[*] Binary protection state of widget

  	RELRO          CANARY            NX           PIE          RPATH        RUNPATH      SYMBOLS      

  	No RELRO       No Canary found   NX disabled  No PIE       No RPATH     No RUNPATH   No Symbols

[*] Function sprintf tear down of widget

lw gp, 0x10(sp)

nop

lw t9, -sym.imp.getopt(gp)

lw a0, 0x3a8(sp)

lw a1, 0x3ac(sp)

jalr t9

move a2, fp

lw gp, 0x10(sp)

bgtz v0, 0x400b70

move v1, v0

bnez s0, 0x400c08

addiu v0, zero, 2

jal 0x400960

nop

lw gp, 0x10(sp)

b 0x400c60

nop

bne s0, v0, 0x400c60

nop

lw t9, -sym.imp.sysinfo(gp)

nop

jalr t9

addiu a0, sp, 0xe8

lw gp, 0x10(sp)

addiu s0, sp, 0x28

lw t9, -sym.imp.sprintf(gp)

lw a2, 0xe8(sp)

lui a1, 0x40

move a0, s0

jalr t9

addiu a1, a1, 0x2118

lw gp, 0x10(sp)

lui a0, 0x40

lw t9, -sym.imp.printf(gp)

addiu a0, a0, 0x2120

jalr t9

move a1, s0

b 0x400e44

nop

lw t9, -sym.imp.memset(gp)

addiu s0, sp, 0x280

addiu a2, zero, 0x100

move a0, s0

jalr t9

move a1, zero

lui a0, 0x40

--

jal 0x4009f0

addiu a0, a0, 0x2124

lw gp, 0x10(sp)

addiu s1, sp, 0x28

lw t9, -sym.imp.memset(gp)

move a0, s1

move a1, zero

jalr t9

addiu a2, zero, 0x40

lw gp, 0x10(sp)

lw v1, 4(s0)

lw v0, 0x280(sp)

lw t9, -sym.imp.memset(gp)

addiu s0, sp, 0x68

sw v1, 4(s1)

addiu a2, zero, 0x40

move a0, s0

move a1, zero

jalr t9

sw v0, 0x28(sp)

move a0, s2

jal 0x4009f0

move a1, s0

lw gp, 0x10(sp)

addiu s4, sp, 0xa8

lw t9, -sym.imp.sprintf(gp)

lui a1, 0x40

addiu a1, a1, 0x2134

move a2, s1

move a0, s4

jalr t9

move a3, s0

addiu v1, zero, 0x3f

lw gp, 0x10(sp)

subu v1, v1, v0

addu a1, s4, v0

move a0, zero

b 0x400d24

addiu a2, zero, 1

sb a2, (a1)

addiu a1, a1, 1

slt v0, a0, v1

bnez v0, 0x400d1c

addiu a0, a0, 1

bnez s7, 0x400d3c

addiu v0, zero, 1

--

move a0, s0

jalr t9

move a1, s1

lw gp, 0x10(sp)

addiu s2, sp, 0x18

lw t9, -sym.MD5Final(gp)

move a1, s0

jalr t9

move a0, s2

lw gp, 0x10(sp)

move a0, s1

lw t9, -sym.imp.memset(gp)

move a1, zero

jalr t9

addiu a2, zero, 0x40

lui v0, 0x40

lw gp, 0x10(sp)

addiu s3, v0, 0x213c

addiu s0, sp, 0x28

lw t9, -sym.imp.strlen(gp)

nop

jalr t9

move a0, s1

lw gp, 0x10(sp)

lbu a2, (s2)

lw t9, -sym.imp.sprintf(gp)

addu a0, s4, v0

move a1, s3

jalr t9

addiu s2, s2, 1

lw gp, 0x10(sp)

bne s2, s0, 0x400dac

lui a1, 0x40

lw t9, -sym.imp.sprintf(gp)

addiu s0, sp, 0x180

addiu a1, a1, 0x2134

move a2, s2

move a3, s1

jalr t9

move a0, s0

lw gp, 0x10(sp)

move a0, s0

lw t9, -sym.imp.strcmp(gp)

nop

jalr t9

addiu a1, sp, 0x280

lw gp, 0x10(sp)

nop

lw t9, -sym.imp.printf(gp)

bnez v0, 0x400e34

lui a0, 0x40

b 0x400e3c

addiu a0, a0, 0x2144

lui a0, 0x40

[*] Function sprintf used 4 times widget