[*] Binary protection state of httpd
RELRO CANARY NX PIE RPATH RUNPATH SYMBOLS
No RELRO No Canary found NX disabled No PIE No RPATH No RUNPATH No Symbols
[*] Function fprintf tear down of httpd
lw t9, -sym.imp.malloc(gp)
addiu v0, zero, 0x40
sw a0, 0xb8(sp)
sw v0, 0x3c(sp)
jalr t9
addiu a0, zero, 0x40
lw gp, 0x18(sp)
bnez v0, 0x404a74
nop
lui v0, 0x41
b 0x405c68
addiu s0, v0, 0x1094
sw v0, 0x38(sp)
lw v0, 0xb8(sp)
nop
beqz v0, 0x404ae8
lui a1, 0x41
lw t9, -sym.imp.fopen(gp)
addiu a1, a1, 0x2d4c
jalr t9
move a0, v0
lw gp, 0x18(sp)
bnez v0, 0x404afc
sw v0, 0x34(sp)
lw v0, -0x7e88(gp)
lw t9, -sym.imp.fprintf(gp)
lw a0, (v0)
lw a2, 0xb8(sp)
lui a1, 0x41
jalr t9
addiu a1, a1, 0x1560
lw gp, 0x18(sp)
lw a0, 0x38(sp)
lw t9, -sym.imp.free(gp)
nop
jalr t9
nop
lui v0, 0x41
lw gp, 0x18(sp)
b 0x405c68
addiu s0, v0, 0x10a4
lw v0, -0x7f3c(gp)
nop
lw v0, (v0)
nop
sw v0, 0x34(sp)
--
sltu v0, zero, v0
negu v0, v0
lw gp, 0x18(sp)
and s0, s0, v0
lw t9, -sym.imp.getaddrinfo(gp)
lw a1, 0x28(s2)
move a0, s0
addiu a2, sp, 0x44
jalr t9
addiu a3, sp, 0x20
lw gp, 0x18(sp)
beqz v0, 0x4056bc
move a0, v0
lw v0, -0x7e88(gp)
lw s1, 0x24(s2)
lw s3, (v0)
bnez s1, 0x405678
lui v0, 0x41
addiu s1, v0, 0x1600
lw t9, -sym.imp.gai_strerror(gp)
lw s0, 0x28(s2)
jalr t9
nop
lw gp, 0x18(sp)
lui a1, 0x41
lw t9, -sym.imp.fprintf(gp)
move a3, s0
sw v0, 0x10(sp)
move a0, s3
addiu a1, a1, 0x1608
jalr t9
move a2, s1
lui v0, 0x41
lw gp, 0x18(sp)
b 0x405b80
addiu s0, v0, 0x1420
lw v0, 0x20(sp)
lw t9, -sym.imp.malloc(gp)
lw a0, 0x10(v0)
jalr t9
nop
lw gp, 0x18(sp)
sw v0, 8(s2)
lw v1, 0x20(sp)
bnez v0, 0x405700
move a0, v0
--
jal 0x4036d4
move a0, s1
move s0, v0
lui v0, 0x41
addiu v0, v0, 0x115c
lw gp, 0x18(sp)
bne s0, v0, 0x404b80
lui v1, 0x41
move s0, zero
lw v1, 0xb8(sp)
nop
beqz v1, 0x405ba4
nop
lw t9, -sym.imp.fclose(gp)
lw a0, 0x34(sp)
jalr t9
nop
lw gp, 0x18(sp)
beqz s0, 0x405c24
nop
lw v0, 0xb8(sp)
nop
beqz v0, 0x405be0
nop
lw v0, -0x7e88(gp)
lw t9, -sym.imp.fprintf(gp)
lw a0, (v0)
lui a1, 0x41
lw a2, 0xb8(sp)
jalr t9
addiu a1, a1, 0x1620
lw gp, 0x18(sp)
nop
lw v0, -0x7e88(gp)
lw t9, -sym.imp.fprintf(gp)
lw a2, 0x38(sp)
lw a0, (v0)
lw a3, 0x40(sp)
lui a1, 0x41
jalr t9
addiu a1, a1, 0x163c
lw gp, 0x18(sp)
lw a0, 0x38(sp)
lw t9, -sym.imp.free(gp)
nop
jalr t9
nop
lw gp, 0x18(sp)
b 0x405c68
nop
lw t9, -sym.imp.free(gp)
lw a0, 0x38(sp)
jalr t9
nop
lw gp, 0x18(sp)
--
lw s4, 0x40(sp)
lw s3, 0x3c(sp)
lw s2, 0x38(sp)
lw s1, 0x34(sp)
lw s0, 0x30(sp)
jr ra
addiu sp, sp, 0x58
nop
nop
nop
lui gp, 0x43
addiu sp, sp, -0x90
addiu gp, gp, -0x4840
sw ra, 0x8c(sp)
sw fp, 0x88(sp)
sw s7, 0x84(sp)
sw s6, 0x80(sp)
sw s5, 0x7c(sp)
sw s4, 0x78(sp)
