[*] Binary protection state of httpd
Full RELRO Canary found NX enabled PIE enabled No RPATH No RUNPATH No Symbols
[*] Function sprintf tear down of httpd
bl sym.ap_cstr_casecmp
cmp r0, 0
bne 0x2ac84
ldr r3, [r5, 0xc]
orr r2, r3, 2
str r2, [r5, 0xc]
cmp r4, 0
beq 0x2ac9c
ldr r7, [0x0002ada4]
movs r6, 1
add.w r8, sp, 0x28
add r7, pc
b 0x2abba
ldrb r2, [r5, 0x10]
movs r6, 0
orrs r3, r2
strb r3, [r5, 0x10]
mov r2, r8
mov r1, r7
mov r0, r4
blx sym.imp.apr_psprintf
mov sl, r0
cmp r0, 0
--
add r2, pc
sub sp, 0xc
mov sb, r1
movs r1, 0xa
ldr r3, [r2, r3]
ldr r0, [r0]
ldr r3, [r3]
str r3, [sp, 4]
mov.w r3, 0
blx sym.imp.apr_file_open_stderr
ldr.w r1, [r4, 0xf4]
mov r5, r0
ldr r0, [r4]
blx sym.imp.apr_file_read_full
cbz r0, 0x3a704
ldr r6, [0x0003a730]
mov r7, sp
mov r2, r7
add r6, pc
mov r1, r6
blx sym.imp.apr_psprintf
mov fp, r0
cbz r0, 0x3a704
ldr.w sl, [0x0003a734]
mov.w r8, 0
add sl, pc
b 0x3a6f2
strb r8, [r4], 1
mov r0, fp
bl sym.ap_unescape_url
mov r0, r4
bl sym.ap_unescape_url
mov r1, fp
mov r2, r4
mov r0, r5
blx 0x18890
mov r2, r7
mov r1, r6
movs r0, 0
blx sym.imp.apr_psprintf
mov fp, r0
cbz r0, 0x3a704
--
mov.w r2, 0
blx sym.imp.apr_file_read_full
ldrd r3, r1, [r6]
mov r4, r0
ldr r0, [r3]
cmp r1, 0
beq.w 0x3e73c
ldr r2, [0x0003e750]
movs r3, 0
add r2, pc
blx sym.imp.apr_threadattr_create
str r0, [sp, 0x14]
blx sym.imp.apr_hash_count
ldr r1, [0x0003e754]
add r3, sp, 0x34
mov fp, r0
mov r2, r3
mov r0, r4
str r3, [sp, 0x24]
add r1, pc
blx sym.imp.apr_psprintf
cmp r0, 0
beq 0x3e6f6
ldr r3, [0x0003e758]
add.w sl, sp, 0x38
ldr r7, [0x0003e75c]
ldr.w r8, [0x0003e760]
add r3, pc
str r3, [sp, 0x20]
add r7, pc
ldr r3, [0x0003e764]
add r8, pc
add r3, pc
str r3, [sp, 0x28]
movs r3, 0
str r3, [sp, 0x10]
strd r8, r3, [sp, 0x18]
ldr r1, [sp, 0x20]
mov r2, sl
blx sym.imp.apr_psprintf
mov sb, r0
cbz r0, 0x3e6d8
--
bne 0x3e712
ldr r0, [r6, 8]
add r5, fp
cbz r0, 0x3e6b6
mov r1, r5
blx 0x18a28
cbz r0, 0x3e6b6
movs r3, 1
str r3, [r6, 0x10]
ldr r3, [r6]
mov r1, r5
ldr r0, [r3]
blx sym.imp.apr_file_read_full
movs r3, 1
str r0, [r6, 8]
str r3, [sp, 0x10]
mov r2, sl
mov r1, r7
movs r0, 0
mov r8, r7
blx sym.imp.apr_psprintf
mov sb, r0
cmp r0, 0
bne 0x3e682
