[*] Binary protection state of xmldb
RELRO CANARY NX PIE RPATH RUNPATH SYMBOLS
No RELRO No Canary found NX disabled No PIE No RPATH No RUNPATH No Symbols
[*] Function fprintf tear down of xmldb
sw v1, 4(v0)
jr ra
sw zero, 0x2c(v0)
jr ra
move v0, zero
lui gp, 0x44
addiu sp, sp, -0x138
addiu gp, gp, -0x4690
sw ra, 0x134(sp)
sw s3, 0x130(sp)
sw s2, 0x12c(sp)
sw s1, 0x128(sp)
sw s0, 0x124(sp)
sw gp, 0x10(sp)
lui s0, 0x43
lw t9, -sym.imp.stat(gp)
lw a0, 0x3ce0(s0)
jalr t9
addiu a1, sp, 0x88
lw gp, 0x10(sp)
bltz v0, 0x40242c
lui a1, 0x42
lw v0, -0x7e74(gp)
lw a2, 0x3ce0(s0)
lw a0, (v0)
lw t9, -sym.imp.fprintf(gp)
lui a3, 0x42
addiu a1, a1, 0x1ae4
jalr t9
addiu a3, a3, 0x1ac0
b 0x402608
nop
lw t9, -sym.dirname(gp)
lw a0, 0x3ce0(s0)
jalr t9
nop
lw gp, 0x10(sp)
move a0, v0
lw t9, -sym.make_valid_path(gp)
addiu a1, zero, 0x1f8
jalr t9
move s3, v0
lw gp, 0x10(sp)
bnez v0, 0x4024d0
nop
lw t9, -sym.imp.__errno_location(gp)
lw v0, -0x7e74(gp)
lw s1, 0x3ce0(s0)
lw s0, (v0)
jalr t9
addiu s2, zero, -1
lw gp, 0x10(sp)
lw a0, (v0)
lw t9, -sym.imp.strerror(gp)
nop
jalr t9
nop
lw gp, 0x10(sp)
lui a1, 0x42
lw t9, -sym.imp.fprintf(gp)
move a0, s0
addiu a1, a1, 0x1b0c
move a2, s1
jalr t9
move a3, v0
lw gp, 0x10(sp)
nop
lw t9, -sym.imp.free(gp)
nop
jalr t9
move a0, s3
b 0x40263c
nop
lw t9, -sym.imp.free(gp)
nop
jalr t9
move a0, s3
lw gp, 0x10(sp)
addiu a0, zero, 1
lw t9, -sym.imp.socket(gp)
addiu a1, zero, 2
jalr t9
move a2, zero
lw gp, 0x10(sp)
bgez v0, 0x402558
move s2, v0
lw t9, -sym.imp.__errno_location(gp)
lw v0, -0x7e74(gp)
nop
lw s0, (v0)
jalr t9
nop
lw gp, 0x10(sp)
lw a0, (v0)
lw t9, -sym.imp.strerror(gp)
nop
jalr t9
nop
lw gp, 0x10(sp)
lui a1, 0x42
lw t9, -sym.imp.fprintf(gp)
move a0, s0
addiu a1, a1, 0x1b2c
jalr t9
move a2, v0
b 0x40263c
nop
lw t9, -sym.imp.snprintf(gp)
lw a3, 0x3ce0(s0)
addiu v0, zero, 1
addiu s0, sp, 0x1a
lui a2, 0x42
addiu a2, a2, 0x1b34
move a0, s0
addiu a1, zero, 0x6c
jalr t9
sh v0, 0x18(sp)
lw gp, 0x10(sp)
move a0, s2
lw t9, -sym.imp.bind(gp)
addiu a1, sp, 0x18
jalr t9
addiu a2, zero, 0x6e
lw gp, 0x10(sp)
bgez v0, 0x402614
nop
lw t9, -sym.imp.__errno_location(gp)
lw v0, -0x7e74(gp)
nop
lw s0, (v0)
jalr t9
nop
lw gp, 0x10(sp)
lw a0, (v0)
lw t9, -sym.imp.strerror(gp)
