[*] Binary protection state of libupnp.so.17.1.8
Full RELRO Canary found NX enabled DSO No RPATH No RUNPATH No Symbols
[*] Function strcpy tear down of libupnp.so.17.1.8
ldr.w r2, [0x0000c518]
add r3, pc
add.w fp, sp, 0x18
str r3, [sp, 4]
mov r8, r1
ldr.w r3, [0x0000c51c]
add r2, pc
mov r6, r0
ldr r3, [r2, r3]
ldr r3, [r3]
str.w r3, [sp, 0x5fc]
mov.w r3, 0
movs r3, 0
str.w r3, [fp]
blx 0x88fc
ldr.w r3, [0x0000c520]
mov r5, r0
ldr r2, [sp, 4]
ldr.w sb, [r2, r3]
mov r0, sb
blx sym.imp.strcpy
add r3, sp, 0x14
mov r1, fp
--
ldr r3, [r2, r3]
movs r2, 0x64
add sl, pc
ldr r3, [r3]
str r3, [sp, 0x17c]
mov.w r3, 0
str r4, [sp, 0x44]
blx 0x9144
movs r2, 0x64
mov r1, r4
add r0, sp, 0xb4
blx 0x9144
movs r2, 0x64
mov r1, r4
add r0, sp, section..gnu.hash
blx 0x9144
ldr r3, [0x0000cfbc]
ldr.w r3, [sl, r3]
mov r0, r3
str r3, [sp, 0x34]
blx sym.imp.strcpy
mov r1, r7
mov r0, r8
--
str r3, [sp, 0x84]
mov.w r3, 0
str r7, [sp, 0x4c]
blx sym.imp.__vfprintf_chk
mov r4, r0
cbnz r0, 0xd6ec
mov.w r6, 0x1f4
b 0xd7b0
ldrd r8, r3, [r5, 0x18]
add.w sb, sp, 0x64
ldrh.w r1, [fp, 4]
add r6, sp, 0x74
ldrb.w r2, [r8, r3]
strb.w r7, [r8, r3]
ldr.w r3, [0x0000dd60]
str r2, [sp, 0x30]
ldr r2, [sp, 0x34]
str r1, [sp, 0x3c]
ldr.w sl, [r2, r3]
mov r0, sl
blx sym.imp.strcpy
add r3, sp, 0x6c
mov r0, r8
--
blx 0x8f90
mov r8, r0
blx 0x8f90
add r3, sp, 0x34
movs r2, 0x2c
movs r1, 0
mov r5, r0
mov r0, r3
str r3, [sp, 0x10]
blx 0x9144
movs r2, 0x2c
movs r1, 0
mov r0, sl
blx 0x9144
mov r0, r7
blx 0x8a60
ldr r3, [0x00016ab4]
ldr.w r3, [sb, r3]
mov r0, r3
str r3, [sp, 0xc]
blx sym.imp.strcpy
add r3, sp, 0x20
mov r0, r6
--
blx 0x8dec
add r2, sp, 8
mov r1, r0
mov r0, r5
bl 0x16ac4
mov r1, r0
mov r5, r0
mov r0, r6
blx 0x8b00
ldr r1, [sp, 8]
mov r0, r6
blx 0x8d74
cbz r5, 0x16ca6
cmn.w r5, 0x6d
beq 0x16ca6
adds r5, 0x64
beq 0x16ca6
ldr r3, [0x00016cec]
ldr r5, [r7, r3]
mov r0, r5
blx sym.imp.strcpy
ldr r0, [r4]
add r1, sp, 4
--
mov r7, r0
mov r6, r1
ldr r3, [0x00019964]
add r2, pc
ldr r4, [0x00019968]
ldr r3, [r2, r3]
add r4, pc
ldr r3, [r3]
str r3, [sp, 4]
mov.w r3, 0
movs r3, 0
str r3, [sp]
ldr r3, [0x0001996c]
ldr r3, [r4, r3]
ldr r3, [r3]
cmp r3, 1
bne 0x19952
ldr r3, [0x00019970]
ldr r5, [r4, r3]
mov r0, r5
blx sym.imp.strcpy
mov r1, sp
mov r0, r7
--
mov sb, r1
mov r0, r6
ldr r3, [r2, r3]
movs r1, 0
movs r2, 0x1c
ldr.w fp, [sp, 0x50]
add r5, pc
ldr r3, [r3]
str r3, [sp, 0x24]
mov.w r3, 0
str r1, [sp, 4]
blx 0x9144
ldr r3, [0x00019bc8]
ldr r3, [r5, r3]
ldr r3, [r3]
cmp r3, 1
bne 0x19baa
ldr r3, [0x00019bcc]
ldr r4, [r5, r3]
mov r0, r4
blx sym.imp.strcpy
add r1, sp, 4
mov r0, sl
