[*] Binary protection state of updateleases
RELRO CANARY NX PIE RPATH RUNPATH SYMBOLS
No RELRO No Canary found NX disabled No PIE No RPATH No RUNPATH No Symbols
[*] Function sprintf tear down of updateleases
move a2, zero
jalr t9
move a0, v0
lw gp, 0x20(sp)
move a0, s5
lw t9, -sym.imp.fclose(gp)
nop
jalr t9
addiu s4, zero, -1
lw gp, 0x20(sp)
nop
lw t9, -sym.imp.remove(gp)
nop
jalr t9
addiu a0, s0, 0x2994
lw gp, 0x20(sp)
nop
lw t9, -sym.imp.fclose(gp)
nop
jalr t9
move a0, s6
lw gp, 0x20(sp)
b 0x4015d4
nop
addiu s0, sp, 0x31c
lw t9, -sym.imp.sprintf(gp)
lui a1, 0x40
move a0, s0
move a2, s2
jalr t9
addiu a1, a1, 0x29a8
lw gp, 0x20(sp)
addiu s1, sp, 0x30
lw t9, -sym.xmldbc_get_wb(gp)
addiu v0, zero, 5
move a2, s0
move a3, s1
move a0, zero
move a1, zero
jalr t9
sw v0, 0x10(sp)
lw gp, 0x20(sp)
move a0, s1
lw t9, -sym.imp.atoi(gp)
nop
jalr t9
--
move a0, s1
lw t9, -sym.imp.inet_addr(gp)
move v1, v0
bnez v0, 0x4010c0
sw v0, 8(s0)
lw v0, -0x7f84(gp)
lw t9, -sym.imp.fputs(gp)
lw a1, (v0)
lui a0, 0x40
jalr t9
addiu a0, a0, 0x29c8
lw gp, 0x20(sp)
b 0x401108
addiu s4, zero, -1
lw v0, (s0)
move s0, v1
addiu v0, v0, 1
jalr t9
sw v0, (v1)
lw gp, 0x20(sp)
sw v0, 4(s0)
sw zero, 8(s0)
lui a1, 0x40
slt v0, s4, s3
move a3, s3
lw t9, -sym.imp.sprintf(gp)
move a0, s7
addiu a1, a1, 0x29b4
lw a2, 0x834(sp)
beqz v0, 0x400ff8
addiu s3, s3, 1
move s4, zero
lw t9, -sym.imp.sysinfo(gp)
nop
jalr t9
addiu a0, sp, 0x80
lui v0, 0x40
addiu s7, v0, 0x2a30
lui v0, 0x40
lw v0, 0x2aa0(v0)
lw gp, 0x20(sp)
sw v0, 0x830(sp)
addiu v0, sp, 0xc0
sw v0, 0x824(sp)
addiu v0, sp, 0x50
sw v0, 0x828(sp)
--
addiu a0, zero, 0xc
lw gp, 0x20(sp)
move v1, v0
bnez v0, 0x4011dc
sw v0, 8(s0)
lw v0, -0x7f84(gp)
lw t9, -sym.imp.fputs(gp)
lw a1, (v0)
lui a0, 0x40
jalr t9
addiu a0, a0, 0x29c8
lw gp, 0x20(sp)
b 0x401560
addiu s4, zero, -1
lw v0, (s0)
move s2, v1
addiu v0, v0, 1
sw v0, (v1)
lw v0, 0xd0(sp)
sw zero, 8(v1)
sw v0, 4(v1)
lbu a0, 0xc4(sp)
lbu a1, 0xc5(sp)
lbu v1, 0xc3(sp)
lbu v0, 0xc2(sp)
lw t9, -sym.imp.sprintf(gp)
lbu a2, 0xc0(sp)
lbu a3, 0xc1(sp)
sw a0, 0x18(sp)
sw a1, 0x1c(sp)
lw a0, 0x82c(sp)
lui a1, 0x40
sw v1, 0x14(sp)
addiu a1, a1, 0x29e8
jalr t9
sw v0, 0x10(sp)
lw gp, 0x20(sp)
addiu s3, sp, 0x31c
lw t9, -sym.imp.sprintf(gp)
addiu s1, sp, 0x21c
lw a3, (s2)
lui a1, 0x40
move a0, s3
addiu a1, a1, 0x2a08
jalr t9
move a2, s1
lw gp, 0x20(sp)
lw a3, 0x82c(sp)
lw t9, -sym.xmldbc_set(gp)
move a0, zero
move a1, zero
jalr t9
move a2, s3
lw gp, 0x20(sp)
lw a3, (s2)
lw t9, -sym.imp.sprintf(gp)
lui a1, 0x40
addiu a1, a1, 0x29b4
move a2, s1
lw s0, 0xd0(sp)
