[*] Binary protection state of trigger

  	RELRO          CANARY            NX           PIE          RPATH        RUNPATH      SYMBOLS      

  	No RELRO       No Canary found   NX disabled  No PIE       No RPATH     No RUNPATH   Symbols

[*] Function printf tear down of trigger

lw t9, -0x7f8c(gp)

nop

beqz t9, 0x4008dc

addiu a0, a0, 0x1138

lw ra, 0x1c(sp)

jr t9

addiu sp, sp, 0x20

lw ra, 0x1c(sp)

nop

jr ra

addiu sp, sp, 0x20

nop

lui gp, 0x42

addiu sp, sp, -0x28

addiu gp, gp, -0x6eb0

sw ra, 0x24(sp)

sw gp, 0x10(sp)

lui v0, 0x41

lw v0, 0x11f8(v0)

sw a1, 0x2c(sp)

sw a2, 0x30(sp)

sw a3, 0x34(sp)

beqz v0, 0x40093c

move a1, a0

lw v0, -0x7fa8(gp)

lw t9, -sym.imp.vfprintf(gp)

addiu a2, sp, 0x2c

lw a0, (v0)

jalr t9

sw a2, 0x18(sp)

lw gp, 0x10(sp)

lw ra, 0x24(sp)

nop

jr ra

addiu sp, sp, 0x28

lui gp, 0x42

addiu sp, sp, -0x20

addiu gp, gp, -0x6eb0

sw ra, 0x1c(sp)

sw s0, 0x18(sp)

sw gp, 0x10(sp)

lui v0, 0x41

lw v0, 0x11f4(v0)

nop

beqz v0, 0x40098c

move s0, a0

--

beqz a0, 0x4009b0

nop

lw t9, -sym.imp.free(gp)

nop

jalr t9

nop

lui a0, 0x40

lui a1, 0x40

addiu a0, a0, 0xf84

addiu a1, a1, 0xf9c

jal sym.verbose

move a2, s0

lw gp, 0x10(sp)

nop

lw t9, -sym.imp.exit(gp)

nop

jalr t9

move a0, s0

lui gp, 0x42

addiu sp, sp, -0x28

addiu gp, gp, -0x6eb0

sw ra, 0x24(sp)

sw s1, 0x20(sp)

sw s0, 0x1c(sp)

sw gp, 0x10(sp)

lw t9, -sym.imp.printf(gp)

lui s0, 0x40

move s1, a0

lui a0, 0x40

addiu a1, s0, 0xf9c

addiu a0, a0, 0xfa4

jalr t9

addiu a2, zero, 1

lw gp, 0x10(sp)

lui a0, 0x40

lw t9, -sym.imp.printf(gp)

addiu a1, s0, 0xf9c

addiu a2, zero, 1

jalr t9

addiu a0, a0, 0xfb4

lw gp, 0x10(sp)

lui a0, 0x40

lw t9, -sym.imp.puts(gp)

nop

jalr t9

addiu a0, a0, 0xfd4

lw gp, 0x10(sp)

lui a0, 0x40

lw t9, -sym.imp.puts(gp)

nop

jalr t9

addiu a0, a0, 0x1004

lw gp, 0x10(sp)

lui a0, 0x40

lw t9, -sym.imp.printf(gp)

lui a1, 0x40

addiu a0, a0, 0x1028

jalr t9

addiu a1, a1, 0x1068

lw gp, 0x10(sp)

lui a0, 0x40

lw t9, -sym.imp.puts(gp)

nop

jalr t9

addiu a0, a0, 0x1084

lw gp, 0x10(sp)

move a0, s1

lw ra, 0x24(sp)

lw s1, 0x20(sp)

lw s0, 0x1c(sp)

j sym.cleanup_exit

addiu sp, sp, 0x28

lui gp, 0x42

addiu sp, sp, -0xb8

addiu gp, gp, -0x6eb0

--

move v1, v0

lui v0, 0x41

lw v0, 0x11f0(v0)

nop

beqz v0, 0x400d84

lui s0, 0x41

lw v0, 0x11f4(s0)

nop

bnez v0, 0x400c64

lui s1, 0x41

lw t9, -sym.imp.strdup(gp)

lui a0, 0x40

jalr t9

addiu a0, a0, 0x1068

sw v0, 0x11f4(s0)

lui s1, 0x41

lui s0, 0x41

lw a1, 0x11f0(s1)

lw a2, 0x11f4(s0)

lui a0, 0x40

jal sym.verbose

addiu a0, a0, 0x10b4

lw gp, 0x18(sp)

lw s4, 0x11f4(s0)

lw s2, 0x11f0(s1)

lw t9, -sym.imp.printf(gp)

lui a0, 0x40

addiu a0, a0, 0x10d0

move a1, s4

jalr t9

move a2, s2

lw gp, 0x18(sp)

beqz s2, 0x400d94

addiu a0, zero, 1

lw t9, -sym.imp.socket(gp)

addiu a1, zero, 1

jalr t9

move a2, zero

lw gp, 0x18(sp)

bltz v0, 0x400d78

move s3, v0

lw t9, -sym.imp.memset(gp)

addiu s1, sp, 0x20

move a0, s1

move a1, zero

jalr t9

[*] Function printf used 5 times trigger