[*] Binary protection state of keyctl
Full RELRO Canary found NX enabled PIE enabled No RPATH No RUNPATH No Symbols
[*] Function printf tear down of keyctl
ldr r0, [0x00001bec]
ldr r5, [r3, r4]
add r0, pc
ldr r4, [0x00001bf0]
ldr r6, [0x00001bf4]
ldr r3, [r5]
ldr r7, [0x00001bf8]
add r4, pc
blx sym.imp.fwrite
ldr r3, [0x00001bfc]
add r6, pc
add r7, pc
add r3, pc
b 0x1b1e
ldr r6, [r4, 8]
ldr r0, [r5]
mov r2, r7
movs r1, 1
adds r4, 0xc
str r6, [sp]
blx sym.imp.__fprintf_chk
ldr r3, [r4, 4]
cmp r3, 0
--
ldr r3, [sp, 0xc]
eors r2, r3
mov.w r3, 0
bne 0x1d60
add sp, 0x10
pop {r4, r5, r6, pc}
movs r2, 0
add r1, sp, 8
blx sym.imp.strtoul
ldr r3, [sp, 8]
ldrb r3, [r3]
cmp r3, 0
beq 0x1c84
ldr r2, [0x00001d98]
ldr r0, [0x00001d9c]
add r2, pc
ldr r0, [r5, r0]
mov r3, r4
movs r1, 1
ldr r0, [r0]
blx sym.imp.__fprintf_chk
movs r0, 2
blx sym.imp.exit
--
movs r1, 1
ldr r3, [r5, r3]
add r0, pc
ldr r3, [r3]
blx sym.imp.fwrite
movs r0, 2
blx sym.imp.exit
blx sym.imp.__stack_chk_fail
ldr r2, [0x00001dc4]
ldr r0, [0x00001d9c]
add r2, pc
b 0x1cb2
ldr r1, [0x00001d9c]
mov r3, r6
ldr r2, [0x00001dc8]
ldr r0, [r5, r1]
movs r1, 1
str r4, [sp]
add r2, pc
ldr r0, [r0]
blx sym.imp.__fprintf_chk
movs r0, 1
blx sym.imp.exit
--
blx sym.imp.keyctl_update
cmp r0, 0
blt 0x1e08
movs r0, 0
blx sym.imp.exit
ldr r0, [0x00001e10]
add r0, pc
bl 0x1dcc
movs r6, 0x7a
movs r0, r0
ldr r2, [0x00001e38]
movs r0, 1
push {r3, lr}
ldr.w ip, [0x00001e3c]
add r2, pc
ldr r3, [0x00001e40]
ldr r1, [0x00001e44]
ldr r3, [r2, r3]
add r1, pc
ldr.w r2, [r2, ip]
blx sym.imp.__printf_chk
movs r0, 0
blx sym.imp.exit
--
mov.w r3, 0
subs r3, r0, 2
cmp r3, 1
bls 0x1e66
bl 0x1af0
mov r4, r0
ldr r0, [r1, 4]
mov r5, r1
bl 0x1c2c
cmp r4, 3
str r0, [sp]
beq 0x1e92
ldr r0, [0x00001eb4]
mov r1, sp
add r0, pc
blx sym.imp.recursive_session_key_scan
ldr r1, [0x00001eb8]
mov r2, r0
movs r0, 1
add r1, pc
blx sym.imp.__printf_chk
movs r0, 0
blx sym.imp.exit
--
ldr r0, [r3, 4]
add r1, pc
blx sym.imp.strcmp
cbnz r0, 0x1ee4
ldr r3, [0x00001f08]
subs r4, 1
movs r2, 1
add r3, pc
str r2, [r3]
cmp r4, 1
beq 0x1ee8
bl 0x1af0
ldr r0, [0x00001f0c]
movs r1, 0
add r0, pc
blx sym.imp.recursive_session_key_scan