sw s3, 0x74(sp)
sw s2, 0x70(sp)
sw s1, 0x6c(sp)
sw s0, 0x68(sp)
sw gp, 0x18(sp)
lw v0, -obj.current_time(gp)
lw t9, -sym.imp.fprintf(gp)
lw v1, (v0)
lw v0, -obj.startuptime(gp)
lui a1, 0x41
lw a2, (v0)
addiu a1, a1, 0x1b44
subu a2, v1, a2
jalr t9
move s1, a0
lw gp, 0x18(sp)
lui a1, 0x41
lw s0, -obj.stats(gp)
lw v0, -obj.tuning(gp)
lw t9, -sym.imp.fprintf(gp)
lw a3, 8(v0)
lw a2, (s0)
addiu a1, a1, 0x1b58
jalr t9
move a0, s1
lw gp, 0x18(sp)
lw a2, 4(s0)
lw t9, -sym.imp.fprintf(gp)
lui a1, 0x41
addiu a1, a1, 0x1b7c
jalr t9
move a0, s1
lw gp, 0x18(sp)
lw a2, 0xc(s0)
lw t9, -sym.imp.fprintf(gp)
lui a1, 0x41
addiu a1, a1, 0x1bb0
jalr t9
move a0, s1
lw gp, 0x18(sp)
lw a2, 0x10(s0)
lw t9, -sym.imp.fprintf(gp)
lui a1, 0x41
addiu a1, a1, 0x1bd0
jalr t9
move a0, s1
lw gp, 0x18(sp)
lw a2, 8(s0)
lw t9, -sym.imp.fprintf(gp)
lui a1, 0x41
addiu a1, a1, 0x1bf0
jalr t9
move a0, s1
lw gp, 0x18(sp)
lw a2, 0x14(s0)
lw t9, -sym.imp.fprintf(gp)
lui a1, 0x41
addiu a1, a1, 0x1c08
jalr t9
move a0, s1
lw gp, 0x18(sp)
lw a2, 0x18(s0)
lw t9, -sym.imp.fprintf(gp)
lui a1, 0x41
addiu a1, a1, 0x1c24
jalr t9
move a0, s1
lw gp, 0x18(sp)
addiu a0, zero, 0xa
lw t9, -sym.imp.fputc(gp)
nop
jalr t9
move a1, s1
lw gp, 0x18(sp)
move a0, zero
lw t9, -sym.imp.getrusage(gp)
nop
jalr t9
addiu a1, sp, 0x20
lw v1, 0x24(sp)
lw v0, 0x2c(sp)
lw gp, 0x18(sp)
addu a1, v0, v1
lui v0, 0xf
ori a3, v0, 0x4240
lw v1, 0x20(sp)
lw v0, 0x28(sp)
slt a0, a1, a3
bnez a0, 0x408304
addu a2, v0, v1
subu a1, a1, a3
addiu a2, a2, 1
addiu a3, zero, 0x2710
bnez a3, 0x408314
div zero, a1, a3
break 7
lw t9, -sym.imp.fprintf(gp)
lui a1, 0x41
addiu a1, a1, 0x1c40
mflo a3
jalr t9
move a0, s1
lw gp, 0x18(sp)
addiu a0, zero, -1
lw t9, -sym.imp.getrusage(gp)
nop
jalr t9
addiu a1, sp, 0x20
lw v1, 0x24(sp)
lw v0, 0x2c(sp)
lw gp, 0x18(sp)
addu a1, v0, v1
lui v0, 0xf
ori a3, v0, 0x4240
lw v1, 0x20(sp)
lw v0, 0x28(sp)
slt a0, a1, a3
bnez a0, 0x408378
addu a2, v0, v1
subu a1, a1, a3
addiu a2, a2, 1
addiu a3, zero, 0x2710
bnez a3, 0x408388
div zero, a1, a3
break 7
lw t9, -sym.imp.fprintf(gp)
lui a1, 0x41
addiu a1, a1, 0x1c6c
move a0, s1
move s3, zero
move s6, zero
move s4, zero
move s7, zero
move s5, zero
mflo a3
jalr t9
addiu s2, zero, -1
lw gp, 0x18(sp)
lui a0, 0x41
lw v1, -obj.stats(gp)
lw t9, -sym.imp.fputs(gp)
lw v0, (v1)
addiu a0, a0, 0x1c98
sw v0, 4(v1)
jalr t9
move a1, s1
--
addiu a0, zero, 0x2d
jalr t9
move a1, s1
lw gp, 0x18(sp)
b 0x4084d8
addiu s4, s4, 1
addiu a0, zero, 0x46
jalr t9
move a1, s1
lw gp, 0x18(sp)
b 0x4084d8
addiu s6, s6, 1
lw t9, -sym.imp.fputc(gp)
nop
jalr t9
move a1, s1
lw gp, 0x18(sp)
addiu s3, s3, 1
lw v1, -obj.tuning(gp)
nop
lw v0, 8(v1)
