[*] Binary protection state of dhcp6s
RELRO CANARY NX PIE RPATH RUNPATH SYMBOLS
No RELRO No Canary found NX disabled No PIE No RPATH No RUNPATH No Symbols
[*] Function sprintf tear down of dhcp6s
addiu a0, zero, 0x7f
lui gp, 0x44
addiu sp, sp, -0x438
addiu gp, gp, 0x900
sw ra, 0x434(sp)
sw s2, 0x430(sp)
sw s1, 0x42c(sp)
sw s0, 0x428(sp)
sw gp, 0x10(sp)
lui v0, 0x42
move s0, a0
addiu s1, sp, 0x24
addiu s2, sp, 0x224
lw t9, -sym.imp.inet_ntop(gp)
addiu v0, v0, 0x12b0
sw s1, 0x1c(sp)
addiu a1, s0, 8
move a2, s2
sw v0, 0x18(sp)
sw zero, 0x20(sp)
addiu a0, zero, 0xa
jalr t9
addiu a3, zero, 0x200
lw gp, 0x10(sp)
lw a3, 0x18(s0)
lw t9, -sym.imp.sprintf(gp)
lui a1, 0x42
move a0, s1
move a2, s2
jalr t9
addiu a1, a1, 0x12c8
jal sym.execute_helper_with_env
addiu a0, sp, 0x18
lw ra, 0x434(sp)
lw gp, 0x10(sp)
move v0, zero
lw s2, 0x430(sp)
lw s1, 0x42c(sp)
lw s0, 0x428(sp)
jr ra
addiu sp, sp, 0x438
lui gp, 0x44
addiu sp, sp, -0x6d0
addiu gp, gp, 0x900
sw ra, 0x6cc(sp)
sw s5, 0x6c8(sp)
--
sw s2, 0x6bc(sp)
sw s1, 0x6b8(sp)
sw s0, 0x6b4(sp)
sw gp, 0x10(sp)
lui v0, 0x42
addiu s0, sp, 0x4ac
addiu s2, sp, 0xac
addiu s3, sp, 0x2ac
addiu s5, sp, 0x2c
lw t9, -sym.imp.inet_ntop(gp)
addiu v0, v0, 0x12dc
move s4, a0
move s1, a1
sw s2, 0x1c(sp)
sw s3, 0x20(sp)
sw s5, 0x24(sp)
move a2, s0
sw v0, 0x18(sp)
sw zero, 0x28(sp)
addiu a0, zero, 0xa
addiu a1, a1, 8
jalr t9
addiu a3, zero, 0x200
lw gp, 0x10(sp)
lw a3, 0x18(s1)
lw t9, -sym.imp.sprintf(gp)
lui a1, 0x42
move a0, s2
move a2, s0
jalr t9
addiu a1, a1, 0x12c8
lw gp, 0x10(sp)
lw a1, 0xc(s4)
lw t9, -sym.imp.inet_ntop(gp)
addiu a3, zero, 0x200
move a2, s0
addiu a1, a1, 8
jalr t9
addiu a0, zero, 0xa
lw gp, 0x10(sp)
lui a1, 0x42
lw t9, -sym.imp.sprintf(gp)
move a0, s3
move a2, s0
jalr t9
addiu a1, a1, 0x12f4
lw gp, 0x10(sp)
lw v0, 8(s4)
lw t9, -sym.imp.sprintf(gp)
lw a2, 0x10(v0)
lui a1, 0x42
move a0, s5
jalr t9
addiu a1, a1, 0x1308
jal sym.execute_helper_with_env
addiu a0, sp, 0x18
lw ra, 0x6cc(sp)
lw gp, 0x10(sp)
move v0, zero
lw s5, 0x6c8(sp)
lw s4, 0x6c4(sp)
lw s3, 0x6c0(sp)
lw s2, 0x6bc(sp)
lw s1, 0x6b8(sp)
lw s0, 0x6b4(sp)
jr ra
addiu sp, sp, 0x6d0
lui v0, 0x8000
ori v0, v0, 0x1f
--
sw s1, 0x834(sp)
sw s0, 0x830(sp)
sw gp, 0x10(sp)
lui v0, 0x42
addiu s0, sp, 0x42c
addiu s2, sp, 0x2c
addiu s4, sp, 0x22c
addiu s5, sp, 0x62c
lw t9, -sym.imp.inet_ntop(gp)
addiu v0, v0, 0x12dc
move s1, a2
move s6, a0
move s3, a1
sw s2, 0x1c(sp)
sw s4, 0x20(sp)
sw s5, 0x24(sp)
addiu a1, a2, 8
sw v0, 0x18(sp)
move a2, s0
sw zero, 0x28(sp)
addiu a0, zero, 0xa
jalr t9
addiu a3, zero, 0x200
lw gp, 0x10(sp)
lw a3, 0x18(s1)
lw t9, -sym.imp.sprintf(gp)
lui a1, 0x42
move a0, s2
move a2, s0
jalr t9
addiu a1, a1, 0x12c8
lw gp, 0x10(sp)
addiu a3, zero, 0x200
lw t9, -sym.imp.inet_ntop(gp)
addiu a1, s3, 8
move a2, s0
jalr t9
addiu a0, zero, 0xa
lw gp, 0x10(sp)
lui a1, 0x42
lw t9, -sym.imp.sprintf(gp)
move a0, s4
move a2, s0
jalr t9
addiu a1, a1, 0x12f4
