[*] Binary protection state of ecmh
RELRO CANARY NX PIE RPATH RUNPATH SYMBOLS
No RELRO No Canary found NX disabled No PIE No RPATH No RUNPATH No Symbols
[*] Function printf tear down of ecmh
lw gp, 0x18(sp)
lw v0, (s0)
lw t9, -sym.imp.fputc(gp)
lw a1, 0x44(v0)
jalr t9
addiu a0, zero, 0xa
lw v0, (s0)
lw gp, 0x18(sp)
lw v0, 0xc(v0)
nop
lw s4, (v0)
b 0x401850
nop
lw s1, 8(s4)
nop
beqz s1, 0x401848
addiu s0, sp, 0x20
lw t9, -sym.imp.inet_ntop(gp)
addiu a3, zero, 0x2e
addiu a0, zero, 0xa
move a1, s1
jalr t9
move a2, s0
lw gp, 0x18(sp)
lw v0, (s5)
lw t9, -sym.imp.fprintf(gp)
lw a0, 0x44(v0)
lui a1, 0x40
addiu a1, a1, 0x7b90
jalr t9
move a2, s0
lw gp, 0x18(sp)
lw v0, (s5)
lw t9, -sym.imp.fprintf(gp)
lw a2, 0x18(s1)
lw a3, 0x1c(s1)
lw a0, 0x44(v0)
lui a1, 0x40
jalr t9
addiu a1, a1, 0x7b9c
lw gp, 0x18(sp)
lw v0, (s5)
lw t9, -sym.imp.fprintf(gp)
lw a0, 0x44(v0)
lw a2, 0x20(s1)
lw a3, 0x24(s1)
lui a1, 0x40
jalr t9
addiu a1, a1, 0x7bac
lw v0, 0x10(s1)
lw v1, 0x90(sp)
lw gp, 0x18(sp)
move s7, s0
lw s3, (v0)
b 0x401828
negu s6, v1
lw s0, 8(s3)
nop
beqz s0, 0x401820
nop
lw t9, -sym.int_find(gp)
lw a0, (s0)
jalr t9
nop
lw gp, 0x18(sp)
beqz v0, 0x401820
move a2, v0
lw v0, (s5)
lw v1, 4(s0)
lw t9, -sym.imp.fprintf(gp)
lw a0, 0x44(v0)
lw a3, 8(v1)
lui a1, 0x40
addiu a2, a2, 4
jalr t9
addiu a1, a1, 0x7bbc
lw v0, 4(s0)
lw gp, 0x18(sp)
lw s2, (v0)
b 0x40180c
nop
lw s0, 8(s2)
nop
beqz s0, 0x401808
move a1, s0
lw v0, 0x14(s0)
lw v1, 0x54(sp)
nop
subu s1, v1, v0
bgez s1, 0x4017bc
addiu fp, fp, 1
move s1, s6
jalr t9
nop
lw v0, (s5)
lw gp, 0x18(sp)
lw v1, 0x10(s0)
lui a1, 0x40
lw a0, 0x44(v0)
lui a3, 0x40
addiu v0, zero, 1
lw t9, -sym.imp.fprintf(gp)
addiu a1, a1, 0x7be4
move a2, s7
bne v1, v0, 0x4017fc
addiu a3, a3, 0x7bd4
lui a3, 0x40
addiu a3, a3, 0x7bdc
jalr t9
sw s1, 0x10(sp)
lw gp, 0x18(sp)
lw s2, (s2)
lw t9, -sym.imp.inet_ntop(gp)
addiu a0, zero, 0xa
move a2, s7
bnez s2, 0x401790
addiu a3, zero, 0x2e
lw s3, (s3)
nop
bnez s3, 0x40172c
nop
lw v0, (s5)
lw t9, -sym.imp.fputc(gp)
lw a1, 0x44(v0)
jalr t9