jalr t9
move a0, s3
lw gp, 0x20(sp)
nop
lw t9, -sym.imp.inet_ntoa(gp)
nop
jalr t9
move a0, s0
lw gp, 0x20(sp)
move a3, v0
lw t9, -sym.xmldbc_set(gp)
move a0, zero
move a1, zero
jalr t9
move a2, s3
lw gp, 0x20(sp)
lw a3, (s2)
lw t9, -sym.imp.sprintf(gp)
lui a1, 0x40
move a2, s1
move a0, s3
jalr t9
addiu a1, a1, 0x2a1c
lw v0, 0x820(sp)
lw gp, 0x20(sp)
beqz v0, 0x40131c
addiu s0, sp, 0x38
lw t9, -sym.xmldbc_del(gp)
move a2, s3
move a0, zero
jalr t9
move a1, zero
b 0x401370
nop
lw a2, 0xd4(sp)
lw t9, -sym.imp.sprintf(gp)
srl a0, a2, 0x18
sll v1, a2, 0x18
srl v0, a2, 8
or v1, v1, a0
andi v0, v0, 0xff00
andi a2, a2, 0xff00
or v1, v1, v0
sll a2, a2, 8
or a2, v1, a2
move a0, s0
jalr t9
move a1, s7
lw gp, 0x20(sp)
move a2, s3
lw t9, -sym.xmldbc_set(gp)
move a3, s0
move a0, zero
jalr t9
move a1, zero
lw gp, 0x20(sp)
--
addiu a3, zero, 0x2d
addiu v1, v1, 1
addu v0, a0, v1
lb a1, (v0)
nop
sll v0, a1, 1
addu v0, a2, v0
lhu v0, (v0)
nop
andi v0, v0, 0x800
bnez v0, 0x4013a4
nop
beq a1, a3, 0x4013a8
addiu v1, v1, 1
addiu v1, v1, -1
bnez v1, 0x401400
addu v0, sp, v1
lw t9, -sym.imp.strcpy(gp)
lui a1, 0x40
jalr t9
addiu a1, a1, 0x2a34
lw gp, 0x20(sp)
b 0x401404
nop
sb zero, 0x41c(v0)
lw t9, -sym.imp.sprintf(gp)
addiu s0, sp, 0x31c
addiu s1, sp, 0x21c
lw a3, (s2)
lui a1, 0x40
move a0, s0
addiu a1, a1, 0x2a40
jalr t9
move a2, s1
lw gp, 0x20(sp)
move a0, zero
lw t9, -sym.xmldbc_set(gp)
move a1, zero
move a2, s0
jalr t9
addiu a3, sp, 0x41c
lw gp, 0x20(sp)
lw a3, (s2)
lw t9, -sym.imp.sprintf(gp)
lui a1, 0x40
move a2, s1
move a0, s0
jalr t9
addiu a1, a1, 0x2a58
lw v0, 0x820(sp)
lw gp, 0x20(sp)
lw a2, 0xd4(sp)
beqz v0, 0x4014a4
srl v0, a2, 0x18
sll v1, a2, 0x18
srl a0, a2, 0x18
srl v0, a2, 8
or v1, v1, a0
andi v0, v0, 0xff00
andi a2, a2, 0xff00
or v1, v1, v0
sll a2, a2, 8
lw t9, -sym.imp.sprintf(gp)
b 0x4014fc
or a2, v1, a2
sll a0, a2, 0x18
srl v1, a2, 8
or a0, a0, v0
andi v1, v1, 0xff00
andi v0, a2, 0xff00
or a0, a0, v1
sll v0, v0, 8
or s0, a0, v0
lw v0, 0x830(sp)
lw t9, -sym.imp.memcmp(gp)
sw v0, 0x28(sp)
sw s0, 0x2c(sp)
addiu a0, sp, 0x2c
addiu a1, sp, 0x28
jalr t9
addiu a2, zero, 4
lw gp, 0x20(sp)
beqz v0, 0x4014f4
addu v0, s0, fp
sw v0, 0x2c(sp)
lw t9, -sym.imp.sprintf(gp)
lw a2, 0x2c(sp)
addiu a0, sp, 0x44
jalr t9
move a1, s7
lw gp, 0x20(sp)
move a0, zero
lw t9, -sym.xmldbc_set(gp)
move a1, zero
addiu a2, sp, 0x31c
jalr t9
addiu a3, sp, 0x44
lw gp, 0x20(sp)
nop
lw t9, -sym.imp.fread(gp)
lw a0, 0x824(sp)
addiu a1, zero, 0x5c
addiu a2, zero, 1
jalr t9
move a3, s6
lw gp, 0x20(sp)
[*] Function sprintf used 11 times updateleases
