[*] Binary protection state of radvd
RELRO CANARY NX PIE RPATH RUNPATH SYMBOLS
No RELRO No Canary found NX disabled No PIE No RPATH No RUNPATH No Symbols
[*] Function printf tear down of radvd
lui v1, 0x41
sll v0, a3, 2
addiu v1, v1, -0x2d70
addu v1, v1, v0
lw v0, (v1)
nop
addu v0, v0, gp
jr v0
nop
lw t9, -sym.imp.closelog(gp)
nop
jalr t9
nop
lw gp, 0x10(sp)
b 0x401cc4
move v0, zero
lui v0, 0x42
lw a0, 0x36e0(v0)
lw t9, -sym.imp.fclose(gp)
nop
jalr t9
nop
b 0x401c70
nop
lw v0, -0x7e9c(gp)
lw t9, -sym.imp.fprintf(gp)
lw a0, (v0)
lui v0, 0x42
lw a2, 0x36d8(v0)
jalr t9
addiu a1, a1, -0x2df0
lw gp, 0x10(sp)
sw zero, 0x36d4(s0)
addiu v0, zero, -1
lw ra, 0x1c(sp)
lw s0, 0x18(sp)
jr ra
addiu sp, sp, 0x20
lui gp, 0x43
addiu sp, sp, -0x478
addiu gp, gp, -0x4c10
sw ra, 0x474(sp)
sw s1, 0x470(sp)
sw s0, 0x46c(sp)
sw gp, 0x18(sp)
lw t9, -sym.imp.vsnprintf(gp)
move a3, a2
move s0, a0
move a2, a1
addiu a0, sp, 0x64
addiu a1, zero, 0x400
jalr t9
lui s1, 0x42
lw a3, 0x36d4(s1)
lw gp, 0x18(sp)
sltiu v0, a3, 5
beqz v0, 0x401ebc
lui a1, 0x41
lui v1, 0x41
sll v0, a3, 2
addiu v1, v1, -0x2d5c
addu v1, v1, v0
lw v0, (v1)
nop
addu v0, v0, gp
jr v0
--
nop
lw t9, -sym.imp.time(gp)
nop
jalr t9
move a0, zero
lw gp, 0x18(sp)
addiu a0, sp, 0x20
lw t9, -sym.imp.localtime(gp)
nop
jalr t9
sw v0, 0x20(sp)
lw gp, 0x18(sp)
addiu s1, sp, 0x24
lw t9, -sym.imp.strftime(gp)
lui a2, 0x41
addiu a2, a2, -0x2dd0
move a3, v0
move a0, s1
lw s0, -0x7e9c(gp)
jalr t9
addiu a1, zero, 0x40
lw gp, 0x18(sp)
lui v0, 0x42
lw a3, 0x36d8(v0)
lw a0, (s0)
lw t9, -sym.imp.fprintf(gp)
addiu v0, sp, 0x64
lui a1, 0x41
sw v0, 0x10(sp)
addiu a1, a1, -0x2dc0
jalr t9
move a2, s1
lw gp, 0x18(sp)
lw a0, (s0)
b 0x401ea0
nop
lw t9, -sym.imp.time(gp)
nop
jalr t9
move a0, zero
lw gp, 0x18(sp)
addiu a0, sp, 0x20
lw t9, -sym.imp.localtime(gp)
nop
jalr t9
sw v0, 0x20(sp)
lw gp, 0x18(sp)
addiu s1, sp, 0x24
lw t9, -sym.imp.strftime(gp)
lui a2, 0x41
addiu a2, a2, -0x2dd0
move a3, v0
move a0, s1
jalr t9
addiu a1, zero, 0x40
lw gp, 0x18(sp)
lui s0, 0x42
lui v0, 0x42
lw a3, 0x36d8(v0)
lw a0, 0x36e0(s0)
lw t9, -sym.imp.fprintf(gp)
addiu v0, sp, 0x64
lui a1, 0x41
sw v0, 0x10(sp)
addiu a1, a1, -0x2dc0
jalr t9
move a2, s1
lw gp, 0x18(sp)
lw a0, 0x36e0(s0)
lw t9, -sym.imp.fflush(gp)
nop
jalr t9
nop
lw gp, 0x18(sp)
b 0x401eec
move v0, zero
lw v0, -0x7e9c(gp)
lw t9, -sym.imp.fprintf(gp)
lw a0, (v0)
lui v0, 0x42
lw a2, 0x36d8(v0)
jalr t9
addiu a1, a1, -0x2df0
lw gp, 0x18(sp)
sw zero, 0x36d4(s1)
b 0x401eec
addiu v0, zero, -1