addiu a0, zero, 0xa
lw gp, 0x18(sp)
lw s4, (s4)
nop
bnez s4, 0x401680
lui a1, 0x40
lw s0, -loc._fbss(gp)
lw t9, -sym.imp.fprintf(gp)
lw v0, (s0)
nop
lw v1, 0xc(v0)
lw a0, 0x44(v0)
lw a2, 8(v1)
move a3, fp
jalr t9
addiu a1, a1, 0x7c00
lw gp, 0x18(sp)
lw v0, (s0)
lw t9, -sym.imp.fputc(gp)
lw a1, 0x44(v0)
jalr t9
addiu a0, zero, 0xa
lw gp, 0x18(sp)
lw v0, (s0)
lw t9, -sym.imp.fputs(gp)
lw a1, 0x44(v0)
lui a0, 0x40
jalr t9
addiu a0, a0, 0x7c48
lw gp, 0x18(sp)
lw v0, (s0)
lw t9, -sym.imp.fputc(gp)
lw a1, 0x44(v0)
jalr t9
addiu a0, zero, 0xa
lui v0, 0x40
addiu s7, v0, 0x7cb8
lui v0, 0x40
lw gp, 0x18(sp)
addiu s6, v0, 0x7cac
move s3, zero
b 0x401b64
lui s5, 0x40
mult s3, v0
lw v1, 8(a0)
mflo v0
addu s1, v1, v0
lw v0, 0x18(s1)
nop
beqz v0, 0x401b60
lui a1, 0x40
lw t9, -sym.imp.fprintf(gp)
lw a0, 0x44(a0)
addiu a1, a1, 0x7c5c
jalr t9
addiu a2, s1, 4
lw gp, 0x18(sp)
lw v0, (s2)
lw t9, -sym.imp.fprintf(gp)
lw a2, (s1)
lw a0, 0x44(v0)
lui a1, 0x40
jalr t9
addiu a1, a1, 0x7c6c
lw gp, 0x18(sp)
lw v0, (s2)
lw t9, -sym.imp.fprintf(gp)
lw a0, 0x44(v0)
lw a2, 0x18(s1)
lui a1, 0x40
jalr t9
addiu a1, a1, 0x7c8c
lw v0, (s2)
lhu a3, 0x24(s1)
lw a0, 0x44(v0)
addiu v0, zero, 1
lw gp, 0x18(sp)
beq a3, v0, 0x401990
move a2, s6
lui a2, 0x40
addiu v0, zero, 0x308
bne a3, v0, 0x401990
addiu a2, a2, 0x7b64
move a2, s7
lw t9, -sym.imp.fprintf(gp)
lui a1, 0x40
jalr t9
addiu a1, a1, 0x7cbc
lw gp, 0x18(sp)
addiu s0, sp, 0x20
lw t9, -sym.imp.inet_ntop(gp)
lw s2, -loc._fbss(gp)
addiu a3, zero, 0x2e
addiu a0, zero, 0xa
addiu a1, s1, 0x34
jalr t9
move a2, s0
lw gp, 0x18(sp)
lw v0, (s2)
lw t9, -sym.imp.fprintf(gp)
lw a0, 0x44(v0)
lui a1, 0x40
addiu a1, a1, 0x7ce0
jalr t9
move a2, s0
lw gp, 0x18(sp)
addiu a0, zero, 0xa
lw t9, -sym.imp.inet_ntop(gp)
addiu a1, s1, 0x44
move a2, s0
jalr t9
addiu a3, zero, 0x2e
lw gp, 0x18(sp)
lw v0, (s2)
lw t9, -sym.imp.fprintf(gp)
lw a0, 0x44(v0)
lui a1, 0x40
move a2, s0
jalr t9
addiu a1, a1, 0x7d00
lw a2, 0x1c(s1)
lw gp, 0x18(sp)
bnez a2, 0x401a50
nop
lw v0, (s2)
lw t9, -sym.imp.fputs(gp)
