[*] Binary protection state of radvdump
RELRO CANARY NX PIE RPATH RUNPATH SYMBOLS
No RELRO No Canary found NX disabled No PIE No RPATH No RUNPATH No Symbols
[*] Function fprintf tear down of radvdump
lui v1, 0x40
sll v0, a3, 2
addiu v1, v1, 0x35f0
addu v1, v1, v0
lw v0, (v1)
nop
addu v0, v0, gp
jr v0
nop
lw t9, -sym.imp.closelog(gp)
nop
jalr t9
nop
lw gp, 0x10(sp)
b 0x400ec4
move v0, zero
lui v0, 0x41
lw a0, 0x4230(v0)
lw t9, -sym.imp.fclose(gp)
nop
jalr t9
nop
b 0x400e70
nop
lw v0, -0x7f68(gp)
lw t9, -sym.imp.fprintf(gp)
lw a0, (v0)
lui v0, 0x41
lw a2, 0x4228(v0)
jalr t9
addiu a1, a1, 0x3570
lw gp, 0x10(sp)
sw zero, 0x4224(s0)
addiu v0, zero, -1
lw ra, 0x1c(sp)
lw s0, 0x18(sp)
jr ra
addiu sp, sp, 0x20
lui gp, 0x42
addiu sp, sp, -0x478
addiu gp, gp, -0x3f10
sw ra, 0x474(sp)
sw s1, 0x470(sp)
sw s0, 0x46c(sp)
sw gp, 0x18(sp)
lw t9, -sym.imp.vsnprintf(gp)
--
nop
lw t9, -sym.imp.time(gp)
nop
jalr t9
move a0, zero
lw gp, 0x18(sp)
addiu a0, sp, 0x20
lw t9, -sym.imp.localtime(gp)
nop
jalr t9
sw v0, 0x20(sp)
lw gp, 0x18(sp)
addiu s1, sp, 0x24
lw t9, -sym.imp.strftime(gp)
lui a2, 0x40
addiu a2, a2, 0x3590
move a3, v0
move a0, s1
lw s0, -0x7f68(gp)
jalr t9
addiu a1, zero, 0x40
lw gp, 0x18(sp)
lui v0, 0x41
lw a3, 0x4228(v0)
lw a0, (s0)
lw t9, -sym.imp.fprintf(gp)
addiu v0, sp, 0x64
lui a1, 0x40
sw v0, 0x10(sp)
addiu a1, a1, 0x35a0
jalr t9
move a2, s1
lw gp, 0x18(sp)
lw a0, (s0)
b 0x4010a0
nop
lw t9, -sym.imp.time(gp)
nop
jalr t9
move a0, zero
lw gp, 0x18(sp)
addiu a0, sp, 0x20
lw t9, -sym.imp.localtime(gp)
nop
jalr t9
sw v0, 0x20(sp)
lw gp, 0x18(sp)
addiu s1, sp, 0x24
lw t9, -sym.imp.strftime(gp)
lui a2, 0x40
addiu a2, a2, 0x3590
move a3, v0
move a0, s1
jalr t9
addiu a1, zero, 0x40
lw gp, 0x18(sp)
lui s0, 0x41
lui v0, 0x41
lw a3, 0x4228(v0)
lw a0, 0x4230(s0)
lw t9, -sym.imp.fprintf(gp)
addiu v0, sp, 0x64
lui a1, 0x40
sw v0, 0x10(sp)
addiu a1, a1, 0x35a0
jalr t9
move a2, s1
lw gp, 0x18(sp)
lw a0, 0x4230(s0)
lw t9, -sym.imp.fflush(gp)
nop
jalr t9
nop
lw gp, 0x18(sp)
b 0x4010ec
move v0, zero
lw v0, -0x7f68(gp)
lw t9, -sym.imp.fprintf(gp)
lw a0, (v0)
lui v0, 0x41
lw a2, 0x4228(v0)
jalr t9
addiu a1, a1, 0x3570
lw gp, 0x18(sp)
sw zero, 0x4224(s1)
b 0x4010ec
addiu v0, zero, -1
move v0, zero
lw ra, 0x474(sp)
lw s1, 0x470(sp)
lw s0, 0x46c(sp)
jr ra
addiu sp, sp, 0x478
addiu sp, sp, -0x28
sw ra, 0x24(sp)
sw gp, 0x10(sp)
addiu v0, sp, 0x30
sw a2, 0x30(sp)
--
addu v1, v1, v0
lw v0, (v1)
nop
addu v0, v0, gp
jr v0
nop
addiu v0, zero, -1
bne a3, v0, 0x4011fc
lui v1, 0x41
addiu v0, zero, 0x18
b 0x401200
sw v0, 0x4234(v1)
sw a3, 0x4234(v1)
lui v0, 0x41
lw t9, -sym.imp.openlog(gp)
lw a2, 0x4234(v0)
move a0, t1
jalr t9
addiu a1, zero, 1
lw gp, 0x18(sp)
b 0x40130c
move v0, zero
bnez a2, 0x401250
lui s0, 0x41
lw v0, -0x7f68(gp)
lw t9, -sym.imp.fprintf(gp)