nop
jalr t9
nop
lw gp, 0x10(sp)
lui a1, 0x42
lw t9, -sym.imp.fprintf(gp)
move a0, s0
addiu a1, a1, 0x1b38
jalr t9
move a2, v0
lw gp, 0x10(sp)
nop
lw t9, -sym.imp.close(gp)
nop
jalr t9
move a0, s2
lw gp, 0x10(sp)
b 0x402640
addiu s2, zero, -1
lw t9, -sym.imp.chmod(gp)
move a0, s0
jalr t9
addiu a1, zero, 0x1ff
lw gp, 0x10(sp)
move a0, s2
lw t9, -sym.imp.listen(gp)
--
move a1, s2
move s0, v0
jal sym.client_puts
sb zero, 0x21c(sp)
lw ra, 0x22c(sp)
move v0, s0
lw gp, 0x10(sp)
lw s2, 0x228(sp)
lw s1, 0x224(sp)
lw s0, 0x220(sp)
jr ra
addiu sp, sp, 0x230
lui gp, 0x44
addiu sp, sp, -0x28
addiu gp, gp, -0x4690
sw ra, 0x24(sp)
sw gp, 0x10(sp)
lui v0, 0x43
lw v0, 0x3cdc(v0)
sw a1, 0x2c(sp)
sw a2, 0x30(sp)
sw a3, 0x34(sp)
beqz v0, 0x402e64
move a1, a0
lw v0, -0x7e28(gp)
lw t9, -sym.imp.vfprintf(gp)
addiu a2, sp, 0x2c
lw a0, (v0)
jalr t9
sw a2, 0x18(sp)
lw gp, 0x10(sp)
lw ra, 0x24(sp)
nop
jr ra
addiu sp, sp, 0x28
lui gp, 0x44
addiu sp, sp, -0x40
addiu gp, gp, -0x4690
sw ra, 0x3c(sp)
sw fp, 0x38(sp)
sw s7, 0x34(sp)
sw s6, 0x30(sp)
sw s5, 0x2c(sp)
sw s4, 0x28(sp)
sw s3, 0x24(sp)
sw s2, 0x20(sp)
--
lui v0, 0x43
lw a1, 0x3ce0(v0)
lui a0, 0x42
addiu a0, a0, 0x1d30
jal 0x402e18
lui s1, 0x43
lw a1, 0x3cd8(s1)
lui a0, 0x42
jal 0x402e18
addiu a0, a0, 0x1d44
lw gp, 0x10(sp)
lw a0, 0x3cd8(s1)
lw t9, -sym.imp.fopen(gp)
lui a1, 0x42
jalr t9
addiu a1, a1, 0x1d58
lw gp, 0x10(sp)
beqz v0, 0x4030d8
move s0, v0
lw t9, -sym.imp.getpid(gp)
nop
jalr t9
nop
lw gp, 0x10(sp)
lui a1, 0x42
lw t9, -sym.imp.fprintf(gp)
move a0, s0
addiu a1, a1, 0x1d5c
jalr t9
move a2, v0
lw gp, 0x10(sp)
nop
lw t9, -sym.imp.fclose(gp)
nop
jalr t9
move a0, s0
b 0x4030e8
nop
lui a0, 0x42
lw a1, 0x3cd8(s1)
jal 0x402e18
addiu a0, a0, 0x1d60
jal 0x4023c0
nop
lw gp, 0x10(sp)
bgez v0, 0x403108
--
addiu s0, s0, 1
bnez v0, 0x403dfc
move a0, s3
lw t9, -sym.imp.putchar(gp)
lw ra, 0x2c(sp)
lw s3, 0x28(sp)
lw s2, 0x24(sp)
lw s1, 0x20(sp)
lw s0, 0x1c(sp)
addiu a0, zero, 0xa
jr t9
addiu sp, sp, 0x30
lui gp, 0x44
addiu sp, sp, -0x28
addiu gp, gp, -0x4690
sw ra, 0x24(sp)
sw gp, 0x10(sp)
lui v0, 0x43
lw v0, 0x4918(v0)
sw a1, 0x2c(sp)
sw a2, 0x30(sp)
sw a3, 0x34(sp)
beqz v0, 0x403e90
move a1, a0
lw v0, -0x7e28(gp)
lw t9, -sym.imp.vfprintf(gp)