lw a1, 0x44(v0)
lui a0, 0x40
jalr t9
addiu a0, a0, 0x7d20
b 0x401a68
nop
lw v0, (s2)
lui a1, 0x40
lw t9, -sym.imp.fprintf(gp)
lw a0, 0x44(v0)
jalr t9
addiu a1, a1, 0x7d44
lw gp, 0x18(sp)
lw a2, 0x58(s1)
lw s0, -loc._fbss(gp)
lw t9, -sym.imp.fprintf(gp)
lw v0, (s0)
lw a3, 0x5c(s1)
lw a0, 0x44(v0)
lui a1, 0x40
jalr t9
addiu a1, a1, 0x7d64
lw gp, 0x18(sp)
lw v0, (s0)
lw t9, -sym.imp.fprintf(gp)
lw a2, 0x60(s1)
lw a3, 0x64(s1)
lw a0, 0x44(v0)
jalr t9
addiu a1, s5, 0x7d88
lw gp, 0x18(sp)
lw v0, (s0)
lw t9, -sym.imp.fprintf(gp)
lw a2, 0x68(s1)
lw a3, 0x6c(s1)
lw a0, 0x44(v0)
lui a1, 0x40
jalr t9
addiu a1, a1, 0x7dac
lw gp, 0x18(sp)
lw v0, (s0)
lw t9, -sym.imp.fprintf(gp)
lw a2, 0x70(s1)
lw a3, 0x74(s1)
lw a0, 0x44(v0)
lui a1, 0x40
jalr t9
addiu a1, a1, 0x7dd0
lw gp, 0x18(sp)
lw v0, (s0)
lw t9, -sym.imp.fprintf(gp)
lw a2, 0x78(s1)
lw a3, 0x7c(s1)
lw a0, 0x44(v0)
lui a1, 0x40
jalr t9
addiu a1, a1, 0x7df4
lw gp, 0x18(sp)
lw v0, (s0)
lw t9, -sym.imp.fprintf(gp)
lw a2, 0x80(s1)
lw a3, 0x84(s1)
lw a0, 0x44(v0)
lui a1, 0x40
jalr t9
addiu a1, a1, 0x7e18
lw gp, 0x18(sp)
lw v0, (s0)
lw t9, -sym.imp.fputc(gp)
lw a1, 0x44(v0)
jalr t9
addiu a0, zero, 0xa
lw gp, 0x18(sp)
addiu s4, s4, 1
addiu s3, s3, 1
lw s2, -loc._fbss(gp)
nop
lw a0, (s2)
nop
lw v0, 4(a0)
nop
sltu v0, s3, v0
bnez v0, 0x4018ec
addiu v0, zero, 0x90
lw t9, -sym.imp.fprintf(gp)
lw a0, 0x44(a0)
lui a1, 0x40
move a2, s4
jalr t9
addiu a1, a1, 0x7e3c
lw gp, 0x18(sp)
lw v0, (s2)
lw t9, -sym.imp.fputc(gp)
lw a1, 0x44(v0)
jalr t9
addiu a0, zero, 0xa
lw gp, 0x18(sp)
lw a0, (s2)
lw t9, -sym.imp.gmtime(gp)
nop
jalr t9
addiu a0, a0, 0x48
lw gp, 0x18(sp)
addiu s0, sp, 0x20
lw t9, -sym.imp.strftime(gp)
lui a2, 0x40
move a3, v0
addiu a2, a2, 0x7e68
move a0, s0
jalr t9
addiu a1, zero, 0x2e
lw gp, 0x18(sp)
lw v0, (s2)
lw t9, -sym.imp.fputs(gp)
lw a1, 0x44(v0)
lui a0, 0x40
jalr t9
addiu a0, a0, 0x7e7c
lw gp, 0x18(sp)
lw v0, (s2)
lw t9, -sym.imp.fputc(gp)
lw a1, 0x44(v0)
jalr t9
addiu a0, zero, 0xa
lw gp, 0x18(sp)
lw v0, (s2)
lw t9, -sym.imp.fprintf(gp)
