[*] Binary protection state of httpd

  	RELRO          CANARY            NX           PIE          RPATH        RUNPATH      SYMBOLS      

  	No RELRO       No Canary found   NX disabled  No PIE       No RPATH     No RUNPATH   No Symbols

[*] Function strcpy tear down of httpd

bnez v0, 0x40222c

addiu s0, s0, 1

lw t9, -sym.imp.strcmp(gp)

move a0, s0

jalr t9

move a1, s3

b 0x40225c

sltiu v0, v0, 1

lw t9, -sym.imp.crypt(gp)

move a0, s3

jalr t9

move a1, s0

lw gp, 0x10(sp)

beqz v0, 0x4022d0

move a0, s0

lw t9, -sym.imp.strcmp(gp)

nop

jalr t9

move a1, v0

sltiu v0, v0, 1

lw gp, 0x10(sp)

beqz v0, 0x4022d4

move s0, zero

beqz s7, 0x402300

addiu s0, zero, 1

lw t9, -sym.imp.strcpy(gp)

move a0, s7

jalr t9

addiu a1, sp, 0x18

lw gp, 0x10(sp)

b 0x402300

addiu s0, zero, 1

beqz s1, 0x4022b0

xori v0, v1, 0xd

sltiu v0, s0, 0x80

beqz v0, 0x4022b0

xori v0, v1, 0xd

addu v0, s2, s0

sb s6, (v0)

addiu s0, s0, 1

xori v0, v1, 0xd

sltiu s1, v0, 1

bnez s1, 0x4022d8

sltiu v0, s0, 0x80

beqz v0, 0x4022d8

addu v0, s2, s0

--

jr ra

addiu sp, sp, 0x20

lui gp, 0x43

addiu sp, sp, -0x38

addiu gp, gp, -0x4840

sw ra, 0x34(sp)

sw s6, 0x30(sp)

sw s5, 0x2c(sp)

sw s4, 0x28(sp)

sw s3, 0x24(sp)

sw s2, 0x20(sp)

sw s1, 0x1c(sp)

sw s0, 0x18(sp)

sw gp, 0x10(sp)

move s4, a0

addiu a0, zero, 5

mult s4, a0

lw t9, -sym.imp.malloc(gp)

mflo a0

move s0, a1

jalr t9

addiu a0, a0, 0xa

lw gp, 0x10(sp)

beqz v0, 0x4062f4

move s2, v0

lw t9, -sym.imp.strcpy(gp)

bnez s0, 0x40624c

addiu s1, v0, 9

lui a1, 0x41

addiu a1, a1, 0x1754

jalr t9

move a0, v0

lw gp, 0x10(sp)

lui v0, 0x41

move s3, s1

lw s5, -obj.pollfds(gp)

b 0x4061ac

addiu s6, v0, 0x1760

lw v0, (s5)

nop

addu v0, v0, v1

lw a2, (v0)

jalr t9

nop

lw gp, 0x10(sp)

addu s1, s1, v0

slt v0, s0, s4

sll v1, s0, 3

lw t9, -sym.imp.sprintf(gp)

move a0, s1

move a1, s6

bnez v0, 0x40618c

addiu s0, s0, 1

lw t9, -sym.log_d(gp)

nop

jalr t9

move a0, s2

lw gp, 0x10(sp)

lui a1, 0x41

lw t9, -sym.imp.strcpy(gp)

addiu a1, a1, 0x1768

jalr t9

move a0, s2

lw gp, 0x10(sp)

lui v0, 0x41

addiu s5, v0, 0x1774

lw s1, -obj.pollfds(gp)

b 0x406228

move s0, zero

lw v0, (s1)

nop

addu v0, v0, v1

lh a2, 4(v0)

jalr t9

nop

lw gp, 0x10(sp)

addu s3, s3, v0

slt v0, s0, s4

sll v1, s0, 3

lw t9, -sym.imp.sprintf(gp)

