[*] Binary protection state of sar
Full RELRO Canary found NX enabled PIE enabled No RPATH No RUNPATH No Symbols
[*] Function printf tear down of sar
lsl.w fp, r0, 6
ldr r2, [0x000029d4]
mov r7, r0
add sl, pc
str r1, [sp, 8]
add.w r3, sl, r3, lsl 3
ldrd r0, r1, [sl, 0x38]
add r2, pc
str r2, [sp, 0xc]
add.w r5, sl, 0x178
ldrd r2, r3, [r3, 8]
add.w r6, r5, fp
bl 0xf648
mov sb, r1
ldr r1, [0x000029d8]
movs r2, 0x40
mov r8, r0
mov r0, r6
add sl, fp
add r1, pc
blx sym.imp.__printf_chk
clz r3, r7
mov.w ip, 0
--
mov r7, r1
ldr r2, [0x00003d1c]
movs r1, 0
ldr r3, [0x00003d20]
mov r0, r5
add.w r8, sp, 0x1c
add r6, sp, 0x4c
add r2, pc
ldr r3, [r2, r3]
movs r2, 0x2c
ldr r3, [r3]
str r3, [sp, 0x24c]
mov.w r3, 0
blx 0x1808
ldrb r3, [r4]
cmp r3, 0
beq 0x3cdc
mov.w r2, 0x200
mov r1, r4
mov r0, r6
blx sym.imp.__printf_chk
movs r3, 0
mov r1, r7
--
movlo r0, 0
add r3, pc
it hs
movhs r0, 1
str r2, [r3]
ldr r2, [0x00003d2c]
ldr r3, [0x00003d20]
add r2, pc
ldr r3, [r2, r3]
ldr r2, [r3]
ldr r3, [sp, 0x24c]
eors r2, r3
mov.w r3, 0
bne 0x3d18
add.w sp, sp, 0x250
pop.w {r4, r5, r6, r7, r8, pc}
ldr r1, [0x00003d30]
mov.w r2, 0x200
mov r0, r6
add r1, pc
blx sym.imp.__printf_chk
b 0x3c62
ldr r0, [0x00003d34]
--
add r5, pc
ldr r1, [r5, r1]
mov r5, r2
ldr r1, [r1]
str r1, [sp, 0xc]
mov.w r1, 0
str r3, [r4]
cmp.w r8, 0
beq 0x42f8
mov r0, r8
blx 0x17b0
cmp r0, 5
mov r2, r0
beq 0x4340
cmp r0, 8
beq 0x432e
mov r3, sp
movs r2, 8
mov r0, r3
mov r1, r7
blx sym.imp.__printf_chk
mov r3, r0
movs r2, 0
mov r0, r3
mov r1, r5
strb.w r2, [sp, 8]
bl 0x4248
ldr r2, [0x00004374]
ldr r3, [0x00004370]
add r2, pc
ldr r3, [r2, r3]
ldr r2, [r3]
ldr r3, [sp, 0xc]
eors r2, r3
mov.w r3, 0
bne 0x4366
add sp, 0x10
pop.w {r4, r5, r6, r7, r8, pc}
mov r3, sp
adds r6, 2
mov r0, r3
mov r1, r8
str r6, [r4]
blx sym.imp.__printf_chk
mov r3, r0
b 0x4306
mov r3, sp
adds r6, 2
mov r1, r8
mov r0, r3
str r6, [r4]
blx sym.imp.__printf_chk
ldr r1, [0x00004378]
mov r3, r0
--
cmp r0, r3
beq 0x5bd4
ldr r1, [r3, 4]!
