[*] Binary protection state of iwconfig
RELRO CANARY NX PIE RPATH RUNPATH SYMBOLS
No RELRO No Canary found NX disabled No PIE No RPATH No RUNPATH No Symbols
[*] Function sprintf tear down of iwconfig
lw ra, 0x94(sp)
lw s5, 0x90(sp)
lw s4, 0x8c(sp)
lw s3, 0x88(sp)
lw s2, 0x84(sp)
lw s1, 0x80(sp)
lw s0, 0x7c(sp)
jr ra
addiu sp, sp, 0x98
lw v0, -0x7f2c(gp)
lw t9, -sym.imp.fprintf(gp)
lw a0, (v0)
b 0x406a3c
addiu a1, a1, -0x55cc
lui gp, 0x42
addiu sp, sp, -0x30
addiu gp, gp, 0x31e0
sw ra, 0x2c(sp)
sw gp, 0x20(sp)
lbu t0, 5(a0)
lbu a2, (a0)
lbu a3, 1(a0)
lbu v0, 2(a0)
lbu v1, 3(a0)
lbu a0, 4(a0)
lw t9, -sym.imp.sprintf(gp)
sw a0, 0x18(sp)
move a0, a1
lui a1, 0x41
sw v0, 0x10(sp)
sw v1, 0x14(sp)
sw t0, 0x1c(sp)
jalr t9
addiu a1, a1, -0x55ac
lw ra, 0x2c(sp)
lw gp, 0x20(sp)
jr ra
addiu sp, sp, 0x30
lui gp, 0x42
addiu sp, sp, -0x30
addiu gp, gp, 0x31e0
sw ra, 0x2c(sp)
sw s0, 0x28(sp)
sw gp, 0x20(sp)
lbu a1, 5(a0)
lbu a2, (a0)
lbu a3, 1(a0)
lbu v0, 2(a0)
lbu v1, 3(a0)
lbu a0, 4(a0)
lui s0, 0x42
lw t9, -sym.imp.sprintf(gp)
sw a1, 0x1c(sp)
lui a1, 0x41
sw a0, 0x18(sp)
sw v0, 0x10(sp)
sw v1, 0x14(sp)
addiu a0, s0, -0x4c7c
jalr t9
addiu a1, a1, -0x55ac
lw ra, 0x2c(sp)
addiu v0, s0, -0x4c7c
lw gp, 0x20(sp)
lw s0, 0x28(sp)
jr ra
addiu sp, sp, 0x30
lui gp, 0x42
addiu sp, sp, -0x28
addiu gp, gp, 0x31e0
sw ra, 0x24(sp)
sw gp, 0x18(sp)
lw v1, (a1)
lui v0, 1
ori v0, v0, 0x5180
bnez v0, 0x406ca4
div zero, v1, v0
break 7
addiu a2, zero, 0xe10
lw v1, 4(a1)
addiu a3, zero, 0x3c
sw v1, 0x14(sp)
lw t9, -sym.imp.sprintf(gp)
lui a1, 0x41
addiu a1, a1, -0x558c
mfhi v0
nop
nop
bnez a2, 0x406cd8
div zero, v0, a2
break 7
mfhi v1
mflo a2
nop
nop
bnez a3, 0x406cf4
div zero, v0, a3
break 7
mfhi v0
nop
nop
bnez a3, 0x406d0c
div zero, v1, a3
--
andi v0, s2, 2
beqz v0, 0x406da0
andi v0, s2, 0x2000
lw t9, -sym.imp.strcpy(gp)
lui a1, 0x41
move a0, s0
jalr t9
addiu a1, a1, -0x556c
lw gp, 0x10(sp)
addiu s0, s0, 4
andi v0, s2, 0x2000
beqz v0, 0x406ea4
lui a1, 0x41
lw t9, -sym.imp.strcpy(gp)
move a0, s0
jalr t9
addiu a1, a1, -0x5564
andi v0, s2, 4