--

sw s3, 0x44(sp)

sw s2, 0x40(sp)

sw s1, 0x3c(sp)

sw s0, 0x38(sp)

sw gp, 0x10(sp)

lw v0, 0x9bc(a0)

nop

addiu v0, v0, -1

sltiu v0, v0, 2

bnez v0, 0x4086d8

move s3, a0

b 0x4088c4

addiu v0, zero, 0x195

lb v0, 0x664(a0)

nop

beqz v0, 0x408708

addiu s0, sp, 0x18

lw v0, 0x9c4(a0)

nop

lw v1, 0x2c(v0)

addiu v0, zero, 0x194

sw v0, 0x9c0(a0)

sw v1, 0xa64(a0)

b 0x408948

addiu v0, zero, 1

lw t9, -sym.imp.strcpy(gp)

lui a1, 0x41

addiu a1, a1, 0x1d48

jalr t9

move a0, s0

lw gp, 0x10(sp)

move a0, s0

lw t9, -sym.imp.mkstemp(gp)

nop

jalr t9

addiu s4, zero, -1

lw gp, 0x10(sp)

beq v0, s4, 0x4088c0

move s2, v0

lw t9, -sym.imp.fcntl(gp)

move a0, v0

addiu a1, zero, 2

jalr t9

addiu a2, zero, 1

lw gp, 0x10(sp)

nop

--

sw v0, (s1)

lw v0, 0xfdc(sp)

lw t9, -sym.imp.atol(gp)

nop

jalr t9

addu a0, v0, a0

lw gp, 0x10(sp)

sw v0, 4(s1)

addiu s0, s0, 0x10

addiu s1, s1, 8

lw t9, -sym.imp.atol(gp)

bne s0, s6, 0x408d38

slti v0, s3, 0x64

bnez v0, 0x408d94

lui v0, 0x41

b 0x409124

addiu a1, v0, 0x1e28

lw t9, -sym.imp.strcmp(gp)

lui a1, 0x41

move a0, s2

jalr t9

addiu a1, a1, 0x1e38

lw gp, 0x10(sp)

bnez v0, 0x408dd0

lui a1, 0x41

lw t9, -sym.imp.strcpy(gp)

move a1, fp

jalr t9

addiu a0, sp, 0x340

lw gp, 0x10(sp)

b 0x409084

nop

lw t9, -sym.imp.strcmp(gp)

move a0, s2

jalr t9

addiu a1, a1, 0x1e40

lw gp, 0x10(sp)

bnez v0, 0x408dfc

move a0, s2

beqz s7, 0x409084

move a3, fp

b 0x4091ec

nop

lw t9, -sym.imp.strcmp(gp)

lui a1, 0x41

jalr t9

--

lui v0, 0x41

b 0x409124

addiu a1, v0, 0x1e50

bnez s7, 0x409084

nop

lw v0, 0x664(sp)

lw v1, 0x660(sp)

subu v0, v0, s4

mult v0, v0

subu v1, v1, s5

mflo v0

nop

nop

mult v1, v1

mflo v1

addu s0, v0, v1

lw v0, 0xfd0(sp)

nop

beqz v0, 0x408e80

nop

lw v1, 0xfd8(sp)

nop

slt v0, s0, v1

beqz v0, 0x409084

nop

lw t9, -sym.imp.strcpy(gp)

addiu a0, sp, 0x340

jalr t9

move a1, fp

addiu a0, zero, 1

lw gp, 0x10(sp)

sw s0, 0xfd8(sp)

b 0x409084

sw a0, 0xfd0(sp)

lw t9, -sym.imp.strcmp(gp)

lui a1, 0x41

jalr t9

addiu a1, a1, 0x31b8

lw gp, 0x10(sp)

bnez v0, 0x408f10

slti v0, s3, 2

beqz v0, 0x408ed0

lui v0, 0x41

b 0x409124

addiu a1, v0, 0x1e5c

bnez s7, 0x409084

--

b 0x40a8b4

addiu a0, a0, 0x2290

lw t9, -sym.imp.inet_aton(gp)

