[*] Binary protection state of ntpd
Full RELRO Canary found NX enabled PIE enabled No RPATH No RUNPATH No Symbols
[*] Function mmap tear down of ntpd
blx sym.imp.mmap
nop
ldr r5, [sp, 0x38]
movs r1, r0
lsls r0, r7, 7
movs r0, r0
ldr.w ip, [0x00004120]
push {r0, r1, r2, r3}
movs r0, 0
ldr r3, [0x00004124]
add ip, pc
push {lr}
sub sp, 0xc
add r2, sp, 0x10
ldr.w r3, [ip, r3]
ldr r1, [r2], 4
ldr r3, [r3]
str r3, [sp, 4]
mov.w r3, 0
str r2, [sp]
bl 0x3e54
--
blx sym.imp.mmap
nop
ldr r4, [sp, 0x348]
movs r1, r0
lsls r0, r7, 7
movs r0, r0
cmp r0, 0xe
beq 0x4136
cmp r0, 0xf
beq 0x4140
cmp r0, 2
beq 0x4140
bx lr
ldr r3, [0x0000414c]
movs r2, 1
add r3, pc
str r2, [r3, 8]
bx lr
ldr r3, [0x00004150]
movs r2, 1
add r3, pc
--
blx sym.imp.mmap
ldr r0, [0x00005064]
mov r2, r5
ldr r1, [sp, 0xc]
add r0, pc
bl 0x3ee4
ldr r0, [0x00005068]
add r0, pc
bl 0x40f0
ldr r1, [sp, 0x30]
cmp r1, 0
beq.w 0x47da
ldr.w r2, [r2, 0xd8]
cbnz r2, 0x4f4a
str.w r3, [sb, 8]
b 0x47da
ldr r0, [0x0000506c]
add r0, pc
bl 0x3ffc
b 0x4ef6
ldr r0, [0x00005070]
--
blx sym.imp.mmap
blx sym.imp.bind
ldr r3, [r0]
cmp r3, 0xb
beq 0x5826
mov r0, r7
bl 0x3ee4
ldr r3, [0x00005898]
movs r2, 1
add r3, pc
str r2, [r3]
b 0x5826
strh r0, [r5, 0x38]
movs r1, r0
lsls r0, r7, 7
movs r0, r0
strh r0, [r4, 0x38]
movs r1, r0
str r0, [r4, 0x28]
movs r0, r0
str r4, [r2, 0x30]
--
blx sym.imp.mmap
ldr r2, [0x00005a78]
mov r3, r5
movs r1, 1
mov r0, r4
add r2, pc
blx sym.imp.munmap
b 0x5a4c
nop
strh r6, [r4, 0x1c]
movs r1, r0
lsls r4, r5, 7
movs r0, r0
str r0, [r5, 0x38]
movs r0, r0
lsls r0, r1, 8
movs r0, r0
str r6, [r2, 0x38]
movs r0, r0
str r6, [r6, 0x38]
movs r0, r0
--
blx sym.imp.mmap
movs r1, 0
mov r0, r5
bl 0x66f4
ldr r6, [sp, 0x14]
sub.w r2, r6, 0xf
rsbs r6, r2, 0
adcs r6, r2
mov r0, r5
bl 0x8cec
cmp r6, 0
beq 0x6978
b 0x69a0
movs r1, 0
mov r0, r5
bl 0x655c
ldr r6, [sp, 0x14]
sub.w r1, r6, 0xd
rsbs r6, r1, 0
adcs r6, r1
b 0x69c4
[*] Function mmap used 6 times ntpd