lw a0, (v0)
lui a1, 0x40
addiu a1, a1, 0x35b0
jalr t9
move a2, t1
b 0x4012cc
nop
lw t9, -sym.imp.fopen(gp)
lui a1, 0x40
sw a2, 0x422c(s0)
jalr t9
addiu a1, a1, 0x35cc
lui v1, 0x41
lw gp, 0x18(sp)
bnez v0, 0x401308
sw v0, 0x4230(v1)
lw v0, -0x7f68(gp)
lw t9, -sym.imp.__errno_location(gp)
lw s1, (v0)
lui v0, 0x41
lw s2, 0x4228(v0)
jalr t9
nop
lw gp, 0x18(sp)
lw a0, (v0)
lw t9, -sym.imp.strerror(gp)
lw s0, 0x422c(s0)
jalr t9
nop
lw gp, 0x18(sp)
lui a1, 0x40
lw t9, -sym.imp.fprintf(gp)
sw v0, 0x10(sp)
move a0, s1
addiu a1, a1, 0x35d0
move a2, s2
jalr t9
move a3, s0
lw gp, 0x18(sp)
b 0x40130c
addiu v0, zero, -1
lw v0, -0x7f68(gp)
lw t9, -sym.imp.fprintf(gp)
lw a0, (v0)
lui a1, 0x40
addiu a1, a1, 0x3570
move a2, t1
jalr t9
move a3, t0
lw gp, 0x18(sp)
sw zero, 0x4224(s0)
b 0x40130c
addiu v0, zero, -1
move v0, zero
lw ra, 0x2c(sp)
lw s2, 0x28(sp)
lw s1, 0x24(sp)
lw s0, 0x20(sp)
jr ra
addiu sp, sp, 0x30
addiu sp, sp, -0x20
sw ra, 0x1c(sp)
sw gp, 0x10(sp)
--
cfc1 v0, 31
cfc1 v0, 31
nop
ori at, v0, 3
xori at, at, 2
ctc1 at, 31
nop
cvt.w.d f0, f12
ctc1 v0, 31
nop
jalr t9
swc1 f0, 0x24(sp)
lw ra, 0x2c(sp)
lw gp, 0x18(sp)
jr ra
addiu sp, sp, 0x30
nop
nop
nop
lui gp, 0x42
addiu sp, sp, -0x20
addiu gp, gp, -0x3f10
sw ra, 0x1c(sp)
sw gp, 0x10(sp)
lw v0, -0x7f68(gp)
lw t9, -sym.imp.fprintf(gp)
lw a0, (v0)
lw v0, -loc._fbss(gp)
lui a1, 0x40
lw a2, (v0)
lui a3, 0x41
addiu a1, a1, 0x3830
jalr t9
addiu a3, a3, 0x4070
lw gp, 0x10(sp)
nop
lw t9, -sym.imp.exit(gp)
nop
jalr t9
addiu a0, zero, 1
lui gp, 0x42
addiu sp, sp, -0x20
addiu gp, gp, -0x3f10
sw ra, 0x1c(sp)
sw s0, 0x18(sp)
sw gp, 0x10(sp)
lw s0, -0x7f68(gp)
lw t9, -sym.imp.fprintf(gp)
lw a0, (s0)
lui a1, 0x40
lui a2, 0x40
addiu a1, a1, 0x3840
jalr t9
addiu a2, a2, 0x3850
lw gp, 0x10(sp)
lw a0, (s0)
lw t9, -sym.imp.fprintf(gp)
lui a1, 0x40
lui a2, 0x40
addiu a1, a1, 0x3854
jalr t9
addiu a2, a2, 0x3884
lw gp, 0x10(sp)
nop
lw t9, -sym.imp.exit(gp)
nop
jalr t9
addiu a0, zero, 1
lui gp, 0x42
addiu v0, zero, 1
beq a0, v0, 0x402064
addiu gp, gp, -0x3f10
addiu v0, zero, 3
beq a0, v0, 0x402074
nop
bnez a0, 0x402088
lui a0, 0x40
--
lw gp, 0x18(sp)
nop
lw t9, -sym.set_debuglevel(gp)
nop
jalr t9
move a0, v0
b 0x402fbc
nop
jal 0x401fc4
nop
lw gp, 0x18(sp)
b 0x403014
nop
jal 0x401f70
nop
lw gp, 0x18(sp)
lw v1, 0x28(sp)
lui v0, 0x41
addiu v0, v0, 0x4090
sll v1, v1, 4
addu v1, v1, v0
lw v0, -0x7f68(gp)
lw a3, (v1)
lw a0, (v0)
lw v0, -loc._fbss(gp)
lw t9, -sym.imp.fprintf(gp)
lw a2, (v0)
lui a1, 0x40
jalr t9
addiu a1, a1, 0x3ea0
b 0x40320c
nop
lw v0, 0x628(sp)
lw t9, -sym.imp.getopt_long(gp)
lw a0, 0x658(sp)
lui a2, 0x40
lui a3, 0x41
sw v0, 0x10(sp)
move a1, s0
addiu a2, a2, 0x3ec4
jalr t9
addiu a3, a3, 0x4090
lw gp, 0x18(sp)
bgtz v0, 0x402f34
move v1, v0
lw v0, -loc._fbss(gp)
[*] Function fprintf used 11 times radvdump