nop

jalr t9

addiu a1, sp, 0x24

lw v0, 0x24(sp)

lui v1, 0xf000

sll v0, v0, 0x18

and v0, v0, v1

lui v1, 0xe000

lw gp, 0x18(sp)

bne v0, v1, 0x40a8f4

nop

lw v0, 0x3c(s1)

nop

beqz v0, 0x40a8f4

addiu s0, sp, 0x88

lw t9, -sym.imp.memset(gp)

addiu a2, zero, 0x20

move a0, s0

jalr t9

move a1, zero

lw gp, 0x18(sp)

lw a1, 0x3c(s1)

lw t9, -sym.imp.strcpy(gp)

nop

jalr t9

move a0, s0

lw gp, 0x18(sp)

lw a0, (s1)

lw t9, -sym.imp.ioctl(gp)

ori a1, zero, 0x8915

jalr t9

move a2, s0

lw gp, 0x18(sp)

bnez v0, 0x40a8a8

addiu a2, zero, 0x23

lw v0, 0x14(s0)

lw t9, -sym.imp.setsockopt(gp)

sw v0, 0x34(sp)

lw v0, 0x24(sp)

move a1, zero

sw v0, 0x30(sp)

addiu v0, zero, 8

lw a0, (s1)

--

lw s2, 0x2c(sp)

lw s1, 0x28(sp)

lw s0, 0x24(sp)

jr ra

addiu sp, sp, 0x38

lui gp, 0x43

addiu sp, sp, -0x20

addiu gp, gp, -0x4840

sw ra, 0x1c(sp)

sw s0, 0x18(sp)

sw gp, 0x10(sp)

lw t9, -sym.imp.gmtime(gp)

sw a0, 0x20(sp)

addiu a0, sp, 0x20

jalr t9

move s0, a1

lw gp, 0x10(sp)

bnez v0, 0x40c3ec

lui a2, 0x41

lw t9, -sym.log_d(gp)

lui a0, 0x41

jalr t9

addiu a0, a0, 0x27a8

lw gp, 0x10(sp)

lui a1, 0x41

lw t9, -sym.imp.strcpy(gp)

addiu a1, a1, 0x1fd0

jalr t9

move a0, s0

b 0x40c404

nop

lw t9, -sym.imp.strftime(gp)

addiu a2, a2, 0x27bc

move a3, v0

move a0, s0

jalr t9

addiu a1, zero, 0x1f

lw ra, 0x1c(sp)

move v0, s0

lw gp, 0x10(sp)

lw s0, 0x18(sp)

jr ra

addiu sp, sp, 0x20

lui gp, 0x43

addiu sp, sp, -0x80

addiu gp, gp, -0x4840

--

lb v1, 2(v0)

nop

beqz v1, 0x40d50c

addiu s0, v0, 2

bne v1, a0, 0x40d538

move a0, s0

lw v0, -obj.debug(gp)

nop

lw v0, (v0)

nop

beqz v0, 0x40d7c0

nop

lui a0, 0x41

lw t9, -sym.log_d(gp)

lw a1, 0x9a8(s2)

b 0x40d7b4

addiu a0, a0, 0x2cf0

lw t9, -sym.imp.strchr(gp)

sw s0, 0x20(sp)

jalr t9

addiu a1, zero, 0x2f

lw gp, 0x18(sp)

move s1, v0

bnez v0, 0x40d574

addiu a0, s2, 0xde0

lw t9, -sym.imp.strcpy(gp)

nop

jalr t9

move a1, s0

lw gp, 0x18(sp)

b 0x40d598

nop

lw t9, -sym.imp.memcpy(gp)

move a1, s0

jalr t9

subu a2, v0, s0

lw v0, 0x20(sp)

lw gp, 0x18(sp)

subu v0, s1, v0

addu v0, s2, v0

sb zero, 0xde0(v0)

lw t9, -sym.sanitize_host(gp)

addiu a0, s2, 0xde0

jalr t9

sw a0, 0x14(s2)

lw gp, 0x18(sp)

