[*] Binary protection state of libwssecurity_user_handling.so
Full RELRO Canary found NX enabled DSO No RPATH No RUNPATH No Symbols
[*] Function printf tear down of libwssecurity_user_handling.so
; assembly | /* r2dec pseudo code output */
| /* /logs/firmware/patool_extraction/rootfs.img_unblob_extracted/rootfs.img_extract/0-50593792.squashfs_v4_le_extract/usr/lib/libwssecurity_user_handling.so @ 0x3734 */
| #include <stdint.h>
|
; (fcn) sym.wssecurity_uh_map_vapix_user_to_onvif_group () | void wssecurity_uh_map_vapix_user_to_onvif_group (int16_t arg1, int16_t arg2, int16_t arg3) {
| int16_t var_bp_0h;
| int16_t var_0h_2;
| int16_t var_ch_2;
| int16_t var_18h;
| int16_t var_1ch;
| int16_t var_20h;
| int16_t var_30h;
| int16_t var_4ch;
| int16_t var_24ch;
| r0 = arg1;
| r1 = arg2;
| r2 = arg3;
0x00003734 svcmi 0xf0e92d | __asm ("svcmi 0xf0e92d");
0x00003738 sub.w sp, sp, 0x254 |
0x0000373c str r1, [sp, 0xc] | var_ch_2 = r1;
0x0000373e mov sl, r2 | sl = r2;
0x00003740 movs r3, 0x80 | r3 = 0x80;
0x00003742 mov r5, r0 | r5 = r0;
0x00003744 ldr r1, [pc, 0x118] |
0x00003746 add r7, sp, 0x18 | r7 += var_18h;
0x00003748 ldr r2, [pc, 0x118] | r2 = *(0x3864);
0x0000374a add.w fp, sp, 0x14 |
0x0000374e mov.w r0, 0x400 | r0 = 0x400;
0x00003752 add r6, sp, 0x30 | r6 += var_30h;
0x00003754 add r1, pc | r1 = 0x6fb8;
0x00003756 ldr r2, [r1, r2] |
0x00003758 ldr r2, [r2] | r2 = *(0x6fb8);
0x0000375a str r2, [sp, 0x24c] | var_24ch = r2;
0x0000375c mov.w r2, 0 | r2 = 0;
0x00003760 str.w r3, [fp] | __asm ("str.w r3, [fp]");
0x00003764 blx 0x1b48 | g_strdup_printf ()
0x00003768 str r7, [sp] | *(sp) = r7;
0x0000376a mov r2, r0 | r2 = r0;
0x0000376c mov r4, r0 | r4 = r0;
0x0000376e mov.w r3, 0x400 | r3 = 0x400;
0x00003772 mov r1, r6 | r1 = r6;
0x00003774 mov r0, r5 | r0 = r5;
0x00003776 blx 0x1bfc | g_key_file_load_from_file ();
0x0000377a ldr r7, [sp, 0x18] | r7 = var_18h;
0x0000377c cmp r7, 0 |
| if (r7 == 0) {
0x0000377e beq 0x3830 | goto label_3;
| }
0x00003780 mov r0, r5 | r0 = r5;
0x00003782 add r5, sp, 0x4c | r5 += var_4ch;
0x00003784 ldr r1, [r6, 0xc] | r1 = *((r6 + 0xc));
0x00003786 mov r3, fp | r3 = fp;
0x00003788 mov r2, r5 | r2 = r5;
0x0000378a blx 0x1c44 | r0 = g_hash_table_insert ();
0x0000378e mov r6, r0 | r6 = r0;
0x00003790 mov r0, r4 | r0 = r4;
0x00003792 adds r3, r6, 1 | r3 = r6 + 1;
| if (r3 == r6) {
0x00003794 beq 0x380e | goto label_4;
| }
0x00003796 movs r6, 0 | r6 = 0;
0x00003798 blx 0x1a24 | fcn_00001a24 ();
0x0000379c movs r0, 0x14 | r0 = 0x14;
0x0000379e str.w r6, [sl] | __asm ("str.w r6, [sl]");
0x000037a2 blx 0x1d60 | fcn_00001d60 ();
0x000037a6 ldr r2, [sp, 0xc] | r2 = var_ch_2;
0x000037a8 str r0, [r2] | *(r2) = r0;
0x000037aa cmp r0, 0 |
| if (r0 == 0) {
0x000037ac beq 0x3842 | goto label_5;
| }
0x000037ae mov.w r0, 0x400 | r0 = 0x400;
