[*] Binary protection state of libipt_SNAT.so
RELRO CANARY NX PIE RPATH RUNPATH SYMBOLS
No RELRO No Canary found NX disabled DSO No RPATH No RUNPATH Symbols
[*] Function printf tear down of libipt_SNAT.so
nop
jr t9
addiu a0, a0, 0x1710
lui gp, 2
addiu gp, gp, -0x7284
addu gp, gp, t9
addiu sp, sp, -0x30
sw ra, 0x2c(sp)
sw s1, 0x28(sp)
sw s0, 0x24(sp)
sw gp, 0x10(sp)
lw v0, (a0)
nop
andi v0, v0, 1
beqz v0, 0xa80
move s0, a0
lw v0, 4(a0)
lw t9, -sym.imp.xtables_ipaddr_to_numeric(gp)
addiu s1, sp, 0x18
move a0, s1
jalr t9
sw v0, 0x18(sp)
lw gp, 0x10(sp)
move a1, v0
lw a0, -0x7fdc(gp)
lw t9, -sym.imp.printf(gp)
nop
jalr t9
addiu a0, a0, 0x14a8
lw v1, 8(s0)
lw v0, 4(s0)
lw gp, 0x10(sp)
beq v1, v0, 0xa80
nop
lw t9, -sym.imp.xtables_ipaddr_to_numeric(gp)
sw v1, 0x18(sp)
jalr t9
move a0, s1
lw gp, 0x10(sp)
move a1, v0
lw a0, -0x7fdc(gp)
lw t9, -sym.imp.printf(gp)
nop
jalr t9
addiu a0, a0, 0x14ac
lw gp, 0x10(sp)
lw v0, (s0)
nop
andi v0, v0, 2
beqz v0, 0xb00
nop
lw t9, -sym.imp.putchar(gp)
nop
jalr t9
addiu a0, zero, 0x3a
lw gp, 0x10(sp)
lhu a1, 0xc(s0)
lw a0, -0x7fdc(gp)
sll v0, a1, 8
lw t9, -sym.imp.printf(gp)
andi v0, v0, 0xffff
srl a1, a1, 8
addiu a0, a0, 0x14b0
jalr t9
or a1, v0, a1
lhu v0, 0xc(s0)
lhu a0, 0xe(s0)
lw gp, 0x10(sp)
beq v0, a0, 0xb00
srl v0, a0, 8
sll a1, a0, 8
lw a0, -0x7fdc(gp)
lw t9, -sym.imp.printf(gp)
andi a1, a1, 0xffff
or a1, a1, v0
jalr t9
addiu a0, a0, str.__hu
lw gp, 0x10(sp)
lw ra, 0x2c(sp)
lw s1, 0x28(sp)
lw s0, 0x24(sp)
jr ra
addiu sp, sp, 0x30
lui gp, 2
addiu gp, gp, -0x73c4
addu gp, gp, t9
addiu sp, sp, -0x38
sw ra, 0x34(sp)
sw s6, 0x30(sp)
sw s5, 0x2c(sp)
sw s4, 0x28(sp)
sw s3, 0x24(sp)
sw s2, 0x20(sp)
--
lw v0, -0x7fdc(gp)
move s0, zero
addiu s4, v0, str.__random
lw v0, -0x7fdc(gp)
b 0xc00
addiu s3, v0, str.__persistent
jalr t9
nop
addiu a0, s0, 2
sll a0, a0, 4
addu a0, s2, a0
move t9, s5
jalr t9
addiu a0, a0, 4
lw gp, 0x10(sp)
addiu a0, zero, 0x20
lw t9, -sym.imp.putchar(gp)
nop
jalr t9
addiu s0, s0, 1
lw v0, 0x24(s1)
lw gp, 0x10(sp)
andi v0, v0, 4
beqz v0, 0xbd8
nop
lw t9, -sym.imp.printf(gp)
nop
jalr t9
move a0, s4
lw gp, 0x10(sp)
lw v0, 0x24(s1)
nop
andi v0, v0, 8
beqz v0, 0xc00
addiu s1, s1, 0x10
lw t9, -sym.imp.printf(gp)
nop
jalr t9
move a0, s3
lw gp, 0x10(sp)
lw v0, 0x20(s2)
lw t9, -sym.imp.printf(gp)
sltu v0, s0, v0
bnez v0, 0xb78
move a0, s6
lw ra, 0x34(sp)
lw s6, 0x30(sp)
lw s5, 0x2c(sp)
lw s4, 0x28(sp)
lw s3, 0x24(sp)
lw s2, 0x20(sp)
lw s1, 0x1c(sp)
lw s0, 0x18(sp)
jr ra
addiu sp, sp, 0x38
lui gp, 2
addiu gp, gp, -0x74ec
addu gp, gp, t9
addiu sp, sp, -0x38
sw ra, 0x34(sp)
sw s5, 0x30(sp)
sw s4, 0x2c(sp)
sw s3, 0x28(sp)
sw s2, 0x24(sp)
sw s1, 0x20(sp)
sw s0, 0x1c(sp)
sw gp, 0x10(sp)
lw a0, -0x7fdc(gp)
lw t9, -sym.imp.printf(gp)
addiu a0, a0, 0x14e8
jalr t9
move s2, a1
lw gp, 0x10(sp)
move s1, s2
lw v0, -0x7fdc(gp)
move s0, zero
addiu s5, v0, sym.print_range
lw v0, -0x7fdc(gp)
nop
addiu s4, v0, 0x14ec
lw v0, -0x7fdc(gp)
b 0xd20
addiu s3, v0, 0x14f4
move t9, s5
jalr t9
nop
lw gp, 0x10(sp)
nop
lw t9, -sym.imp.putchar(gp)
nop
jalr t9
addiu a0, zero, 0x20
lw v0, 0x24(s1)
lw gp, 0x10(sp)
andi v0, v0, 4
beqz v0, 0xcf8
nop
lw t9, -sym.imp.printf(gp)
nop
jalr t9
move a0, s4
lw gp, 0x10(sp)
lw v0, 0x24(s1)
nop
andi v0, v0, 8
beqz v0, 0xd20
addiu s1, s1, 0x10
lw t9, -sym.imp.printf(gp)
nop
jalr t9
move a0, s3
lw gp, 0x10(sp)
addiu a0, s0, 2
lw v0, 0x20(s2)
sll a0, a0, 4
addu a0, s2, a0
sltu v0, s0, v0
addiu a0, a0, 4
bnez v0, 0xcac
addiu s0, s0, 1
lw ra, 0x34(sp)
lw s5, 0x30(sp)
lw s4, 0x2c(sp)
lw s3, 0x28(sp)
lw s2, 0x24(sp)
lw s1, 0x20(sp)
lw s0, 0x1c(sp)
jr ra
[*] Function printf used 10 times libipt_SNAT.so