ldr r1, [0x00001f10]
mov r2, r0
mov r0, r4
add r1, pc
blx sym.imp.__printf_chk
movs r0, 0
blx sym.imp.exit
--
strd r0, r7, [sp]
blx sym.imp.strlen
str r0, [sp, 0xc]
mov r0, r7
cbz r7, 0x1f8e
blx sym.imp.strlen
str r0, [sp, 8]
cbnz r6, 0x1fb6
cmp r4, 1
beq 0x1fc8
cmp r4, 2
bne 0x1f74
ldr r0, [0x00001fe0]
add r0, pc
mov r1, r5
blx sym.imp.recursive_session_key_scan
ldr r1, [0x00001fe4]
mov r2, r0
movs r0, 1
add r1, pc
blx sym.imp.__printf_chk
movs r0, 0
blx sym.imp.exit
--
mov r6, r0
ldr r0, [r4, 8]
blx sym.imp.strtoul
ldr r3, [sp]
mov r1, r0
ldrb r7, [r3]
cbnz r7, 0x203c
mov r0, r6
blx sym.imp.keyctl_set_timeout
cmp r0, 0
blt 0x2054
mov r0, r7
blx sym.imp.exit
ldr r0, [0x00002068]
movs r1, 1
ldr r2, [0x0000206c]
ldr r3, [r4, 8]
ldr r0, [r5, r0]
add r2, pc
ldr r0, [r0]
blx sym.imp.__fprintf_chk
movs r0, 2
blx sym.imp.exit
--
blx sym.imp.exit
ldr r0, [0x00002134]
add r0, pc
bl 0x1dcc
ldr r4, [0x00002138]
ldr r2, [0x0000213c]
ldr r6, [0x00002140]
add r4, pc
add r2, pc
add.w r4, r4, 0x27c
add r6, pc
ldr r3, [r4, 4]
mov r1, r6
ldrb r0, [r5, r3]
ldrb r3, [r4, 8]
tst r0, r3
mov.w r0, 1
ite ne
movne r3, 0x31
moveq r3, 0x30
blx sym.imp.__printf_chk
ldr r2, [r4, 0xc]!
cmp r2, 0
--
str r0, [sp, 0x5c]
ite ne
movne r0, 0x77
moveq r0, 0x2d
tst.w r1, 2
str r0, [sp, 0x50]
ite ne
movne r0, 0x72
moveq r0, 0x2d
tst.w r1, 1
ite ne
movne r1, 0x76
moveq r1, 0x2d
str r1, [sp, 0x58]
ldr r1, [0x000023ac]
str r0, [sp, 0x54]
movs r0, 1
strd r6, r7, [sp, 4]
add r1, pc
str.w ip, [sp]
blx sym.imp.__printf_chk
mov r0, r5
blx sym.imp.exit
ldr r0, [0x000023b0]
mov r3, r6
ldr r2, [0x000023b4]
movs r1, 1
ldr r0, [r4, r0]
add r2, pc
ldr r0, [r0]
blx sym.imp.__fprintf_chk
movs r0, 3
blx sym.imp.exit
--
str r3, [sp, 4]
mov.w r3, 0
beq 0x23d8
bl 0x1af0
ldr r0, [r1, 4]
bl 0x1c2c
mov r1, sp
blx sym.imp.keyctl_read_alloc
cmp r0, 0
blt 0x2422
lsrs r4, r0, 2
beq 0x241a
ldr r6, [0x00002434]
ldr r5, [sp]
add r6, pc
b 0x2400
movs r3, 0x20
mov r1, r6
movs r0, 1
subs r4, 1
blx sym.imp.__printf_chk
cmp r4, 1
ldr r2, [r5], 4
bne 0x23f4
ldr r1, [0x00002438]
movs r3, 0xa
mov r0, r4
add r1, pc
blx sym.imp.__printf_chk
movs r0, 0
blx sym.imp.exit
--
moveq r3, 0x2d