move v0, zero
lw ra, 0x474(sp)
lw s1, 0x470(sp)
lw s0, 0x46c(sp)
jr ra
addiu sp, sp, 0x478
addiu sp, sp, -0x28
sw ra, 0x24(sp)
sw gp, 0x10(sp)
addiu v0, sp, 0x30
sw a2, 0x30(sp)
--
addu v1, v1, v0
lw v0, (v1)
nop
addu v0, v0, gp
jr v0
nop
addiu v0, zero, -1
bne a3, v0, 0x401ffc
lui v1, 0x42
addiu v0, zero, 0x18
b 0x402000
sw v0, 0x36e4(v1)
sw a3, 0x36e4(v1)
lui v0, 0x42
lw t9, -sym.imp.openlog(gp)
lw a2, 0x36e4(v0)
move a0, t1
jalr t9
addiu a1, zero, 1
lw gp, 0x18(sp)
b 0x40210c
move v0, zero
bnez a2, 0x402050
lui s0, 0x42
lw v0, -0x7e9c(gp)
lw t9, -sym.imp.fprintf(gp)
lw a0, (v0)
lui a1, 0x41
addiu a1, a1, -0x2db0
jalr t9
move a2, t1
b 0x4020cc
nop
lw t9, -sym.imp.fopen(gp)
lui a1, 0x41
sw a2, 0x36dc(s0)
jalr t9
addiu a1, a1, -0x2d94
lui v1, 0x42
lw gp, 0x18(sp)
bnez v0, 0x402108
sw v0, 0x36e0(v1)
lw v0, -0x7e9c(gp)
lw t9, -sym.imp.__errno_location(gp)
lw s1, (v0)
lui v0, 0x42
lw s2, 0x36d8(v0)
jalr t9
nop
lw gp, 0x18(sp)
lw a0, (v0)
lw t9, -sym.imp.strerror(gp)
lw s0, 0x36dc(s0)
jalr t9
nop
lw gp, 0x18(sp)
lui a1, 0x41
lw t9, -sym.imp.fprintf(gp)
sw v0, 0x10(sp)
move a0, s1
addiu a1, a1, -0x2d90
move a2, s2
jalr t9
move a3, s0
lw gp, 0x18(sp)
b 0x40210c
addiu v0, zero, -1
lw v0, -0x7e9c(gp)
lw t9, -sym.imp.fprintf(gp)
lw a0, (v0)
lui a1, 0x41
addiu a1, a1, -0x2df0
move a2, t1
jalr t9
move a3, t0
lw gp, 0x18(sp)
sw zero, 0x36d4(s0)
b 0x40210c
addiu v0, zero, -1
move v0, zero
lw ra, 0x2c(sp)
lw s2, 0x28(sp)
lw s1, 0x24(sp)
lw s0, 0x20(sp)
jr ra
addiu sp, sp, 0x30
addiu sp, sp, -0x20
sw ra, 0x1c(sp)
sw gp, 0x10(sp)
--
lw gp, 0x18(sp)
lwc1 f20, 0x228(sp)
lw ra, 0x224(sp)
lw fp, 0x220(sp)
lw s7, 0x21c(sp)
lw s6, 0x218(sp)
lwc1 f21, 0x22c(sp)
lw s5, 0x214(sp)
lw s4, 0x210(sp)
lw s3, 0x20c(sp)
lw s2, 0x208(sp)
lw s1, 0x204(sp)
lw s0, 0x200(sp)
jr ra
addiu sp, sp, 0x230
nop
nop
jr ra
move v0, zero
lui gp, 0x43
addiu sp, sp, -0x20
addiu gp, gp, -0x4c10
sw ra, 0x1c(sp)
sw gp, 0x10(sp)
lw v0, -0x7e9c(gp)
lw t9, -sym.imp.fprintf(gp)
lw a0, (v0)
lw v0, -obj.pname(gp)
lui a1, 0x41
lw a2, (v0)
lui a3, 0x42
addiu a1, a1, -0x1000
jalr t9
addiu a3, a3, 0x3030
lw gp, 0x10(sp)
nop
lw t9, -sym.imp.exit(gp)
nop
jalr t9
addiu a0, zero, 1
lui gp, 0x43
addiu sp, sp, -0x20
addiu gp, gp, -0x4c10
sw ra, 0x1c(sp)
sw s0, 0x18(sp)
sw gp, 0x10(sp)
lw s0, -0x7e9c(gp)
lw t9, -sym.imp.fprintf(gp)
lw a0, (s0)
lui a2, 0x41
lui a1, 0x41
addiu a2, a2, -0xfe0
jalr t9
addiu a1, a1, -0xff0
lw gp, 0x10(sp)
lw a1, (s0)
lw t9, -sym.imp.fputs(gp)
lui a0, 0x41
jalr t9