lw a0, 0x44(v0)
lui a1, 0x40
lui a2, 0x40
addiu a1, a1, 0x7e94
jalr t9
addiu a2, a2, 0x7eb4
lw gp, 0x18(sp)
lw v0, (s2)
lw t9, -sym.imp.fprintf(gp)
lw a0, 0x44(v0)
lui a1, 0x40
move a2, s0
jalr t9
addiu a1, a1, 0x7ec0
lw a0, 0x60(sp)
addiu v0, zero, 0x3c
mult a0, v0
lw a1, 0x50(sp)
mflo v0
lw v1, (s2)
lw gp, 0x18(sp)
subu v0, a1, v0
lw a0, 0x44(v1)
sw v0, 0x14(sp)
lw v0, 0x60(sp)
lw a3, 0x5c(sp)
lw t9, -sym.imp.fprintf(gp)
lw a2, 0x58(sp)
lui a1, 0x40
addiu a1, a1, 0x7ee0
jalr t9
sw v0, 0x10(sp)
lw gp, 0x18(sp)
lw v0, (s2)
lw t9, -sym.imp.fputc(gp)
lw a1, 0x44(v0)
jalr t9
addiu a0, zero, 0xa
lw gp, 0x18(sp)
lw v0, (s2)
lw t9, -sym.imp.fprintf(gp)
lw a0, 0x44(v0)
lui a1, 0x40
move a2, s4
jalr t9
addiu a1, a1, 0x7f10
lw v0, (s2)
lw gp, 0x18(sp)
lw v1, 0xc(v0)
lw t9, -sym.imp.fprintf(gp)
lw a2, 8(v1)
lw a0, 0x44(v0)
lui a1, 0x40
jalr t9
addiu a1, a1, 0x7f2c
lw gp, 0x18(sp)
lw v0, (s2)
lw t9, -sym.imp.fprintf(gp)
lw a0, 0x44(v0)
lui a1, 0x40
move a2, fp
jalr t9
addiu a1, a1, 0x7f48
lw gp, 0x18(sp)
lw v0, (s2)
lw t9, -sym.imp.fprintf(gp)
lw a0, 0x44(v0)
lui a1, 0x40
addiu a1, a1, 0x7f64
jalr t9
addiu a2, zero, 2
lw gp, 0x18(sp)
lw v0, (s2)
lw t9, -sym.imp.fprintf(gp)
lw a0, 0x44(v0)
lui a1, 0x40
addiu a2, zero, 0xfa
jalr t9
addiu a1, a1, 0x7f80
lw gp, 0x18(sp)
lw v0, (s2)
lw t9, -sym.imp.fputc(gp)
lw a1, 0x44(v0)
jalr t9
addiu a0, zero, 0xa
lw v0, (s2)
lw gp, 0x18(sp)
lw a2, 0x50(v0)
lw t9, -sym.imp.fprintf(gp)
lw a3, 0x54(v0)
lw a0, 0x44(v0)
lui a1, 0x40
jalr t9
addiu a1, a1, 0x7f9c
lw v0, (s2)
lw gp, 0x18(sp)
lw a2, 0x58(v0)
lw t9, -sym.imp.fprintf(gp)
lw a3, 0x5c(v0)
lw a0, 0x44(v0)
lui a1, 0x40
jalr t9
addiu a1, a1, 0x7fbc
lw v0, (s2)
lw gp, 0x18(sp)
lw a2, 0x60(v0)
lw t9, -sym.imp.fprintf(gp)
lw a3, 0x64(v0)
lw a0, 0x44(v0)
lui a1, 0x40
jalr t9
addiu a1, a1, 0x7fdc
lw v0, (s2)
lw gp, 0x18(sp)
lw a2, 0x68(v0)
lw t9, -sym.imp.fprintf(gp)
lw a3, 0x6c(v0)
lw a0, 0x44(v0)
lui a1, 0x40
jalr t9
addiu a1, a1, 0x7ffc
lw v0, (s2)
lw gp, 0x18(sp)
lw a2, 0x70(v0)
lw t9, -sym.imp.fprintf(gp)