--
blx 0x8b7c
cmp.w r8, 0
bne 0x19c54
mvn r4, 0x64
b 0x19c24
mov r1, r8
mov r0, r6
blx 0x9730
cmp r5, 0
beq 0x19c20
cmp r7, 0
beq 0x19c4e
mov r1, r7
mov r0, r5
blx 0x9730
cmp.w sb, 0
beq 0x19c4e
ldr r3, [0x00019cec]
ldr.w sl, [sl, r3]
mov r0, sl
blx sym.imp.strcpy
mov r1, sp
mov r0, r4
--
add r7, pc
ldr r3, [r3]
str r3, [sp, 4]
mov.w r3, 0
movs r3, 0
str r3, [sp]
blx 0x8f90
ldr r3, [0x00019d9c]
mov r5, r0
ldr r3, [r7, r3]
ldr r3, [r3]
cmp r3, 1
bne 0x19d76
cbz r0, 0x19d7c
cbz r6, 0x19d82
mov r1, r6
blx 0x9730
ldr r3, [0x00019da0]
ldr r6, [r7, r3]
mov r0, r6
blx sym.imp.strcpy
mov r1, sp
mov r0, r4
--
ldr r3, [r2, r3]
movs r2, 0x1c
add r5, pc
ldr r3, [r3]
str r3, [sp, 0x2c]
mov.w r3, 0
str r1, [sp, 0xc]
blx 0x9144
ldr r3, [0x00019ebc]
ldr r3, [r5, r3]
ldr.w sl, [r3]
cmp.w sl, 1
bne 0x19e96
cmp.w r8, 0
beq 0x19e9c
cmp r7, 0
beq 0x19e9c
ldr r3, [0x00019ec0]
ldr.w fp, [r5, r3]
mov r0, fp
blx sym.imp.strcpy
add r1, sp, 0xc
mov r0, sb
--
mvn r4, 0x64
mov r0, r5
blx 0x88b4
ldr r2, [0x00019f94]
ldr r3, [0x00019f88]
add r2, pc
ldr r3, [r2, r3]
ldr r2, [r3]
ldr r3, [sp, 4]
eors r2, r3
mov.w r3, 0
beq 0x19f7c
blx 0x8b7c
mov r1, r7
blx 0x9730
cmp r6, 0
beq 0x19f0e
ldr r3, [0x00019f98]
ldr.w r7, [r8, r3]
mov r0, r7
blx sym.imp.strcpy
mov r1, sp
mov r0, r4
--
mov r7, r1
mov r0, r6
ldr r3, [r2, r3]
movs r1, 0
movs r2, 0x1c
ldr.w fp, [sp, 0x50]
add r5, pc
ldr r3, [r3]
str r3, [sp, 0x24]
mov.w r3, 0
str r1, [sp, 4]
blx 0x9144
ldr r3, [0x0001a0c0]
ldr r3, [r5, r3]
ldr r3, [r3]
cmp r3, 1
bne 0x1a0a0
ldr r3, [0x0001a0c4]
ldr r4, [r5, r3]
mov r0, r4
blx sym.imp.strcpy
add r1, sp, 4
mov r0, sl
--
mov r4, r0
ldr r2, [0x0001a190]
add r1, pc
ldr r3, [0x0001a194]
ldrd sb, sl, [sp, 0x30]
ldr r2, [r1, r2]
add r3, pc
ldr r2, [r2]
str r2, [sp, 0xc]
mov.w r2, 0
movs r2, 0
str r2, [sp, 8]
ldr r2, [0x0001a198]
ldr r2, [r3, r2]
ldr r2, [r2]
cmp r2, 1
bne 0x1a17e
ldr r2, [0x0001a19c]
ldr.w r8, [r3, r2]
mov r0, r8
blx sym.imp.strcpy
add r1, sp, 8
mov r0, r4
--
mov r8, r3
mov r4, r0
ldr r2, [0x0001a23c]
add r1, pc
ldr r3, [0x0001a240]
ldr r2, [r1, r2]
add r3, pc
ldr r2, [r2]
str r2, [sp, 4]
mov.w r2, 0
movs r2, 0
str r2, [sp]
ldr r2, [0x0001a244]
ldr r2, [r3, r2]
ldr r2, [r2]
cmp r2, 1
bne 0x1a22c
ldr r2, [0x0001a248]
ldr r7, [r3, r2]
mov r0, r7
blx sym.imp.strcpy
mov r1, sp
mov r0, r4
--
mov r4, r0
add r1, pc
ldr r3, [0x0001a30c]
ldr.w sl, [sp, 0x38]
ldr r2, [r1, r2]
add r3, pc
ldr.w sb, [sp, 0x40]
ldr r2, [r2]
str r2, [sp, 0x14]
mov.w r2, 0
movs r2, 0
str r2, [sp, 0x10]
ldr r2, [0x0001a310]
ldr r2, [r3, r2]
ldr r2, [r2]
cmp r2, 1
bne 0x1a2f6
ldr r2, [0x0001a314]
