[*] Binary protection state of libxt_tcp.so
RELRO CANARY NX PIE RPATH RUNPATH SYMBOLS
No RELRO No Canary found NX disabled DSO No RPATH No RUNPATH Symbols
[*] Function printf tear down of libxt_tcp.so
sw gp, 0x10(sp)
lw v0, -0x7fe8(gp)
andi s1, a0, 0xff
addiu s5, v0, 0x1e40
lw v0, -0x7fe8(gp)
move a0, zero
addiu s4, v0, 0x1e3c
lw v0, -0x7fdc(gp)
b 0xab4
addiu s3, v0, section..rodata
addiu s0, s0, 1
lw s2, (v1)
nop
and v0, s1, s2
beqz v0, 0xa58
addiu v1, v1, 8
beqz a0, 0xa90
sll v0, s0, 3
lw t9, -sym.imp.putchar(gp)
nop
jalr t9
addiu a0, zero, 0x2c
lw gp, 0x10(sp)
sll v0, s0, 3
addu v0, v0, s4
lw t9, -sym.imp.printf(gp)
lw a1, (v0)
jalr t9
move a0, s3
nor v0, zero, s2
lw gp, 0x10(sp)
and s1, s1, v0
addiu a0, zero, 1
beqz s1, 0xac4
move v1, s5
b 0xa5c
move s0, zero
bnez a0, 0xafc
nop
lw a0, -0x7fdc(gp)
lw t9, -sym.imp.printf(gp)
lw ra, 0x34(sp)
lw s5, 0x30(sp)
lw s4, 0x2c(sp)
lw s3, 0x28(sp)
lw s2, 0x24(sp)
lw s1, 0x20(sp)
lw s0, 0x1c(sp)
addiu a0, a0, str.NONE
jr t9
addiu sp, sp, 0x38
lw ra, 0x34(sp)
lw s5, 0x30(sp)
lw s4, 0x2c(sp)
lw s3, 0x28(sp)
lw s2, 0x24(sp)
lw s1, 0x20(sp)
lw s0, 0x1c(sp)
jr ra
addiu sp, sp, 0x38
lui gp, 2
addiu gp, gp, -0x6be0
addu gp, gp, t9
addiu sp, sp, -0x28
sw ra, 0x24(sp)
sw s1, 0x20(sp)
sw s0, 0x1c(sp)
sw gp, 0x10(sp)
lhu v0, 0x20(a1)
move s1, a1
bnez v0, 0xb60
addiu s0, a1, 0x20
lhu v1, 2(s0)
ori v0, zero, 0xffff
beq v1, v0, 0xbc4
nop
lbu v0, 0xb(s0)
nop
andi v0, v0, 1
beqz v0, 0xb8c
nop
lw a0, -0x7fdc(gp)
lw t9, -sym.imp.printf(gp)
nop
jalr t9
addiu a0, a0, 0x19fc
lw gp, 0x10(sp)
lhu a1, 0x20(s1)
lhu a2, 2(s0)
lw t9, -sym.imp.printf(gp)
beq a1, a2, 0xbb4
nop
lw a0, -0x7fdc(gp)
jalr t9
addiu a0, a0, str.__sport__u:_u
b 0xbc0
nop
lw a0, -0x7fdc(gp)
jalr t9
addiu a0, a0, str.__sport__u
lw gp, 0x10(sp)
lhu v0, 4(s0)
nop
bnez v0, 0xbe4
ori v0, zero, 0xffff
lhu v1, 6(s0)
nop
beq v1, v0, 0xc48
nop
lbu v0, 0xb(s0)
nop
andi v0, v0, 2
beqz v0, 0xc10
nop
lw a0, -0x7fdc(gp)
lw t9, -sym.imp.printf(gp)
nop
jalr t9
addiu a0, a0, 0x19fc
lw gp, 0x10(sp)
lhu a1, 4(s0)
lhu a2, 6(s0)
lw t9, -sym.imp.printf(gp)
beq a1, a2, 0xc38
nop
lw a0, -0x7fdc(gp)
jalr t9
addiu a0, a0, str.__dport__u:_u
b 0xc44
nop
lw a0, -0x7fdc(gp)
jalr t9
addiu a0, a0, str.__dport__u
lw gp, 0x10(sp)
lbu v0, 8(s0)
nop
bnez v0, 0xc6c
nop
lbu v0, 0xb(s0)
nop
andi v0, v0, 8
beqz v0, 0xcb4
nop
lbu v0, 0xb(s0)
nop
andi v0, v0, 8