lw gp, 0x10(sp)
lw a2, 0x10(s6)
lw t9, -sym.imp.sprintf(gp)
lui a1, 0x42
move a0, s5
jalr t9
addiu a1, a1, 0x1308
lw gp, 0x10(sp)
nop
lw t9, -sym.execute_helper_with_env(gp)
nop
jalr t9
addiu a0, sp, 0x18
lw ra, 0x84c(sp)
lw gp, 0x10(sp)
lw s6, 0x848(sp)
lw s5, 0x844(sp)
lw s4, 0x840(sp)
lw s3, 0x83c(sp)
lw s2, 0x838(sp)
lw s1, 0x834(sp)
lw s0, 0x830(sp)
jr ra
--
lui gp, 0x44
addiu sp, sp, -0x638
addiu gp, gp, 0x900
sw ra, 0x634(sp)
sw s2, 0x630(sp)
sw s1, 0x62c(sp)
sw s0, 0x628(sp)
sw gp, 0x10(sp)
lui v0, 0x42
addiu s0, sp, 0x28
addiu s2, sp, 0x228
addiu s1, sp, 0x428
lw t9, -sym.imp.inet_ntop(gp)
addiu v0, v0, 0x5308
addiu a3, zero, 0x200
move a1, a0
sw s0, 0x1c(sp)
sw s2, 0x20(sp)
move a2, s1
sw v0, 0x18(sp)
sw zero, 0x24(sp)
jalr t9
addiu a0, zero, 0xa
lw gp, 0x10(sp)
lui a1, 0x42
lw t9, -sym.imp.sprintf(gp)
move a0, s0
move a2, s1
jalr t9
addiu a1, a1, 0x5320
lw gp, 0x10(sp)
lui a1, 0x42
lw t9, -sym.imp.sprintf(gp)
lw a2, -obj.inf_uid(gp)
move a0, s2
jalr t9
addiu a1, a1, 0x5330
lw gp, 0x10(sp)
nop
lw t9, -sym.execute_helper_with_env(gp)
nop
jalr t9
addiu a0, sp, 0x18
lw ra, 0x634(sp)
lw gp, 0x10(sp)
move v0, zero
lw s2, 0x630(sp)
lw s1, 0x62c(sp)
lw s0, 0x628(sp)
jr ra
addiu sp, sp, 0x638
lui gp, 0x44
addiu sp, sp, -0x28
--
sw s3, 0x84c(sp)
sw s2, 0x848(sp)
sw s1, 0x844(sp)
sw s0, 0x840(sp)
sw gp, 0x20(sp)
lui v0, 0x42
lw t9, -sym.imp.inet_ntop(gp)
addiu s0, sp, 0x3c
addiu s2, sp, 0x63c
addiu v0, v0, 0x5340
addiu s3, sp, 0x23c
addiu s4, sp, 0x43c
move s1, a1
move a2, s2
move a1, a0
addiu a3, zero, 0x200
addiu a0, zero, 0xa
sw v0, 0x28(sp)
sw s0, 0x2c(sp)
sw s3, 0x30(sp)
sw s4, 0x34(sp)
jalr t9
sw zero, 0x38(sp)
lw gp, 0x20(sp)
lui a1, 0x42
lw t9, -sym.imp.sprintf(gp)
move a0, s0
addiu a1, a1, 0x5320
jalr t9
move a2, s2
lbu v0, (s1)
lbu a0, 1(s1)
sll v0, v0, 8
or a0, v0, a0
addiu v1, zero, 1
lw gp, 0x20(sp)
beq a0, v1, 0x417c58
nop
addiu v0, zero, 3
beq a0, v0, 0x417c10
lui v1, 0x42
addiu v0, v1, 0x5378
lw a0, 4(v0)
lw a1, 0x5378(v1)
sw a0, 4(s2)
sw a1, (s2)
lw t9, -sym.imp.sprintf(gp)
lui a1, 0x42
move a0, s3
move a2, s2
jalr t9
addiu a1, a1, 0x5380
lw gp, 0x20(sp)
lui a1, 0x42
lw t9, -sym.imp.sprintf(gp)
lw a2, -obj.inf_uid(gp)
move a0, s4
jalr t9
addiu a1, a1, 0x5330
lw gp, 0x20(sp)
nop
lw t9, -sym.execute_helper_with_env(gp)
nop
jalr t9
addiu a0, sp, 0x28
lw ra, 0x854(sp)
lw gp, 0x20(sp)
move v0, zero
lw s4, 0x850(sp)
lw s3, 0x84c(sp)
lw s2, 0x848(sp)
lw s1, 0x844(sp)
lw s0, 0x840(sp)
jr ra
addiu sp, sp, 0x858
lbu a1, 9(s1)
lbu a2, 4(s1)
lbu a3, 5(s1)
lbu v0, 6(s1)
lbu v1, 7(s1)
lbu a0, 8(s1)
lw t9, -sym.imp.sprintf(gp)
sw a1, 0x1c(sp)
lui a1, 0x42
sw a0, 0x18(sp)
sw v0, 0x10(sp)
sw v1, 0x14(sp)
addiu a1, a1, 0x5358
jalr t9
move a0, s2
lw gp, 0x20(sp)
b 0x417b9c
nop
lbu a1, 0xd(s1)
lbu a2, 8(s1)
lbu a3, 9(s1)
lbu v0, 0xa(s1)
lbu v1, 0xb(s1)
lbu a0, 0xc(s1)
b 0x417c28
nop
lui gp, 0x44
[*] Function sprintf used 13 times dhcp6s