nop
sltu v0, s3, v0
bnez v0, 0x4083ec
addiu s2, s2, 1
lw t9, -sym.imp.fprintf(gp)
lui a1, 0x41
sw s4, 0x10(sp)
sw s6, 0x14(sp)
move a2, s5
move a3, s7
move a0, s1
jalr t9
addiu a1, a1, 0x1ca8
lw gp, 0x18(sp)
lui a0, 0x41
lw t9, -sym.imp.fputs(gp)
move a1, s1
jalr t9
addiu a0, a0, 0x1cdc
lw ra, 0x8c(sp)
lw gp, 0x18(sp)
lw fp, 0x88(sp)
lw s7, 0x84(sp)
lw s6, 0x80(sp)
lw s5, 0x7c(sp)
--
addiu a0, a0, 0x1d10
b 0x408678
nop
lw t9, -sym.imp.fdopen(gp)
addiu a1, a1, 0x1d18
jalr t9
move a0, s1
lw gp, 0x10(sp)
bnez v0, 0x408628
move s0, v0
lw t9, -sym.lerror(gp)
lui a0, 0x41
jalr t9
addiu a0, a0, 0x1d1c
lw gp, 0x10(sp)
nop
lw t9, -sym.imp.close(gp)
b 0x408670
move a0, s1
lw t9, -sym.imp.gettimeofday(gp)
addiu a0, sp, 0x18
jalr t9
move a1, zero
lw gp, 0x10(sp)
lw a2, 0x18(sp)
lw t9, -sym.imp.fprintf(gp)
lw a3, 0x1c(sp)
lui a1, 0x41
addiu a1, a1, 0x1d24
jalr t9
move a0, s0
jal 0x408170
move a0, s0
lw gp, 0x10(sp)
move a0, s0
lw t9, -sym.imp.fclose(gp)
nop
jalr t9
nop
lw ra, 0x54(sp)
lw gp, 0x10(sp)
lw s1, 0x50(sp)
lw s0, 0x4c(sp)
jr ra
addiu sp, sp, 0x58
lui gp, 0x43
--
lw ra, 0x3c(sp)
move v0, s0
lw s5, 0x38(sp)
lw s4, 0x34(sp)
lw s3, 0x30(sp)
lw s2, 0x2c(sp)
lw s1, 0x28(sp)
lw s0, 0x24(sp)
jr ra
addiu sp, sp, 0x40
lui gp, 0x43
addiu sp, sp, -0x30
addiu gp, gp, -0x4840
sw ra, 0x2c(sp)
sw s2, 0x28(sp)
sw s1, 0x24(sp)
sw s0, 0x20(sp)
sw gp, 0x10(sp)
move s1, a1
sw a2, 0x38(sp)
sw a3, 0x3c(sp)
beqz a1, 0x40a178
move s2, a0
lw s0, -0x7e88(gp)
lui v0, 0x42
lw t9, -sym.imp.fprintf(gp)
lw a2, 0x3b94(v0)
lw a0, (s0)
lui a1, 0x41
jalr t9
addiu a1, a1, 0x2144
lw gp, 0x10(sp)
addiu v0, sp, 0x38
lw t9, -sym.imp.vfprintf(gp)
lw a0, (s0)
move a1, s1
move a2, v0
jalr t9
sw v0, 0x18(sp)
lw gp, 0x10(sp)
lw a1, (s0)
lw t9, -sym.imp.fputc(gp)
nop
jalr t9
addiu a0, zero, 0xa
lw gp, 0x10(sp)
beqz s2, 0x40a198
nop
lw t9, -sym.imp.perror(gp)
nop
jalr t9
move a0, s2
lw gp, 0x10(sp)
nop
--
nop
move a0, zero
jal 0x40a0e8
addiu a1, a1, 0x214c
b 0x40a318
nop
lui a1, 0x41
lw a2, 0x3b94(v0)
move a0, zero
jal 0x40a0e8
addiu a1, a1, 0x2184
lw gp, 0x18(sp)
nop
lw t9, -sym.imp.getopt(gp)
lw a0, 0xd8(sp)
lw a1, 0xdc(sp)
lui a2, 0x41
jalr t9
addiu a2, a2, 0x21b4
lw gp, 0x18(sp)
bne v0, s1, 0x40a274
move v1, v0
beqz s0, 0x40a374
addiu a0, zero, 5
lw v0, -0x7e88(gp)
lw t9, -sym.imp.fprintf(gp)
lw a0, (v0)
lui a1, 0x41
lui a2, 0x41
addiu a1, a1, 0x161c
jalr t9
addiu a2, a2, 0x20d0
b 0x40adec
nop
lw t9, -sym.imp.getrlimit(gp)
nop
jalr t9
addiu a1, sp, 0x28
lw gp, 0x18(sp)
bne v0, s1, 0x40a3a0
lui a0, 0x41
addiu a0, a0, 0x21bc
jal 0x40a0e8
move a1, zero
lw gp, 0x18(sp)
lw v0, 0x2c(sp)
[*] Function fprintf used 19 times httpd
