[*] Binary protection state of ddnsd
RELRO CANARY NX PIE RPATH RUNPATH SYMBOLS
No RELRO No Canary found NX disabled No PIE No RPATH No RUNPATH No Symbols
[*] Function sprintf tear down of ddnsd
move a1, s3
lw t9, -sym.imp.strstr(gp)
move s0, v0
bnez v0, 0x401fc0
move a0, v0
lw ra, 0x84(sp)
lw s5, 0x80(sp)
lw s4, 0x7c(sp)
lw s3, 0x78(sp)
lw s2, 0x74(sp)
lw s1, 0x70(sp)
lw s0, 0x6c(sp)
jr ra
addiu sp, sp, 0x88
lui gp, 0x42
addiu sp, sp, -0xa8
addiu gp, gp, 0x2b00
sw ra, 0xa4(sp)
sw s2, 0xa0(sp)
sw s1, 0x9c(sp)
sw s0, 0x98(sp)
sw gp, 0x10(sp)
addiu s0, sp, 0x18
move s1, a1
lw a2, 0x1c(a0)
lw t9, -sym.imp.sprintf(gp)
lui a1, 0x41
move s2, a0
addiu a1, a1, -0x600c
jalr t9
move a0, s0
lw gp, 0x10(sp)
move a0, s1
lw t9, -sym.sobj_add_string(gp)
nop
jalr t9
move a1, s0
lw gp, 0x10(sp)
lw a2, 0x20(s2)
lw t9, -sym.imp.sprintf(gp)
lui a1, 0x41
addiu a1, a1, -0x5ffc
jalr t9
move a0, s0
lw gp, 0x10(sp)
move a0, s1
lw t9, -sym.sobj_add_string(gp)
nop
jalr t9
move a1, s0
lw gp, 0x10(sp)
lw a2, 0x24(s2)
lw t9, -sym.imp.sprintf(gp)
lui a1, 0x41
addiu a1, a1, -0x5ff0
jalr t9
move a0, s0
lw gp, 0x10(sp)
move a0, s1
lw t9, -sym.sobj_add_string(gp)
nop
jalr t9
move a1, s0
lw gp, 0x10(sp)
lw a2, 0x28(s2)
lw t9, -sym.imp.sprintf(gp)
lui a1, 0x41
addiu a1, a1, -0x5fe4
jalr t9
move a0, s0
lw gp, 0x10(sp)
move a0, s1
lw t9, -sym.sobj_add_string(gp)
nop
jalr t9
move a1, s0
lw gp, 0x10(sp)
lw a2, 0x2c(s2)
lw t9, -sym.imp.sprintf(gp)
lui a1, 0x41
addiu a1, a1, -0x5fd8
jalr t9
move a0, s0
lw gp, 0x10(sp)
move a0, s1
lw t9, -sym.sobj_add_string(gp)
nop
jalr t9
move a1, s0
lw gp, 0x10(sp)
lw a2, 0x30(s2)
lw t9, -sym.imp.sprintf(gp)
lui a1, 0x41
addiu a1, a1, -0x5fc8
jalr t9
move a0, s0
lw gp, 0x10(sp)
move a0, s1
lw t9, -sym.sobj_add_string(gp)
nop
jalr t9
move a1, s0
lw gp, 0x10(sp)
lw a2, 0x34(s2)
lw t9, -sym.imp.sprintf(gp)
lui a1, 0x41
addiu a1, a1, -0x5fbc
jalr t9
move a0, s0
lw gp, 0x10(sp)
move a1, s0
lw t9, -sym.sobj_add_string(gp)
nop
jalr t9
move a0, s1
lw gp, 0x10(sp)
lui a1, 0x41
lw t9, -sym.sobj_add_string(gp)
addiu a1, a1, -0x5fac
jalr t9
move a0, s1
lw v1, 0x38(s2)
addiu v0, zero, 1