tst.w r1, 4
str r3, [sp, 8]
ite ne
movne r4, 0x77
moveq r4, 0x2d
ldr r3, [0x0000257c]
tst.w r1, 2
ite ne
movne r2, 0x72
moveq r2, 0x2d
tst.w r1, 1
str r4, [sp, 0xc]
ite ne
movne r1, 0x76
moveq r1, 0x2d
strd r2, r1, [sp, 0x10]
add r3, pc
mov.w r2, -1
movs r1, 1
blx sym.imp.__sprintf_chk
add sp, 0x1c
pop.w {r4, r5, r6, r7, r8, sb, sl, fp, pc}
--
ble.w 0x279a
ldr r1, [0x000027e0]
add r1, pc
strd r3, r2, [sp]
movs r0, 1
ldr r3, [sp, 0x24]
str r1, [sp, 0xc]
ldr r1, [r3]
mov r3, r7
str r5, [sp, 0x10]
ldr r2, [r6]
add r2, r1
ldr r1, [0x000027e4]
str r2, [sp, 0x14]
ldr r2, [0x000027e8]
add r1, pc
add r2, pc
adds r2, 0x18
str r2, [sp, 8]
mov r2, r4
blx sym.imp.__printf_chk
ldr r7, [0x000027ec]
ldr r0, [r6]
--
ble 0x27a0
ldr r1, [0x000027fc]
add r1, pc
strd r3, r2, [sp]
movs r0, 1
ldr r3, [sp, 0x24]
str r1, [sp, 0xc]
ldr r1, [r3]
mov r3, r7
str r5, [sp, 0x10]
ldr r2, [r6]
add r2, r1
ldr r1, [0x00002800]
str r2, [sp, 0x14]
ldr r2, [0x00002804]
add r1, pc
add r2, pc
adds r2, 0x18
str r2, [sp, 8]
mov r2, r4
blx sym.imp.__printf_chk
b 0x2678
ldr r1, [0x00002808]
mov r2, r4
movs r0, 1
movs r4, 0
add r1, pc
blx sym.imp.__printf_chk
b 0x25b4
movs r2, 0x20
--
strb.w r2, [sl, 0x1a]
strb.w r2, [sl, 0x1b]
ldr r2, [sp, 0x30]
add r2, r1
strb r3, [r2, 0x18]
b 0x2702
ldr r1, [0x0000280c]
add r1, pc
b 0x2650
ldr r1, [0x00002810]
add r1, pc
b 0x2744
blx sym.imp.__stack_chk_fail
ldr r0, [0x00002814]
mov r3, r4
ldr r2, [0x00002818]
movs r1, 1
ldr r0, [r7, r0]
add r2, pc
ldr r0, [r0]
blx sym.imp.__fprintf_chk
movs r0, 3
blx sym.imp.exit
--
add r6, pc
ldr r3, [r3]
str r3, [sp, 0x4c]
mov.w r3, 0
beq 0x28ca
bl 0x1af0
ldr r0, [r1, 4]
bl 0x1c2c
add r1, sp, 0x28
blx sym.imp.keyctl_read_alloc
cmp r0, 0
blt 0x29a2
lsrs r4, r0, 2
beq 0x298e
cmp r4, 1
beq 0x29c6
ldr r1, [0x000029dc]
mov r2, r4
movs r0, 1
add r1, pc
blx sym.imp.__printf_chk
ldr r3, [0x000029e0]
add r7, sp, 0x2c
--
add.w fp, sp, 0x40
ldrd r2, r3, [sp, 0x30]
ldr r1, [sp, 0x24]
mov r0, fp
bl 0x2440
ldr r1, [sp, 0x2c]
mov r3, fp
ldr r0, [sp, 0x3c]
mov r2, r6
str r1, [sp, 0x10]
add r1, r0
movs r0, 1
str r1, [sp, 0x14]
ldr r1, [sp, 0x38]
strd r1, r1, [sp, 8]
ldr r1, [sp, 0x34]
str r1, [sp, 4]