addiu a0, a0, -0xfdc
lw gp, 0x10(sp)
lw a0, (s0)
lw t9, -sym.imp.fprintf(gp)
lui a1, 0x41
lui a2, 0x41
addiu a1, a1, -0xfc4
jalr t9
addiu a2, a2, -0xfa4
lw gp, 0x10(sp)
lw a0, (s0)
lw t9, -sym.imp.fprintf(gp)
lui a1, 0x41
lui a2, 0x41
addiu a1, a1, -0xf94
jalr t9
addiu a2, a2, -0xf78
lw gp, 0x10(sp)
lw a0, (s0)
lw t9, -sym.imp.fprintf(gp)
lui a1, 0x41
lui a2, 0x41
addiu a1, a1, -0xf64
jalr t9
addiu a2, a2, -0xf48
lw gp, 0x10(sp)
lw a0, (s0)
lw t9, -sym.imp.fprintf(gp)
lui a1, 0x41
addiu a1, a1, -0xf34
jalr t9
addiu a2, zero, 0x18
lw gp, 0x10(sp)
lw a0, (s0)
lw t9, -sym.imp.fprintf(gp)
lui a1, 0x41
lui a2, 0x41
addiu a1, a1, -0xf14
jalr t9
addiu a2, a2, -0xee4
lw gp, 0x10(sp)
nop
lw t9, -sym.imp.exit(gp)
nop
jalr t9
addiu a0, zero, 1
lui gp, 0x43
addiu sp, sp, -0x28
addiu gp, gp, -0x4c10
sw ra, 0x24(sp)
sw s1, 0x20(sp)
sw s0, 0x1c(sp)
sw gp, 0x10(sp)
lw t9, -sym.imp.fopen(gp)
lui a1, 0x41
--
jalr t9
addiu a1, a1, -0xac0
lw gp, 0x18(sp)
beqz v0, 0x407e44
addiu s2, zero, 2
lw t9, -sym.imp.strcmp(gp)
lui a1, 0x41
move a0, s0
jalr t9
addiu a1, a1, -0xab8
lw gp, 0x18(sp)
beqz v0, 0x407e44
addiu s2, zero, 4
lw t9, -sym.imp.strcmp(gp)
lui a1, 0x41
move a0, s0
jalr t9
addiu a1, a1, -0xab0
lw gp, 0x18(sp)
beqz v0, 0x407e44
move s2, zero
lw v0, -0x7e9c(gp)
lui a1, 0x41
lw a0, (v0)
lw v0, -obj.pname(gp)
lw t9, -sym.imp.fprintf(gp)
lw a2, (v0)
addiu a1, a1, -0xaa8
b 0x407e20
move a3, s0
lw t9, -sym.imp.strdup(gp)
lw a0, (s1)
jalr t9
nop
lw gp, 0x18(sp)
b 0x407e44
move s3, v0
lw t9, -sym.imp.strdup(gp)
lw a0, (s1)
jalr t9
nop
lw gp, 0x18(sp)
b 0x407e44
move s4, v0
jal 0x40694c
nop
lw gp, 0x18(sp)
b 0x407e44
nop
jal 0x4068f8
nop
lw gp, 0x18(sp)
lw v1, 0x20(sp)
lui v0, 0x42
addiu v0, v0, 0x3300
sll v1, v1, 4
addu v1, v1, v0
lw v0, -0x7e9c(gp)
lui a1, 0x41
lw a0, (v0)
lw v0, -obj.pname(gp)
lw a3, (v1)
lw a2, (v0)
lw t9, -sym.imp.fprintf(gp)
addiu a1, a1, -0xa8c
jalr t9
nop
lw gp, 0x18(sp)
nop
lw t9, -sym.imp.exit(gp)
addiu a0, zero, 1
jalr t9
nop
addiu s5, zero, 1
lw v0, 0x3c(sp)
lw t9, -sym.imp.getopt_long(gp)
lw a0, 0x68(sp)
lw a1, 0x6c(sp)
lui a2, 0x41
lui a3, 0x42
sw v0, 0x10(sp)
addiu a2, a2, -0xa68
jalr t9
addiu a3, a3, 0x3300
--
lui a1, 0x40
lw t9, -sym.imp.signal(gp)
addiu a1, a1, 0x70b8
jalr t9
addiu a0, zero, 0xf
lw gp, 0x18(sp)
lui a1, 0x40
lw t9, -sym.imp.signal(gp)
addiu a1, a1, 0x7008
jalr t9
addiu a0, zero, 2
lw gp, 0x18(sp)
lui a1, 0x40
lw t9, -sym.imp.signal(gp)
addiu a1, a1, 0x6df8
jalr t9
addiu a0, zero, 0x10
lw gp, 0x18(sp)
nop