lw a3, 0x74(v0)
lw a0, 0x44(v0)
lui a1, 0x41
jalr t9
addiu a1, a1, -0x7fe4
lw v0, (s2)
lw gp, 0x18(sp)
lw a2, 0x78(v0)
lw t9, -sym.imp.fprintf(gp)
lw a3, 0x7c(v0)
lw a0, 0x44(v0)
lui a1, 0x41
jalr t9
addiu a1, a1, -0x7fc4
lw v0, (s2)
lw gp, 0x18(sp)
lw a3, 0x84(v0)
lw a2, 0x80(v0)
lw t9, -sym.imp.fprintf(gp)
lw a0, 0x44(v0)
lui a1, 0x41
jalr t9
addiu a1, a1, -0x7fa4
lw gp, 0x18(sp)
lw v0, (s2)
lw t9, -sym.imp.fputc(gp)
lw a1, 0x44(v0)
jalr t9
addiu a0, zero, 0xa
lw gp, 0x18(sp)
lw v0, (s2)
lw t9, -sym.imp.fputs(gp)
lw a1, 0x44(v0)
lui a0, 0x41
jalr t9
addiu a0, a0, -0x7f84
lw gp, 0x18(sp)
lw v0, (s2)
lw t9, -sym.imp.fflush(gp)
--
beqz v0, 0x4058f8
addiu v0, zero, 0x75
addiu v0, zero, 0x66
beq v1, v0, 0x405910
addiu v0, zero, 0x69
bne v1, v0, 0x405a80
nop
b 0x40591c
nop
beq v1, v0, 0x4059d4
addiu v0, zero, 0x76
bne v1, v0, 0x405a80
nop
b 0x405a20
nop
lw v0, (s1)
b 0x405ab4
sw zero, 0x20(v0)
lw s0, (s1)
nop
lw a2, 0x10(s0)
nop
beqz a2, 0x405948
lui a1, 0x41
lw v0, -0x7f08(gp)
lw t9, -sym.imp.fprintf(gp)
lw a0, (v0)
b 0x40598c
addiu a1, a1, -0x70fc
lw t9, -sym.imp.strdup(gp)
lw a0, (s3)
jalr t9
nop
lw gp, 0x18(sp)
b 0x405ab4
sw v0, 0x10(s0)
lw s0, (s1)
nop
lw a2, 0x14(s0)
nop
beqz a2, 0x4059a0
lui a1, 0x41
lw v0, -0x7f08(gp)
lw t9, -sym.imp.fprintf(gp)
lw a0, (v0)
addiu a1, a1, -0x70c4
jalr t9
nop
lw gp, 0x18(sp)
b 0x40611c
addiu v0, zero, -1
lw t9, -sym.imp.strdup(gp)
lw a0, (s3)
jalr t9
nop
lw gp, 0x18(sp)
b 0x405ab4
sw v0, 0x14(s0)
lw v0, (s1)
b 0x405ab4
sw s2, 0x34(v0)
lw v0, (s1)
b 0x405ab4
sw zero, 0x34(v0)
lw t9, -sym.imp.getpwnam(gp)
lw a0, (s3)
jalr t9
nop
lw gp, 0x18(sp)
bnez v0, 0x405a10
lui a1, 0x41
lw v0, -0x7fcc(gp)
nop
lw a2, (v0)
lw v0, -0x7f08(gp)
lw t9, -sym.imp.fprintf(gp)
lw a0, (v0)
b 0x40598c
addiu a1, a1, -0x7088
lw s5, 0xc(v0)
lw s4, 8(v0)
b 0x405ab4
nop
lw v0, (s1)
b 0x405ab4
sw s2, 0x24(v0)
lw t9, -sym.imp.printf(gp)
lui a1, 0x40
lui a2, 0x41
lui a3, 0x41
addiu a0, a0, -0x7064
addiu a1, a1, 0x7eb4
addiu a2, a2, -0x6fe8
jalr t9
addiu a3, a3, -0x6fdc
b 0x406114
nop