ldr r1, [sp, 0x30]
str r1, [sp]
mov r1, sb
blx sym.imp.__printf_chk
ldr r0, [sp, 0x2c]
blx sym.imp.free
subs r4, 1
beq 0x299c
ldr r6, [r5], 4
mov r1, r7
mov r0, r6
blx sym.imp.keyctl_describe_alloc
cmp r0, 0
bge 0x2908
mov r2, r6
mov r1, sl
movs r0, 1
blx sym.imp.__printf_chk
b 0x296e
ldr r0, [0x000029ec]
add r0, pc
blx sym.imp.puts
mov r0, r4
blx sym.imp.exit
mov r0, r4
blx sym.imp.exit
ldr r0, [0x000029f0]
add r0, pc
bl 0x1dcc
mov fp, r6
ldr r0, [0x000029f4]
ldr r6, [sp, 0x1c]
mov r3, fp
ldr r2, [0x000029f8]
movs r1, 1
ldr r0, [r6, r0]
add r2, pc
ldr r0, [r0]
blx sym.imp.__fprintf_chk
movs r0, 3
blx sym.imp.exit
--
mov r6, r0
ldr r0, [r4, 8]
blx sym.imp.strtoul
ldr r3, [sp]
mov r1, r0
ldrb r7, [r3]
cbnz r7, 0x2a4c
mov r0, r6
blx sym.imp.keyctl_setperm
cmp r0, 0
blt 0x2a64
mov r0, r7
blx sym.imp.exit
ldr r0, [0x00002a78]
movs r1, 1
ldr r2, [0x00002a7c]
ldr r3, [r4, 8]
ldr r0, [r5, r0]
add r2, pc
ldr r0, [r0]
blx sym.imp.__fprintf_chk
movs r0, 2
blx sym.imp.exit
--
beq 0x2ad2
ldr r7, [r1, 4]
mov r5, r1
ldr r1, [0x00002b1c]
mov r0, r7
add r1, pc
blx sym.imp.strcmp
cmp r0, 0
ite ne
movne r0, r7
moveq r0, 0
blx sym.imp.keyctl_join_session_keyring
subs r3, r0, 0
blt 0x2b08
ldr r2, [0x00002b20]
ldr r1, [r6, r2]
ldr r2, [0x00002b24]
ldr r0, [r1]
movs r1, 1
add r2, pc
blx sym.imp.__fprintf_chk
cmp r4, 2
beq 0x2aec
ldr r0, [r5, 8]
add.w r1, r5, 8
blx sym.imp.execvp
ldr r0, [r5, 8]
bl 0x1dcc
movs r0, 0
blx sym.imp.keyctl_join_session_keyring
subs r3, r0, 0
blt 0x2b08
ldr r0, [0x00002b20]
mov r1, r4
ldr r2, [0x00002b28]
ldr r0, [r6, r0]
add r2, pc
ldr r0, [r0]
blx sym.imp.__fprintf_chk
ldr r0, [0x00002b2c]
add r0, pc
--
subs r3, r0, 4
cmp r3, 1
bls 0x2b90
bl 0x1af0
mov r4, r0
ldr r0, [r1, 4]
mov r5, r1
bl 0x1c2c
cmp r4, 5
mov r6, r0
beq 0x2bc8
movs r3, 0
ldrd r1, r2, [r5, 8]
mov r0, r6
blx sym.imp.keyctl_search
subs r2, r0, 0
blt 0x2bc0
ldr r1, [0x00002bd4]
movs r0, 1
add r1, pc
blx sym.imp.__printf_chk
movs r0, 0
blx sym.imp.exit
--
bl 0x1dcc
nop
adds r0, r0, 0
movs r0, r0
push {r3, lr}
subs r3, r0, 4
cmp r3, 1
bhi 0x2c7e
cmp r0, 5
mov r4, r1
beq 0x2c8a
movs r3, 0
ldrd r1, r2, [r4, 8]
ldr r0, [r4, 4]
blx sym.imp.request_key