0x000037b2 blx 0x1b48 | g_strdup_printf ()
0x000037b6 ldr.w r3, [fp] | r3 = *(fp);
0x000037ba mov r4, r0 | r4 = r0;
0x000037bc cmp r3, 0 |
| if (r3 <= 0) {
0x000037be ble 0x380a | goto label_6;
| }
0x000037c0 mov r8, r6 | r8 = r6;
0x000037c2 mov.w sb, 0x400 | sb = 0x400;
0x000037c6 add r6, sp, 0x1c | r6 += var_1ch;
0x000037c8 add r7, sp, 0x20 | r7 += var_20h;
| if (r4 == 0) {
| label_0:
0x000037ca cbz r4, 0x37f0 | goto label_7;
| }
| do {
0x000037cc ldr r0, [r5] | r0 = *(r5);
0x000037ce mov r3, sb | r3 = sb;
0x000037d0 mov r2, r4 | r2 = r4;
0x000037d2 mov r1, r7 | r1 = r7;
0x000037d4 str r6, [sp] | *(sp) = r6;
0x000037d6 blx 0x1cc0 | r0 = fcn_00001cc0 ();
0x000037da cmp r0, 0x22 |
| if (r0 != 0x22) {
0x000037dc bne 0x37f0 | goto label_7;
| }
0x000037de lsl.w sb, sb, 1 | sb <<= 1;
0x000037e2 mov r0, r4 | r0 = r4;
0x000037e4 mov r1, sb | r1 = sb;
0x000037e6 blx 0x1a9c | r0 = fcn_00001a9c ();
0x000037ea mov r4, r0 | r4 = r0;
0x000037ec cmp r4, 0 |
0x000037ee bne 0x37cc |
| } while (r4 != 0);
| label_7:
0x000037f0 ldr r0, [r6] | r0 = *(r6);
0x000037f2 mov r2, sl | r2 = sl;
0x000037f4 ldr r1, [sp, 0xc] | r1 = var_ch_2;
0x000037f6 add.w r8, r8, 1 | r8++;
0x000037fa adds r5, 4 | r5 += 4;
0x000037fc ldr r0, [r0] | r0 = *(r0);
0x000037fe bl 0x2f34 | fcn_00002f34 (r0, r1, r2);
0x00003802 ldr.w r2, [fp] | r2 = *(fp);
0x00003806 cmp r2, r8 |
| if (r2 > r8) {
0x00003808 bgt 0x37ca | goto label_0;
| }
| label_6:
0x0000380a movs r6, 0 | r6 = 0;
0x0000380c mov r0, r4 | r0 = r4;
| label_4:
0x0000380e blx 0x1a24 | fcn_00001a24 ();
| do {
| label_1:
0x00003812 ldr r2, [pc, 0x54] |
0x00003814 ldr r3, [pc, 0x4c] | r3 = *(0x3864);
0x00003816 add r2, pc | r2 = 0x7084;
0x00003818 ldr r3, [r2, r3] | r3 = *(0x7084);
0x0000381a ldr r2, [r3] | r2 = *(0x7084);
0x0000381c ldr r3, [sp, 0x24c] | r3 = var_24ch;
0x0000381e eors r2, r3 | r2 ^= r3;
0x00003820 mov.w r3, 0 | r3 = 0;
| if (r2 != r3) {
0x00003824 bne 0x383e | goto label_8;
| }
0x00003826 mov r0, r6 | r0 = r6;
0x00003828 add.w sp, sp, 0x254 |
0x0000382c pop.w {r4, r5, r6, r7, r8, sb, sl, fp, pc} |
| if (r0 != 0) {
| label_3:
0x00003830 cbnz r0, 0x384c | goto label_9;
| }
| label_2:
0x00003832 mov r0, r4 | r0 = r4;
0x00003834 mov.w r6, -1 | r6 = -1;
0x00003838 blx 0x1a24 | fcn_00001a24 ();
0x0000383c b 0x3812 |
| } while (1);
| label_8:
0x0000383e blx 0x1a90 | fcn_00001a90 ();
| label_5:
0x00003842 mov.w r6, -1 | r6 = -1;
0x00003846 blx 0x19f0 | fcn_000019f0 ();
0x0000384a b 0x3812 | goto label_1;
| label_9:
0x0000384c ldr r3, [pc, 0x1c] |
0x0000384e movs r1, 0x10 | r1 = 0x10;
0x00003850 ldr r2, [pc, 0x1c] |
0x00003852 mov r0, r7 | r0 = r7;
0x00003854 add r3, pc | r3 = 0x70c4;
0x00003856 add r2, pc | r2 = 0x70ca;
0x00003858 blx 0x1c9c | fcn_00001c9c ();
0x0000385c b 0x3832 | goto label_2;
| }
[*] Function printf used 3 times libwssecurity_user_handling.so