ldr r2, [r1]
cmp r2, 4
bne 0x5b5c
b 0x586e
ldr.w r3, [fp]
orr r3, r3, 4
str.w r3, [fp]
ldr.w r3, [r6, r4, lsl 2]
b 0x584a
adds r5, 1
b 0x5786
ldr r3, [0x00005d4c]
mov r1, r5
movw r2, 0x1ff
movs r5, 0
ldr.w r4, [r8, r3]
mov r0, r4
blx sym.imp.__printf_chk
mov r0, r4
strb.w r5, [r4, 0x1ff]
--
mov sl, r1
ldr r3, [0x0000799c]
movs r1, 0
add r2, pc
ldr r7, [0x000079a0]
add r4, sp, 4
mov fp, r0
ldr r3, [r2, r3]
add r0, sp, 8
mov.w r2, 0x1fc
ldr.w r8, [sp, 0x230]
add r7, pc
ldr r3, [r3]
str r3, [sp, 0x204]
mov.w r3, 0
str r1, [sp, 4]
blx 0x1808
ldr.w r1, [sl, 0x48]
movw r2, 0x1ff
mov r0, r4
blx sym.imp.__printf_chk
mov r0, r4
mov r1, r7
--
mov r4, r0
cmp r0, 0
beq 0xefae
ldr r1, [0x0000efd0]
mov r2, r8
adds r0, 5
add r1, pc
blx 0x17f8
cbz r0, 0xefb4
subs r4, r4, r6
subs r4, 6
subs r4, 0x10
bics r4, r4, 0x10
bne 0xefb4
ldr.w r8, [0x0000efd4]
mov r3, sp
movs r2, 0x10
adds r1, r6, 6
mov r0, r3
add r8, pc
blx sym.imp.__printf_chk
mov r2, r7
mov r1, r8
--
mov r0, fp
strb r5, [sl, -0x4]
blx sym.imp.write
cmp r0, 0
beq 0xf01e
ldrb r3, [r0]
cmp r3, 0
beq 0xf01e
ldr r1, [sp, 0x14]
mov.w r2, 0x1000
blx sym.imp.close
mov r5, r0
cmp r0, 0
bne 0xf01e
mov r1, r4
add.w r4, sp, 0x2000
adds r4, 0x28
mov.w r2, 0x100
subs r3, r4, 4
mov r0, r3
blx sym.imp.__printf_chk
ldrd r1, r2, [sp, 0x18]
strb.w r5, [r4, 0xffb]
--
blx sym.imp.puts
cbz r0, 0xf400
ldr r1, [0x0000f410]
add r1, pc
blx sym.imp.strcmp
cbnz r0, 0xf3fa
movs r3, 1
str r3, [r7]
ldr r2, [0x0000f414]
mov r3, r4
mov r1, r5
mov r0, r6
add r2, pc
blx 0x175c
movs r0, 1
pop {r3, r4, r5, r6, r7, pc}
ldr r1, [0x0000f418]
mov r0, r6
add r5, r6
add r1, pc
blx sym.imp.__printf_chk
mov r0, r4
strb r4, [r5, -0x1]
--
ldr r2, [r3]
ldr r3, [sp, 0xc]
eors r2, r3
mov.w r3, 0
bne 0xf588
add sp, 0x14
ldr pc, [sp], 4
mov.w r0, 0x5180
movt r0, 1
b 0xf564
blx 0x1684
ldr r1, [0x0000f660]
movs r1, r0
lsls r4, r1, 5
movs r0, r0
ldr r1, [0x0000f5c8]
movs r1, r0
push {r3, r4, r5, r6, r7, lr}
movs r1, 0
mov r4, r0
blx sym.imp.__snprintf_chk
cbz r0, 0xf5ec
ldr r1, [0x0000f5f0]
mov r6, r0
movs r2, 5
add r1, pc
blx sym.imp.close
adds r1, r6, 5
cbnz r0, 0xf5e8
ldr r7, [0x0000f5f4]
mov.w r2, 0x200
movs r5, 0x21
add r7, pc
addw r4, r7, 0x80c
mov r0, r4
blx sym.imp.__printf_chk
movs r3, 0
strb.w r3, [r7, 0xa0b]
--
add.w r1, sp, 0x1000
ldr r3, [0x0000f9bc]
adds r1, 4
add r2, pc
ldr r3, [r2, r3]
ldr r2, [r3]
ldr r3, [r1]
eors r2, r3
mov.w r3, 0
bne 0xf9b4
add.w sp, sp, 0x1000
add sp, 0xc
pop.w {r4, r5, r6, r7, r8, sb, pc}
movs r0, 0
b 0xf976
ldr r3, [0x0000f9cc]
mov.w r2, 0x1000
ldr r1, [r4]
add r3, pc
mov r0, r3
blx sym.imp.__printf_chk
strb.w sb, [r0, 0xfff]
b 0xf956
--
movs r3, 0x40
ldr r2, [0x0000fc8c]
mov r1, r3
vldr d16, [r5]
add r0, pc
