.connect(gp)
addiu a1, sp, 0x18
jalr t9
addiu a2, zero, 0x6e
lw gp, 0x10(sp)
bgez v0, 0x4017d8
nop
lw t9, -sym.imp.close(gp)
nop
jalr t9
--
jalr t9
move s0, a1
addiu v0, v0, 1
move a0, s1
move a2, s0
move a3, s2
addiu a1, zero, 0xc
jal 0x40188c
sw v0, 0x10(sp)
lw ra, 0x2c(sp)
lw gp, 0x18(sp)
lw s2, 0x28(sp)
lw s1, 0x24(sp)
lw s0, 0x20(sp)
jr ra
addiu sp, sp, 0x30
lui gp, 0x42
addiu sp, sp, -0x230
addiu gp, gp, -0x54b0
sw ra, 0x22c(sp)
sw s2, 0x228(sp)
sw s1, 0x224(sp)
sw s0, 0x220(sp)
sw gp, 0x18(sp)
addiu s0, sp, 0x20
lw t9, -sym.imp.snprintf(gp)
move v0, a2
lui a2, 0x40
sw a3, 0x10(sp)
addiu a2, a2, 0x2ac8
move a3, v0
move s1, a0
move s2, a1
move a0, s0
jalr t9
addiu a1, zero, 0x1ff
lw gp, 0x18(sp)
move a0, s0
lw t9, -sym.imp.strlen(gp)
nop
jalr t9
sb zero, 0x21f(sp)
addiu v0, v0, 1
move a0, s1
move a2, s2
move a3, s0
addiu a1, zero, 0xb
jal 0x40188c
sw v0, 0x10(sp)
lw ra, 0x22c(sp)
lw gp, 0x18(sp)
lw s2, 0x228(sp)
lw s1, 0x224(sp)
lw s0, 0x220(sp)
jr ra
addiu sp, sp, 0x230
lui gp, 0x42
addiu sp, sp, -0x230
addiu gp, gp, -0x54b0
sw ra, 0x22c(sp)
sw s2, 0x228(sp)
sw s1, 0x224(sp)
sw s0, 0x220(sp)
sw gp, 0x18(sp)
addiu s0, sp, 0x20
lw t9, -sym.imp.snprintf(gp)
move v0, a2
lui a2, 0x40
sw a3, 0x10(sp)
addiu a2, a2, 0x2ac8
move a3, v0
move s1, a0
move s2, a1
move a0, s0
jalr t9
addiu a1, zero, 0x1ff
lw gp, 0x18(sp)
move a0, s0
lw t9, -sym.imp.strlen(gp)
nop
jalr t9
sb zero, 0x21f(sp)
addiu v0, v0, 1
move a0, s1
move a2, s2
move a3, s0
--
move s3, a3
addiu v0, v0, 1
move a0, s1
move a2, s0
move a3, s2
addiu a1, zero, 1
sw s3, 0x14(sp)
jal 0x402184
sw v0, 0x10(sp)
lw ra, 0x34(sp)
lw gp, 0x18(sp)
lw s3, 0x30(sp)
lw s2, 0x2c(sp)
lw s1, 0x28(sp)
lw s0, 0x24(sp)
jr ra
addiu sp, sp, 0x38
lui gp, 0x42
addiu sp, sp, -0x428
addiu gp, gp, -0x54b0
sw ra, 0x424(sp)
sw s0, 0x420(sp)
sw gp, 0x10(sp)
addiu v0, sp, 0x42c
addiu s0, sp, 0x1c
lw t9, -sym.imp.vsnprintf(gp)
sw a1, 0x42c(sp)
sw a2, 0x430(sp)
sw a3, 0x434(sp)
move a2, a0
move a3, v0
move a0, s0
sw v0, 0x18(sp)
jalr t9
addiu a1, zero, 0x400
lw gp, 0x10(sp)
nop
lw t9, -sym.imp.system(gp)
nop
jalr t9
move a0, s0
lw ra, 0x424(sp)
lw gp, 0x10(sp)
lw s0, 0x420(sp)
jr ra
addiu sp, sp, 0x428
lui gp, 0x42
addiu sp, sp, -0x438
addiu gp, gp, -0x54b0
sw ra, 0x434(sp)
sw s4, 0x430(sp)
sw s3, 0x42c(sp)
sw s2, 0x428(sp)
sw s1, 0x424(sp)
sw s0, 0x420(sp)
sw gp, 0x10(sp)
lw t9, -sym.imp.vsnprintf(gp)
addiu v0, sp, 0x444
addiu s0, sp, 0x1c
sw a3, 0x444(sp)
move s2, a0
move a3, v0
move a0, s0
move s3, a1
sw v0, 0x18(sp)
jalr t9
addiu a1, zero, 0x400
lw gp, 0x10(sp)
lui a1, 0x40
lw t9, -sym.imp.popen(gp)
move a0, s0
jalr t9
addiu a1, a1, 0x28a8
lw gp, 0x10(sp)
beqz v0, 0x40255c
move s1, v0
addiu s3, s3, -1
[*] Function printf used 16 times updateleases