subs r2, r0, 0
blt 0x2c82
ldr r1, [0x00002c94]
movs r0, 1
add r1, pc
blx sym.imp.__printf_chk
movs r0, 0
blx sym.imp.exit
--
subs r2, r2, r6
movs r0, r0
subs r0, r3, r7
movs r0, r0
push {r3, lr}
subs r3, r0, 3
cmp r3, 1
bhi 0x2cca
cmp r0, 4
mov r4, r1
beq 0x2cd6
movs r3, 0
movs r2, 0
ldrd r0, r1, [r4, 4]
blx sym.imp.request_key
subs r2, r0, 0
blt 0x2cce
ldr r1, [0x00002ce0]
movs r0, 1
add r1, pc
blx sym.imp.__printf_chk
movs r0, 0
blx sym.imp.exit
--
ldr r0, [r4, 0x10]
bl 0x1c2c
mov r2, r7
mov r3, r0
mov r1, sb
mov r0, r6
blx sym.imp.keyctl_reject
cmp r0, 0
blt 0x2d86
movs r0, 0
blx sym.imp.exit
movs r7, 0x81
b 0x2d4e
ldr r2, [0x00002dc8]
ldr r0, [0x00002dcc]
ldr r3, [r4, 8]
add r2, pc
ldr r0, [r5, r0]
movs r1, 1
ldr r0, [r0]
blx sym.imp.__fprintf_chk
movs r0, 2
blx sym.imp.exit
--
ldr r3, [r2, r3]
add r6, pc
ldr r3, [r3]
str r3, [sp, 4]
mov.w r3, 0
beq 0x2df8
bl 0x1af0
ldr r0, [r1, 4]
bl 0x1c2c
mov r1, sp
blx sym.imp.keyctl_read_alloc
subs r4, r0, 0
blt 0x2e6e
beq 0x2e46
ldr r1, [0x00002e84]
mov r2, r4
movs r0, 1
ldr.w r8, [0x00002e88]
adds r7, r4, 1
add r1, pc
blx sym.imp.__printf_chk
ldr r5, [sp]
add r8, pc
subs r5, 1
ldrb r2, [r5, 1]!
mov r1, r8
movs r0, 1
blx sym.imp.__printf_chk
subs r3, r7, r4
subs r4, 1
--
blx sym.imp.keyctl_read_alloc
subs r5, r0, 0
blt 0x302a
ldr r6, [sp]
beq 0x301e
blx sym.imp.__ctype_b_loc
subs r3, r6, 1
ldr r1, [r0]
adds r4, r3, r5
b 0x2fe4
cmp r4, r3
beq 0x301e
ldrb r2, [r3, 1]!
ldrh.w r2, [r1, r2, lsl 1]
lsls r2, r2, 0x11
bmi 0x2fe0
ldr r1, [0x0000303c]
movs r0, 1
ldr r6, [0x00003040]
add r1, pc
blx sym.imp.__printf_chk
ldr r4, [sp]
add r6, pc
add r5, r4
ldrb r2, [r4], 1
mov r1, r6
movs r0, 1
blx sym.imp.__printf_chk
cmp r4, r5
bne 0x3002
--
add r2, pc
ldr r3, [r2, r3]
ldr r2, [r3]
ldr r3, [sp, 0x5c]
eors r2, r3
mov.w r3, 0
bne 0x317a
mov r0, r4
add sp, 0x64
pop.w {r4, r5, r6, r7, r8, sb, pc}
mov r0, r7
bl 0x1dcc
blx sym.imp.__stack_chk_fail
ldr r0, [0x000031b0]
mov r3, r7
ldr r2, [0x000031b4]
movs r1, 1
ldr.w r0, [r8, r0]
add r2, pc
ldr r0, [r0]
blx sym.imp.__fprintf_chk
movs r0, 1
blx sym.imp.exit
--
ldr r3, [0x000033c0]
movs r2, 0x26
ldr r0, [0x000033c4]
movs r1, 1
ldr r3, [r6, r3]
