[*] Binary protection state of pppd
RELRO CANARY NX PIE RPATH RUNPATH SYMBOLS
No RELRO No Canary found NX disabled No PIE No RPATH No RUNPATH No Symbols
[*] Function sprintf tear down of pppd
lw t9, -sym.imp.fopen(gp)
lui a1, 0x44
addiu a0, s0, -0xec8
jalr t9
addiu a1, a1, 0x2b54
lw gp, 0x18(sp)
beqz v0, 0x4074e0
move s0, v0
lw t9, -sym.imp.fprintf(gp)
lui a1, 0x44
addiu a1, a1, 0x6c3c
move a2, s1
jalr t9
move a0, v0
lw gp, 0x18(sp)
move a0, s0
lw t9, -sym.imp.fclose(gp)
nop
jalr t9
addiu s0, sp, 0x20
lw gp, 0x18(sp)
lui v1, 0x46
lui v0, 0x46
lhu a0, -0xed8(v0)
lw v0, -0xed4(v1)
lw t9, -sym.imp.sprintf(gp)
lw a2, -obj.linkname(gp)
lui a1, 0x44
sw a0, 0x10(sp)
addiu a1, a1, 0x2d4c
move a3, s1
move a0, s0
jalr t9
sw v0, 0x14(sp)
lw gp, 0x18(sp)
nop
lw t9, -sym.imp.system(gp)
nop
jalr t9
move a0, s0
lw gp, 0x18(sp)
lw ra, 0x6c(sp)
lw s1, 0x68(sp)
lw s0, 0x64(sp)
jr ra
addiu sp, sp, 0x70
--
b 0x410db0
lui v0, 0x46
lw t9, -sym.slprintf(gp)
lui v0, 0x44
addiu a0, v1, 0x28a0
addiu a1, zero, 0x40
jalr t9
addiu a2, v0, 0x432c
lw gp, 0x10(sp)
lui v1, 0x46
lw t9, -sym.script_setenv(gp)
lui a0, 0x44
addiu a0, a0, 0x4204
addiu a1, v1, 0x28a0
jalr t9
move a2, zero
lw gp, 0x10(sp)
lw s5, 0x2c(s1)
lw s6, 0x30(s1)
lw v0, -obj.ipparam(gp)
lw s4, 0x24(s1)
lw a2, (v0)
lw fp, 0x28(s1)
beqz a2, 0x410e3c
lui v1, 0x44
lw t9, -sym.imp.sprintf(gp)
addiu s3, sp, 0x18
lui a1, 0x44
addiu a1, a1, 0x4224
jalr t9
move a0, s3
lw gp, 0x10(sp)
nop
lw t9, -sym.imp.fopen(gp)
lui a1, 0x44
addiu a1, a1, 0x2b54
jalr t9
move a0, s3
lw gp, 0x10(sp)
beqz v0, 0x4118b4
move s0, v0
bnez s4, 0x411514
lui v1, 0x44
bnez fp, 0x41155c
nop
bnez s5, 0x411444
--
move a0, s4
lw t9, -sym.slprintf(gp)
lw a3, -obj.hostname(gp)
lui a2, 0x44
subu a1, s7, a0
jalr t9
addiu a2, a2, 0x4edc
lw gp, 0x10(sp)
b 0x41491c
nop
lw t9, -sym.slprintf(gp)
lui a2, 0x44
addiu a2, a2, 0x4eec
move a0, s4
jalr t9
addiu a1, zero, 0x100
lbu v0, 0x24(s3)
lw gp, 0x10(sp)
beqz v0, 0x414b28
lui v0, 0x44
addiu s6, sp, 0x24
addiu s5, v0, 0x4efc
move s2, s6
move s1, zero
addu v0, s3, s1
lw t9, -sym.imp.sprintf(gp)
lbu a2, 0xc(v0)
move a0, s2
jalr t9
move a1, s5
lbu s0, 0x24(s3)
addiu s1, s1, 1
slt v0, s1, s0
lw gp, 0x10(sp)
bnez v0, 0x414a40
addiu s2, s2, 2
sll s0, s0, 1
addu s0, s6, s0
lw t9, -sym.slprintf(gp)
lui a2, 0x44
move a0, s0
addiu a2, a2, 0x4f04
jalr t9
subu a1, s7, s0
lw gp, 0x10(sp)
b 0x414900
--
sh v0, 0x28(sp)
swl zero, 0x2d(sp)
swr zero, 0x2a(sp)
lhu a0, 0x18(t1)
addiu v1, sp, 0x36
sh a0, 0x2e(sp)
lw v0, 0x1c(t1)
addiu t0, t1, 0x12