lw gp, 0x10(sp)
beqz v0, 0x406e00
addiu a0, s0, 0xa
mtc1 s1, f0
lui v0, 0x41
lui a1, 0x41
cvt.d.w f2, f0
lw t9, -sym.imp.sprintf(gp)
lwc1 f0, -0x5c48(v0)
nop
lwc1 f1, -0x5c44(v0)
nop
div.d f4, f2, f0
mfc1 a2, f4
mfc1 a3, f5
b 0x406e44
addiu a1, a1, -0x5558
lui v0, 0xf
ori v0, v0, 0x4240
slt v0, s1, v0
bnez v0, 0x406e5c
slti v0, s1, 0x3e8
mtc1 s1, f0
lui v0, 0x41
lui a1, 0x41
cvt.d.w f2, f0
lw t9, -sym.imp.sprintf(gp)
lwc1 f0, -0x5c48(v0)
addiu a1, a1, -0x5554
lwc1 f1, -0x5c44(v0)
nop
div.d f4, f2, f0
mfc1 a2, f4
mfc1 a3, f5
lw ra, 0x24(sp)
lw s2, 0x20(sp)
lw s1, 0x1c(sp)
lw s0, 0x18(sp)
jr t9
addiu sp, sp, 0x28
lw t9, -sym.imp.sprintf(gp)
bnez v0, 0x406e98
lui v0, 0x41
mtc1 s1, f0
lui a1, 0x41
cvt.d.w f2, f0
lwc1 f0, -0x5c40(v0)
nop
lwc1 f1, -0x5c3c(v0)
nop
div.d f4, f2, f0
mfc1 a2, f4
mfc1 a3, f5
b 0x406e44
addiu a1, a1, -0x5550
lui a1, 0x41
b 0x406eb4
addiu a1, a1, -0x5548
lui a1, 0x41
lw t9, -sym.imp.sprintf(gp)
move a0, s0
addiu a1, a1, -0x5540
move a2, s1
lw ra, 0x24(sp)
lw s2, 0x20(sp)
lw s1, 0x1c(sp)
lw s0, 0x18(sp)
jr t9
addiu sp, sp, 0x28
lui gp, 0x42
addiu sp, sp, -0x28
addiu gp, gp, 0x31e0
sw ra, 0x24(sp)
sw s2, 0x20(sp)
sw s1, 0x1c(sp)
sw s0, 0x18(sp)
sw gp, 0x10(sp)
andi v0, a2, 1
move s1, a2
move s2, a1
--
addiu a1, a1, -0x556c
lw gp, 0x10(sp)
addiu s0, s0, 4
andi v0, s1, 0x2000
lw t9, -sym.imp.strcpy(gp)
beqz v0, 0x406f6c
move a0, s0
lui a1, 0x41
jalr t9
addiu a1, a1, -0x5534
lw gp, 0x10(sp)
b 0x406f80
addiu a0, s0, 9
lui a1, 0x41
jalr t9
addiu a1, a1, -0x5528
lw gp, 0x10(sp)
addiu a0, s0, 8
andi v0, s1, 4
beqz v0, 0x406fc4
lui v0, 0xf
mtc1 s2, f0
lui v0, 0x41
lui a1, 0x41
cvt.d.w f2, f0
lw t9, -sym.imp.sprintf(gp)
lwc1 f0, -0x5c48(v0)
nop
lwc1 f1, -0x5c44(v0)
nop
div.d f4, f2, f0
mfc1 a2, f4
mfc1 a3, f5
b 0x407004
addiu a1, a1, -0x5558
ori v0, v0, 0x4240
slt v0, s2, v0
bnez v0, 0x40701c
slti v0, s2, 0x3e8
mtc1 s2, f0
lui v0, 0x41
lui a1, 0x41
cvt.d.w f2, f0
lw t9, -sym.imp.sprintf(gp)
lwc1 f0, -0x5c48(v0)
addiu a1, a1, -0x5554
lwc1 f1, -0x5c44(v0)
nop
div.d f4, f2, f0
mfc1 a2, f4
