[*] Binary protection state of ip

  	RELRO          CANARY            NX           PIE          RPATH        RUNPATH      SYMBOLS      

  	No RELRO       No Canary found   NX disabled  No PIE       No RPATH     No RUNPATH   No Symbols

[*] Function strcpy tear down of ip

jalr t9

move a0, s0

andi v0, v0, 1

b 0x4056b0

sltiu a2, v0, 1

sll v1, a2, 2

addiu v0, v0, -0x6fc8

addu v1, v1, v0

lw t9, -sym.imp.fprintf(gp)

lw a2, (v1)

lui a1, 0x43

addiu a1, a1, 0x1768

jalr t9

move a0, s1

lw gp, 0x20(sp)

b 0x405788

nop

lw t9, -sym.imp.socket(gp)

addiu a0, zero, 2

lw s3, 0x94(sp)

jalr t9

move a2, zero

lw gp, 0x20(sp)

bltz v0, 0x405798

move s4, v0

lw t9, -sym.imp.strcpy(gp)

addiu s0, sp, 0x28

addiu a1, s3, 4

move a0, s0

sw zero, 0x28(sp)

sw zero, 0x2c(sp)

sw zero, 0x30(sp)

sw zero, 0x34(sp)

sw zero, 0x38(sp)

sw zero, 0x3c(sp)

sw zero, 0x40(sp)

jalr t9

sw zero, 0x44(sp)

lw gp, 0x20(sp)

move a2, s0

lw t9, -sym.imp.ioctl(gp)

move a0, s4

jalr t9

ori a1, zero, 0x8942

lw gp, 0x20(sp)

bltz v0, 0x405e7c

--

nop

lw t9, -sym.tnl_ioctl_get_iftype(gp)

nop

jalr t9

move a0, s3

move v1, v0

addiu v0, zero, -1

lw gp, 0x40(sp)

beq v1, v0, 0x411fc0

addiu v0, zero, 0x301

bne v1, v0, 0x411af4

addiu s0, sp, 0x90

lw t9, -sym.imp.memset(gp)

move a0, s0

move a1, zero

jalr t9

addiu a2, zero, 0x40

lw gp, 0x40(sp)

addiu a2, zero, 0x40

lw t9, -sym.imp.memset(gp)

move a0, s0

jalr t9

move a1, zero

lw gp, 0x40(sp)

addiu v0, zero, 0x29

lw t9, -sym.imp.strcpy(gp)

move a0, s0

move a1, s3

jalr t9

sb v0, 0xa4(sp)

lw gp, 0x40(sp)

nop

lw t9, -sym.tnl_ioctl_get_ifindex(gp)

nop

jalr t9

move a0, s0

lw gp, 0x40(sp)

beqz v0, 0x411af4

sw v0, 0xa0(sp)

lw t9, -sym.tnl_get_ioctl(gp)

move a0, s0

jalr t9

move a1, s0

lw gp, 0x40(sp)

bnez v0, 0x411af4

nop

--

bnez s0, 0x429f24

nop

lw v0, -0x7fe0(gp)

lw v1, -0x7fe0(gp)

addiu s2, v0, -0x4a9c

addiu s3, v1, -0x4a5c

lw s0, (s2)

nop

bnez s0, 0x429e94

nop

b 0x429ef4

addiu s2, s2, 4

lw s0, (s0)

nop

beqz s0, 0x429ef0

nop

lw t9, -sym.imp.strcmp(gp)

addiu a0, s0, 0x28

jalr t9

move a1, s1

lw gp, 0x10(sp)

bnez v0, 0x429e84

move a1, s1

lw v0, 4(s0)

lw a0, -0x7fe0(gp)

lw t9, -sym.imp.strcpy(gp)

sw v0, -0x4ac0(s4)

jalr t9

addiu a0, a0, -0x4abc

lw ra, 0x2c(sp)

lw v0, 4(s0)

lw gp, 0x10(sp)

lw s4, 0x28(sp)

lw s3, 0x24(sp)

lw s2, 0x20(sp)

lw s1, 0x1c(sp)

lw s0, 0x18(sp)

jr ra

addiu sp, sp, 0x30

addiu s2, s2, 4

bne s2, s3, 0x429e6c

nop

lw t9, -sym.imp.if_nametoindex(gp)

move a0, s1

lw ra, 0x2c(sp)

lw s4, 0x28(sp)

--

beqz s0, 0x42a2bc

nop

lw v0, 4(s0)

nop

bne v0, a0, 0x42a230

nop

lhu v1, 2(s2)

lw a1, 0x1c(sp)

sw v1, 8(s0)

lw v0, 8(s2)

beqz a1, 0x42a2f0

sw v0, 0x10(s0)

lhu v0, (a1)

nop

addiu a2, v0, -4

sltiu v1, a2, 0x15

bnez v1, 0x42a288

sw a2, 0xc(s0)

addiu a2, zero, 0x14

lw t9, -sym.imp.memcpy(gp)

addiu a1, a1, 4

jalr t9

addiu a0, s0, 0x14

lw gp, 0x10(sp)

lw a1, 0x24(sp)

lw t9, -sym.imp.strcpy(gp)

addiu a0, s0, 0x28

jalr t9

addiu a1, a1, 4

lw gp, 0x10(sp)

b 0x42a18c

move v0, zero

lw t9, -sym.imp.malloc(gp)

nop

jalr t9

addiu a0, zero, 0x38

lw gp, 0x10(sp)

beqz v0, 0x42a188

move s0, v0

lw v0, (s1)

lw v1, 4(s2)

sw v0, (s0)

sw v1, 4(s0)

b 0x42a254

sw s0, (s1)

addiu v0, s0, 0x14

[*] Function strcpy used 4 times ip