[*] Binary protection state of doorcontrold
Full RELRO Canary found NX enabled PIE enabled No RPATH No RUNPATH No Symbols
[*] Function printf tear down of doorcontrold
mov r0, r4
bl 0xde74
movs r0, 0
pop.w {r4, r5, r6, r7, r8, pc}
movs r1, 5
mov r0, r4
bl 0xdc70
ldr r1, [0x00009cb8]
mov r2, r4
add r1, pc
blx 0x647c
b 0x9c7e
nop
lsrs r7, r7, 9
movs r0, r0
ldr r3, [0x00009d30]
push {r4, r5, r6, lr}
sub sp, 8
add r3, pc
ldr r0, [r3]
blx sym.imp.__fprintf_chk
cbz r0, 0x9d2a
mov r6, r0
--
push {r1, r2, r3, r4, r5, r6, r7}
movs r3, r0
stm r3!, {r2, r3, r4, r5, r7}
movs r1, r0
invalid
pop {r1, r3, r7}
movs r1, r0
push {r3, lr}
bl 0xbe48
bl 0x9cbc
pop.w {r3, lr}
b.w 0xbe60
nop
push {r4, r5, r6, lr}
sub sp, 8
cbz r0, 0x9da2
mov r6, r0
ldr r3, [0x00009dbc]
add r3, pc
ldr r0, [r3, 4]
blx sym.imp.__fprintf_chk
mov r4, r0
cbnz r0, 0x9d7a
--
bkpt 0x62
movs r1, r0
pop {r1, r2, r3}
movs r1, r0
stm r3!, {r5}
movs r1, r0
bkpt 0x3a
movs r1, r0
cbnz r6, 0x9e52
movs r1, r0
push.w {r4, r5, r6, r7, r8, sb, sl, fp, lr}
sub sp, 0xc
cmp r0, 0
beq 0x9e9c
mov r8, r0
mov sb, r1
ldr r3, [0x00009ed0]
mov sl, r2
add r3, pc
ldr r0, [r3, 4]
blx sym.imp.__fprintf_chk
mov r7, r0
cbz r0, 0x9e1e
--
movs r3, r0
cbnz r0, 0xa5e2
movs r1, r0
invalid
push {r2, r6}
movs r1, r0
ldr r0, [0x0000a650]
movs r2, 0
ldr r1, [0x0000a654]
ldr r3, [0x0000a658]
add r0, pc
push {r4, r5, r6, lr}
ldr r1, [r0, r1]
sub sp, 0x10
add r3, pc
ldr r0, [r3]
ldr r1, [r1]
str r1, [sp, 0xc]
mov.w r1, 0
str r2, [sp, 8]
blx sym.imp.__fprintf_chk
mov r6, r0
cmp r0, 0
--
nop
str r3, [sp, 0x200]
movs r3, r0
ldr r0, [0x0000be6c]
movs r3, 0
add r0, pc
str r3, [r0, 8]
b.w 0x6b3c
str r3, [sp, 0x1a0]
movs r3, r0
ldr r3, [0x0000bee8]
push {r4, r5, r6, r7, lr}
mov r6, r0
sub sp, 0xc
add r3, pc
cbz r0, 0xbede
ldr r2, [0x0000beec]
mov r7, r1
ldr r3, [r3, r2]
ldr r0, [r3]
blx sym.imp.__fprintf_chk
mov r4, r0
cbnz r0, 0xbe9c
--
mov r4, r0
ldr r2, [0x0000bf58]
sub sp, 8
add r3, pc
ldr r0, [r3, 8]
add r2, pc
cbnz r0, 0xbf2c
ldr r3, [0x0000bf5c]
movw r2, 0x14f
ldr r4, [0x0000bf60]
ldr r1, [0x0000bf64]
add r3, pc
add r4, pc
add.w r3, r3, 0x1ec
add r1, pc
str r4, [sp]
blx 0x6ec0
ldr r3, [0x0000bf68]
ldr r3, [r2, r3]
ldr r0, [r3]
blx sym.imp.__fprintf_chk
mov r3, r0
cbnz r0, 0xbf40
--
adds r3, 0xa0
add r1, pc
str r4, [sp]
blx 0x6ec0
nop
strh r4, [r0, 0x2a]
movs r1, r0
strh r6, [r5, 0x28]
movs r1, r0
strh r6, [r7, 0x22]
movs r1, r0
push.w {r3, r4, r5, r6, r7, r8, sb, lr}
mov sb, r0
ldr r3, [0x0000f2c4]
ldr r2, [0x0000f2c8]
add r3, pc
ldr r6, [r0, 0x78]
ldr.w r7, [r0, 0x80]
ldr r3, [r3, r2]
ldr r0, [r3]
blx sym.imp.__fprintf_chk
mov r4, r0
cmp r0, 0
--