lw t9, -sym.imp.getpid(gp)
nop
jalr t9
addiu s0, sp, 0x24
lw gp, 0x18(sp)
lui a2, 0x41
lw t9, -sym.imp.snprintf(gp)
move a3, v0
addiu a2, a2, -0x850
addiu a1, zero, 0x10
jalr t9
move a0, s0
lw gp, 0x18(sp)
nop
lw t9, -sym.imp.strlen(gp)
nop
jalr t9
move a0, s0
lw gp, 0x18(sp)
move a1, s0
lw t9, -sym.imp.write(gp)
move a2, v0
jalr t9
move a0, s1
lw gp, 0x18(sp)
move a0, s0
lw t9, -sym.imp.strlen(gp)
--
lw gp, 0x10(sp)
sw zero, 0x3744(v0)
lw s1, 0x20(sp)
move v0, zero
lw s0, 0x1c(sp)
jr ra
addiu sp, sp, 0x28
lui gp, 0x43
addiu gp, gp, -0x4c10
lw t9, -sym.imp.realloc(gp)
nop
jr t9
nop
lui gp, 0x43
addiu gp, gp, -0x4c10
lw t9, -sym.imp.malloc(gp)
nop
jr t9
nop
lui gp, 0x43
addiu sp, sp, -0x20
addiu gp, gp, -0x4c10
sw ra, 0x1c(sp)
sw gp, 0x10(sp)
lw v0, -0x7e9c(gp)
lw t9, -sym.imp.fprintf(gp)
move a2, a0
lui a1, 0x41
lw a0, (v0)
jalr t9
addiu a1, a1, -0xa90
lw gp, 0x10(sp)
nop
lw t9, -sym.imp.exit(gp)
nop
jalr t9
addiu a0, zero, 2
lui gp, 0x43
addiu sp, sp, -0x28
addiu gp, gp, -0x4c10
sw ra, 0x24(sp)
sw s1, 0x20(sp)
sw s0, 0x1c(sp)
sw gp, 0x10(sp)
lui s0, 0x42
lw a0, 0x374c(s0)
--
lwc1 f20, 0x28(sp)
cfc1 a0, 31
cfc1 a0, 31
nop
ori at, a0, 3
xori at, at, 2
ctc1 at, 31
nop
cvt.w.d f0, f2
ctc1 a0, 31
nop
swc1 f0, 4(s0)
lw s0, 0x20(sp)
lwc1 f21, 0x2c(sp)
jr ra
addiu sp, sp, 0x30
lui gp, 0x43
addiu sp, sp, -0x88
addiu gp, gp, -0x4c10
sw ra, 0x84(sp)
sw s3, 0x80(sp)
sw s2, 0x7c(sp)
sw s1, 0x78(sp)
sw s0, 0x74(sp)
sw gp, 0x18(sp)
lw t9, -sym.imp.snprintf(gp)
move s2, a0
addiu s0, sp, 0x20
move s1, a2
move s3, a3
move a2, a1
move a0, s0
addiu a1, zero, 0x50
jalr t9
move a3, s2
sltiu v0, v0, 0x50
lw gp, 0x18(sp)
beqz v0, 0x40b61c
addiu v0, zero, -1
lw t9, -sym.imp.access(gp)
move a0, s0
jalr t9
move a1, zero
lw gp, 0x18(sp)
bnez v0, 0x40b61c
addiu v0, zero, -1
--
beqz s1, 0x40b618
nop
lw t9, -sym.imp.__errno_location(gp)
nop
jalr t9
nop
lw gp, 0x18(sp)
lw a0, (v0)
lw t9, -sym.imp.strerror(gp)
nop
jalr t9
nop
lw gp, 0x18(sp)
lui a1, 0x41
lw t9, -sym.flog(gp)
sw s2, 0x10(sp)
sw v0, 0x14(sp)
addiu a1, a1, 0x259c
move a2, s1
move a3, s3
jalr t9
addiu a0, zero, 3
lw gp, 0x18(sp)
b 0x40b61c
addiu v0, zero, -1
lw t9, -sym.imp.fprintf(gp)
lui a1, 0x41
addiu a1, a1, 0x25c0
move a2, s3
jalr t9
move a0, v0
lw gp, 0x18(sp)
nop
lw t9, -sym.imp.fclose(gp)
nop
jalr t9
move a0, s0
lw gp, 0x18(sp)
b 0x40b61c
move v0, zero
addiu v0, zero, -1
lw ra, 0x84(sp)
lw s3, 0x80(sp)
lw s2, 0x7c(sp)
lw s1, 0x78(sp)
lw s0, 0x74(sp)
[*] Function printf used 21 times radvd