ldr r7, [r3, r2]
mov r0, r7
blx sym.imp.strcpy
add r1, sp, 0x10
mov r0, r4
--
ldr r2, [0x0001a3c8]
mov r4, r0
add r1, pc
ldr r3, [0x0001a3cc]
ldr.w sb, [sp, 0x30]
ldr r2, [r1, r2]
add r3, pc
ldr r2, [r2]
str r2, [sp, 0xc]
mov.w r2, 0
movs r2, 0
str r2, [sp, 8]
ldr r2, [0x0001a3d0]
ldr r2, [r3, r2]
ldr r2, [r2]
cmp r2, 1
bne 0x1a3b8
ldr r2, [0x0001a3d4]
ldr r7, [r3, r2]
mov r0, r7
blx sym.imp.strcpy
add r1, sp, 8
mov r0, r4
--
mov r7, r0
ldr r3, [0x0001a47c]
add r2, pc
ldr r1, [0x0001a480]
ldrd r8, sb, [sp, 0x28]
ldr r3, [r2, r3]
add r1, pc
ldr r3, [r3]
str r3, [sp, 4]
mov.w r3, 0
movs r3, 0
str r3, [sp]
ldr r3, [0x0001a484]
ldr r3, [r1, r3]
ldr r3, [r3]
cmp r3, 1
bne 0x1a466
ldr r3, [0x0001a488]
ldr r6, [r1, r3]
mov r0, r6
blx sym.imp.strcpy
mov r1, sp
mov r0, r7
--
ldr r7, [r7]
cmp r7, 1
bne 0x1a538
cmp.w sl, 0
bne 0x1a4f2
strd r6, r8, [sp]
blx 0x8738
ldr r2, [0x0001a55c]
ldr r3, [0x0001a550]
add r2, pc
ldr r3, [r2, r3]
ldr r2, [r3]
ldr r3, [sp, 0xc]
eors r2, r3
mov.w r3, 0
beq 0x1a544
blx 0x8b7c
ldr r3, [0x0001a560]
ldr.w r7, [ip, r3]
mov r0, r7
blx sym.imp.strcpy
add r1, sp, 8
mov r0, sb
--
ldr r6, [0x0001a6d0]
mov r0, r5
str r3, [sp, 4]
ldr r3, [0x0001a6d4]
add r6, pc
ldr r3, [r2, r3]
movs r2, 0x1c
ldr r3, [r3]
str r3, [sp, 0x2c]
mov.w r3, 0
str r1, [sp, 0xc]
blx 0x9144
ldr r3, [0x0001a6d8]
ldr r3, [r6, r3]
ldr r3, [r3]
cmp r3, 1
bne.w 0x1a6ba
ldr r3, [0x0001a6dc]
ldr.w fp, [r6, r3]
mov r0, fp
blx sym.imp.strcpy
add r1, sp, 0xc
mov r0, sb
--
mov r1, sb
mov r0, sl
str r3, [sp, 8]
ldr r3, [sp, 0x14]
strd r4, r3, [sp]
mov r3, fp
blx 0x9614
ldr r2, [0x0001a8c8]
ldr r3, [0x0001a8c0]
add r2, pc
ldr r3, [r2, r3]
ldr r2, [r3]
ldr r3, [sp, 0x44]
eors r2, r3
mov.w r3, 0
beq.w 0x1a8b2
blx 0x8b7c
ldr r3, [0x0001a8cc]
ldr.w fp, [r7, r3]
mov r0, fp
blx sym.imp.strcpy
add r1, sp, 0x24
mov r0, sl
--
mov r0, r6
str r3, [sp, 4]
ldr r3, [0x0001aa08]
add r2, pc
add r5, pc
ldr r3, [r2, r3]
movs r2, 0x1c
ldr r3, [r3]
str r3, [sp, 0x2c]
mov.w r3, 0
str r1, [sp, 0xc]
blx 0x9144
ldr r3, [0x0001aa0c]
ldr r3, [r5, r3]
ldr.w fp, [r3]
cmp.w fp, 1
bne 0x1a9e6
ldr r3, [0x0001aa10]
ldr r7, [r5, r3]
mov r0, r7
blx sym.imp.strcpy
add r1, sp, 0xc
mov r0, sl
--
mov r4, r3
mov r8, r0
ldr r2, [0x0001aabc]
add r1, pc
ldr r3, [0x0001aac0]
ldr r2, [r1, r2]
add r3, pc
ldr r2, [r2]
str r2, [sp, 0xc]
mov.w r2, 0
movs r2, 0
str r2, [sp, 4]
ldr r2, [0x0001aac4]
ldr r2, [r3, r2]
ldr r2, [r2]
cmp r2, 1
bne 0x1aaa4
ldr r2, [0x0001aac8]
ldr r7, [r3, r2]
mov r0, r7
blx sym.imp.strcpy
add r1, sp, 4
mov r0, r8
[*] Function strcpy used 22 times libupnp.so.17.1.8