cmp r0, 0
bne 0xf252
mov r0, r5
bl 0xda94
mov r1, r0
mov r0, r8
blx sym.imp.exit
ldr r4, [r4, 4]
mov r8, r0
cmp r4, 0
bne 0xf256
mov r0, r8
add.w sb, sb, 0x58
blx 0x65d4
lsls r1, r0, 2
str r0, [r7]
mov r0, sb
blx sym.imp.nb_malloc
str r0, [r7, 4]
mov r0, r8
blx sym.imp.__fprintf_chk
mov r4, r0
cbz r0, 0xf2b4
--
bl 0x20df8
mov r1, r4
mov r2, r6
mov r0, r5
bl 0x1bfd8
mov r0, r4
movw r1, 0x2710
pop.w {r4, r5, r6, lr}
b.w sym.imp.strstr
push {r4, r5, r6, r7, lr}
sub sp, 0xc
ldr r4, [0x0000fcb8]
mov r7, r2
mov r6, r3
bl 0xbe48
ldr r2, [0x0000fcbc]
add r4, pc
mov r3, r4
ldr r3, [r4, r2]
ldr r0, [r3]
blx sym.imp.__fprintf_chk
cbz r0, 0xfcae
mov r4, r0
--
movs r1, r0
ldrh r2, [r7, 0x1a]
movs r1, r0
str r1, [sp, 0xc8]
movs r1, r0
ldrh r0, [r1, 0x1c]
movs r1, r0
ldrh r0, [r4, 0x1a]
movs r1, r0
push {r4, r5, r6, r7, lr}
sub sp, 0xc
ldr r4, [0x0000feac]
mov r6, r1
ldr r7, [sp, 0x20]
bl 0xbe48
ldr r2, [0x0000feb0]
add r4, pc
mov r3, r4
ldr r3, [r4, r2]
ldr r0, [r3]
blx sym.imp.__fprintf_chk
cbz r0, 0xfea0
mov r4, r0
--
ldrh r6, [r0, 8]
movs r1, r0
push.w {r4, r5, r6, r7, r8, lr}
sub sp, 8
ldr r5, [sp, 0x24]
ldr.w r8, [0x000101b0]
add r8, pc
cbz r5, 0x10194
mov r4, r0
mov r7, r3
mov r6, r2
bl 0xbe48
ldr.w r2, [r4, 0x90]
movs r0, 8
ldr r1, [r5, 8]
ubfx r2, r2, 3, 1
bl 0x89b4
ldr r3, [0x000101b4]
ldr.w r3, [r8, r3]
ldr r0, [r3]
blx sym.imp.__fprintf_chk
mov r4, r0
cbnz r0, 0x10170
--
ldrh r4, [r6, 0x22]
movs r1, r0
strh r2, [r3, 0x3c]
movs r1, r0
strh r2, [r4, 0x34]
movs r1, r0
ldr r7, [0x000105dc]
movs r1, r0
strh r6, [r1, 0x3a]
movs r1, r0
push {r3, r4, r5, r6, r7, lr}
mov r7, r2
ldr r4, [0x00010398]
mov r6, r3
bl 0xbe48
ldr r2, [0x0001039c]
add r4, pc
mov r3, r4
ldr r3, [r4, r2]
ldr r0, [r3]
blx sym.imp.__fprintf_chk
cbz r0, 0x1038e
mov r4, r0
--
mov r0, r5
bl 0xf86c
pop.w {r3, r4, r5, r6, r7, lr}
b.w 0xbe60
nop
adds r7, 0x5e
movs r3, r0
lsls r0, r4, 0x13
movs r0, r0
push.w {r4, r5, r6, r7, r8, sb, sl, lr}
sub sp, 8
ldr r4, [0x00010480]
mov r7, r1
ldr.w sb, [sp, 0x28]
bl 0xbe48
ldr r2, [0x00010484]
add r4, pc
mov r3, r4
ldr r3, [r4, r2]
ldr r0, [r3]
blx sym.imp.__fprintf_chk
cmp r0, 0
beq 0x10476
--
movs r3, r0
lsls r0, r4, 0x13
movs r0, r0
ldrh r6, [r7, 0x18]
movs r1, r0
str r4, [r3, r3]
movs r1, r0
strh r2, [r5, 0x2a]
movs r1, r0
push {r4, r5, r6, r7, lr}
sub sp, 0xc
ldr r4, [0x00010504]
mov r7, r2
mov r6, r3
bl 0xbe48
ldr r2, [0x00010508]
add r4, pc
mov r3, r4
ldr r3, [r4, r2]
ldr r0, [r3]
blx sym.imp.__fprintf_chk
cbz r0, 0x104fa
mov r4, r0
--
beq.w 0x1140c
mov r0, r4
ldr r4, [0x00011448]
add r4, pc
mov r1, r4
blx 0x704c
cmp r0, 0
beq 0x113de
mov r1, r4
mov r0, r6
blx 0x704c