beqz v0, 0xc9c
nop
lw a0, -0x7fdc(gp)
lw t9, -sym.imp.printf(gp)
nop
jalr t9
addiu a0, a0, 0x19fc
lw gp, 0x10(sp)
nop
lw a0, -0x7fdc(gp)
lw t9, -sym.imp.printf(gp)
lbu a1, 8(s0)
jalr t9
addiu a0, a0, str.__tcp_option__u
lw gp, 0x10(sp)
lbu v0, 9(s0)
nop
bnez v0, 0xcd8
nop
lbu v0, 0xb(s0)
nop
andi v0, v0, 4
beqz v0, 0xd98
nop
lbu v0, 0xb(s0)
nop
andi v0, v0, 4
beqz v0, 0xd08
nop
lw a0, -0x7fdc(gp)
lw t9, -sym.imp.printf(gp)
nop
jalr t9
addiu a0, a0, 0x19fc
lw gp, 0x10(sp)
nop
lw a0, -0x7fdc(gp)
lw t9, -sym.imp.printf(gp)
nop
jalr t9
addiu a0, a0, str.__tcp_flags
lbu a0, 9(s0)
addiu v0, zero, 0xff
lw gp, 0x10(sp)
beq a0, v0, 0xd4c
nop
lw t9, -0x7fdc(gp)
nop
addiu t9, t9, sym.print_tcpf
jalr t9
nop
lw gp, 0x10(sp)
nop
lw t9, -sym.imp.putchar(gp)
nop
jalr t9
addiu a0, zero, 0x20
lw gp, 0x10(sp)
--
lui gp, 2
addiu gp, gp, -0x6e6c
addu gp, gp, t9
addiu sp, sp, -0x20
sw ra, 0x1c(sp)
sw s0, 0x18(sp)
sw gp, 0x10(sp)
bnez a1, 0xe0c
andi s0, a0, 0xffff
lw a1, -0x7fdc(gp)
sll a0, s0, 8
lw t9, -sym.imp.getservbyport(gp)
srl v0, s0, 8
andi a0, a0, 0xffff
or a0, a0, v0
jalr t9
addiu a1, a1, 0x1a5c
lw gp, 0x10(sp)
beqz v0, 0xe0c
nop
lw a1, (v0)
nop
bnez a1, 0xe20
nop
lw a0, -0x7fdc(gp)
lw t9, -sym.imp.printf(gp)
addiu a0, a0, 0x1a60
b 0xe2c
move a1, s0
lw a0, -0x7fdc(gp)
lw t9, -sym.imp.printf(gp)
addiu a0, a0, section..rodata
lw ra, 0x1c(sp)
lw s0, 0x18(sp)
jr t9
addiu sp, sp, 0x20
lui gp, 2
addiu gp, gp, -0x6efc
addu gp, gp, t9
addiu sp, sp, -0x30
sw ra, 0x2c(sp)
sw s4, 0x28(sp)
sw s3, 0x24(sp)
sw s2, 0x20(sp)
sw s1, 0x1c(sp)
sw s0, 0x18(sp)
sw gp, 0x10(sp)
move v1, a0
andi s1, a1, 0xffff
lw s3, 0x40(sp)
bnez a3, 0xe88
andi s2, a2, 0xffff
lw v0, -0x7fdc(gp)
b 0xe94
addiu s0, v0, 0x1a70
lw v0, -0x7fdc(gp)
nop
addiu s0, v0, 0x1a64
bnez s1, 0xeac
ori v0, zero, 0xffff
bne s2, v0, 0xeac
nop
beqz a3, 0xf64
nop
lw a0, -0x7fdc(gp)
lw t9, -sym.imp.printf(gp)
addiu a0, a0, section..rodata
jalr t9
move a1, v1
lw gp, 0x10(sp)
nop
lw v0, -0x7fdc(gp)
lw t9, -sym.imp.printf(gp)
bne s1, s2, 0xef0
addiu s4, v0, sym.print_port
lw a0, -0x7fdc(gp)
move a1, s0
jalr t9
addiu a0, a0, 0x1a68
b 0xf2c
move a0, s1
lw a0, -0x7fdc(gp)
move a1, s0
jalr t9
addiu a0, a0, 0x1a90
move a0, s1
move t9, s4
jalr t9
move a1, s3
lw gp, 0x10(sp)
nop
lw t9, -sym.imp.putchar(gp)
nop
--
lw s2, 0x20(sp)
lw s1, 0x1c(sp)
lw s0, 0x18(sp)
addiu a0, zero, 0x20
jr t9