ldrd r2, r8, [sp, 0x24]
movs r0, 0
mov r1, r8
blx sym.imp.apr_psprintf
cmp r0, 0
bne 0x3e670
--
beq 0x41a5c
ldr r4, [r0, 0x10]
cbnz r4, 0x41970
b 0x41a90
ldr r4, [r4, 0xc]
cmp r4, 0
beq 0x41a56
ldr r3, [r4, 8]
mov r1, r6
ldr r0, [r3]
blx sym.imp.getgrnam
cmp r0, 0
bne 0x4196a
mov r1, r5
ldr r0, [r7, 0x2c]
blx sym.imp.apr_file_read_full
ldr r1, [0x00041aa4]
add r7, sp, 8
mov r2, r7
add r1, pc
blx sym.imp.apr_psprintf
mov sl, r0
mov r5, r0
cmp r0, 0
beq 0x41a16
ldr.w sb, [0x00041aa8]
movs r5, 0
ldr.w r8, [0x00041aac]
ldr.w fp, [0x00041ab0]
add sb, pc
add r8, pc
add fp, pc
b 0x419c4
bic r5, r5, 3
ldr r1, [0x00041ab4]
mov r2, r7
movs r0, 0
add r1, pc
blx sym.imp.apr_psprintf
mov sl, r0
cbz r0, 0x41a12
--
ldr r1, [0x00041ac8]
mov r0, sl
add r1, pc
blx sym.imp.getgrnam
cmp r0, 0
bne 0x419b4
orr r5, r5, 0x10
b 0x419b4
ldr r0, [0x00041acc]
add r0, pc
b 0x41a1c
mov r1, r6
ldr r0, [r7, 0x2c]
blx sym.imp.apr_file_read_full
ldr r1, [0x00041ad0]
add r7, sp, 8
mov r2, r7
mov r4, r5
mov r6, r5
add r1, pc
blx sym.imp.apr_psprintf
mov sl, r0
mov r5, r0
--
ldr r0, [r0, 0x2c]
blx sym.imp.apr_file_read_full
mov r1, sb
mov r6, r0
ldr r0, [r7, 0x28]
add.w r4, r4, 0x40000000
blx sym.imp.apr_atomic_dec32
sub.w r2, sb, 4
mov r1, r5
str r0, [sp, 8]
mov r5, r0
blx sym.imp.apr_os_global_mutex_get
ldr r1, [0x00041dbc]
subs r4, 1
movs r2, 0
add.w sb, sp, 0x10
str.w r2, [r5, r4, lsl 2]
mov r0, r6
add r1, pc
mov r2, sb
blx sym.imp.apr_psprintf
mov r4, r0
cmp r0, 0
beq 0x41d9e
ldr r3, [0x00041dc0]
ldr.w fp, [0x00041dc4]
add r3, pc
add fp, pc
str r3, [sp, 0xc]
b 0x41d36
ldr r4, [sp, 8]
mov r2, r5
mov r1, r8
mov r0, r7
str r4, [sp, 4]
movs r4, 0
str r4, [sp]
bl 0x41b84
mov sl, r0
mov r2, sb
ldr r1, [sp, 0xc]
movs r0, 0
blx sym.imp.apr_psprintf
subs r2, r0, 0
mov r4, r0
--
add sl, pc
ldr r1, [0x00041dcc]
ldr r2, [0x00041db8]
add r1, pc
ldr r2, [r1, r2]
ldr r1, [r2]
ldr r2, [sp, 0x14]
eors r1, r2
mov.w r2, 0
bne 0x41da2
mov r0, sl
add sp, 0x1c
pop.w {r4, r5, r6, r7, r8, sb, sl, fp, pc}
mov sl, r0
b 0x41d82
blx sym.imp.apr_sha1_init
ldr r1, [0x00041dd0]
mov r2, sb
mov r0, r6
add r1, pc
blx sym.imp.apr_psprintf
b 0x41d82
add r4, sp, 0x248
[*] Function sprintf used 13 times httpd