lw gp, 0x10(sp)
beq v1, v0, 0x4022d0
--
move a0, s1
lw gp, 0x10(sp)
move a0, s5
lw t9, -sym.imp.strlen(gp)
nop
jalr t9
addiu s0, sp, 0x18
lw gp, 0x10(sp)
move a2, v0
lw t9, -sym.MD5Update(gp)
move a0, s1
jalr t9
move a1, s5
lw gp, 0x10(sp)
move a1, s1
lw t9, -sym.MD5Final(gp)
nop
jalr t9
move a0, s0
lui v0, 0x41
lw gp, 0x10(sp)
move s1, s0
addiu s6, v0, -0x5f40
move s3, s2
addiu s4, sp, 0xa0
lw t9, -sym.imp.sprintf(gp)
lbu a2, (s0)
move a0, s2
move a1, s6
jalr t9
addiu s2, s2, 2
lw gp, 0x10(sp)
bne s2, s4, 0x4024a8
addiu s0, s0, 1
lw t9, -sym.imp.strcat(gp)
lui a1, 0x41
move a0, s3
jalr t9
addiu a1, a1, -0x5cf0
lw gp, 0x10(sp)
move a1, s7
lw t9, -sym.imp.strcat(gp)
nop
jalr t9
move a0, s3
lw gp, 0x10(sp)
--
lw t9, -sym.MD5Init(gp)
nop
jalr t9
move a0, s0
lw gp, 0x10(sp)
nop
lw t9, -sym.imp.strlen(gp)
nop
jalr t9
move a0, s3
lw gp, 0x10(sp)
move a0, s0
lw t9, -sym.MD5Update(gp)
move a1, s3
jalr t9
move a2, v0
lw gp, 0x10(sp)
move a1, s0
lw t9, -sym.MD5Final(gp)
nop
jalr t9
addiu a0, sp, 0x18
lw gp, 0x10(sp)
move s0, s3
move s3, s6
lw t9, -sym.imp.sprintf(gp)
lbu a2, (s1)
move a0, s0
move a1, s3
jalr t9
addiu s0, s0, 2
lw gp, 0x10(sp)
bne s0, s2, 0x402564
addiu s1, s1, 1
beqz s5, 0x4025a8
sb zero, 0xa0(sp)
lw t9, -sym.imp.free(gp)
nop
jalr t9
move a0, s5
lw gp, 0x10(sp)
nop
lw t9, -sym.imp.strdup(gp)
nop
jalr t9
addiu a0, sp, 0x80
--
lw a2, -0x5620(v0)
nop
blez a2, 0x4027ac
move s0, a0
lw v0, 0x40(a0)
nop
slt v0, v0, a2
bnez v0, 0x4027b0
lui v0, 0x42
lw v0, 0x20(a0)
lw v1, 0x18(a0)
sw v0, 0x10(sp)
lw v0, 8(v1)
lw a3, 0x2c(a0)
lw t9, -sym.imp.syslog(gp)
lui a1, 0x41
sw v0, 0x14(sp)
addiu a1, a1, -0x5f34
jalr t9
addiu a0, zero, 5
lw gp, 0x18(sp)
lui v0, 0x42
lw a2, -0x560c(v0)
lw v0, 0x40(s0)
lw a3, 0x1c(s0)
lw t9, -sym.imp.sprintf(gp)
addiu s0, sp, 0x20
lui a1, 0x41
addiu a1, a1, -0x5ee4
move a0, s0
jalr t9
sw v0, 0x10(sp)
lw gp, 0x18(sp)
nop
lw t9, -sym.imp.system(gp)
nop
jalr t9
move a0, s0
lw gp, 0x18(sp)
b 0x4027e0
nop
lui v0, 0x42
lw v0, -0x561c(v0)
addiu a0, zero, 0x3c
mult v0, a0
lw t9, -sym.sloop_register_timeout(gp)
[*] Function sprintf used 10 times ddnsd