cmp r0, 0
ite ne
movne sl, 1
mov.w sl, 2
cmp sl, r7
beq 0x113b4
ldr r3, [0x0001144c]
ldr r3, [r5, r3]
ldr r0, [r3]
blx sym.imp.__fprintf_chk
str r0, [sp, 0x10]
cmp r0, 0
--
cmp r3, sb
bhi 0x136a2
cmp r4, 0
beq 0x13788
movs r2, 0
add r3, sp, 0x2c
str r3, [sp]
add.w sb, sp, 0x48
strd r2, r2, [sp, 0x2c]
movs r1, 4
strd r2, r2, [sp, 0x34]
mov r0, sb
strd r2, r2, [sp, 0x3c]
str r2, [sp, 0x44]
ldr r3, [0x000139ac]
ldr r2, [0x000139b0]
add r3, pc
add r2, pc
bl 0xf1c4
mov r0, r4
blx sym.imp.__fprintf_chk
mov r5, r0
cbz r0, 0x13788
--
str r4, [r5, 0x6c]
movs r1, r0
str r2, [r1, 0x60]
movs r1, r0
ldr r2, [0x00013b2c]
ldr r3, [0x00013b30]
push.w {r4, r5, r6, r7, r8, sb, sl, fp, lr}
sub sp, 0x24
add r2, pc
mov sb, r1
mov r4, r0
ldr r3, [r2, r3]
ldr r3, [r3]
str r3, [sp, 0x1c]
mov.w r3, 0
bl 0x11788
str r0, [sp, 0x14]
bl 0x117c8
blx 0x6728
mov r0, r4
blx sym.imp.__fprintf_chk
cmp r0, 0
beq 0x13afe
--
ldr r2, [r2]
str r2, [sp, 0x24]
mov.w r2, 0
str r3, [sp, 0x14]
ldr r3, [r5]
cbz r3, 0x15b36
ldr r3, [r3]
cmp r3, 0
ble 0x15bc8
cmp.w r3, 0x3e8
ble 0x15b3a
add r3, sp, 0x14
str r3, [r5]
ldr r0, [r5, 4]
cbz r0, 0x15b7a
add r7, sp, 0x18
movs r3, 0
movs r2, 0xa
mov r1, r7
str r3, [sp, 0x18]
blx sym.imp.g_printf
mov r2, r0
mov r3, r1
--
ldr r2, [r2]
str r2, [sp, 0x24]
mov.w r2, 0
str r3, [sp, 0x14]
ldr r3, [r5]
cbz r3, 0x15cae
ldr r3, [r3]
cmp r3, 0
ble 0x15d40
cmp.w r3, 0x3e8
ble 0x15cb2
add r3, sp, 0x14
str r3, [r5]
ldr r0, [r5, 4]
cbz r0, 0x15cf2
add r7, sp, 0x18
movs r3, 0
movs r2, 0xa
mov r1, r7
str r3, [sp, 0x18]
blx sym.imp.g_printf
mov r2, r0
mov r3, r1
--
ldr r2, [r2]
str r2, [sp, 0x24]
mov.w r2, 0
str r3, [sp, 0x14]
ldr r3, [r5]
cbz r3, 0x15e66
ldr r3, [r3]
cmp r3, 0
ble 0x15ef8
cmp.w r3, 0x3e8
ble 0x15e6a
add r3, sp, 0x14
str r3, [r5]
ldr r0, [r5, 4]
cbz r0, 0x15eaa
add r7, sp, 0x18
movs r3, 0
movs r2, 0xa
mov r1, r7
str r3, [sp, 0x18]
blx sym.imp.g_printf
mov r2, r0
mov r3, r1
--
ldr r2, [r2]
str r2, [sp, 0x24]
mov.w r2, 0
str r3, [sp, 0x14]
ldr r3, [r5]
cbz r3, 0x1641e
ldr r3, [r3]
cmp r3, 0
ble 0x164b0
cmp.w r3, 0x3e8
ble 0x16422
add r3, sp, 0x14
str r3, [r5]
ldr r0, [r5, 4]
cbz r0, 0x16462
add r7, sp, 0x18
movs r3, 0
movs r2, 0xa
mov r1, r7
str r3, [sp, 0x18]
blx sym.imp.g_printf
mov r2, r0
mov r3, r1
--
ldr r2, [r2]
str r2, [sp, 0x24]
mov.w r2, 0
str r3, [sp, 0x14]
ldr r3, [r5]
cbz r3, 0x166fa
ldr r3, [r3]
cmp r3, 0
ble 0x1678c
cmp.w r3, 0x3e8
ble 0x166fe
add r3, sp, 0x14
str r3, [r5]
ldr r0, [r5, 4]
cbz r0, 0x1673e
add r7, sp, 0x18
movs r3, 0
movs r2, 0xa
mov r1, r7
str r3, [sp, 0x18]
blx sym.imp.g_printf
mov r2, r0
mov r3, r1
[*] Function printf used 22 times doorcontrold