add r0, pc
ldr r3, [r3]
blx sym.imp.fwrite
movs r0, 2
blx sym.imp.exit
add r2, sp, 4
mov r1, r8
mov r0, r7
blx sym.imp.keyctl_pkey_query
cmp r0, 0
blt 0x33a8
ldr r1, [0x000033c8]
movs r0, 1
ldr r2, [r5, -0x38]
add r1, pc
blx sym.imp.__printf_chk
ldr r1, [0x000033cc]
movs r0, 1
ldrh r2, [r5, -0x34]
add r1, pc
blx sym.imp.__printf_chk
ldr r1, sym.imp.geteuid
movs r0, 1
ldrh r2, [r5, -0x32]
add r1, pc
blx sym.imp.__printf_chk
ldr r1, [0x000033d4]
movs r0, 1
ldrh r2, [r5, -0x30]
add r1, pc
blx sym.imp.__printf_chk
ldr r1, sym.imp.perror
movs r0, 1
ldrh r2, [r5, -0x2e]
add r1, pc
blx sym.imp.__printf_chk
ldr r3, [r5, -0x3c]
movs r0, 1
ldr r1, [0x000033dc]
tst.w r3, 1
ite ne
movne r2, 0x79
moveq r2, 0x6e
add r1, pc
blx sym.imp.__printf_chk
ldr r3, [r5, -0x3c]
movs r0, 1
ldr r1, [0x000033e0]
tst.w r3, 2
ite ne
movne r2, 0x79
moveq r2, 0x6e
add r1, pc
blx sym.imp.__printf_chk
ldr r3, [r5, -0x3c]
movs r0, 1
ldr r1, [0x000033e4]
tst.w r3, 4
ite ne
movne r2, 0x79
moveq r2, 0x6e
add r1, pc
blx sym.imp.__printf_chk
ldr r3, [r5, -0x3c]
movs r0, 1
ldr r1, [0x000033e8]
tst.w r3, 8
add r1, pc
ite ne
movne r2, 0x79
moveq r2, 0x6e
blx sym.imp.__printf_chk
mov r0, r4
blx sym.imp.exit
--
str r3, [sp, 0xc]
mov.w r3, 0
beq 0x3850
bl 0x1af0
ldr r0, [r1, 0xc]
mov r4, r1
bl 0x1c2c
mov r5, r0
add r0, sp, 8
bl 0x2e98
ldr r3, [sp, 8]
mov r2, r0
ldrd r0, r1, [r4, 4]
str r5, [sp]
blx sym.imp.add_key
subs r2, r0, 0
blt 0x3882
ldr r1, [0x00003894]
movs r0, 1
add r1, pc
blx sym.imp.__printf_chk
movs r0, 0
blx sym.imp.exit
--
push {lr}
sub sp, 0xc
beq 0x38a8
bl 0x1af0
ldr r0, [r1, 8]
mov r4, r1
bl 0x1c2c
mov r5, r0
ldr r0, [0x000038e0]
movs r3, 0
ldr r1, [r4, 4]
mov r2, r3
str r5, [sp]
add r0, pc
blx sym.imp.add_key
subs r2, r0, 0
blt 0x38d6
ldr r1, [0x000038e4]
movs r0, 1
add r1, pc
blx sym.imp.__printf_chk
movs r0, 0
blx sym.imp.exit
--
sub sp, 0xc
beq 0x38f8
bl 0x1af0
mov r4, r1
ldr r0, [r1, 0x10]
bl 0x1c2c
ldr r6, [r4, 0xc]
mov r5, r0
mov r0, r6
blx sym.imp.strlen
mov r2, r6
mov r3, r0
ldrd r0, r1, [r4, 4]
str r5, [sp]
blx sym.imp.add_key
subs r2, r0, 0
blt 0x392c
ldr r1, [0x00003934]
movs r0, 1
add r1, pc
blx sym.imp.__printf_chk
movs r0, 0