lw v0, (s1)
nop
sw zero, 0x30(v0)
b 0x405ab4
sw s2, 0x2c(v0)
lw v0, (s1)
nop
sw s2, 0x30(v0)
b 0x405ab4
sw zero, 0x2c(v0)
lw s0, -0x7f08(gp)
lw t9, -sym.imp.fprintf(gp)
lw a0, (s0)
lw a2, (s6)
lui a1, 0x41
jalr t9
addiu a1, a1, -0x6fc8
lw gp, 0x18(sp)
lui a0, 0x41
lw a1, (s0)
lw t9, -sym.imp.fputs(gp)
b 0x405b40
addiu a0, a0, -0x6dec
lw v0, 0x28(sp)
lw t9, -sym.imp.getopt_long(gp)
lw a0, 0x58(sp)
lui a2, 0x41
lui a3, 0x42
sw v0, 0x10(sp)
move a1, s6
addiu a2, a2, -0x6c54
jalr t9
--
lw v0, 0x24(v1)
nop
beqz v0, 0x406668
addiu v0, zero, 7
bne a0, v0, 0x406610
addiu v0, zero, 3
lui v0, 0x41
b 0x406650
addiu a1, v0, -0x6574
bne a0, v0, 0x406624
addiu v0, zero, 4
lui v0, 0x41
b 0x406650
addiu a1, v0, -0x656c
bne a0, v0, 0x406638
addiu v0, zero, 6
lui v0, 0x41
b 0x406650
addiu a1, v0, -0x6564
beq a0, v0, 0x406648
lui v0, 0x40
b 0x406650
addiu a1, v0, 0x7bd0
lui v0, 0x41
addiu a1, v0, -0x655c
lw t9, -sym.imp.printf(gp)
lui a0, 0x41
jalr t9
addiu a0, a0, -0x6554
lw gp, 0x10(sp)
nop
lw t9, -sym.imp.vprintf(gp)
lw a1, 0x18(sp)
jalr t9
move a0, s0
lw gp, 0x10(sp)
lw ra, 0x24(sp)
lw s0, 0x20(sp)
jr ra
addiu sp, sp, 0x28
lui gp, 0x42
addiu sp, sp, -0x20
addiu gp, gp, 0x2270
sw ra, 0x1c(sp)
sw gp, 0x10(sp)
lui a1, 0x41
move a2, a0
addiu a1, a1, -0x654c
jal sym.dolog
addiu a0, zero, 6
lw gp, 0x10(sp)
lui a0, 0x41
--
lw v1, (v0)
addiu v0, zero, 1
jr ra
sw v0, 0x28(v1)
lui gp, 0x42
addiu sp, sp, -0x20
addiu gp, gp, 0x2270
sw ra, 0x1c(sp)
sw s0, 0x18(sp)
sw gp, 0x10(sp)
lw t9, -sym.imp.fopen(gp)
lui a0, 0x41
lui a1, 0x41
addiu a0, a0, -0x658c
jalr t9
addiu a1, a1, -0x6b38
lw gp, 0x10(sp)
beqz v0, 0x4067a8
move s0, v0
lw t9, -sym.imp.getpid(gp)
nop
jalr t9
nop
lw gp, 0x10(sp)
lui a1, 0x41
lw t9, -sym.imp.fprintf(gp)
addiu a1, a1, -0x6578
move a2, v0
jalr t9
move a0, s0
lw gp, 0x10(sp)
nop
lw t9, -sym.imp.fclose(gp)
nop
jalr t9
move a0, s0
lw gp, 0x10(sp)
nop
lw t9, -sym.imp.getpid(gp)
nop
jalr t9
nop
lw gp, 0x10(sp)
lui a1, 0x41
lw ra, 0x1c(sp)
lw s0, 0x18(sp)
[*] Function printf used 43 times ecmh
