[*] Binary protection state of cgibin

  	RELRO          CANARY            NX           PIE          RPATH        RUNPATH      SYMBOLS      

  	No RELRO       No Canary found   NX disabled  No PIE       No RPATH     No RUNPATH   No Symbols

[*] Function fprintf tear down of cgibin

jalr t9

move a1, s0

sw v0, (s1)

lw gp, 0x10(sp)

addiu s1, s1, 4

bnez v0, 0x40a070

addiu s4, s3, 1

lw t9, -sym.sobj_get_string(gp)

nop

jalr t9

move a0, s5

lw gp, 0x10(sp)

sll v1, s3, 2

lw t9, -sym.imp.fputs(gp)

addu v1, sp, v1

lui a0, 0x42

sw v0, 0x2c(v1)

addiu a0, a0, -0x16d4

jalr t9

move a1, s2

lui v0, 0x42

lw gp, 0x10(sp)

addiu s6, v0, -0x16ac

addiu s1, sp, 0x2c

move s0, zero

lw t9, -sym.imp.fprintf(gp)

lw a2, (s1)

addiu s0, s0, 1

move a0, s2

jalr t9

move a1, s6

slt v0, s0, s4

lw gp, 0x10(sp)

bnez v0, 0x40a0e0

addiu s1, s1, 4

lui v0, 0x43

lw t9, -sym.imp.strstr(gp)

lw a0, 0xe80(v0)

lui a1, 0x42

jalr t9

addiu a1, a1, -0x16a4

lw gp, 0x10(sp)

lui a1, 0x42

lw t9, -sym.imp.fprintf(gp)

addiu a1, a1, -0x1b7c

move a2, v0

jalr t9

move a0, s2

sll v1, s3, 2

addiu v0, sp, 0x2c

addu s1, v0, v1

lw gp, 0x10(sp)

lui v0, 0x42

move s0, s4

addiu s3, v0, -0x1698

lw t9, -sym.imp.fprintf(gp)

lw a2, (s1)

move a0, s2

move a1, s3

jalr t9

addiu s0, s0, -1

lw gp, 0x10(sp)

bgtz s0, 0x40a158

addiu s1, s1, -4

lw t9, -sym.imp.fflush(gp)

nop

jalr t9

move a0, s2

lw gp, 0x10(sp)

lui s0, 0x42

lw t9, -sym.xmldbc_read(gp)

addiu a2, s0, -0x1780

addiu a1, zero, 2

jalr t9

move a0, zero

lw gp, 0x10(sp)

--

lw gp, 0x30(sp)

lui s1, 0x42

lw t9, -sym.imp.sprintf(gp)

lui a1, 0x42

addiu a1, a1, -0xf5c

addiu a0, s2, 0x1ed0

addiu a2, s1, -0x1088

move a3, s5

jalr t9

sw v0, 0x10(sp)

lw gp, 0x30(sp)

lui a1, 0x42

lw t9, -sym.imp.fopen(gp)

addiu a1, a1, -0x107c

jalr t9

addiu a0, s2, 0x1ed0

lw gp, 0x30(sp)

beqz v0, 0x40bb38

move s0, v0

lw t9, -sym.imp.getpid(gp)

nop

jalr t9

nop

lw gp, 0x30(sp)

lui a1, 0x42

lw t9, -sym.imp.fprintf(gp)

addiu a1, a1, -0x1078

addiu a2, s1, -0x1088

move a3, s5

move a0, s0

jalr t9

sw v0, 0x10(sp)

lw gp, 0x30(sp)

nop

lw t9, -sym.imp.fclose(gp)

nop

jalr t9

move a0, s0

lw gp, 0x30(sp)

nop

lw t9, -sym.imp.getpid(gp)

nop

jalr t9

nop

lw gp, 0x30(sp)

lui a1, 0x42

--

nop

jalr t9

move a0, s5

slt v0, v0, s0

lw gp, 0x18(sp)

beqz v0, 0x40de04

move a3, s0

b 0x40de6c

lui v0, 0x43

jal 0x40d89c

addiu a1, sp, 0x1a4

lw gp, 0x18(sp)

move s1, v0

lui v0, 0x43

lw a0, 0x22fc(v0)

nop

beqz a0, 0x40decc

lui a1, 0x42

lw t9, -sym.imp.fopen(gp)

nop

jalr t9

addiu a1, a1, -0x176c

lw gp, 0x18(sp)

beqz v0, 0x40decc

move s0, v0

lw t9, -sym.imp.fprintf(gp)

lui a1, 0x42

addiu a1, a1, -0x5f8

move a2, s1

jalr t9

move a0, v0

lw gp, 0x18(sp)

nop

lw t9, -sym.imp.fclose(gp)

nop

jalr t9

move a0, s0

lw gp, 0x18(sp)

lw ra, 0x9cc(sp)

move v0, zero

lw fp, 0x9c8(sp)

lw s7, 0x9c4(sp)

lw s6, 0x9c0(sp)

lw s5, 0x9bc(sp)

lw s4, 0x9b8(sp)

lw s3, 0x9b4(sp)

[*] Function fprintf used 5 times cgibin