lwl a0, 3(v0)
lwl a1, 7(v0)
lwl a3, 0xb(v0)
lwl a2, 0xf(v0)
lwr a0, (v0)
lwr a1, 4(v0)
lwr a2, 0xc(v0)
lwr a3, 8(v0)
swl a0, 3(v1)
swl a1, 7(v1)
swr a0, (v1)
swr a1, 4(v1)
swl a3, 0xb(v1)
swl a2, 0xf(v1)
swr a2, 0xc(v1)
swr a3, 8(v1)
lwl v0, 3(t0)
lw t9, -sym.imp.sprintf(gp)
lwr v0, (t0)
lw a0, -obj.remote_number(gp)
sw v0, 0x30(sp)
lhu v1, 4(t0)
lui a1, 0x45
sh v1, 0x34(sp)
lbu v0, 0x14(t1)
lbu a2, 0x12(t1)
lbu a3, 0x13(t1)
sw v0, 0x10(sp)
lbu v1, 0x15(t1)
addiu a1, a1, -0x68f0
sw v1, 0x14(sp)
lbu v0, 0x16(t1)
nop
sw v0, 0x18(sp)
lbu v1, 0x17(t1)
jalr t9
sw v1, 0x1c(sp)
lw gp, 0x20(sp)
--
move a2, v1
lw v0, 4(a0)
sw v1, 0x2c24(a1)
lw v1, 0x20(sp)
lw a0, 0x1c(sp)
subu v1, v1, v0
bgez v1, 0x432904
subu a2, a0, a2
lui v0, 0xf
ori v0, v0, 0x4240
addu v1, v1, v0
b 0x432904
addiu a2, a2, -1
lui gp, 0x46
addiu sp, sp, -0x28
addiu gp, gp, 0x6730
sw ra, 0x24(sp)
sw s0, 0x20(sp)
sw gp, 0x18(sp)
lw v0, (a0)
lhu a1, 6(a0)
lhu v1, 4(a0)
lhu a3, 2(v0)
lhu a2, (v0)
lui s0, 0x47
lw t9, -sym.imp.sprintf(gp)
sw a1, 0x14(sp)
lui a1, 0x45
sw v1, 0x10(sp)
addiu a0, s0, 0x2c2c
jalr t9
addiu a1, a1, -0x63f4
lw ra, 0x24(sp)
addiu v0, s0, 0x2c2c
lw gp, 0x18(sp)
lw s0, 0x20(sp)
jr ra
addiu sp, sp, 0x28
lui gp, 0x46
addiu sp, sp, -0x20
addiu gp, gp, 0x6730
sw ra, 0x1c(sp)
sw s0, 0x18(sp)
sw gp, 0x10(sp)
lw t9, -sym.imp.sprintf(gp)
lui s0, 0x47
lhu a3, 2(a0)
lhu a2, (a0)
lui a1, 0x45
addiu a0, s0, 0x2cac
jalr t9
addiu a1, a1, -0x63e4
lw ra, 0x1c(sp)
addiu v0, s0, 0x2cac
lw gp, 0x10(sp)
lw s0, 0x18(sp)
jr ra
addiu sp, sp, 0x20
lui gp, 0x46
addiu sp, sp, -0x20
addiu gp, gp, 0x6730
sw ra, 0x1c(sp)
sw s0, 0x18(sp)
sw gp, 0x10(sp)
andi a2, a0, 0xffff
--
lui v0, 0x45
b 0x432b14
addiu v0, v0, -0x63d4
b 0x432b14
addiu v0, v0, -0x6380
b 0x432b14
addiu v0, v0, -0x639c
b 0x432b14
addiu v0, v0, -0x63cc
b 0x432b14
addiu v0, v0, -0x63dc
b 0x432b14
addiu v0, v0, -0x637c
b 0x432b14
addiu v0, v0, -0x6394
b 0x432b14
addiu v0, v0, -0x63b4
b 0x432b14
addiu v0, v0, -0x6384
b 0x432b14
addiu v0, v0, -0x63c4
b 0x432b14
addiu v0, v0, -0x63a4
beq a2, v0, 0x432bf8
nop
lw t9, -sym.imp.sprintf(gp)
lui s0, 0x47
lui a1, 0x45
addiu a1, a1, -0x6374
jalr t9
addiu a0, s0, 0x2cec
lw gp, 0x10(sp)
b 0x432b14
addiu v0, s0, 0x2cec
lui v0, 0x45
b 0x432b14
addiu v0, v0, -0x63bc
lui gp, 0x46
addiu sp, sp, -0x38
addiu gp, gp, 0x6730
sw ra, 0x34(sp)
sw s1, 0x30(sp)
sw s0, 0x2c(sp)
sw gp, 0x20(sp)
lb v0, 2(a0)
nop
--
sw a0, 0x14(sp)
sw a1, 0x18(sp)
sw v1, 0x10(sp)
addiu a0, s1, 0x2b20
addiu a2, a2, -0x6360
move a3, v0
jalr t9
