[*] Binary protection state of xmldb

  	RELRO          CANARY            NX           PIE          RPATH        RUNPATH      SYMBOLS      

  	No RELRO       No Canary found   NX disabled  No PIE       No RPATH     No RUNPATH   No Symbols

[*] Function strcat tear down of xmldb

lw v0, -0x7fcc(gp)

lw t9, -sym.imp.strlen(gp)

lw a0, (v0)

jalr t9

nop

lui v1, 0x43

lw s0, 0x490c(v1)

lw gp, 0x10(sp)

beqz s0, 0x4042b8

addiu s1, v0, 2

lw t9, -sym.imp.strlen(gp)

nop

jalr t9

move a0, s0

addiu v0, v0, 1

lw gp, 0x10(sp)

addu s1, s1, v0

lw t9, -sym.imp.realloc(gp)

move a0, s0

jalr t9

move a1, s1

lui s0, 0x43

lw gp, 0x10(sp)

beqz v0, 0x4043e0

sw v0, 0x490c(s0)

lw t9, -sym.imp.strcat(gp)

lui a1, 0x42

move a0, v0

jalr t9

addiu a1, a1, 0x2410

lw gp, 0x10(sp)

lw a0, 0x490c(s0)

lw v0, -0x7fcc(gp)

lw t9, -sym.imp.strcat(gp)

lw a1, (v0)

jalr t9

nop

b 0x40400c

nop

lw v0, -0x7ecc(gp)

nop

lw v0, (v0)

nop

slt v0, v0, s5

bnez v0, 0x404358

lui a0, 0x42

lw t9, -sym.imp.puts(gp)

nop

jalr t9

addiu a0, a0, 0x23b0

move a0, s5

jal 0x403dc0

move a1, s4

jal 0x403f0c

--

lw t9, -sym.imp.strlen(gp)

nop

jalr t9

lui s1, 0x43

lw gp, 0x10(sp)

lw a0, 0x4910(s1)

lw t9, -sym.imp.strlen(gp)

nop

jalr t9

move s0, v0

lw gp, 0x10(sp)

addu s0, s0, v0

lw t9, -sym.imp.malloc(gp)

nop

jalr t9

addiu a0, s0, 2

lw gp, 0x10(sp)

beqz v0, 0x404740

move s0, v0

lw t9, -sym.imp.strcpy(gp)

lw a1, 0x4910(s1)

jalr t9

move a0, v0

lw gp, 0x10(sp)

lw a1, 0x490c(s2)

lw t9, -sym.imp.strcat(gp)

nop

jalr t9

move a0, s0

lw gp, 0x10(sp)

lui v0, 0x43

lw a0, 0x48fc(v0)

lw v0, -0x7e28(gp)

lw t9, -sym.xmldbc_ephp(gp)

lw a3, (v0)

move a2, s0

jalr t9

move a1, zero

lw gp, 0x10(sp)

move a0, s0

lw t9, -sym.imp.free(gp)

nop

jalr t9

move s0, v0

b 0x404648

nop

[*] Function strcat used 3 times xmldb