blx sym.imp.exit
--
cmp r0, 1
push {r3, lr}
beq 0x3946
bl 0x1af0
mov r4, r0
movs r0, 0
blx sym.imp.keyctl_join_session_keyring
cmp r0, 0
blt 0x3980
blx sym.imp.keyctl_session_to_parent
cmp r0, 0
blt 0x3978
movs r1, 0
mvn r0, 2
blx sym.imp.keyctl_get_keyring_ID
subs r2, r0, 0
blt 0x3988
ldr r1, [0x00003990]
mov r0, r4
add r1, pc
blx sym.imp.__printf_chk
movs r0, 0
blx sym.imp.exit
--
ldrb.w r8, [r3]
cmp.w r8, 0
bne 0x39fc
ldr r0, [r4, 0xc]
bl 0x1c2c
mov r1, r7
mov r2, r0
mov r0, r6
blx sym.imp.keyctl_negate
cmp r0, 0
blt 0x3a14
mov r0, r8
blx sym.imp.exit
ldr r0, [0x00003a28]
movs r1, 1
ldr r2, [0x00003a2c]
ldr r3, [r4, 8]
ldr r0, [r5, r0]
add r2, pc
ldr r0, [r0]
blx sym.imp.__fprintf_chk
movs r0, 2
blx sym.imp.exit
--
add r6, pc
ldr r2, [r2]
str r2, [sp, 4]
mov.w r2, 0
bls 0x3af4
bl 0x1af0
ldr r0, [r1, 4]
mov r5, r1
bl 0x1c2c
cmp r4, 3
mov r7, r0
beq 0x3b28
mov.w r0, -1
mov r1, r7
blx sym.imp.keyctl_get_persistent
subs r2, r0, 0
blt 0x3b20
ldr r1, [0x00003b60]
movs r0, 1
add r1, pc
blx sym.imp.__printf_chk
movs r0, 0
blx sym.imp.exit
ldr r0, [0x00003b64]
add r0, pc
bl 0x1dcc
ldr r0, [r5, 8]
movs r2, 0
mov r1, sp
blx sym.imp.strtoul
ldr r3, [sp]
ldrb r3, [r3]
cmp r3, 0
beq 0x3b06
ldr r0, [0x00003b68]
movs r1, 1
ldr r2, [0x00003b6c]
ldr r3, [r5, 8]
ldr r0, [r6, r0]
add r2, pc
ldr r0, [r0]
blx sym.imp.__fprintf_chk
movs r0, 2
blx sym.imp.exit
--
mov r2, sl
str r0, [sp]
mov r1, sb
ldr r3, [r4, 0x14]
mov r0, r8
ldr r4, [sp, 0x10]
str r7, [sp, 8]
str r4, [sp, 4]
blx sym.imp.keyctl_dh_compute_kdf
subs r2, r0, 0
blt 0x3c5a
ldr.w sb, [0x00003ca0]
mov r4, r2
ldr r1, [0x00003ca4]
subs r5, r7, 1
add.w sl, r4, 1
mov.w r8, 0
add sb, pc
movs r0, 1
add r1, pc
blx sym.imp.__printf_chk
ldrb r2, [r5, 1]!
mov r1, sb
movs r0, 1
blx sym.imp.__printf_chk
sub.w r3, sl, r4
strb.w r8, [r5]
--
beq 0x3d90
mov r0, r7
movs r7, 0
mov r2, sl
str r5, [sp, 0xc]
mov r1, sb
ldr r3, [r4, 0x14]
str.w r8, [sp, 8]
strd r7, r7, [sp]
blx sym.imp.keyctl_dh_compute_kdf
subs r2, r0, 0
blt 0x3d5e
ldr.w sl, [0x00003d9c]
mov r4, r2
ldr r1, [0x00003da0]
add.w r5, r8, -1
add.w sb, r4, 1
movs r0, 1
add sl, pc
add r1, pc
blx sym.imp.__printf_chk
ldrb r2, [r5, 1]!
