[*] Binary protection state of ubinfo
Full RELRO Canary found NX enabled PIE enabled No RPATH No RUNPATH No Symbols
[*] Function printf tear down of ubinfo
ldr r4, [0x00001538]
mov r7, r1
mov r6, r2
ldr r3, [0x0000153c]
add r4, pc
ldr r5, [0x00001540]
ldr r3, [r4, r3]
add r5, pc
ldr r3, [r3]
str r3, [sp, 0xcc]
mov.w r3, 0
add r3, sp, 0x10
bl 0x3a94
cmp r0, 0
bne 0x14ec
ldr r1, [0x00001544]
mov r4, r0
ldrd r3, r2, [sp, 0x10]
movs r0, 1
add r1, pc
blx sym.imp.__fprintf_chk
ldr r3, [sp, 0x20]
cmp r3, 3
beq 0x14ca
ldr r2, [0x00001548]
add r2, pc
ldr r1, [0x0000154c]
movs r0, 1
add r1, pc
blx sym.imp.__fprintf_chk
ldr r1, [0x00001550]
movs r0, 1
ldr r2, [sp, 0x24]
add r1, pc
blx sym.imp.__fprintf_chk
ldr r1, [0x00001554]
movs r0, 1
ldr r2, [sp, 0x38]
add r1, pc
blx sym.imp.__fprintf_chk
ldrd r0, r1, [sp, 0x30]
movs r2, 0
bl 0x1a90
ldr r0, [0x00001558]
add r0, pc
blx 0xa54
ldr r3, [sp, 0x20]
cmp r3, 4
beq 0x14d0
ldr r3, [sp, 0x40]
cbnz r3, 0x14c4
ldr r2, [0x0000155c]
add r2, pc
ldr r1, [0x00001560]
movs r0, 1
add r1, pc
blx sym.imp.__fprintf_chk
ldr r1, [0x00001564]
add r2, sp, 0x44
movs r0, 1
add r1, pc
blx sym.imp.__fprintf_chk
ldr r1, [0x00001568]
movs r0, 1
ldrd r2, r3, [sp, 0x18]
add r1, pc
blx sym.imp.__fprintf_chk
ldr r2, [0x0000156c]
ldr r3, [0x0000153c]
add r2, pc
ldr r3, [r2, r3]
ldr r2, [r3]
ldr r3, [sp, 0xcc]
eors r2, r3
mov.w r3, 0
bne 0x1534
mov r0, r4
add sp, 0xd0
pop.w {r4, r5, r6, r7, r8, pc}
ldr r2, [0x00001570]
add r2, pc
b 0x1484
ldr r2, [0x00001574]
add r2, pc
b 0x1442
ldr r1, [0x00001578]
movs r0, 1
add r1, pc
blx sym.imp.__fprintf_chk
ldrd r0, r1, [sp, 0x28]
movs r2, 1
--
ldr r2, [0x0000186c]
ldr r3, [0x00001870]
add r2, pc
ldr r3, [r2, r3]
mov r2, r4
ldr r3, [r3]
str r3, [sp, 0x134]
mov.w r3, 0
bl 0x33bc
ldr r3, [0x00001874]
add r3, pc
str r3, [sp, 0x18]
cmp r0, 0
bne.w 0x1820
ldr r1, [0x00001878]
mov r7, r0
ldr r2, [r4]
movs r0, 1
ldr r6, [0x0000187c]
add r1, pc
blx sym.imp.__fprintf_chk
ldr r1, [0x00001880]
movs r0, 1
ldr r2, [r4, 8]
add r6, pc
add r1, pc
blx sym.imp.__fprintf_chk
ldr r1, [0x00001884]
movs r0, 1
add r1, pc
blx sym.imp.__fprintf_chk
ldr r0, [r4, 0x3c]
mov r2, r7
asrs r1, r0, 0x1f
bl 0x1a90
movs r0, 0xa
blx sym.imp.strncpy
ldr r1, [0x00001888]
movs r0, 1
ldr r2, [r4, 0x1c]
add r1, pc
blx sym.imp.__fprintf_chk
ldrd r0, r1, [r4, 0x28]
mov r2, r7
bl 0x1a90
mov r0, r6
blx 0xa54
ldr r1, [0x0000188c]
movs r0, 1
ldr r2, [r4, 0x20]
add r1, pc
blx sym.imp.__fprintf_chk
ldrd r0, r1, [r4, 0x30]
mov r2, r7
bl 0x1a90
mov r0, r6
blx 0xa54
ldr r1, [0x00001890]
movs r0, 1
ldr r2, [r4, 0x4c]
add r1, pc
blx sym.imp.__fprintf_chk
ldr r1, [0x00001894]
movs r0, 1
ldr r2, [r4, 0x38]
add r1, pc
blx sym.imp.__fprintf_chk
ldr r1, [0x00001898]
movs r0, 1
ldr r2, [r4, 0x48]
add r1, pc
blx sym.imp.__fprintf_chk
ldr r1, [0x0000189c]
movs r0, 1
ldrd r2, r3, [r4, 0x40]
add r1, pc
blx sym.imp.__fprintf_chk
ldr r2, [r4, 0x50]
cmp r2, 1
ble.w 0x17da
ldr r3, [0x000018a0]
add r3, pc
ldr r1, [0x000018a4]