addiu a1, zero, 0x100
lw ra, 0x34(sp)
addiu v0, s1, 0x2b20
lw gp, 0x20(sp)
lw s1, 0x30(sp)
lw s0, 0x2c(sp)
jr ra
addiu sp, sp, 0x38
lui gp, 0x46
addiu sp, sp, -0x20
addiu gp, gp, 0x6730
sw ra, 0x1c(sp)
sw s0, 0x18(sp)
sw gp, 0x10(sp)
andi a2, a0, 0xffff
sltiu v0, a2, 0x28
bnez v0, 0x432d3c
lui v1, 0x45
lw t9, -sym.imp.sprintf(gp)
lui s0, 0x47
lui a1, 0x45
addiu a1, a1, -0x6060
jalr t9
addiu a0, s0, 0x2d2c
lw gp, 0x10(sp)
addiu v0, s0, 0x2d2c
lw ra, 0x1c(sp)
lw s0, 0x18(sp)
jr ra
addiu sp, sp, 0x20
sll v0, a2, 2
addiu v1, v1, -0x6050
addu v1, v1, v0
lw a0, (v1)
nop
addu a0, a0, gp
jr a0
nop
lui v0, 0x45
--
lw v0, -0x7b90(gp)
lw ra, 0x24(sp)
lw v1, (v0)
lw s1, 0x20(sp)
sw v1, 0x7360(s0)
lw s0, 0x1c(sp)
jr ra
addiu sp, sp, 0x28
lui gp, 0x46
addiu sp, sp, -0x20
addiu gp, gp, 0x6730
sw ra, 0x1c(sp)
sw s0, 0x18(sp)
sw gp, 0x10(sp)
andi v0, a0, 0x80
bnez v0, 0x438e6c
lui v0, 0x45
lui v0, 0x45
andi a3, a0, 0x7f
addiu a2, v0, -0x5680
slti v0, a3, 0x20
bnez v0, 0x438e80
addiu v0, zero, 0x7f
beq a3, v0, 0x438eb4
lui s0, 0x47
lw t9, -sym.imp.sprintf(gp)
lui a1, 0x45
addiu a0, s0, 0x73ac
jalr t9
addiu a1, a1, -0x5668
lw ra, 0x1c(sp)
addiu v0, s0, 0x73ac
lw gp, 0x10(sp)
lw s0, 0x18(sp)
jr ra
addiu sp, sp, 0x20
andi a3, a0, 0x7f
addiu a2, v0, -0x567c
slti v0, a3, 0x20
beqz v0, 0x438e38
addiu v0, zero, 0x7f
lw t9, -sym.imp.sprintf(gp)
lui s0, 0x47
lui a1, 0x45
addiu a0, s0, 0x73ac
addiu a1, a1, -0x5678
jalr t9
addiu a3, a3, 0x40
lw ra, 0x1c(sp)
addiu v0, s0, 0x73ac
lw gp, 0x10(sp)
lw s0, 0x18(sp)
jr ra
addiu sp, sp, 0x20
lw t9, -sym.imp.sprintf(gp)
lui a1, 0x45
addiu a0, s0, 0x73ac
jalr t9
addiu a1, a1, -0x5670
lw ra, 0x1c(sp)
addiu v0, s0, 0x73ac
lw gp, 0x10(sp)
lw s0, 0x18(sp)
jr ra
addiu sp, sp, 0x20
lui gp, 0x46
addiu sp, sp, -0x20
addiu gp, gp, 0x6730
sw ra, 0x1c(sp)
sw s0, 0x18(sp)
sw gp, 0x10(sp)
addiu v0, zero, 0xa
beq a0, v0, 0x438fa8
addiu v0, zero, 0xd
beq a0, v0, 0x438f5c
--
move a1, s1
jalr t9
addiu a2, zero, 0x14
lw gp, 0x10(sp)
move a1, s2
lw t9, -sym.SHA1_Update(gp)
move a0, s0
jalr t9
addiu a2, zero, 8
lw gp, 0x10(sp)
move a0, s0
lw t9, -sym.SHA1_Update(gp)
move a1, s6
jalr t9
addiu a2, zero, 0x29
lw gp, 0x10(sp)
move a1, s0
lw t9, -sym.SHA1_Final(gp)
nop
jalr t9
move a0, s1
lui v0, 0x44
lw gp, 0x10(sp)
lw s0, 0x340(sp)
addiu s2, v0, 0x4efc
lw t9, -sym.imp.sprintf(gp)
lbu a2, (s1)
move a0, s0
move a1, s2
jalr t9
addiu s1, s1, 1
lw gp, 0x10(sp)
bne s3, s1, 0x43d40c
addiu s0, s0, 2
lw ra, 0x324(sp)
lw s6, 0x320(sp)
lw s5, 0x31c(sp)
lw s4, 0x318(sp)
lw s3, 0x314(sp)