addiu a2, sp, 0x2c
lw a0, (v0)
jalr t9
sw a2, 0x18(sp)
lw gp, 0x10(sp)
lw ra, 0x24(sp)
nop
jr ra
addiu sp, sp, 0x28
lui gp, 0x44
addiu sp, sp, -0x20
addiu gp, gp, -0x4690
sw ra, 0x1c(sp)
sw s0, 0x18(sp)
sw gp, 0x10(sp)
lui v0, 0x43
lw v0, 0x490c(v0)
nop
beqz v0, 0x403edc
move s0, a0
--
addiu v0, zero, 1
bne a2, v0, 0x4065b4
nop
lw t9, -sym.imp.strcmp(gp)
lw a0, 0x1c(a1)
lui a1, 0x42
jalr t9
addiu a1, a1, 0x255c
lw gp, 0x10(sp)
bnez v0, 0x4065b8
move s0, zero
b 0x4068b0
nop
jalr t9
nop
lw gp, 0x10(sp)
b 0x4065bc
slt v0, s0, s5
move s0, zero
slt v0, s0, s5
lw t9, -sym.imp.fputc(gp)
addiu a0, zero, 9
move a1, s3
bnez v0, 0x4065a0
addiu s0, s0, 1
lw t9, -sym.imp.fprintf(gp)
lw a2, 0x1c(s2)
lui a1, 0x42
addiu a1, a1, 0x2564
jalr t9
move a0, s3
andi v0, s7, 1
lw gp, 0x10(sp)
beqz v0, 0x4066a0
lui v0, 0x42
addiu fp, v0, 0x2568
lw s0, 0x10(s2)
b 0x406694
addiu s6, s2, 0x10
lw s4, (s0)
jalr t9
nop
lw gp, 0x10(sp)
move s1, v0
lw t9, -sym.sobj_escape_javascript(gp)
beqz v0, 0x406690
move a1, v0
lw v0, 0xc(s0)
nop
beqz v0, 0x406648
move a0, v0
jalr t9
nop
lw gp, 0x10(sp)
nop
lw t9, -sym.sobj_get_string(gp)
lw s0, 8(s0)
jalr t9
move a0, s1
lw gp, 0x10(sp)
move a2, s0
lw t9, -sym.imp.fprintf(gp)
move a3, v0
move a0, s3
jalr t9
move a1, fp
lw gp, 0x10(sp)
nop
lw t9, -sym.sobj_del(gp)
nop
jalr t9
move a0, s1
lw gp, 0x10(sp)
move s0, s4
lw t9, -sym.sobj_new(gp)
bne s0, s6, 0x406608
nop
lw t9, -sym.imp.fputc(gp)
addiu a0, zero, 0x3e
jalr t9
move a1, s3
lui a1, 0x42
--
b 0x40682c
addiu s1, s5, 1
jal 0x40651c
nop
lw gp, 0x10(sp)
lw s0, (s0)
nop
move a1, s0
move a0, s3
move a2, s1
bne s0, s4, 0x406818
move a3, s7
b 0x406854
move s0, zero
jalr t9
nop
lw gp, 0x10(sp)
slt v0, s0, s5
lw t9, -sym.imp.fputc(gp)
addiu s0, s0, 1
addiu a0, zero, 9
bnez v0, 0x406848
move a1, s3
lw a2, 0x1c(s2)
lui a1, 0x42
lw t9, -sym.imp.fprintf(gp)
move a0, s3
lw ra, 0x3c(sp)
lw fp, 0x38(sp)
lw s7, 0x34(sp)
lw s6, 0x30(sp)
lw s5, 0x2c(sp)
lw s4, 0x28(sp)
lw s3, 0x24(sp)
lw s2, 0x20(sp)
lw s1, 0x1c(sp)
lw s0, 0x18(sp)
addiu a1, a1, 0x2574
jr t9
addiu sp, sp, 0x40
lw ra, 0x3c(sp)
lw fp, 0x38(sp)
lw s7, 0x34(sp)
lw s6, 0x30(sp)
lw s5, 0x2c(sp)
lw s4, 0x28(sp)
[*] Function fprintf used 10 times xmldb