strd r4, r6, [sp, 0x10]
add r2, pc
addw r0, r0, 0xd2c
str r2, [sp]
movs r2, 1
vstr d16, [sp, 8]
mov r4, r0
blx 0x1920
ldr r6, [0x0000fc90]
mov r1, r4
movs r2, 0x7f
movs r5, 0x2f
add r6, pc
add.w r4, r6, 0xd70
mov r0, r4
blx sym.imp.__printf_chk
movs r3, 0
strb.w r3, [r6, 0xdef]
--
add r5, pc
b 0x105dc
ldrb.w r3, [r8]
mov r1, r5
movs r0, 0
orr r3, r3, 1
strb.w r3, [r8]
blx 0x18a4
mov sb, r0
cmp r0, 0
beq 0x10674
mov r1, r4
mov r0, sb
blx sym.imp.strcmp
cmp r0, 0
beq 0x105c2
movs r2, 0xf
mov r1, sb
mov r0, r6
mov.w fp, 0
blx sym.imp.__printf_chk
movs r1, 0x2d
mov r0, r6
--
add r5, pc
mov r1, r5
ldr r3, [r3]
str r3, [sp, 0x1f4]
mov.w r3, 0
ldr.w r3, [0x00010c98]
add r4, pc
mov r0, r4
add r3, pc
str r3, [sp, 0x30]
blx sym.imp.fopen
str r0, [sp, 0x24]
cmp r0, 0
beq.w 0x10c6c
add r3, sp, 0xb4
mov r1, r4
movs r2, 0x3f
mov r0, r3
str r3, [sp, 0x28]
add r7, sp, 0xf4
blx sym.imp.__printf_chk
ldr.w r0, [0x00010c9c]
movs r1, 0
--
movs r1, 1
ldr r0, [r3]
add r2, pc
ldr r3, [sp, 0x28]
blx 0x1868
b 0x1084c
ldr r1, [sp, 0x30]
ldr r2, [0x00010cd4]
ldr r2, [r1, r2]
movs r1, 1
str r3, [sp]
ldr r3, [0x00010cf0]
ldr r0, [r2]
ldr r2, [0x00010cf4]
add r3, pc
add r2, pc
blx 0x1868
b 0x1084c
movs r2, 0x20
mov r1, r5
blx sym.imp.__printf_chk
ldr r3, [sp, 0x2c]
strb.w fp, [r5, 0x52]
--
cmp r3, 0x61
bne.w 0x1094c
ldr r3, [0x00010cf8]
ldr r2, [0x00010cfc]
add r3, pc
add r2, pc
str.w r2, [r5, 0xc4]
ldrh r2, [r3]
ldrb r3, [r3, 2]
strh.w r2, [r5, 0x53]
strb.w r3, [r5, 0x55]
b 0x10958
ldr.w r0, [ip, 0x10]
adds r0, 0x84
str r0, [r4, 0xc]
b 0x10a92
add.w r3, r5, 0x53
movs r2, 0xf
mov r0, r3
add.w r1, sp, 0x55
blx sym.imp.__printf_chk
mov r3, r0
mov r0, r3
ldr r3, [0x00010d00]
ldr r1, [0x00010d04]
movs r2, 0x10
add r3, pc
add r1, pc
str.w r3, [r5, 0xc4]
blx 0x17e0
b 0x10958
add.w r3, r5, 0x53
b 0x10bfa
ldr r3, [r4, 4]
movs r2, 0x20
mov r1, r5
add.w r0, r6, 0xc8
str.w r3, [r6, 0xec]
blx sym.imp.__printf_chk
movs r3, 1
strb.w r8, [r6, 0xe7]
--
add r5, r4
mov r0, r6
ldr.w r1, [r2, 0x80]
add.w r6, r2, 0x63
bl 0x1122c
mov r3, r6
str r1, [sp]
mov.w r2, -1
mov r0, r5
movs r1, 1
blx 0x17ec
mov r0, r4
add sp, 8
pop.w {r4, r5, r6, r7, r8, sb, sl, pc}
ldr r5, [0x00010e94]
add.w r1, r4, 0xc8
movs r2, 0x2f
add r5, pc
sub.w r4, r5, 0xe0
mov r0, r4
blx sym.imp.__printf_chk
movs r3, 0
strb r3, [r5, -0xb1]
--
ubfx r5, r3, 8, 0xc
uxtb r1, r3
lsrs r3, r3, 0xc
orr.w r3, r3, r2, lsl 20
and.w r2, r2, fp
orrs r2, r5
bic r3, r3, 0xff
orrs r3, r1
ldr r1, [sp, 0x14]
cmp r3, sl
it eq
cmpeq r2, r1
bne 0x10edc
ldr r6, [0x00010fc0]
mov r1, r4
mov r5, r0
movs r2, 0x7f
add r6, pc
sub.w r4, r6, 0xb0
mov r0, r4
blx sym.imp.__printf_chk
strb r5, [r6, -0x31]
b 0x10f56
[*] Function printf used 22 times sar