mfc1 a3, f5
lw ra, 0x24(sp)
lw s2, 0x20(sp)
lw s1, 0x1c(sp)
lw s0, 0x18(sp)
jr t9
addiu sp, sp, 0x28
lw t9, -sym.imp.sprintf(gp)
bnez v0, 0x407058
lui v0, 0x41
mtc1 s2, f0
lui a1, 0x41
cvt.d.w f2, f0
lwc1 f0, -0x5c40(v0)
nop
lwc1 f1, -0x5c3c(v0)
nop
div.d f4, f2, f0
mfc1 a2, f4
mfc1 a3, f5
b 0x407004
addiu a1, a1, -0x5550
lui a1, 0x41
move a2, s2
lw ra, 0x24(sp)
lw s2, 0x20(sp)
lw s1, 0x1c(sp)
lw s0, 0x18(sp)
--
addiu s5, v0, -0x63b8
addiu s4, s0, -0x551c
b 0x40715c
addiu s2, zero, 1
bnez v1, 0x407144
move a0, s1
lw t9, -sym.imp.strcpy(gp)
nop
jalr t9
move a1, s5
addiu s0, s1, 1
lw gp, 0x10(sp)
move s1, s0
lw t9, -sym.imp.strcpy(gp)
move a0, s1
jalr t9
move a1, s4
lw gp, 0x10(sp)
addiu s1, s1, 2
slt v0, s2, s3
andi v1, s2, 1
bnez v0, 0x407120
addiu s2, s2, 1
b 0x4071f8
nop
lw t9, -sym.imp.sprintf(gp)
lui s0, 0x41
lbu a2, (a1)
jalr t9
addiu a1, s0, -0x5518
lui v0, 0x41
lw gp, 0x10(sp)
addiu s1, s1, 2
addiu s6, v0, -0x63b8
addiu s5, s0, -0x5518
b 0x4071ec
addiu s2, zero, 1
bnez v1, 0x4071cc
addu v0, s4, s2
lw t9, -sym.imp.strcpy(gp)
move a0, s1
jalr t9
move a1, s6
addiu s0, s1, 1
lw gp, 0x10(sp)
move s1, s0
addu v0, s4, s2
lw t9, -sym.imp.sprintf(gp)
lbu a2, (v0)
move a0, s1
jalr t9
move a1, s5
lw gp, 0x10(sp)
addiu s2, s2, 1
addiu s1, s1, 2
slt v0, s2, s3
bnez v0, 0x4071a4
andi v1, s2, 1
lw ra, 0x34(sp)
lw s6, 0x30(sp)
lw s5, 0x2c(sp)
lw s4, 0x28(sp)
lw s3, 0x24(sp)
lw s2, 0x20(sp)
lw s1, 0x1c(sp)
lw s0, 0x18(sp)
jr ra
addiu sp, sp, 0x38
--
addiu gp, gp, 0x31e0
sw ra, 0x34(sp)
sw gp, 0x28(sp)
beqz a3, 0x407300
nop
lbu t1, 1(a1)
nop
beqz t1, 0x407300
nop
lbu t2, 0x2d(a2)
lbu t0, 3(a1)
sltu v0, t2, t1
lbu t3, (a1)
lbu a3, 0x2c(a2)
lbu v1, 2(a1)
beqz v0, 0x4072b4
andi v0, t0, 7
bnez v0, 0x40727c
lui v0, 0x41
b 0x407284
addiu t0, v0, -0x5a5c
lui v0, 0x41
addiu t0, v0, -0x5510
addiu v0, t1, -0x100
addiu v1, v1, -0x100
lw t9, -sym.imp.sprintf(gp)
lui a1, 0x41
sw v0, 0x10(sp)
sw v1, 0x14(sp)
sw t0, 0x18(sp)
addiu a1, a1, -0x5504
jalr t9
move a2, t3
b 0x407344
nop
lbu a2, 0x2e(a2)
bnez v0, 0x4072c8
lui v0, 0x41
