[*] Binary protection state of oak.cgi
Full RELRO Canary found NX disabled PIE enabled No RPATH No RUNPATH No Symbols
[*] Function printf tear down of oak.cgi
lw s0, 0x1c(sp)
jr ra
addiu sp, sp, 0x28
lui gp, 2
addiu gp, gp, -0x580c
addu gp, gp, t9
addiu sp, sp, -0x30
lw t9, -sym.imp.g_strnfill(gp)
move a1, zero
sw gp, 0x10(sp)
sw s4, 0x28(sp)
sw s3, 0x24(sp)
sw s2, 0x20(sp)
sw s1, 0x1c(sp)
sw s0, 0x18(sp)
sw ra, 0x2c(sp)
move s1, a0
jalr t9
addiu a0, zero, 0x29
lw gp, 0x10(sp)
move s4, v0
move s0, v0
lw s2, -0x7fdc(gp)
addiu s3, v0, 0x28
addiu s2, s2, str._02x
lw t9, -sym.imp.g_sprintf(gp)
lbu a2, (s1)
move a0, s0
move a1, s2
jalr t9
addiu s0, s0, 2
addiu s1, s1, 1
bne s3, s0, 0x1874
lw gp, 0x10(sp)
lw ra, 0x2c(sp)
move v0, s4
lw s3, 0x24(sp)
lw s4, 0x28(sp)
lw s2, 0x20(sp)
lw s1, 0x1c(sp)
lw s0, 0x18(sp)
jr ra
addiu sp, sp, 0x30
lui gp, 2
addiu gp, gp, -0x58ac
addu gp, gp, t9
--
jalr t9
addiu a0, a0, str.SERNO
beqz v0, 0x2740
lw gp, 0x18(sp)
lw t9, -sym.psk_generate_nonce(gp)
bal sym.psk_generate_nonce
nop
move s0, v0
beqz v0, 0x2758
lw gp, 0x18(sp)
lw t9, -sym.psk_generate_psk(gp)
lw a0, 0x28(sp)
bal sym.psk_generate_psk
move a1, v0
move s2, v0
beqz v0, 0x28a8
lw gp, 0x18(sp)
lw v0, 0x2c(sp)
lw t9, -sym.imp.curl_easy_init(gp)
jalr t9
sw v0, 0x20(sp)
lw gp, 0x18(sp)
move a1, s2
move s3, v0
lw a0, -0x7fdc(gp)
lw t9, -sym.imp.g_strdup_printf(gp)
jalr t9
addiu a0, a0, str.x_auth_psk:__s
lw gp, 0x18(sp)
move a1, s0
move s7, v0
lw a0, -0x7fdc(gp)
lw t9, -sym.imp.g_strdup_printf(gp)
jalr t9
addiu a0, a0, str.x_auth_nonce:__s
lw gp, 0x18(sp)
move a0, zero
move fp, v0
lw a1, -0x7fdc(gp)
lw t9, -sym.imp.curl_slist_append(gp)
jalr t9
addiu a1, a1, str.accept:_application_json
move s5, v0
beqz v0, 0x2818
lw gp, 0x18(sp)
lw t9, -sym.imp.curl_slist_append(gp)
move a1, s7
jalr t9
move a0, v0
beqz v0, 0x28cc
lw gp, 0x18(sp)
lw t9, -sym.imp.curl_slist_append(gp)
move a1, fp
move a0, v0
jalr t9
sw v0, 0x24(sp)
move s5, v0
lw gp, 0x18(sp)
beqz v0, 0x2920
lw v1, 0x24(sp)
lw t9, -sym.imp.g_free(gp)
jalr t9
move a0, s7
lw gp, 0x18(sp)
lw t9, -sym.imp.g_free(gp)
jalr t9
move a0, fp
beqz s3, 0x2854
lw gp, 0x18(sp)
beqz s6, 0x2750
lw a1, -0x7fdc(gp)
lw a1, -0x7fdc(gp)
addiu a1, a1, str.https:__oakcgi.dev.o3c.axis.com_v1
lw a0, -0x7fdc(gp)
lw t9, -sym.imp.g_strdup_printf(gp)
lw a2, 0x20(sp)
jalr t9
addiu a0, a0, str._s__s
lw gp, 0x18(sp)
move a2, v0
addiu a1, zero, 0x2712
lw t9, -sym.imp.curl_easy_setopt(gp)
move a0, s3
jalr t9
move s6, v0
lw gp, 0x18(sp)
move a2, s5
addiu a1, zero, 0x2727
lw t9, -sym.imp.curl_easy_setopt(gp)
jalr t9
move a0, s3
lw gp, 0x18(sp)
addiu a2, zero, 0x1e
addiu a1, zero, 0xd
lw t9, -sym.imp.curl_easy_setopt(gp)
--
