[*] Binary protection state of rndimage

  	RELRO          CANARY            NX           PIE          RPATH        RUNPATH      SYMBOLS      

  	No RELRO       No Canary found   NX disabled  No PIE       No RPATH     No RUNPATH   No Symbols

[*] Function sprintf tear down of rndimage

lw t9, -sym.imp.fopen(gp)

lui a1, 0x40

addiu a0, s0, 0x4b90

jalr t9

addiu a1, a1, 0x4ba8

lw gp, 0x10(sp)

b 0x400f54

move s1, v0

lw t9, -sym.imp.fscanf(gp)

lui a1, 0x40

addiu a1, a1, 0x4bac

move a0, v0

jalr t9

addiu a2, sp, 0x18

lw gp, 0x10(sp)

lw v0, 0x18(sp)

nop

addiu v0, v0, 1

slti v1, v0, 0xb

bnez v1, 0x400f74

sw v0, 0x18(sp)

addiu v0, zero, 1

sw v0, 0x18(sp)

lw a2, 0x18(sp)

addiu s0, sp, 0x38

lw t9, -sym.imp.sprintf(gp)

lui a1, 0x40

addiu a1, a1, 0x4bb0

jalr t9

move a0, s0

lw gp, 0x10(sp)

move a0, s1

lw t9, -sym.imp.rewind(gp)

nop

jalr t9

addiu s4, sp, 0x18

lw gp, 0x10(sp)

move a0, s0

lw t9, -sym.imp.strlen(gp)

nop

jalr t9

addiu s3, zero, 5

lw gp, 0x10(sp)

move a3, s1

lw t9, -sym.imp.fwrite(gp)

move a1, v0

move a0, s0

jalr t9

addiu a2, zero, 1

lw gp, 0x10(sp)

move a0, s1

lw t9, -sym.imp.fclose(gp)

nop

jalr t9

lui s0, 0x41

lw gp, 0x10(sp)

lw a2, 0x18(sp)

lw t9, -sym.imp.sprintf(gp)

lui a1, 0x40

addiu a1, a1, 0x4bb8

jalr t9

addiu a0, s0, 0x54b8

lw gp, 0x10(sp)

addiu a0, s0, 0x54b8

lw t9, -sym.imp.unlink(gp)

nop

jalr t9

addiu s0, s0, 0x54b8

lw gp, 0x10(sp)

lui v0, 0x41

sw s0, 0x5040(v0)

addiu v1, zero, 0x96

lui v0, 0x41

lui s1, 0x41

addiu s1, s1, 0x5438

lw t9, -sym.imp.memset(gp)

sw v1, 0x5030(v0)

addiu v1, zero, 0x28

lui v0, 0x41

move a0, s1

sw v1, 0x5034(v0)

move a1, zero

jalr t9

addiu a2, zero, 0x80

lui v0, 0x40

lw gp, 0x10(sp)

move s2, s1

addiu s5, v0, 0x4bd4

move s0, zero

addiu s1, zero, 0x1a

lw t9, -sym.imp.random(gp)

nop

jalr t9

addiu s0, s0, 1

bnez s1, 0x40109c

divu zero, v0, s1

break 7

lw gp, 0x10(sp)

move a0, s2

lw t9, -sym.imp.sprintf(gp)

move a1, s5

mfhi v0

addu v0, s4, v0

lb a3, 4(v0)

jalr t9

move a2, s2

lw gp, 0x10(sp)

bne s0, s3, 0x401080

lui v0, 0x41

lw t9, -sym.imp.strrchr(gp)

lui s1, 0x41

lw a0, 0x5040(v0)

sw s2, 0x5434(s1)

jalr t9

addiu a1, zero, 0x2f

lw gp, 0x10(sp)

addiu s2, v0, 1

addiu s0, sp, 0x38

lw t9, -sym.imp.sprintf(gp)

lui a2, 0x40

lui a1, 0x40

move a3, s2

addiu a2, a2, 0x4be8

move a0, s0

jalr t9

addiu a1, a1, 0x4bdc

lw gp, 0x10(sp)

lui a1, 0x40

lw t9, -sym.imp.fopen(gp)

addiu a1, a1, 0x4ba8

jalr t9

move a0, s0

lw gp, 0x10(sp)

lw s0, 0x5434(s1)

lw t9, -sym.imp.strlen(gp)

move a0, s0

jalr t9

move s1, v0

lw gp, 0x10(sp)

--

lw t9, -sym.imp.random(gp)

mfhi s5

jalr t9

addiu s0, s0, -1

subu s0, s0, s5

bnez s0, 0x401a7c

divu zero, v0, s0

break 7

lw gp, 0x20(sp)

mfhi s1

sltiu v0, s1, 0x32

beqz v0, 0x401a94

nop

addiu s1, s1, 0x1e

lw t9, -sym.imp.random(gp)

lui v0, 0x41

lw s0, 0x5044(v0)

jalr t9

nop

bnez s7, 0x401ab4

div zero, v0, s7

break 7

lw gp, 0x20(sp)

lw a0, 0xe8(sp)

lw v1, -obj.g_font_file(gp)

lw t9, -sym.imp.sprintf(gp)

lui a1, 0x40

move a2, s0

mfhi v0

sll v0, v0, 2

addu v0, v1, v0

lw a3, (v0)

jalr t9

addiu a1, a1, 0x4e38

lui a0, 0x41

lw v0, 0x5434(a0)

lw gp, 0x20(sp)

addu v0, v0, s3

lb a1, (v0)

lw a3, 0x28(sp)

lui v0, 0xff

lw t9, -sym.get_chr_from_file(gp)

ori v0, v0, 0xffff

lw a0, 0xe8(sp)

and a3, a3, v0

jalr t9

[*] Function sprintf used 5 times rndimage