b 0x4072d0
addiu v0, v0, -0x5a5c
lui v0, 0x41
addiu v0, v0, -0x5510
lw t9, -sym.imp.sprintf(gp)
lui a1, 0x41
sw a2, 0x1c(sp)
sw t1, 0x10(sp)
sw t2, 0x14(sp)
sw v1, 0x18(sp)
sw v0, 0x20(sp)
addiu a1, a1, -0x54c8
jalr t9
move a2, t3
b 0x407344
nop
lbu v0, 3(a1)
lbu a2, (a1)
andi v0, v0, 7
lbu a3, 1(a1)
lbu v1, 2(a1)
bnez v0, 0x407324
lui v0, 0x41
b 0x40732c
addiu v0, v0, -0x5a5c
lui v0, 0x41
addiu v0, v0, -0x5510
lui a1, 0x41
lw t9, -sym.imp.sprintf(gp)
sw v1, 0x10(sp)
sw v0, 0x14(sp)
jalr t9
addiu a1, a1, -0x5490
lw ra, 0x34(sp)
lw gp, 0x28(sp)
jr ra
addiu sp, sp, 0x38
lui v0, 0x3b9a
ori v1, v0, 0xca00
lui gp, 0x42
slt v0, a1, v1
bnez v0, 0x40738c
addiu gp, gp, 0x31e0
bnez v1, 0x407378
div zero, a1, v1
break 7
lui a1, 0x41
lw t9, -sym.imp.sprintf(gp)
mflo a2
b 0x4073dc
addiu a1, a1, -0x5460
lui v0, 0xf
ori v1, v0, 0x4240
slt v0, a1, v1
lw t9, -sym.imp.sprintf(gp)
bnez v0, 0x4073c0
nop
bnez v1, 0x4073b0
div zero, a1, v1
break 7
lui a1, 0x41
mflo a2
b 0x4073dc
addiu a1, a1, -0x5458
addiu a2, zero, 0x3e8
bnez a2, 0x4073d0
div zero, a1, a2
break 7
lui a1, 0x41
addiu a1, a1, -0x5450
mflo a2
jr t9
nop
lui v0, 0x41
mtc1 a2, f0
lwc1 f4, -0x5c40(v0)
lui gp, 0x42
mtc1 a3, f1
lwc1 f5, -0x5c3c(v0)
nop
c.lt.d f0, f4
nop
bc1f 0x407450
addiu gp, gp, 0x31e0
cfc1 v0, 31
cfc1 v0, 31
nop
ori at, v0, 3
xori at, at, 2
ctc1 at, 31
nop
cvt.w.d f2, f0
ctc1 v0, 31
nop
lui a1, 0x41
mfc1 a2, f2
lw t9, -sym.imp.sprintf(gp)
nop
jr t9
addiu a1, a1, -0x5448
lui v0, 0x41
lwc1 f2, -0x5c50(v0)
nop
lwc1 f3, -0x5c4c(v0)
nop
c.le.d f2, f0
nop
bc1f 0x407490
lui v0, 0x41
div.d f4, f0, f2
lui a1, 0x41
lw t9, -sym.imp.sprintf(gp)
mfc1 a2, f4
mfc1 a3, f5
b 0x4074d8
addiu a1, a1, -0x543c
lwc1 f2, -0x5c48(v0)
lw t9, -sym.imp.sprintf(gp)
lwc1 f3, -0x5c44(v0)
nop
c.le.d f2, f0
nop
bc1f 0x4074c4
lui a1, 0x41
div.d f4, f0, f2
mfc1 a2, f4
mfc1 a3, f5
b 0x4074d8
addiu a1, a1, -0x5428
div.d f2, f0, f4
lui a1, 0x41
addiu a1, a1, -0x5414
mfc1 a2, f2
mfc1 a3, f3
jr t9
nop
lui gp, 0x42
addiu sp, sp, -0x28
[*] Function sprintf used 20 times iwconfig