addiu sp, sp, 0x30
lw ra, 0x2c(sp)
lw s4, 0x28(sp)
lw s3, 0x24(sp)
lw s2, 0x20(sp)
lw s1, 0x1c(sp)
lw s0, 0x18(sp)
jr ra
addiu sp, sp, 0x30
lui gp, 2
addiu gp, gp, -0x7044
addu gp, gp, t9
addiu sp, sp, -0x38
sw ra, 0x34(sp)
sw s3, 0x30(sp)
sw s2, 0x2c(sp)
sw s1, 0x28(sp)
sw s0, 0x24(sp)
sw gp, 0x18(sp)
lw a0, -0x7fdc(gp)
lw t9, -sym.imp.printf(gp)
addiu a0, a0, str.tcp
addiu s1, a1, 0x20
move s2, a2
jalr t9
move s0, a1
lw gp, 0x18(sp)
lbu a3, 0xb(s1)
lw v0, -0x7fdc(gp)
lw a0, -0x7fdc(gp)
lhu a1, 0x20(s0)
lhu a2, 2(s1)
addiu s0, v0, sym.print_ports
addiu a0, a0, 0x1a74
andi a3, a3, 1
move t9, s0
jalr t9
sw s2, 0x10(sp)
lw gp, 0x18(sp)
lbu a3, 0xb(s1)
lw a0, -0x7fdc(gp)
lhu a2, 6(s1)
lhu a1, 4(s1)
addiu a0, a0, 0x1a78
andi a3, a3, 2
move t9, s0
jalr t9
sw s2, 0x10(sp)
lbu v0, 0xb(s1)
lbu a2, 8(s1)
lw gp, 0x18(sp)
bnez a2, 0x1044
andi v0, v0, 8
bnez v0, 0x1058
nop
b 0x107c
nop
bnez v0, 0x1058
nop
lw v0, -0x7fdc(gp)
b 0x1064
addiu a1, v0, 0x1a70
lw v0, -0x7fdc(gp)
nop
addiu a1, v0, 0x1a64
lw a0, -0x7fdc(gp)
lw t9, -sym.imp.printf(gp)
nop
jalr t9
addiu a0, a0, str.option_s_u
lw gp, 0x18(sp)
lbu v0, 0xb(s1)
lbu s0, 9(s1)
lbu s3, 0xa(s1)
bnez s0, 0x10a0
andi v0, v0, 4
bnez v0, 0x10b4
nop
b 0x1154
nop
bnez v0, 0x10b4
nop
lw v0, -0x7fdc(gp)
b 0x10c0
addiu a1, v0, 0x1a70
lw v0, -0x7fdc(gp)
nop
addiu a1, v0, 0x1a64
lw a0, -0x7fdc(gp)
lw t9, -sym.imp.printf(gp)
nop
jalr t9
addiu a0, a0, str.flags:_s
lw gp, 0x18(sp)
beqz s2, 0x10fc
move a1, s0
lw a0, -0x7fdc(gp)
lw t9, -sym.imp.printf(gp)
addiu a0, a0, str.0x_02X_0x_02X
jalr t9
move a2, s3
b 0x1150
nop
lw v0, -0x7fdc(gp)
move a0, s0
addiu s0, v0, sym.print_tcpf
move t9, s0
jalr t9
nop
lw gp, 0x18(sp)
nop
lw t9, -sym.imp.putchar(gp)
nop
jalr t9
addiu a0, zero, 0x2f
move t9, s0
jalr t9
move a0, s3
lw gp, 0x18(sp)
nop
lw t9, -sym.imp.putchar(gp)
nop
jalr t9
addiu a0, zero, 0x20
lw gp, 0x18(sp)
lbu v0, 0xb(s1)
nop
andi a1, v0, 0xf0
beqz a1, 0x1190
nop
lw a0, -0x7fdc(gp)
lw t9, -sym.imp.printf(gp)
lw ra, 0x34(sp)
lw s3, 0x30(sp)
lw s2, 0x2c(sp)
lw s1, 0x28(sp)
lw s0, 0x24(sp)
addiu a0, a0, str.Unknown_invflags:_0x_X
jr t9
addiu sp, sp, 0x38
lw ra, 0x34(sp)
lw s3, 0x30(sp)
lw s2, 0x2c(sp)
lw s1, 0x28(sp)
lw s0, 0x24(sp)
jr ra
addiu sp, sp, 0x38
lui gp, 2
addiu gp, gp, -0x726c
addu gp, gp, t9
addiu sp, sp, -0x30
sw ra, 0x2c(sp)
[*] Function printf used 19 times libxt_tcp.so