movs r0, 1
add r1, pc
blx sym.imp.__fprintf_chk
ldr r1, [0x000018a8]
movs r0, 1
ldrd r2, r3, [r4, 0x14]
add r1, pc
blx sym.imp.__fprintf_chk
ldr r3, [r4, 8]
cbnz r3, 0x16a8
ldr r2, [0x000018ac]
ldr r3, [0x00001870]
add r2, pc
ldr r3, [r2, r3]
ldr r2, [r3]
ldr r3, [sp, 0x134]
eors r2, r3
mov.w r3, 0
bne.w 0x1866
mov r0, r7
add sp, 0x13c
pop.w {r4, r5, r6, r7, r8, sb, sl, fp, pc}
ldr r1, [0x000018b0]
movs r0, 1
add r1, pc
blx sym.imp.__fprintf_chk
ldrd sb, r3, [r4, 0xc]
cmp sb, r3
bgt 0x1762
ldr r3, [0x000018b4]
mov.w r8, 1
ldr.w fp, [0x000018b8]
add r6, sp, 0x78
str r7, [sp, 0x1c]
mov r7, r8
add r3, pc
add fp, pc
mov r8, r3
b 0x16ea
mov r2, sb
cmp r7, 0
bne 0x174c
mov r1, r8
movs r0, 1
blx sym.imp.__fprintf_chk
ldr r3, [r4, 0x10]
add.w sb, sb, 1
--
ldr r0, [r4]
add r3, pc
blx sym.imp.readdir64
mov r0, r5
ldr r4, [r4]
blx 0xa6c
ldr r1, [0x000018c8]
ldr r2, [0x000018cc]
str r0, [sp, 8]
add r1, pc
str r5, [sp, 4]
add r2, pc
str r1, [sp]
movs r3, 8
mov r0, r4
movs r1, 1
blx sym.imp.readdir64
b 0x168a
mov r1, fp
movs r0, 1
blx sym.imp.__fprintf_chk
ldr r3, [r4, 0x10]
add.w sb, sb, 1
--
adds r0, 0x7a
movs r0, r0
adds r0, 0x3e
movs r0, r0
cmp r2, 0xe4
movs r0, r0
push.w {r4, r5, r6, r7, r8, sb, lr}
sub sp, 0xc
ldr r4, [0x00001a68]
movs r2, 0
mov r1, sp
mov r5, r0
ldr r3, [0x00001a6c]
add r4, pc
ldr r7, [0x00001a70]
ldr r3, [r4, r3]
add r7, pc
ldr r3, [r3]
str r3, [sp, 4]
mov.w r3, 0
blx sym.imp.__printf_chk
ldr.w r8, [sp]
lsrs r2, r1, 0x1f
--
subs r0, 0x96
movs r0, r0
lsls r0, r7, 2
movs r0, r0
subs r0, 0x58
movs r0, r0
push.w {r4, r5, r6, r7, r8, lr}
mov r4, r0
sub sp, 0x10
mov r5, r1
mov r6, r2
cmp r2, 0
bne 0x1b42
ldr r7, [0x00001c00]
add r7, pc
ldr r1, [0x00001c04]
mov r3, r5
mov r2, r4
movs r0, 1
add r1, pc
blx sym.imp.__fprintf_chk
movs r3, 1
movt r3, 0x4000
--
str r5, [sp, 4]
movt r4, 0xfafa
add r1, pc
lsrs r0, r0, 5
add.w r0, r0, r0, lsl 1
add.w r0, r0, r0, lsl 4
subs r0, r3, r0
subs r3, r3, r0
mov.w r0, -0x5050506
mul r0, r3, r0
sbc.w r5, r5, r5
mla r0, r4, r5, r0
umull r3, r4, r3, r4
lsrs r3, r3, 1
add r0, r4
orr.w r3, r3, r0, lsl 31
lsrs r0, r0, 1
str r3, [sp, 8]
str r0, [sp, 0xc]
movs r0, 1
blx sym.imp.__fprintf_chk
cbnz r6, 0x1b80
add sp, 0x10
--
ldr r7, [0x00001c0c]
add r7, pc
b 0x1aa4
ubfx r0, r4, 0, 0x14
ldr.w r8, [0x00001c10]
lsrs r4, r4, 0x14
movw r2, 0x9999
movt r2, 1
orr.w r4, r4, r5, lsl 12
asrs r5, r5, 0x14
add r8, pc
movs r1, 0
movs r3, 0
bl 0x41c4
mov r2, r7
strd r0, r1, [sp, 8]
str r4, [sp]
mov r1, r8
movs r0, 1
str r5, [sp, 4]
blx sym.imp.__fprintf_chk
cmp r6, 0
beq 0x1b3c
--
mvn r4, 0x5000000
movw ip, 0xfffb
movt ip, 0xafff
movs r0, 1
add r1, pc
sub.w r8, lr, r5
add.w r5, r5, r8, lsr 1
lsrs r5, r5, 0x19
mls lr, r7, r5, lr
subs.w r3, r3, lr
mul r4, r3, r4
sbc.w r7, r7, r7
umull r3, r5, r3, ip
mla r4, ip, r7, r4
lsrs r3, r0
add r4, r5
orr.w r3, r3, r4, lsl 31
lsrs r4, r0
str r3, [sp, 8]
str r4, [sp, 0xc]
blx sym.imp.__fprintf_chk
b 0x1b3a
subs r0, 0x76
[*] Function printf used 27 times ubinfo