mov r1, sl
movs r0, 1
blx sym.imp.__printf_chk
sub.w r3, sb, r4
strb r7, [r5]
--
ldr r0, [r4, 8]
bl 0x1c2c
mov r1, r0
ldr r0, [r4, 0xc]
mov r4, r1
bl 0x1c2c
mov r1, r4
mov r2, r0
mov r3, sp
mov r0, r5
blx sym.imp.keyctl_dh_compute_alloc
subs r2, r0, 0
blt 0x3e68
ldr r1, [0x00003e7c]
movs r0, 1
mov r4, r2
ldr.w sb, [0x00003e80]
add.w r8, r4, 1
movs r7, 0
add r1, pc
blx sym.imp.__printf_chk
ldr r5, [sp]
add sb, pc
subs r5, 1
ldrb r2, [r5, 1]!
mov r1, sb
movs r0, 1
blx sym.imp.__printf_chk
sub.w r3, r8, r4
strb r7, [r5]
--
ldr r0, [r4, 8]
blx sym.imp.strtoul
ldr r3, [sp]
mov r1, r0
ldrb r7, [r3]
cbnz r7, 0x3f08
mov.w r2, -1
mov r0, r6
blx sym.imp.keyctl_chown
cmp r0, 0
blt 0x3f20
mov r0, r7
blx sym.imp.exit
ldr r0, [0x00003f34]
movs r1, 1
ldr r2, [0x00003f38]
ldr r3, [r4, 8]
ldr r0, [r5, r0]
add r2, pc
ldr r0, [r0]
blx sym.imp.__fprintf_chk
movs r0, 2
blx sym.imp.exit
--
ldr r0, [r4, 8]
blx sym.imp.strtoul
ldr r3, [sp]
mov r2, r0
ldrb r7, [r3]
cbnz r7, 0x3f90
mov.w r1, -1
mov r0, r6
blx sym.imp.keyctl_chown
cmp r0, 0
blt 0x3fa8
mov r0, r7
blx sym.imp.exit
ldr r0, [0x00003fbc]
movs r1, 1
ldr r2, [0x00003fc0]
ldr r3, [r4, 8]
ldr r0, [r5, r0]
add r2, pc
ldr r0, [r0]
blx sym.imp.__fprintf_chk
movs r0, 2
blx sym.imp.exit
--
blt 0x4028
ldr r3, [0x00004054]
movs r0, 1
add r3, pc
ldr r3, [r3]
cbz r3, 0x4026
movs r0, 0xa
blx sym.imp.putchar
movs r0, 1
pop {r3, r4, r5, pc}
ldr r3, [0x00004058]
add r3, pc
ldr r3, [r3]
cbnz r3, 0x4042
movs r0, 0
pop {r3, r4, r5, pc}
ldr r1, [0x0000405c]
mov r2, r4
movs r0, 1
add r1, pc
blx sym.imp.__printf_chk
b 0x4008
ldr r1, [0x00004060]
movs r0, 1
add r1, pc
blx sym.imp.__printf_chk
b 0x4030
nop
--
ldrb r1, [r3, 0x10]
ldr r2, [r3, 8]
cbz r1, 0x41a4
cmp r6, r2
blo 0x4128
ldr r3, [sp, 0x30]
ldrb r1, [r3, 0x11]
ldr r0, [r3, 4]
cbnz r1, 0x41aa
mov r1, r7
blx sym.imp.memcmp
cmp r0, 0
bne 0x4128
ldr r1, [0x000041b8]
mov r3, sl
mov r2, sl
movs r0, 1
str r7, [sp, 4]
add r1, pc
str r4, [sp]
blx sym.imp.__printf_chk
mov r1, r5
mov r0, sb
[*] Function printf used 61 times keyctl
