[*] Binary protection state of servd
RELRO CANARY NX PIE RPATH RUNPATH SYMBOLS
No RELRO No Canary found NX disabled No PIE No RPATH No RUNPATH No Symbols
[*] Function strcpy tear down of servd
b 0x404a48
nop
lw s1, 8(s3)
lw t9, -sym.imp.strcmp(gp)
nop
jalr t9
move a0, s1
lw gp, 0x10(sp)
bnez v0, 0x4045e0
lui a1, 0x41
move a0, s0
move a1, zero
jal 0x403240
sb zero, 0x38(sp)
lw gp, 0x10(sp)
beqz v0, 0x404594
lui a1, 0x41
lw v0, 0x10(v0)
nop
bnez v0, 0x404584
lui v0, 0x41
lui v0, 0x41
b 0x404588
addiu a1, v0, -0x58ec
addiu a1, v0, -0x58e4
lw t9, -sym.imp.strcpy(gp)
b 0x40459c
nop
lw t9, -sym.imp.strcpy(gp)
addiu a1, a1, -0x558c
jalr t9
addiu a0, sp, 0x38
lw gp, 0x10(sp)
addiu s0, sp, 0x38
lw t9, -sym.imp.strlen(gp)
nop
jalr t9
move a0, s0
lw gp, 0x10(sp)
beqz v0, 0x404a4c
nop
lw t9, -sym.susock_send(gp)
move a0, s5
move a1, s0
addiu a2, v0, 1
b 0x404640
addiu a3, zero, 0x4000
lw t9, -sym.imp.strcmp(gp)
move a0, s1
--
lw a0, (v0)
addiu a1, a1, -0x5588
addiu a2, a2, -0x5498
addiu a3, a3, -0x5504
jalr t9
nop
b 0x404a18
nop
lw t9, -sym.imp.memset(gp)
addiu s1, s2, 0x2c
move a0, s1
move a1, zero
addiu a2, zero, 0x32
sw s4, 0xc(s2)
jalr t9
sw s5, 0x28(s2)
lw gp, 0x10(sp)
addiu s0, s2, 0x5e
lw t9, -sym.imp.memset(gp)
addiu a2, zero, 0x32
move a0, s0
jalr t9
move a1, zero
lw gp, 0x10(sp)
lw a1, 4(s3)
lw t9, -sym.imp.strcpy(gp)
nop
jalr t9
move a0, s1
lw gp, 0x10(sp)
lw a1, 0xc(s3)
lw t9, -sym.imp.strcpy(gp)
nop
jalr t9
move a0, s0
b 0x404a2c
lui v0, 0x42
lw v0, -0x7ef0(gp)
lui a1, 0x41
lw t9, -sym.imp.fprintf(gp)
lw a0, (v0)
addiu a1, a1, -0x54ec
jalr t9
move a2, s0
jal 0x402fdc
move a0, s2
b 0x404a48
nop
lui v0, 0x42
addiu v0, v0, -0x4f28
lw v1, 4(v0)
sw v0, (s2)
--
bnez s0, 0x404f20
nop
bnez s3, 0x405130
nop
lw v0, 0xc(s2)
nop
bnez v0, 0x4050dc
move s0, zero
b 0x405130
nop
lw a1, 0x10(s0)
nop
beqz a1, 0x4050dc
addiu v1, zero, 0x40
lb v0, (a1)
lw a3, 0x10(s2)
bne v0, v1, 0x405040
nop
beqz a3, 0x405028
addiu a1, a1, 1
move a2, a1
lw t9, -sym.imp.sprintf(gp)
move a0, s4
b 0x4050b4
move a1, s7
lw t9, -sym.imp.strcpy(gp)
nop
jalr t9
move a0, s4
b 0x4050bc
nop
beqz a3, 0x405088
move a2, a1
lw t9, -sym.imp.sprintf(gp)
move a0, s4
jalr t9
move a1, s7
lw gp, 0x18(sp)
lw v0, 0x10(s2)
lw a2, 8(s2)
lw a3, 0xc(s0)
lw a0, (s6)
lw t9, -sym.imp.fprintf(gp)
lui a1, 0x41
sw v0, 0x10(sp)
jalr t9
addiu a1, a1, -0x5404
b 0x4050bc
nop
lw t9, -sym.imp.strcpy(gp)
nop
jalr t9
move a0, s4
lw gp, 0x18(sp)
lui a1, 0x41
lw a0, (s6)
lw t9, -sym.imp.fprintf(gp)
lw a2, 8(s2)
lw a3, 0xc(s0)
addiu a1, a1, -0x53e8
jalr t9
nop
lw gp, 0x18(sp)
nop
lw t9, -sym.spawn(gp)
nop
jalr t9
move a0, s4
lw gp, 0x18(sp)
sw v0, 8(s0)
--
move s2, a1
beqz a1, 0x408008
move v1, zero
lw t9, -sym.imp.strlen(gp)
nop
jalr t9
move a0, a1
lw gp, 0x10(sp)
bnez v0, 0x407fbc
move s1, v0
b 0x408008
move v1, zero
jal 0x407ec4
nop
lw gp, 0x10(sp)
bltz v0, 0x408008
addiu v1, zero, -1
lw v1, 0x10(s0)
lw v0, 0xc(s0)
nop
subu v0, v0, v1
sltu v0, v0, s1
bnez v0, 0x407fa8
move a0, s0
lw a0, 0x14(s0)
lw t9, -sym.imp.strcpy(gp)
addu a0, a0, v1
jalr t9
move a1, s2
lw v0, 0x10(s0)
lw gp, 0x10(sp)
addu v0, v0, s1
move v1, zero
b 0x408008
sw v0, 0x10(s0)
addiu v1, zero, -1
lw ra, 0x24(sp)
move v0, v1
lw s2, 0x20(sp)
lw s1, 0x1c(sp)
lw s0, 0x18(sp)
jr ra
addiu sp, sp, 0x28
bnez a0, 0x408034
addiu v0, zero, -1
jr ra
[*] Function strcpy used 7 times servd