lw s2, 0x310(sp)
lw s1, 0x30c(sp)
lw s0, 0x308(sp)
jr ra
addiu sp, sp, 0x328
lui gp, 0x46
addiu sp, sp, -0x50
--
b 0x440d20
sw zero, 0x88(sp)
beqz s2, 0x440dfc
move a1, s4
b 0x440f20
move v1, zero
lui gp, 0x46
addiu gp, gp, 0x6730
lw a0, (a0)
lw t9, -sym.np_finished(gp)
nop
jr t9
addiu a1, zero, 0x57
lui gp, 0x46
addiu sp, sp, -0x20
addiu gp, gp, 0x6730
sw ra, 0x1c(sp)
sw s0, 0x18(sp)
sw gp, 0x10(sp)
lw t9, -sym.eui64_ntoa(gp)
sw a0, 0x20(sp)
jalr t9
sw a1, 0x24(sp)
lw gp, 0x10(sp)
lui s0, 0x47
lw t9, -sym.imp.sprintf(gp)
lui a1, 0x45
addiu a0, s0, 0x73dc
addiu a1, a1, -0x4e98
jalr t9
move a2, v0
lw ra, 0x1c(sp)
addiu v0, s0, 0x73dc
lw gp, 0x10(sp)
lw s0, 0x18(sp)
jr ra
addiu sp, sp, 0x20
lui gp, 0x46
addiu sp, sp, -0x28
addiu gp, gp, 0x6730
sw ra, 0x24(sp)
sw s2, 0x20(sp)
sw s1, 0x1c(sp)
sw s0, 0x18(sp)
sw gp, 0x10(sp)
lw s1, -obj.ipv6cp_wantoptions(gp)
--
lui a1, 0x44
move a0, s7
addiu a1, a1, 0x4040
move t9, s6
sll s0, s0, 8
jalr t9
or s0, s0, v0
lui a1, 0x44
move a2, s0
move a0, s7
move t9, s6
jalr t9
addiu a1, a1, 0x3748
b 0x4414ec
addiu s4, fp, 2
lui gp, 0x46
addiu sp, sp, -0xb8
addiu gp, gp, 0x6730
sw ra, 0xb4(sp)
sw s3, 0xb0(sp)
sw s2, 0xac(sp)
sw s1, 0xa8(sp)
sw s0, 0xa4(sp)
sw gp, 0x18(sp)
lw v0, -obj.baud_rate(gp)
lw t9, -sym.imp.sprintf(gp)
lw a2, (v0)
addiu s2, sp, 0x20
lui a1, 0x45
move s3, a0
addiu a1, a1, -0x71b8
jalr t9
move a0, s2
lw gp, 0x18(sp)
addiu s1, sp, 0x40
lw v0, -obj.ipv6cp_gotoptions(gp)
nop
lw a1, 0x28(v0)
lw a0, 0x24(v0)
jal 0x441080
addiu s0, sp, 0x60
lw gp, 0x18(sp)
move a0, s1
lw t9, -sym.imp.strcpy(gp)
nop
jalr t9
--
lw a0, 0x24(s2)
lw a1, 0x28(s2)
jal 0x441080
addiu s0, sp, 0x30
lw gp, 0x18(sp)
lui a0, 0x45
lw t9, -sym.script_setenv(gp)
move a1, v0
move a2, zero
jalr t9
addiu a0, a0, -0x4da0
lw a0, 0x2c(s1)
lw a1, 0x30(s1)
jal 0x441080
nop
lw gp, 0x18(sp)
lui a0, 0x45
lw t9, -sym.script_setenv(gp)
move a1, v0
addiu a0, a0, -0x4d98
jalr t9
move a2, zero
lw gp, 0x18(sp)
lui a1, 0x45
lw a2, -obj.ifname(gp)
lw t9, -sym.imp.sprintf(gp)
addiu a1, a1, -0x4d8c
jalr t9
move a0, s0
lw gp, 0x18(sp)
nop
lw t9, -sym.imp.system(gp)
nop
jalr t9
move a0, s0
lw gp, 0x18(sp)
lui a1, 0x45
lw a2, -obj.ifname(gp)
lw t9, -sym.imp.sprintf(gp)
addiu a1, a1, -0x4d58
jalr t9
move a0, s0
lw gp, 0x18(sp)
nop
lw t9, -sym.imp.system(gp)
nop
jalr t9
move a0, s0
lw gp, 0x18(sp)
lui a0, 0x45
lw t9, -sym.imp.system(gp)
nop
jalr t9
addiu a0, a0, -0x4d40
lw gp, 0x18(sp)
nop
lw v0, -obj.demand(gp)
nop
lbu v1, (v0)
[*] Function sprintf used 16 times pppd