--

beqz v0, 0x40d7c0

nop

lui a0, 0x41

lw t9, -sym.log_d(gp)

b 0x40d628

addiu a0, a0, 0x2d1c

lb v0, (v0)

nop

bnez v0, 0x40d638

nop

lw v0, -obj.debug(gp)

nop

lw v0, (v0)

nop

beqz v0, 0x40d7c0

nop

lui a0, 0x41

lw t9, -sym.log_d(gp)

addiu a0, a0, 0x2d3c

jalr t9

nop

b 0x40d7bc

nop

bnez s1, 0x40d65c

addiu a0, s2, 0x24

lw t9, -sym.imp.strcpy(gp)

lui a1, 0x41

jalr t9

addiu a1, a1, 0x33ac

lw gp, 0x18(sp)

b 0x40d6a4

nop

lw t9, -sym.unescape_url(gp)

move a1, a0

jalr t9

move a0, s1

addiu v1, zero, -1

lw gp, 0x18(sp)

bne v0, v1, 0x40d6a4

nop

lw v0, -obj.debug(gp)

nop

lw v0, (v0)

nop

beqz v0, 0x40d7c0

move a1, s1

--

lw gp, 0x18(sp)

lui a0, 0x41

lw t9, -sym.lerror(gp)

nop

jalr t9

addiu a0, a0, 0x1f3c

b 0x40de10

nop

move a0, s2

jal 0x40b8d0

move a1, s1

lw gp, 0x18(sp)

bne v0, s3, 0x40de1c

nop

lw t9, -sym.imp.close(gp)

nop

jalr t9

move a0, s1

lw gp, 0x18(sp)

b 0x40dee0

nop

lb v0, 0xf78(s2)

nop

bnez v0, 0x40de44

move s1, zero

lw t9, -sym.imp.strcpy(gp)

lw a0, 0x28(sp)

jalr t9

move a1, fp

lw gp, 0x18(sp)

addiu s1, zero, 1

beq s0, s4, 0x40de50

addiu v0, zero, 0x2f

sb v0, (s0)

lw t9, -sym.imp.strcpy(gp)

lw a0, 0x2c(sp)

jalr t9

move a1, s0

lw v0, 0x9dc(s2)

addiu v1, zero, 0x4000

andi v0, v0, 0xf000

lw gp, 0x18(sp)

bne v0, v1, 0x40de84

addiu v0, zero, 0x2f

sb v0, (s0)

b 0x40deac

addiu s0, s0, 1

beqz s1, 0x40deac

nop

lw t9, -sym.imp.strrchr(gp)

lw a0, 0x28(sp)

jalr t9

addiu a1, zero, 0x2f

lw gp, 0x18(sp)

beqz v0, 0x40deac

--

jal 0x40b840

move a0, s2

lw gp, 0x18(sp)

nop

lw v0, -obj.debug(gp)

nop

lw v0, (v0)

nop

beqz v0, 0x40e4b0

lui a0, 0x41

lw t9, -sym.log_d(gp)

b 0x40e4a4

addiu a0, a0, 0x3018

lw v0, 0x9dc(s2)

ori v1, zero, 0x8000

andi v0, v0, 0xf000

beq v0, v1, 0x40e2c4

nop

jal 0x40b840

move a0, s2

lw gp, 0x18(sp)

lui a0, 0x41

lw t9, -sym.log_d(gp)

b 0x40e3f0

addiu a0, a0, 0x3044

lw t9, -sym.imp.strcpy(gp)

lui a1, 0x41

lw a0, 0x28(sp)

jalr t9

addiu a1, a1, 0x33ac

lw gp, 0x18(sp)

nop

lw t9, -sym.imp.strlen(gp)

nop

jalr t9

move a0, fp

lw v1, 0x9c4(s2)

lw gp, 0x18(sp)

move s7, v0

lw s0, 0x10(v1)

move s5, zero

move s6, zero

b 0x40e374

move s4, zero

lw s3, 4(s0)

nop

[*] Function strcpy used 13 times httpd