b 0x26ac
lw gp, 0x18(sp)
lw t9, -sym.imp.__stack_chk_fail(gp)
jalr t9
nop
nop
nop
nop
lui gp, 2
addiu gp, gp, -0x6980
addu gp, gp, t9
addiu sp, sp, -0x40
sw gp, 0x18(sp)
sw s3, 0x38(sp)
sw s2, 0x34(sp)
sw ra, 0x3c(sp)
sw s1, 0x30(sp)
sw s0, 0x2c(sp)
move s3, a2
beqz a1, 0x2a3c
move s2, a3
beqz a0, 0x2a48
move s0, a1
move a1, a0
lw a0, -0x7fdc(gp)
lw t9, -sym.imp.g_strdup_printf(gp)
jalr t9
addiu a0, a0, str._context__:___s___
lw gp, 0x18(sp)
move s1, v0
lw a0, -0x7fdc(gp)
lw t9, -sym.imp.g_strdup_printf(gp)
move a3, s3
move a2, s0
move a1, s1
sw s2, 0x10(sp)
jalr t9
addiu a0, a0, str.Content_Type:_application_json_r_n_r_n_apiVersion__:__1.0____s_method_:___s____error_:_code_:__d__message_:__s_
lw gp, 0x18(sp)
sw v0, 0x24(sp)
lw t9, -sym.imp.g_free(gp)
jalr t9
move a0, s1
lw ra, 0x3c(sp)
lw v0, 0x24(sp)
lw s3, 0x38(sp)
lw s2, 0x34(sp)
lw s1, 0x30(sp)
lw s0, 0x2c(sp)
jr ra
addiu sp, sp, 0x40
lw s0, -0x7fdc(gp)
bnez a0, 0x29cc
addiu s0, s0, str.unknown
lw a0, -0x7fdc(gp)
lw t9, -sym.imp.g_strdup(gp)
jalr t9
addiu a0, a0, 0x319c
move s1, v0
b 0x29e8
lw gp, 0x18(sp)
lui gp, 2
addiu gp, gp, -0x6a54
addu gp, gp, t9
addiu sp, sp, -0x30
sw gp, 0x10(sp)
sw s1, 0x28(sp)
sw ra, 0x2c(sp)
sw s0, 0x24(sp)
beqz a0, 0x2aec
move s1, a1
move a1, a0
lw a0, -0x7fdc(gp)
lw t9, -sym.imp.g_strdup_printf(gp)
jalr t9
addiu a0, a0, str._context__:___s___
lw gp, 0x10(sp)
move s0, v0
lw a0, -0x7fdc(gp)
lw t9, -sym.imp.g_strdup_printf(gp)
move a2, s1
move a1, s0
jalr t9
addiu a0, a0, str.Content_Type:_application_json_r_n_r_n_apiVersion__:__1.0____s_method__:__getOAK____data_:_oak_:__s_
lw gp, 0x10(sp)
sw v0, 0x1c(sp)
lw t9, -sym.imp.g_free(gp)
jalr t9
move a0, s0
lw ra, 0x2c(sp)
lw v0, 0x1c(sp)
lw s1, 0x28(sp)
lw s0, 0x24(sp)
jr ra
addiu sp, sp, 0x30
lw a0, -0x7fdc(gp)
lw t9, -sym.imp.g_strdup(gp)
jalr t9
addiu a0, a0, 0x319c
move s0, v0
b 0x2aa8
lw gp, 0x10(sp)
lui gp, 2
addiu gp, gp, -0x6af8
addu gp, gp, t9
addiu sp, sp, -0x28
sw gp, 0x10(sp)
sw ra, 0x24(sp)
sw s0, 0x20(sp)
beqz a0, 0x2b80
move a1, a0
lw a0, -0x7fdc(gp)
lw t9, -sym.imp.g_strdup_printf(gp)
jalr t9
addiu a0, a0, str._context__:___s___
lw gp, 0x10(sp)
move s0, v0
lw a0, -0x7fdc(gp)
lw t9, -sym.imp.g_strdup_printf(gp)
move a1, s0
jalr t9
addiu a0, a0, str.Content_Type:_application_json_r_n_r_n_apiVersion__:__1.0____s_method__:__getSupportedVersions____data_:_apiVersions_:___1.0__
lw gp, 0x10(sp)
sw v0, 0x1c(sp)
lw t9, -sym.imp.g_free(gp)
jalr t9
move a0, s0
lw ra, 0x24(sp)
lw v0, 0x1c(sp)
lw s0, 0x20(sp)
jr ra
addiu sp, sp, 0x28
lw a0, -0x7fdc(gp)
lw t9, -sym.imp.g_strdup(gp)
jalr t9
addiu a0, a0, 0x319c
move s0, v0
b 0x2b44
lw gp, 0x10(sp)
[*] Function printf used 10 times oak.cgi
